Function at 0x100a2d4
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x1011584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x664], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp + 0x2c]
mov ebx, dword [ebp + 0x38]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x670], eax
xor eax, eax
mov esi, 0x208
push esi
mov word [ebp - 0x210], ax
xor edi, edi
lea eax, [ebp - 0x20e]
push edi
push eax
mov dword [ebp - 0x684], ebx
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
mov dword [ebp - 0x638], edi
call sub.msvcrt.dll_memset
add esp, 0x18
inc dword [ebp + 0x3c]
cmp dword [ebp + 0x3c], 0x200
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x63c], edi
mov dword [ebp - 0x634], edi
mov dword [ebp - 0x640], 1
mov dword [ebp - 0x62c], edi
jbe 0x100a3d8
cmp dword [ebx], edi
jne 0x100a3d0
push 0x40002843
call fcn.0100e4fd
pop ecx
mov dword [ebx], 1
xor eax, eax
inc eax
jmp 0x100a9c7
lea eax, [ebp - 0x660]
push eax
push 9
push edi
push dword [ebp - 0x64c]
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a9b5
mov ebx, dword [sym.imp.msvcrt.dll_free]
mov dword [ebp - 0x648], edi
xor esi, esi
cmp dword [ebp - 0x62c], edi
jne 0x100a50a
mov dword [ebp - 0x644], 0x20a
mov dword [ebp - 0x67c], 0x105
lea ecx, [ebp - 0x628]
mov eax, dword [ebp - 0x634]
cmp dword [ebp - 0x62c], edi
jne 0x100a444
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x644]
push edx
push ecx
lea ecx, [ebp - 0x650]
push ecx
push edi
lea ecx, [ebp - 0x67c]
push ecx
push eax
push dword [ebp - 0x648]
push dword [ebp - 0x660]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, edi
jne 0x100a6ac
cmp dword [ebp - 0x650], 1
je 0x100a495
cmp dword [ebp - 0x650], 2
je 0x100a495
cmp dword [ebp - 0x650], 7
jne 0x100a5dd
mov eax, dword [ebp - 0x644]
cmp eax, edi
jbe 0x100a5dd
mov ecx, dword [ebp - 0x630]
cmp dword [ebp - 0x62c], edi
jne 0x100a4b7
lea ecx, [ebp - 0x628]
mov edx, 0x4e20
cmp eax, edx
jbe 0x100a4c8
mov eax, edx
mov dword [ebp - 0x644], eax
shr eax, 1
xor edx, edx
mov word [ecx + eax*2 - 2], dx
cmp dword [ebp - 0x650], 2
jne 0x100a53c
cmp dword [ebp - 0x62c], edi
jne 0x100a515
push 0x104
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x100a502
xor esi, esi
inc esi
lea ecx, [ebp - 0x41c]
jmp 0x100a56d
mov ecx, dword [ebp - 0x630]
jmp 0x100a430
push dword [ebp - 0x644]
push dword [ebp - 0x63c]
push dword [ebp - 0x630]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x100a534
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x63c]
jmp 0x100a56d
cmp dword [ebp - 0x650], 7
jne 0x100a575
mov edx, dword [ebp - 0x644]
shr edx, 1
xor eax, eax
dec edx
je 0x100a575
cmp word [ecx + eax*2], di
jne 0x100a55f
push 0x3b
pop edx
mov word [ecx + eax*2], dx
mov edx, dword [ebp - 0x644]
shr edx, 1
inc eax
dec edx
cmp eax, edx
jb 0x100a552
cmp esi, edi
jne 0x100a64b
mov eax, dword [ebp - 0x630]
cmp dword [ebp - 0x62c], edi
jne 0x100a589
lea eax, [ebp - 0x628]
push eax
push ecx
push dword [ebp + 0x40]
push dword [ebp + 0x34]
push dword [ebp - 0x670]
push dword [ebp - 0x658]
push dword [ebp - 0x678]
push dword [ebp - 0x66c]
push dword [ebp - 0x668]
push dword [ebp - 0x664]
push dword [ebp + 0x18]
push dword [ebp - 0x674]
push dword [ebp - 0x64c]
push dword [ebp - 0x654]
push dword [ebp - 0x65c]
call fcn.0100a217
test eax, eax
je 0x100a762
mov ecx, dword [ebp - 0x634]
cmp dword [ebp - 0x62c], edi
jne 0x100a6a1
lea ecx, [ebp - 0x210]
mov eax, ecx
push ecx
push eax
push dword [ebp + 0x40]
push dword [ebp + 0x34]
push dword [ebp - 0x670]
push dword [ebp - 0x658]
push dword [ebp - 0x678]
push dword [ebp - 0x66c]
push dword [ebp - 0x668]
push dword [ebp - 0x664]
push dword [ebp + 0x18]
push dword [ebp - 0x674]
push dword [ebp - 0x64c]
push dword [ebp - 0x654]
push dword [ebp - 0x65c]
call fcn.0100a217
test eax, eax
je 0x100a762
cmp dword [ebp - 0x630], edi
je 0x100a662
push dword [ebp - 0x630]
call ebx
pop ecx
mov dword [ebp - 0x630], edi
cmp dword [ebp - 0x63c], edi
je 0x100a679
push dword [ebp - 0x63c]
call ebx
pop ecx
mov dword [ebp - 0x63c], edi
cmp dword [ebp - 0x634], edi
je 0x100a690
push dword [ebp - 0x634]
call ebx
pop ecx
mov dword [ebp - 0x634], edi
inc dword [ebp - 0x648]
mov dword [ebp - 0x62c], edi
jmp 0x100a408
mov eax, dword [ebp - 0x634]
jmp 0x100a5f7
cmp eax, 0x103
je 0x100a76d
cmp eax, 0xea
jne 0x100a64b
cmp dword [ebp - 0x62c], edi
jne 0x100a64b
mov dword [ebp - 0x62c], 1
cmp dword [ebp - 0x630], edi
je 0x100a6e1
push dword [ebp - 0x630]
call ebx
pop ecx
cmp dword [ebp - 0x63c], edi
je 0x100a6f8
push dword [ebp - 0x63c]
call ebx
pop ecx
mov dword [ebp - 0x63c], edi
cmp dword [ebp - 0x634], edi
je 0x100a70f
push dword [ebp - 0x634]
call ebx
pop ecx
mov dword [ebp - 0x634], edi
push dword [ebp - 0x644]
mov esi, dword [sym.imp.msvcrt.dll_malloc]
call esi
pop ecx
mov dword [ebp - 0x630], eax
cmp eax, edi
je 0x100a95e
push dword [ebp - 0x644]
call esi
pop ecx
mov dword [ebp - 0x63c], eax
cmp eax, edi
je 0x100a95e
mov eax, dword [ebp - 0x67c]
add eax, eax
push eax
call esi
pop ecx
mov dword [ebp - 0x634], eax
cmp eax, edi
jne 0x100a408
jmp 0x100a93f
mov dword [ebp - 0x640], edi
jmp 0x100a982
push 0x20a
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x680], 0x105
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
jmp 0x100a932
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x680]
push eax
push dword [ebp - 0x638]
push dword [ebp - 0x648]
push dword [ebp - 0x660]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
jne 0x100a8fa
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x62c], edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100a7c9
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
mov eax, dword [ebp - 0x64c]
cmp eax, edi
je 0x100a7f9
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100a7e7
sub eax, edx
sar eax, 1
lea esi, [esi + eax + 1]
push esi
lea eax, [ebp - 0x62c]
push eax
call fcn.010091a8
test al, al
je 0x100a901
mov eax, dword [ebp - 0x64c]
test eax, eax
je 0x100a87a
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100a81b
mov edi, dword [ebp - 0x62c]
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x64c]
push esi
push edi
call sub.msvcrt.dll_wcsncpy_s
mov eax, dword [ebp - 0x64c]
add esp, 0x10
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100a849
sub eax, ecx
sar eax, 1
je 0x100a868
push 0x10012dc
push esi
push edi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push dword [ebp - 0x638]
push esi
push edi
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
jmp 0x100a892
mov edi, dword [ebp - 0x62c]
push 0
push dword [ebp - 0x638]
push esi
push edi
call sub.msvcrt.dll_wcsncpy_s
add esp, 0x10
push dword [ebp - 0x638]
call ebx
pop ecx
push dword [ebp + 0x40]
and dword [ebp - 0x638], 0
push dword [ebp + 0x3c]
push dword [ebp - 0x684]
push dword [ebp + 0x34]
push dword [ebp - 0x670]
push dword [ebp - 0x658]
push dword [ebp - 0x678]
push dword [ebp - 0x66c]
push dword [ebp - 0x668]
push dword [ebp - 0x664]
push dword [ebp + 0x18]
push dword [ebp - 0x674]
push edi
push dword [ebp - 0x654]
push dword [ebp - 0x65c]
call fcn.0100a2d4
push edi
test eax, eax
je 0x100a951
call ebx
pop ecx
jmp 0x100a901
cmp eax, 0x103
je 0x100a96f
cmp dword [ebp - 0x638], 0
je 0x100a913
push dword [ebp - 0x638]
call ebx
pop ecx
inc dword [ebp - 0x648]
push 0x20a
mov dword [ebp - 0x680], 0x105
call dword [sym.imp.msvcrt.dll_malloc]
xor edi, edi
test eax, eax
mov dword [ebp - 0x638], eax
pop ecx
jne 0x100a78f
push 8
pop esi
push esi
call fcn.0100e412
pop ecx
mov dword [ebp - 0x640], esi
jmp 0x100a971
call ebx
and dword [ebp - 0x640], 0
xor edi, edi
jmp 0x100a981
push 8
pop esi
push esi
call fcn.0100e412
mov dword [ebp - 0x640], esi
jmp 0x100a981
xor edi, edi
cmp dword [ebp - 0x638], edi
je 0x100a982
push dword [ebp - 0x638]
call ebx
pop ecx
cmp dword [ebp - 0x630], edi
je 0x100a993
push dword [ebp - 0x630]
call ebx
pop ecx
cmp dword [ebp - 0x63c], edi
je 0x100a9a4
push dword [ebp - 0x63c]
call ebx
pop ecx
cmp dword [ebp - 0x634], edi
je 0x100a9b5
push dword [ebp - 0x634]
call ebx
pop ecx
push dword [ebp - 0x660]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f411
leave
ret 0x3c