Function at 0x100358f
Capabilities:
Print debug messages
Query environment variable
Query or enumerate registry value
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x10070f0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x418]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x1001b48
mov edi, 0x80000002
push edi
mov dword [ebp - 0x41c], ebx
call esi
test eax, eax
jne 0x100368b
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x1001b24
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x41c], ebx
je 0x100368b
lea eax, [ebp - 0x418]
push eax
push 0x20019
push ebx
push 0x1001ad0
push edi
call esi
test eax, eax
jne 0x1003685
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x1001ab0
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003671
cmp word [ebp - 0x20c], bx
jne 0x1003677
mov dword [ebp - 0x41c], ebx
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100368b
mov dword [ebp - 0x41c], ebx
call fcn.010029d1
test eax, eax
je 0x10039bd
call fcn.0100318c
test eax, eax
je 0x10036c1
xor edi, edi
inc edi
push edi
push edi
push ebx
push ebx
mov esi, 0x1001a9c
push esi
call fcn.0100281c
test eax, eax
jne 0x10036c1
push edi
push edi
push edi
push ebx
push esi
call fcn.0100281c
cmp dword [ebp - 0x41c], ebx
je 0x10036e7
push 3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01002534
test eax, eax
je 0x100399b
jmp 0x1003984
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x1d4], ebx
je 0x100399b
push 0x1001a84
mov byte [ebp - 0x412], 1
mov byte [ebp - 0x411], bl
mov dword [ebp - 0x424], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x434], eax
je 0x100399b
mov esi, 0xa68
push esi
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x42c], edi
je 0x100398f
push 0x1001a68
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1003988
lea ecx, [ebp - 0x438]
push ecx
push esi
push edi
push 1
push 0xffffffffffffffff
push ebx
call eax
test al, al
je 0x1003988
lea esi, [edi + 0x2f2]
cmp word [esi], bx
je 0x1003988
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call edi
test eax, eax
jne 0x10037af
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
mov esi, dword [ebp - 0x42c]
add esi, 0xf0
cmp word [esi], bx
je 0x10037f6
push 0x101
lea eax, [ebp - 0x410]
push eax
push esi
call edi
test eax, eax
jne 0x10037e3
lea eax, [ebp - 0x410]
push esi
push eax
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [ebp - 0x412], al
cmp byte [ebp - 0x412], bl
mov dword [ebp - 0x430], esi
jne 0x100382a
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x1d4]
push esi
push 0x1001a28
call sub.ntdll.dll_DbgPrint
add esp, 0xc
mov byte [ebp - 0x411], 1
jmp 0x1003866
mov eax, dword [ebp - 0x42c]
mov eax, dword [eax + 0x7c]
and eax, 0x8000000
neg eax
sbb eax, eax
and eax, 0xfffffffe
add eax, 5
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01002534
cmp al, bl
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x430], ecx
jne 0x100396c
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push 1
lea ecx, [ebp - 0x424]
push ecx
push ebx
push eax
push ebx
push 0x11ff
mov dword [ebp - 0x43c], eax
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
lea ecx, [ebp - 0x410]
push 0x100
xor eax, eax
cmp dword [ebp - 0x424], ebx
push ecx
je 0x10038fd
cmp byte [ebp - 0x411], 1
setne al
add eax, 0x643
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
cmp edi, ebx
je 0x10038ef
push 0x400
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x10038ef
push dword [ebp - 0x430]
lea eax, [ebp - 0x410]
push dword [ebp - 0x424]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100394a
cmp byte [ebp - 0x411], 1
setne al
add eax, 0x645
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edi, eax
cmp edi, ebx
je 0x100396c
push 0x400
push pe_nt_image_headers32
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x100394a
push dword [ebp - 0x430]
lea eax, [ebp - 0x410]
push dword [ebp - 0x43c]
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp edi, ebx
je 0x100396c
cmp esi, ebx
je 0x100396c
push 0x10019c8
push 0x4010
push ebx
push esi
push ebx
push ebx
call fcn.010044eb
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x42c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x10039c0
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x434]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push ebx
push ebx
push ebx
mov esi, 0x10019bc
push esi
call fcn.0100281c
test eax, eax
jne 0x10039bd
push ebx
push ebx
push 1
push 0x1001304
push esi
call fcn.0100281c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005225
leave
ret