Function at 0x30cedc1
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x31077cc
push esi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp byte [edi + 4], bl
jne 0x30cef18
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x30160b8
push dword [edi]
mov byte [edi + 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x30cef18
mov eax, dword [sym.imp.msvcrt.dll__osver]
test word [eax], 0x8000
je 0x30cef24
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push 0x30160a4
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x30cef5a
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.0302a9e0
mov edi, eax
cmp edi, ebx
pop ecx
je 0x30cef5a
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x30160a4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x30cee7a
push edi
jmp 0x30ceffd
mov eax, dword [ebp - 8]
mov byte [edi + eax], bl
cmp dword [ebp - 0x18], 2
jne 0x30ceec3
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x30cee74
push eax
call fcn.0302a9e0
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30cee74
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
mov dword [ebp - 8], eax
call fcn.0302a9c0
cmp dword [ebp - 8], ebx
mov edi, dword [ebp - 0x1c]
pop ecx
jne 0x30ceec9
jmp 0x30cee74
cmp dword [ebp - 0x18], 1
jne 0x30cee74
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [0x30f02f8]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jle 0x30cee74
add eax, eax
push eax
call fcn.0302a9e0
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30cee74
push dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [0x30f02f8]
push edi
mov dword [ebp - 0xc], eax
call fcn.0302a9c0
cmp dword [ebp - 0xc], ebx
pop ecx
jle 0x30ceffa
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push 0x3016080
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call dword [0x30f0290]
test eax, eax
jne 0x30cef5a
mov eax, dword [ebp - 0x10]
shr eax, 1
add eax, eax
mov dword [ebp - 0x1c], eax
add eax, 2
push eax
call fcn.0302a9e0
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x30cef65
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30cef18
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x3016080
push dword [ebp - 4]
call dword [0x30f0290]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x30cee74
mov eax, dword [ebp - 0x1c]
mov word [eax + edi], bx
cmp dword [ebp - 0x20], 1
jne 0x30cefaa
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], edi
jmp 0x30cef18
cmp dword [ebp - 0x20], 2
jne 0x30cee74
push ebx
push ebx
push edi
call dword [0x30f02b0]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x30cee74
add eax, eax
push eax
call fcn.0302a9e0
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x30cee74
push dword [ebp - 0xc]
push eax
push edi
call dword [0x30f02b0]
push edi
mov dword [ebp - 0xc], eax
call fcn.0302a9c0
cmp dword [ebp - 0xc], ebx
pop ecx
jne 0x30cef0f
push dword [ebp - 0x1c]
call fcn.0302a9c0
pop ecx
jmp 0x30cef18