Function at 0x10030cda
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100b02c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x10031889
test ecx, ecx
je 0x10031889
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x2c]
mov edi, 0xfde9
push eax
push edi
mov word [ecx], ax
mov dword [ebp - 0x1c], eax
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x28], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1005fb39
mov ebx, eax
pop ecx
test ebx, ebx
je 0x10031889
push dword [ebp - 0x28]
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x2c]
push 0
push edi
call esi
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10030d59
sub eax, ecx
sar eax, 1
cmp eax, 1
jbe 0x10030d8f
push 0x22
pop ecx
cmp cx, word [ebx]
jne 0x10030d8f
cmp cx, word [ebx + eax*2 - 2]
jne 0x10030d8f
add eax, 0xfffffffe
push eax
lea eax, [ebx + 2]
push eax
push dword [ebp - 0x28]
push ebx
call fcn.1006049d
add esp, 0x10
push 0x25
pop eax
cmp ax, word [ebx]
jne 0x10030dd3
lea eax, [ebx + 2]
movzx ecx, word [eax]
test cx, cx
je 0x1003183e
cmp cx, 0x25
je 0x10030db6
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x10030da6
cmp word [eax], 0
je 0x1003183e
cmp word [eax + 2], 0
jne 0x1003183e
mov dword [ebp - 0x1c], ebx
jmp 0x1003183e
mov esi, 0x1008da90
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.FIDL_AdminTools
push ebx
movsd dword es:[edi], dword [esi]
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030dfa
mov esi, 0x1008d7e0
jmp 0x10031696
push str.FIDL_CDBurning
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e15
mov esi, 0x1008d8a0
jmp 0x10031696
push str.FIDL_CommonAdminTools
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e30
mov esi, 0x1008d7f0
jmp 0x10031696
push str.FIDL_CommonOEMLinks
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e4b
mov esi, 0x1008d890
jmp 0x10031696
push str.FIDL_CommonPrograms
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e66
mov esi, 0x1008d650
jmp 0x10031696
push str.FIDL_CommonStartMenu
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e81
mov esi, 0x1008d660
jmp 0x10031696
push str.FIDL_CommonStartup
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030e9c
mov esi, 0x1008d640
jmp 0x10031696
push str.FIDL_CommonTemplates
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030eb7
mov esi, 0x1008d690
jmp 0x10031696
push str.FIDL_Contacts
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030ed2
mov esi, str.THxV
jmp 0x10031696
push str.FIDL_Cookies
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030eed
mov esi, 0x1008d6f0
jmp 0x10031696
push str.FIDL_Desktop
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f08
mov esi, 0x1008d5a0
jmp 0x10031696
push str.FIDL_DeviceMetadataStore
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f23
mov esi, 0x1008da40
jmp 0x10031696
push str.FIDL_DocumentsLibrary
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f3e
mov esi, 0x1008d9f0
jmp 0x10031696
push str.FIDL_Downloads
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f59
mov esi, 0x1008d930
jmp 0x10031696
push str.FIDL_Favorites
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f74
mov esi, 0x1008d600
jmp 0x10031696
push str.FIDL_Fonts
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030f8f
mov esi, 0x1008d590
jmp 0x10031696
push str.FIDL_GameTasks
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030faa
mov esi, 0x1008d9b0
jmp 0x10031696
push str.FIDL_History
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030fc5
mov esi, 0x1008d700
jmp 0x10031696
push str.FIDL_ImplicitAppShortcuts
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030fe0
mov esi, 0x1008da80
jmp 0x10031696
push str.FIDL_InternetCache
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10030ffb
mov esi, 0x1008d6e0
jmp 0x10031696
push str.FIDL_Libraries
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031016
mov esi, 0x1008da50
jmp 0x10031696
push str.FIDL_Links
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031031
mov esi, 0x1008d9d0
jmp 0x10031696
push str.FIDL_LocalAppData
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031053
mov dword [ebp - 0x1c], str._LOCALAPPDATA_
mov esi, 0x1008d6c0
jmp 0x10031696
push str.FIDL_LocalAppDataLow
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003106e
mov esi, 0x1008d6d0
jmp 0x10031696
push str.FIDL_LocalizedResourcesDir
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031089
mov esi, 0x1008d880
jmp 0x10031696
push str.FIDL_Music
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100310a4
mov esi, 0x1008d800
jmp 0x10031696
push str.FIDL_MusicLibrary
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100310bf
mov esi, 0x1008da00
jmp 0x10031696
push str.FIDL_NetHood
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100310da
mov esi, 0x1008d610
jmp 0x10031696
push str.FIDL_OriginalImages
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100310f5
mov esi, 0x1008d9e0
jmp 0x10031696
push str.FIDL_PhotoAlbums
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031110
mov esi, 0x1008d910
jmp 0x10031696
push str.FIDL_PicturesLibrary
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003112b
mov esi, 0x1008da10
jmp 0x10031696
push str.FIDL_Pictures
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031146
mov esi, 0x1008d750
jmp 0x10031696
push str.FIDL_Playlists
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031161
mov esi, 0x1008d8c0
jmp 0x10031696
push str.FIDL_PrintHood
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003117c
mov esi, 0x1008d620
jmp 0x10031696
push str.FIDL_Profile
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003119e
mov dword [ebp - 0x1c], str._USERPROFILE_
mov esi, 0x1008d740
jmp 0x10031696
push str.FIDL_ProgramData
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100311c0
mov dword [ebp - 0x1c], str._ALLUSERSPROFILE_
mov esi, 0x1008d680
jmp 0x10031696
push str.FIDL_ProgramFiles
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100311e2
mov dword [ebp - 0x1c], str._ProgramFiles_
mov esi, 0x1008d7a0
jmp 0x10031696
push str.FIDL_ProgramFilesX64
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031204
mov dword [ebp - 0x1c], str._ProgramW6432_
mov esi, 0x1008d780
jmp 0x10031696
push str.FIDL_ProgramFilesX86
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031226
mov dword [ebp - 0x1c], str._ProgramFiles_x86__
mov esi, 0x1008d760
jmp 0x10031696
push str.FIDL_ProgramFilesCommon
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031248
mov dword [ebp - 0x1c], str._CommonProgramFiles_
mov esi, 0x1008d7b0
jmp 0x10031696
push str.FIDL_ProgramFilesCommonX64
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003126a
mov dword [ebp - 0x1c], str._CommonProgramW6432_
mov esi, 0x1008d790
jmp 0x10031696
push str.FIDL_ProgramFilesCommonX86
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003128c
mov dword [ebp - 0x1c], str._CommonProgramFiles_x86__
mov esi, 0x1008d770
jmp 0x10031696
push str.FIDL_Programs
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100312a7
mov esi, 0x1008d5c0
jmp 0x10031696
push str.FIDL_Public
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100312c9
mov dword [ebp - 0x1c], str._PUBLIC_
mov esi, 0x1008d920
jmp 0x10031696
push str.FIDL_PublicDesktop
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100312e4
mov esi, 0x1008d670
jmp 0x10031696
push str.FIDL_PublicDocuments
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100312ff
mov esi, 0x1008d6a0
jmp 0x10031696
push str.FIDL_PublicDownloads
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003131a
mov esi, 0x1008d940
jmp 0x10031696
push str.FIDL_PublicGameTasks
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031335
mov esi, 0x1008d9a0
jmp 0x10031696
push str.FIDL_PublicLibraries
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031350
mov esi, 0x1008da60
jmp 0x10031696
push str.FIDL_PublicMusic
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003136b
mov esi, 0x1008d840
jmp 0x10031696
push str.FIDL_PublicPictures
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031386
mov esi, 0x1008d830
jmp 0x10031696
push str.FIDL_PublicRingtones
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100313a1
mov esi, 0x1008d860
jmp 0x10031696
push str.FIDL_PublicVideos
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100313bc
mov esi, 0x1008d850
jmp 0x10031696
push str.FIDL_QuickLaunch
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100313d7
mov esi, 0x1008d960
jmp 0x10031696
push str.FIDL_Recent
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100313f2
mov esi, 0x1008d5e0
jmp 0x10031696
push str.FIDL_RecordedTVLibrary
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003140d
mov esi, 0x1008da30
jmp 0x10031696
push str.FIDL_ResourceDir
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031428
mov esi, 0x1008d870
jmp 0x10031696
push str.FIDL_Ringtones
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031443
mov esi, 0x1008d820
jmp 0x10031696
push str.FIDL_RoamingAppData
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031465
mov dword [ebp - 0x1c], str._APPDATA_
mov esi, 0x1008d6b0
jmp 0x10031696
push str.FIDL_SampleMusic
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031480
mov esi, 0x1008d8e0
jmp 0x10031696
push str.FIDL_SamplePictures
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003149b
mov esi, 0x1008d8f0
jmp 0x10031696
push str.FIDL_SamplePlaylists
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100314b6
mov esi, 0x1008d8d0
jmp 0x10031696
push str.FIDL_SampleVideos
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100314d1
mov esi, 0x1008d900
jmp 0x10031696
push str.FIDL_SavedGames
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100314ec
mov esi, 0x1008d9c0
jmp 0x10031696
push str.FIDL_SavedSearches
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031507
mov esi, 0x1008d950
jmp 0x10031696
push str.FIDL_SendTo
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031522
mov esi, 0x1008d5f0
jmp 0x10031696
push str.FIDL_SidebarDefaultParts
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003153d
mov esi, str.Tn9
jmp 0x10031696
push str.FIDL_SidebarParts
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031558
mov esi, 0x1008d980
jmp 0x10031696
push str.FIDL_StartMenu
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031573
mov esi, 0x1008d5d0
jmp 0x10031696
push str.FIDL_Startup
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003158e
mov esi, 0x1008d5b0
jmp 0x10031696
push str.FIDL_System
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100315a9
mov esi, 0x1008d710
jmp 0x10031696
push str.FIDL_SystemX86
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100315c4
mov esi, 0x1008d720
jmp 0x10031696
push str.FIDL_Templates
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100315df
mov esi, 0x1008d630
jmp 0x10031696
push str.FIDL_UserPinned
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x100315fa
mov esi, 0x1008da70
jmp 0x10031696
push str.FIDL_UserProfiles
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031615
mov esi, 0x1008d8b0
jmp 0x10031696
push str.FIDL_UserProgramFiles
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003162d
mov esi, 0x1008d7c0
jmp 0x10031696
push str.FIDL_UserProgramFilesCommon
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031645
mov esi, 0x1008d7d0
jmp 0x10031696
push str.FIDL_Videos
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x1003165d
mov esi, 0x1008d810
jmp 0x10031696
push str.FIDL_VideosLibrary
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031675
mov esi, 0x1008da20
jmp 0x10031696
push str.FIDL_Windows
push ebx
call fcn.1006136f
pop ecx
pop ecx
test eax, eax
jne 0x10031889
mov dword [ebp - 0x1c], str._windir_
mov esi, 0x1008d730
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
pop ecx
mov edi, 0x1008da90
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x1003183e
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1003183e
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10031835
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0x7000
lea ecx, [ebp - 0x18]
push ecx
call eax
test eax, eax
jne 0x1003172b
mov eax, dword [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100316f7
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
jae 0x1003171d
push dword [ebp - 0x28]
push ecx
push dword [ebp - 0x24]
call fcn.10060b10
add esp, 0xc
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x10031835
push 4
pop ecx
mov edi, 0x1008d790
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10031745
mov dword [ebp - 0x2c], str.CommonW6432Dir
jmp 0x10031761
push 4
pop ecx
mov edi, 0x1008d780
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x10031835
mov dword [ebp - 0x2c], str.ProgramW6432Dir
xor esi, esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push 0x20119
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10031827
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031827
cmp dword [ebp - 0x20], esi
je 0x10031827
test byte [ebp - 0x20], 1
jne 0x10031827
add dword [ebp - 0x20], 2
push dword [ebp - 0x20]
call fcn.1005fb39
mov edi, eax
pop ecx
cmp edi, esi
je 0x10031827
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10031820
cmp dword [ebp - 0x38], 1
jne 0x10031820
mov eax, dword [ebp - 0x20]
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
shr eax, 1
xor ecx, ecx
push edi
mov word [edi + eax*2 - 2], cx
call esi
mov ecx, 0x104
cmp eax, ecx
ja 0x1003181e
push ecx
push dword [ebp - 0x24]
push edi
call esi
test eax, eax
jne 0x1003181e
mov ecx, dword [ebp - 0x24]
mov word [ecx], ax
xor esi, esi
push edi
call fcn.10060146
pop ecx
cmp dword [ebp - 0x30], esi
je 0x10031835
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
cmp word [eax], 0
jne 0x10031876
cmp dword [ebp - 0x1c], 0
je 0x10031876
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp - 0x1c]
call esi
mov ecx, 0x104
cmp eax, ecx
ja 0x10031876
mov edi, dword [ebp - 0x24]
push ecx
push edi
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x10031876
mov word [edi], ax
push ebx
call fcn.10060146
mov eax, dword [ebp - 0x24]
cmp word [eax], 0
pop ecx
setne al
jmp 0x1003188b
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005fc2b
leave
ret