Function at 0x30d1ccc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x3106b60
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp byte [edi + 4], bl
jne 0x30d1f31
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x3016d80
push dword [edi]
mov byte [edi + 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30d1f31
mov eax, dword [0x31063ac]
shr eax, 0x1f
test al, 1
je 0x30d1e48
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push 0x3016d6c
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x30d1d4b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30d1f31
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.0302cf60
mov edi, eax
cmp edi, ebx
pop ecx
je 0x30d1d3d
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x3016d6c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x30d1d91
push edi
call fcn.0302cf40
pop ecx
jmp 0x30d1f31
mov eax, dword [ebp - 8]
mov byte [edi + eax], bl
cmp dword [ebp - 0x18], 2
jne 0x30d1dda
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x30d1d85
push eax
call fcn.0302cf60
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30d1d85
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
mov dword [ebp - 8], eax
call fcn.0302cf40
cmp dword [ebp - 8], ebx
mov edi, dword [ebp - 0x1c]
pop ecx
jne 0x30d1de0
jmp 0x30d1d85
cmp dword [ebp - 0x18], 1
jne 0x30d1d85
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [0x30ef6a8]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jle 0x30d1d85
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0302cf60
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30d1d85
push dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [0x30ef6a8]
push edi
mov dword [ebp - 0xc], eax
call fcn.0302cf40
cmp dword [ebp - 0xc], ebx
pop ecx
jg 0x30d1e3a
push dword [ebp - 0x1c]
jmp 0x30d1d86
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], eax
jmp 0x30d1f31
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push 0x3016d48
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call dword [0x30ef634]
test eax, eax
jne 0x30d1d3d
mov edi, dword [ebp - 0x10]
shr edi, 1
xor ecx, ecx
push 2
pop edx
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0302cf60
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
je 0x30d1d3d
lea ecx, [ebp - 0x10]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x3016d48
push dword [ebp - 4]
call dword [0x30ef634]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x30d1ec1
push dword [ebp - 8]
jmp 0x30d1d86
mov eax, dword [ebp - 8]
mov word [eax + edi*2], bx
cmp dword [ebp - 0x20], 1
je 0x30d1e3d
cmp dword [ebp - 0x20], 2
je 0x30d1ede
push eax
jmp 0x30d1d86
mov edi, dword [0x30ef654]
push ebx
push ebx
push eax
call edi
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x30d1eb9
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0302cf60
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30d1eb9
push dword [ebp - 0x18]
push eax
push dword [ebp - 8]
call edi
push dword [ebp - 8]
mov edi, eax
call fcn.0302cf40
cmp edi, ebx
pop ecx
je 0x30d1e32
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 8], ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret