Function at 0x1009c000
Capabilities:
Check if file exists
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018909c
mov eax, dword fs:[0]
push eax
mov eax, 0x103fc
call fcn.10128a30
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x101e8308]
xor edi, edi
mov edx, dword [0x101e8304]
cmp edx, eax
mov dword [ebp - 0x10318], 0
mov dword [ebp - 0x10314], edi
mov dword [ebp - 0x10328], eax
mov dword [ebp - 0x10320], edx
je 0x1009ca04
xor eax, eax
mov ecx, 0x100
cmp byte [edx + 0x1c], al
cmovne eax, ecx
lea ecx, [edx + 4]
or eax, 0x20019
cmp dword [ecx + 0x14], 8
jb 0x1009c07f
mov ecx, dword [ecx]
lea esi, [ebp - 0x10310]
push esi
push eax
push 0
push ecx
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1009c86a
push eax
push eax
push eax
push eax
mov dword [ebp - 0x10230], eax
lea eax, [ebp - 0x10230]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x10310]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1009c86a
xor esi, esi
mov dword [ebp - 0x1031c], esi
cmp dword [ebp - 0x10230], esi
je 0x1009c85e
nop
push 0x7ffe
lea eax, [ebp - 0x10218]
push 0
push eax
call fcn.10150460
push 0x7ffe
lea eax, [ebp - 0x8218]
push 0
push eax
call fcn.10150460
add esp, 0x18
mov dword [ebp - 0x10268], 0x3fff
lea eax, [ebp - 0x10264]
mov dword [ebp - 0x10264], 0x7ffe
push eax
lea eax, [ebp - 0x8218]
push eax
push 0
push 0
lea eax, [ebp - 0x10268]
push eax
lea eax, [ebp - 0x10218]
push eax
push esi
push dword [ebp - 0x10310]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1009c85e
lea ecx, [ebp - 0x8218]
mov dword [ebp - 0x10270], eax
mov dword [ebp - 0x1026c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x10280], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009c172
sub ecx, edx
lea eax, [ebp - 0x8218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10280]
call fcn.1001ba50
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10228]
mov dword [ebp - 0x1021c], 0
movups xmmword [ebp - 0x1022c], xmm0
mov dword [ebp - 0x1022c], 0
mov dword [ebp - 0x10324], eax
push 1
mov byte [ebp - 4], 1
call fcn.100a2e79
mov dword [ebp - 0x1021c], eax
lea eax, [ebp - 0x10220]
mov byte [ebp - 4], 2
push eax
call fcn.100934a0
mov dword [ebp - 0x10228], eax
lea eax, [ebp - 0x10220]
push eax
call fcn.1001aaa0
mov dword [ebp - 0x10224], eax
push 0x54
lea eax, [ebp - 0x1030c]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.10150460
add esp, 0x18
lea eax, [ebp - 0x10228]
lea ecx, [ebp - 0x1030c]
push 1
push 0x1019be60
push str..__A_z_:______:________:__._eE__xX__eE__.__
push eax
call fcn.10093630
lea ecx, [ebp - 0x1030c]
mov byte [ebp - 4], 4
call fcn.10098830
mov edi, eax
test edi, edi
je 0x1009c24c
lock inc dword [edi + 0x20]
mov ecx, dword [ebp - 0x1022c]
test ecx, ecx
je 0x1009c281
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x1009c281
mov esi, dword [ebp - 0x1022c]
test esi, esi
je 0x1009c281
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x1009c26a
mov ecx, dword [ebp - 0x102f8]
mov dword [ebp - 0x1022c], edi
mov byte [ebp - 4], 3
test ecx, ecx
je 0x1009c2ed
mov eax, dword [ebp - 0x102f0]
sub eax, ecx
sar eax, 2
lea edx, [eax*4]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c2c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov dword [ebp - 0x102f8], 0
mov dword [ebp - 0x102f4], 0
mov dword [ebp - 0x102f0], 0
push 0x38
lea eax, [ebp - 0x102b8]
push 0
push eax
call fcn.10150460
xorps xmm0, xmm0
mov dword [ebp - 0x102b8], 0
mov byte [ebp - 0x102b4], 0
movups xmmword [ebp - 0x102b0], xmm0
mov dword [ebp - 0x102a0], 0
mov byte [ebp - 0x1029c], 0
mov dword [ebp - 0x10298], 0
mov dword [ebp - 0x10294], 0
mov byte [ebp - 0x10290], 0
mov dword [ebp - 0x1028c], 0
mov dword [ebp - 0x10288], 0
mov byte [ebp - 0x10284], 0
xor eax, eax
mov dword [ebp - 0x10238], 0
mov dword [ebp - 0x10234], 7
mov word [ebp - 0x10248], ax
push 0x208
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 7
push eax
call fcn.10150460
add esp, 0x18
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x1026c], 8
lea eax, [ebp - 0x10280]
cmovae eax, dword [ebp - 0x10280]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x10250], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x1024c], 7
mov word [ebp - 0x10260], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1009c3e2
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10260]
call fcn.1001ba50
cmp dword [ebp - 0x1024c], 8
lea ecx, [ebp - 0x10260]
mov eax, dword [ebp - 0x10250]
lea edx, [ebp - 0x1022c]
cmovae ecx, dword [ebp - 0x10260]
push 1
push 0
push edx
lea eax, [ecx + eax*2]
mov byte [ebp - 4], 8
lea edx, [ebp - 0x102b8]
push edx
lea ecx, [ebp - 0x10260]
cmovae ecx, dword [ebp - 0x10260]
push eax
push ecx
call fcn.10092b20
add esp, 0x18
test al, al
je 0x1009c4fe
mov ecx, dword [ebp - 0x102ac]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x102b0]
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jbe 0x1009c4fe
cmp eax, 1
lea eax, [ebp - 0x1028c]
jbe 0x1009c48b
lea eax, [esi + 0xc]
cmp byte [eax + 8], 0
je 0x1009c498
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x1009c49c
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [ebp - 0x10360], 0
mov dword [ebp - 0x1035c], 7
mov word [ebp - 0x10370], dx
cmp ecx, eax
je 0x1009c4ce
sub eax, ecx
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x10370]
call fcn.1001ba50
or dword [ebp - 0x10318], 3
lea ecx, [ebp - 0x10248]
call fcn.100171c0
movups xmm0, xmmword [ebp - 0x10370]
movups xmmword [ebp - 0x10248], xmm0
movq xmm0, qword [ebp - 0x10360]
movq qword [ebp - 0x10238], xmm0
cmp dword [ebp - 0x10234], 8
lea eax, [ebp - 0x10248]
cmovae eax, dword [ebp - 0x10248]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1009c87e
call fcn.100d1170
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x1009c6cb
cmp dword [ebp - 0x10234], 8
lea eax, [ebp - 0x10248]
push 0x60
cmovae eax, dword [ebp - 0x10248]
lea ecx, [ebp - 0x10358]
push str.d:jenkins.jenkinsworkspacemultiplugin_nativemultiplugin_rightsplugin_startup_autorunmgr.cpp
mov dword [ebp - 0x10324], eax
mov dword [ebp - 0x10348], 0
mov dword [ebp - 0x10344], 0xf
mov byte [ebp - 0x10358], 0
call fcn.10019000
push 3
push 0x10193e24
lea ecx, [ebp - 0x10340]
mov byte [ebp - 4], 9
mov dword [ebp - 0x10330], 0
mov dword [ebp - 0x1032c], 0xf
mov byte [ebp - 0x10340], 0
call fcn.10019000
mov byte [ebp - 4], 0xa
call fcn.100d1170
mov edi, eax
lea ecx, [ebp - 0x10408]
push 0x48
lea eax, [ebp - 0x10358]
push eax
lea eax, [ebp - 0x10340]
push eax
call fcn.100167c0
mov esi, eax
push 0x1019c20c
push esi
mov byte [ebp - 4], 0xb
call fcn.100174d0
mov eax, dword [ebp - 0x10324]
mov ecx, 0x10193e70
test eax, eax
cmovne ecx, eax
push ecx
push esi
call fcn.1001a540
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x10408]
call fcn.10017580
mov edx, dword [ebp - 0x1032c]
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x1009c657
mov ecx, dword [ebp - 0x10340]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c64d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov edx, dword [ebp - 0x10344]
mov dword [ebp - 0x10330], 0
mov dword [ebp - 0x1032c], 0xf
mov byte [ebp - 0x10340], 0
mov byte [ebp - 4], 8
cmp edx, 0x10
jb 0x1009c6b0
mov ecx, dword [ebp - 0x10358]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c6a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov dword [ebp - 0x10348], 0
mov dword [ebp - 0x10344], 0xf
mov byte [ebp - 0x10358], 0
mov edx, dword [ebp - 0x1024c]
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x1009c70f
mov ecx, dword [ebp - 0x10260]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c705
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov edx, dword [ebp - 0x10234]
xor eax, eax
mov dword [ebp - 0x10250], 0
mov dword [ebp - 0x1024c], 7
mov word [ebp - 0x10260], ax
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x1009c770
mov ecx, dword [ebp - 0x10248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c766
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
xor eax, eax
mov dword [ebp - 0x10238], 0
lea ecx, [ebp - 0x102b0]
mov dword [ebp - 0x10234], 7
mov word [ebp - 0x10248], ax
call fcn.10093c60
mov ecx, dword [ebp - 0x1022c]
test ecx, ecx
je 0x1009c7cd
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x1009c7cd
mov esi, dword [ebp - 0x1022c]
test esi, esi
je 0x1009c7cd
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x1009c7b6
mov dword [ebp - 0x1022c], 0
mov ecx, dword [ebp - 0x1021c]
mov byte [ebp - 4], 0xc
test ecx, ecx
je 0x1009c7f8
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x1009c7f8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov edx, dword [ebp - 0x1026c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x1009c83f
mov ecx, dword [ebp - 0x10280]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c835
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov edi, dword [ebp - 0x10314]
mov esi, dword [ebp - 0x1031c]
inc esi
mov dword [ebp - 0x1031c], esi
cmp esi, dword [ebp - 0x10230]
jne 0x1009c0e0
push dword [ebp - 0x10310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x10320]
add edx, 0x20
cmp edx, dword [ebp - 0x10328]
jmp 0x1009c056
mov edi, dword [ebp - 0x10314]
mov edx, dword [ebp - 0x1024c]
inc edi
mov dword [ebp - 0x10314], edi
mov byte [ebp - 4], 7
cmp edx, 8
jb 0x1009c8cf
mov ecx, dword [ebp - 0x10260]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c8c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
mov edx, dword [ebp - 0x10234]
xor eax, eax
mov dword [ebp - 0x10250], 0
mov dword [ebp - 0x1024c], 7
mov word [ebp - 0x10260], ax
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x1009c930
mov ecx, dword [ebp - 0x10248]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c926
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
xor eax, eax
mov dword [ebp - 0x10238], 0
lea ecx, [ebp - 0x102b0]
mov dword [ebp - 0x10234], 7
mov word [ebp - 0x10248], ax
call fcn.10093c60
mov ecx, dword [ebp - 0x1022c]
test ecx, ecx
je 0x1009c98d
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x1009c98d
mov esi, dword [ebp - 0x1022c]
test esi, esi
je 0x1009c98d
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x1009c976
mov dword [ebp - 0x1022c], 0
mov ecx, dword [ebp - 0x1021c]
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x1009c9b8
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test eax, eax
je 0x1009c9b8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov edx, dword [ebp - 0x1026c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x1009c845
mov ecx, dword [ebp - 0x10280]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1009c9f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009ca21
push edx
push ecx
call fcn.10127e1e
add esp, 8
jmp 0x1009c845
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
call fcn.10153963
int3