Function at 0x76e2c179
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
lea ecx, [ebp - 0x10]
push ecx
push eax
mov ebx, 0x76e133a0
push ebx
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
call edi
test eax, eax
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
jne 0x76e2c1e7
push dword [ebp - 4]
call sym.adsldpc.dll_AllocADsMem
test eax, eax
mov dword [ebp - 8], eax
je 0x76e2c24e
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x76e2c3b9
mov ebx, dword [ebp - 8]
jmp 0x76e2c2c9
cmp dword [ebp + 0xc], 0
mov edi, 0x76e2c400
je 0x76e2c23b
push dword [ebp + 0xc]
call esi
mov ebx, eax
mov dword [esp], 0x76e13394
call esi
add ebx, eax
mov dword [esp], 0x76e2c3ec
call esi
push edi
add ebx, eax
call esi
add ebx, eax
cmp ebx, 0x104
pop ecx
pop ecx
jae 0x76e2c225
mov eax, 0x208
jmp 0x76e2c22e
push dword [ebp + 0xc]
call esi
pop ecx
shl eax, 2
push eax
call sym.adsldpc.dll_AllocADsMem
mov ebx, eax
mov dword [ebp - 8], ebx
jmp 0x76e2c24a
push 0x208
call sym.adsldpc.dll_AllocADsMem
mov dword [ebp - 8], eax
mov ebx, eax
test ebx, ebx
jne 0x76e2c256
push 8
pop eax
jmp 0x76e2c3d1
push edi
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
push 0x76e2c3ec
push ebx
call edi
add esp, 0x10
cmp dword [ebp + 0xc], 0
je 0x76e2c2b5
push 0x3a
push dword [ebp + 0xc]
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
jne 0x76e2c28e
push dword [ebp + 0xc]
jmp 0x76e2c2ba
sub eax, dword [ebp + 0xc]
sar eax, 1
push eax
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.msvcrt.dll_wcsncat]
push 0x76e2c3e8
push ebx
call edi
mov eax, dword [ebp - 0xc]
add eax, 2
push eax
push ebx
call edi
add esp, 0x1c
jmp 0x76e2c2bf
push 0x76e2c3d8
push ebx
call edi
pop ecx
pop ecx
push 0x76e13394
push ebx
call edi
pop ecx
pop ecx
push 0x208
call sym.adsldpc.dll_AllocADsMem
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x76e2c2e2
push 8
pop ebx
jmp 0x76e2c3b9
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
push eax
push ebx
call edi
test eax, eax
mov dword [ebp - 4], eax
je 0x76e2c327
cmp eax, 0x104
jbe 0x76e2c332
push dword [ebp - 0xc]
call sym.adsldpc.dll_FreeADsMem
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sym.adsldpc.dll_AllocADsMem
test eax, eax
mov dword [ebp - 0xc], eax
je 0x76e2c2da
push dword [ebp - 4]
push eax
push ebx
call edi
test eax, eax
mov dword [ebp - 4], eax
jne 0x76e2c332
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x76e2c3b7
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0xc]
call fcn.76e2bebd
mov ebx, eax
test ebx, ebx
jne 0x76e2c3b9
push dword [ebp - 8]
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
push 2
push ebx
push 0x76e133a0
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x76e2c3b9
push dword [ebp + 0x10]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push 0x76e13318
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x76e2c3b9
cmp dword [ebp + 0x2c], 1
push 4
sete al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push ebx
push 0x76e133ac
push dword [ebp + 8]
call edi
mov ebx, eax
push dword [ebp - 8]
call sym.adsldpc.dll_FreeADsMem
cmp dword [ebp - 0xc], 0
je 0x76e2c3cf
push dword [ebp - 0xc]
call sym.adsldpc.dll_FreeADsMem
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x28