Function at 0x1002b236
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x834], 0x105
mov ebx, ecx
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x830], edi
cmp dword [0x1008b950], edi
je 0x1002b286
mov eax, 0x4df
jmp 0x1002b4b5
lea eax, [ebp - 0x82c]
mov dword [ebx], edi
push eax
push 0x100081b4
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x1002b4c8
push dword [ebp - 0x82c]
mov esi, 0x104
lea ecx, [ebp - 0x61c]
mov edx, esi
call fcn.1000b82d
push 0x10005048
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.1000b82d
lea eax, [ebp - 0x61c]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.10022e38
push 0x10005058
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.10022e38
lea eax, [ebp - 0x830]
push eax
push 1
push edi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002b4c8
lea eax, [ebp - 0x834]
mov dword [ebp - 0x834], esi
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x838]
push eax
push edi
push edi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x838], 2
mov esi, eax
jne 0x1002b382
push 0x104
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1002b4c8
lea eax, [ebp - 0x824]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x414]
call fcn.10031469
test esi, esi
jne 0x1002b4c8
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1008b950], eax
test eax, eax
je 0x1002b4c8
push 0x10005078
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1002b4c6
lea eax, [ebp - 0x83c]
mov esi, esp
push eax
mov ecx, edi
call dword [0x1008c6d4]
call edi
cmp esi, esp
je 0x1002b3d8
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x1002b42e
mov eax, dword [ebp - 0x83c]
mov edi, esp
push dword [ebp - 0x828]
push 0x100081a4
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x1008c6d4]
call dword [esi]
cmp edi, esp
je 0x1002b409
mov ecx, 4
int 0x29
mov ebx, eax
mov edi, esp
mov eax, dword [ebp - 0x83c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1008c6d4]
call esi
cmp edi, esp
je 0x1002b42e
mov ecx, 4
int 0x29
xor edi, edi
cmp dword [ebp - 0x82c], 0
je 0x1002b49e
lea eax, [ebp - 0x828]
mov dword [ebp - 0x828], edi
push eax
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov ecx, dword [ebp - 0x828]
test ecx, ecx
je 0x1002b49e
mov eax, dword [ecx]
mov edi, esp
push dword [ebp - 0x82c]
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x1008c6d4]
call esi
cmp edi, esp
je 0x1002b47b
mov ecx, 4
int 0x29
mov eax, dword [ebp - 0x828]
mov edi, esp
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1008c6d4]
call esi
cmp edi, esp
je 0x1002b49e
mov ecx, 4
int 0x29
cmp dword [ebp - 0x830], 0
je 0x1002b4b3
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret
xor edi, edi
push ebx
push 0x100081a4
push 1
push edi
push 0x100081b4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
jmp 0x1002b430