Function at 0x1003ca2b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100410f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x210]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push eax
xor eax, eax
mov dword [ebp - 0x21c], ecx
cmp byte [ecx + 0x7c], al
setne al
dec eax
and eax, 0xfffffe00
add eax, 0x20219
push eax
push ebx
push edx
push esi
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003cc93
push edi
push 0x38
pop ecx
call fcn.10014d5b
test eax, eax
je 0x1003ca94
mov ecx, eax
call fcn.1003b6df
mov edi, eax
jmp 0x1003ca96
mov edi, ebx
test edi, edi
je 0x1003cc4c
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x24], eax
lea eax, [edi + 0x20]
push eax
lea eax, [edi + 0x1c]
push eax
lea eax, [edi + 0x18]
push eax
push dword [ebp - 0x210]
call fcn.1003c432
mov esi, eax
test esi, esi
jne 0x1003cc65
lea eax, [edi + 4]
push eax
push 0x1000c5a8
push dword [ebp - 0x210]
call fcn.1003c576
mov esi, eax
test esi, esi
jne 0x1003cbef
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], ebx
push eax
push 0x1000c5ec
push dword [ebp - 0x210]
call fcn.1003c576
mov esi, eax
test esi, esi
jne 0x1003cbd9
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1003cb30
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1003cb3a
cmp eax, 0x104
jbe 0x1003cb42
push 8
pop esi
test esi, esi
jne 0x1003cbd9
lea ecx, [ebp - 0x20c]
lea eax, [ecx + 2]
push 2
mov dword [ebp - 0x218], eax
pop edx
mov ax, word [ecx]
add ecx, edx
cmp ax, bx
jne 0x1003cb54
sub ecx, dword [ebp - 0x218]
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mov dword [ebp - 0x218], eax
mul edx
seto cl
neg ecx
or ecx, eax
call fcn.10014d5b
mov dword [edi], eax
test eax, eax
jne 0x1003cb8a
push 8
pop esi
jmp 0x1003cbd9
mov edx, dword [ebp - 0x218]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, eax
call fcn.1003b442
test eax, eax
jns 0x1003cbbb
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0x1003cbb7
movzx esi, ax
jmp 0x1003cbd9
mov esi, eax
jmp 0x1003cbd9
mov eax, dword [ebp - 0x218]
cmp eax, 1
jbe 0x1003cbd9
mov ecx, dword [edi]
push 0x5c
pop edx
cmp dx, word [ecx + eax*2 - 4]
jne 0x1003cbd9
xor edx, edx
mov word [ecx + eax*2 - 4], dx
cmp dword [ebp - 0x214], ebx
je 0x1003cc0a
push dword [ebp - 0x214]
call fcn.10014d79
pop ecx
jmp 0x1003cc0a
cmp esi, 2
jne 0x1003cc0a
lea eax, [edi + 8]
push eax
push 0x1000c5fc
push dword [ebp - 0x210]
call fcn.1003c576
mov esi, eax
test esi, esi
jne 0x1003cc65
lea eax, [edi + 0xc]
push eax
push 0x1000c608
push dword [ebp - 0x210]
call fcn.1003c576
lea esi, [eax - 2]
neg esi
sbb esi, esi
and esi, eax
jne 0x1003cc65
lea eax, [edi + 0x10]
push eax
push 0x1000c610
push dword [ebp - 0x210]
call fcn.1003c576
mov esi, eax
cmp esi, 2
jne 0x1003cc4f
mov esi, ebx
jmp 0x1003cc4f
push 8
pop esi
test esi, esi
jne 0x1003cc65
mov eax, dword [ebp - 0x21c]
push edi
add eax, 4
push eax
call fcn.1003b8bd
mov ebx, eax
push dword [ebp - 0x210]
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegCloseKey]
test esi, esi
jne 0x1003cc79
test ebx, ebx
jne 0x1003cc92
test edi, edi
je 0x1003cc92
mov ecx, edi
call fcn.1003ba77
mov ecx, edi
call fcn.1003ba77
push edi
call fcn.10014d79
pop ecx
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1000e130
leave
ret 0x10