Function at 0x6a3064a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x6c
mov ecx, dword [0x6a31b1e0]
test ecx, ecx
je 0x6a3064c4
mov ebx, dword [0x6a31b1e4]
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 0x6a3148b4
call sub.msvcrt.dll_getenv
test eax, eax
je 0x6a3064b3
mov dword [esp], str.kernel32
call sub.KERNEL32.dll_GetModuleHandleA
push edx
mov esi, eax
test eax, eax
je 0x6a306548
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
test eax, eax
jne 0x6a3065c0
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x6a306548
call eax
movzx eax, ax
mov dword [esp], eax
call fcn.6a306840
mov ebx, eax
test eax, eax
je 0x6a306548
mov dword [0x6a31b1e4], ebx
mov dword [0x6a31b1e0], 1
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x6a3066f3
test esi, esi
je 0x6a3066ec
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x6a306480
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], esi
call sub.KERNEL32.dll_EnumResourceLanguagesA
sub esp, 0x14
mov ebx, dword [ebp - 0x28]
jmp 0x6a30652e
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea edi, [ebp - 0x24]
mov dword [esp + 4], edi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
jne 0x6a306504
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x80000005
jne 0x6a306504
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x6a306504
shl eax, 1
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x40], eax
test eax, eax
je 0x6a306504
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x6a3067d6
imul eax, dword [ebp - 0x24], 0xa
mov edx, dword [ebp - 0x20]
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x44], eax
mov ebx, eax
test eax, eax
je 0x6a3067d6
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], esi
mov esi, ebx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x24]
jae 0x6a3067ae
mov ebx, eax
cmp dword [ebp - 0x48], 0
je 0x6a306690
mov byte [eax], 0x3a
lea ebx, [eax + 1]
mov edx, ebx
jmp 0x6a3066b3
movzx edi, cl
cmp di, cx
jne 0x6a3067ae
cmp di, 0x3a
je 0x6a3067ae
mov ecx, edi
mov byte [edx], cl
inc edx
add dword [ebp - 0x3c], 2
mov edi, dword [ebp - 0x3c]
mov cx, word [edi]
test cx, cx
jne 0x6a306694
cmp edx, eax
je 0x6a3067ae
mov byte [edx], 0
mov dword [esp], ebx
call fcn.6a3067e8
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
add dword [ebp - 0x3c], 2
inc dword [ebp - 0x48]
jmp 0x6a306676
xor ebx, ebx
jmp 0x6a30652e
mov dword [ebp - 0x24], 9
lea eax, [ebp - 0x24]
mov dword [esp + 0x14], eax
lea ebx, [ebp - 0x31]
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
test edi, edi
jne 0x6a30657e
cmp dword [ebp - 0x20], 1
jne 0x6a30657e
mov eax, dword [ebp - 0x24]
cmp eax, 9
ja 0x6a30657e
jne 0x6a3067a7
cmp byte [ebp - 0x29], 0
jne 0x6a30657e
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x28]
cmp edx, ebx
jbe 0x6a30657e
cmp byte [edx], 0
jne 0x6a30657e
mov dword [esp], eax
call fcn.6a30787c
mov ebx, eax
test eax, eax
je 0x6a30657e
jmp 0x6a30652e
mov byte [ebp + eax - 0x31], 0
jmp 0x6a306765
mov ebx, esi
mov esi, dword [ebp - 0x4c]
mov byte [eax], 0
cmp dword [ebp - 0x44], eax
jae 0x6a3067cb
mov ecx, dword [ebp - 0x40]
mov dword [esp], ecx
call sub.msvcrt.dll_free
jmp 0x6a30652e
mov edi, dword [ebp - 0x44]
mov dword [esp], edi
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x6a306504