Function at 0x10038cb
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
push 0x100225c
push 0x80000002
mov dword [ebp - 0x18], ebx
mov byte [ebp - 1], bl
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 3
mov dword [ebp - 8], eax
je 0x1003acb
cmp eax, 2
je 0x1003acb
cmp eax, ebx
jne 0x1003ae9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x1002290
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], edi
call esi
cmp eax, 3
mov dword [ebp - 8], eax
je 0x1003ab6
cmp eax, 2
je 0x1003ab6
cmp eax, ebx
jne 0x1003ae9
cmp dword [ebp - 0x14], edi
jne 0x1003aad
cmp dword [ebp - 0xc], edi
jne 0x1003aad
cmp dword [ebp - 0x18], 3
jb 0x100397b
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
dec eax
dec eax
jne 0x1003ab9
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
mov edi, 0x100229c
push edi
push dword [ebp - 0x1c]
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1003ae9
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [ebp - 0x10], eax
jne 0x10039c0
mov dword [ebp - 8], 8
jmp 0x1003ada
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push edi
push dword [ebp - 0x1c]
call esi
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x1003ada
cmp dword [ebp - 0x14], 1
je 0x10039f3
cmp dword [ebp - 0x14], 2
je 0x10039f3
mov dword [ebp - 8], 0xd
jmp 0x1003ada
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.01003846
test eax, eax
jl 0x10039e7
cmp dword [ebp - 0x14], 2
jne 0x1003a7b
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push ebx
push dword [ebp - 0x10]
call esi
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x1003a2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003ada
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x1003a48
mov dword [ebp - 8], 8
jmp 0x1003ace
push dword [ebp - 0xc]
push edi
push dword [ebp - 0x10]
call esi
cmp eax, ebx
jne 0x1003a60
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1003ace
cmp eax, dword [ebp - 0xc]
jbe 0x1003a6e
mov dword [ebp - 8], 0x7a
jmp 0x1003ace
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x18]
dec eax
dec eax
je 0x1003a8b
mov dword [ebp - 8], 0x54f
jmp 0x1003ada
mov eax, dword [ebp - 0x10]
movsx eax, byte [eax]
push eax
call dword [sym.imp.msvcrt.dll_tolower]
cmp al, 0x61
pop ecx
mov byte [ebp - 1], al
jl 0x10039e7
cmp al, 0x7a
jle 0x1003ab9
jmp 0x10039e7
mov dword [ebp - 8], 0xd
jmp 0x1003ae9
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x18]
mov dword [0x100c064], eax
mov al, byte [ebp - 1]
mov byte [0x100c068], al
jmp 0x1003ada
mov dword [ebp - 8], ebx
cmp edi, ebx
je 0x1003ada
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x1003ae9
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x1c], ebx
pop edi
pop esi
pop ebx
je 0x1003afa
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret