Function at 0x3001ac8a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x54]
sub esp, 0xbc
mov eax, dword [0x30034b3c]
push ebx
push esi
push dword [ebp + 0x7c]
mov dword [ebp + 0x50], eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp + 0x5c]
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
call fcn.3001abe3
mov esi, eax
cmp esi, ebx
je 0x3001acc9
push 0x30009b54
call fcn.30010597
pop ecx
jmp 0x3001afbe
push edi
mov edi, dword [ebp + 0x60]
push dword [ebp - 0x60]
mov ecx, edi
call fcn.3000d531
mov esi, eax
cmp esi, ebx
je 0x3001ace7
push 0x30009b34
jmp 0x3001afb7
push dword [ebp - 0x60]
mov ecx, dword [ebp + 0x64]
call fcn.3000d531
mov esi, eax
cmp esi, ebx
je 0x3001ad02
push 0x300015a4
jmp 0x3001afb7
push dword [ebp - 0x60]
mov ecx, dword [ebp + 0x68]
call fcn.3000d531
mov esi, eax
cmp esi, ebx
je 0x3001ad1d
push 0x30009b10
jmp 0x3001afb7
push dword [ebp - 0x60]
mov ecx, dword [ebp + 0x6c]
call fcn.3000d531
mov esi, eax
cmp esi, ebx
je 0x3001ad38
push 0x30009af0
jmp 0x3001afb7
push dword [ebp + 0x7c]
lea eax, [ebp - 0x54]
push 0x51
push eax
push dword [ebp + 0x5c]
call fcn.3001a986
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x54]
push eax
push dword [0x300340d0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x3001ad73
push 0x30009894
jmp 0x3001afb7
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x58]
push ecx
mov dword [ebp - 0x58], eax
mov eax, dword [edi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push ebx
push ebx
push 0x30008e68
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
je 0x3001ada7
cmp esi, ebx
je 0x3001ada7
push 0x30009ab8
jmp 0x3001afb7
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x64]
mov eax, dword [eax]
lea ecx, [ebp - 0x58]
push ecx
push eax
push ebx
push ebx
push 0x30008e90
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
je 0x3001add8
cmp esi, ebx
je 0x3001add8
push 0x30009a84
jmp 0x3001afb7
mov eax, dword [ebp + 0x64]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push eax
call fcn.3000e757
test eax, eax
jne 0x3001adfa
mov esi, 0x65b
push 0x30009a64
jmp 0x3001afb7
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x68]
mov eax, dword [eax]
lea ecx, [ebp - 0x58]
push ecx
push eax
push ebx
push ebx
push 0x30008e9c
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
je 0x3001ae2b
cmp esi, ebx
je 0x3001ae2b
push 0x30009a2c
jmp 0x3001afb7
mov eax, dword [ebp + 0x78]
lea ecx, [ebp - 0x58]
push ecx
push eax
push ebx
push ebx
push 0x30008eac
push dword [ebp - 0x5c]
mov dword [eax], ebx
mov dword [ebp - 0x58], 4
call edi
mov esi, eax
cmp esi, 2
je 0x3001ae5d
cmp esi, ebx
je 0x3001ae5d
push 0x300099f8
jmp 0x3001afb7
mov esi, dword [ebp + 0x68]
mov eax, dword [esi]
mov dword [ebp + 0x64], ebx
jmp 0x3001ae6d
inc dword [ebp + 0x64]
add eax, 2
push 0x25
push eax
call fcn.3001621d
cmp eax, ebx
jne 0x3001ae67
lea ecx, [ebp - 0x68]
call fcn.3000d430
push dword [esi + 4]
lea ecx, [ebp - 0x68]
call fcn.3000d531
mov esi, eax
cmp esi, ebx
je 0x3001aeaa
push 0x300099d0
call fcn.30010597
pop ecx
lea ecx, [ebp - 0x68]
call fcn.3000d43a
jmp 0x3001afbd
mov esi, dword [ebp + 0x68]
push dword [esi]
lea ecx, [ebp - 0x68]
call fcn.3000d622
mov eax, dword [ebp + 0x64]
mov ecx, dword [esi + 4]
imul eax, eax, 0x104
shr eax, 1
add eax, ecx
push eax
mov ecx, esi
call fcn.3000d531
mov esi, eax
cmp esi, ebx
jne 0x3001ae92
mov eax, dword [ebp + 0x68]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push eax
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x3001aef6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x3001aef8
xor esi, esi
cmp esi, ebx
je 0x3001af03
push 0x300099b0
jmp 0x3001ae97
lea ecx, [ebp - 0x68]
call fcn.3000d43a
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x6c]
mov eax, dword [eax]
lea ecx, [ebp - 0x58]
push ecx
push eax
push ebx
push ebx
push 0x30008e7c
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
jne 0x3001af48
mov ecx, dword [ebp + 0x6c]
push 0x30008f08
call fcn.3000d622
mov esi, eax
cmp esi, ebx
je 0x3001af53
push 0x3000997c
jmp 0x3001afb7
cmp esi, ebx
je 0x3001af53
push 0x30009944
jmp 0x3001afb7
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x70]
mov dword [ebp - 0x58], 4
push ebx
push ebx
push 0x30008eb8
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
jne 0x3001afa3
mov eax, dword [ebp + 0x70]
mov dword [eax], ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x74]
mov dword [ebp - 0x58], 4
push ebx
push ebx
push 0x30008edc
push dword [ebp - 0x5c]
call edi
mov esi, eax
cmp esi, 2
jne 0x3001afae
mov eax, dword [ebp + 0x74]
mov dword [eax], ebx
xor esi, esi
jmp 0x3001afbd
cmp esi, ebx
je 0x3001af79
push 0x30009904
jmp 0x3001afb7
cmp esi, ebx
je 0x3001afbd
push 0x300098d0
call fcn.30010597
pop ecx
pop edi
cmp dword [ebp - 0x5c], ebx
je 0x3001afcc
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x50]
mov eax, esi
pop esi
pop ebx
call fcn.3001fd67
add ebp, 0x54
leave
ret 0x24