Function at 0x1003bea8
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x4bc
mov eax, 0x101566a0
call fcn.1012b6ae
mov ebx, ecx
lea ecx, [ebp - 0x4c8]
call fcn.1002f97a
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4a8]
call fcn.1002f97a
mov byte [ebp - 4], 1
mov edi, 0x101847f0
and dword [ebp - 0x468], 0
test byte [ebp + 8], 1
mov dword [ebp - 0x46c], 2
je 0x1003c0e2
and dword [ebp - 0x464], 0
push 0x31
call fcn.10010082
pop ecx
test eax, eax
je 0x1003bf1f
lea ecx, [ebp - 0x464]
push ecx
push 0x1018d2a4
push SysReAllocStringLen
call eax
jmp 0x1003bf36
lea eax, [ebp - 0x464]
push eax
push 0x1018d2a4
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003c0e2
mov esi, dword [ebp - 0x464]
push 0x43
call fcn.10010082
pop ecx
test eax, eax
je 0x1003bf68
lea ecx, [ebp - 0x468]
push ecx
push 0
lea ecx, [ebp - 0x46c]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1003bf82
lea eax, [ebp - 0x468]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x468]
test eax, eax
je 0x1003c0d7
add eax, 2
push 0x1024c714
push eax
mov dword [ebp - 0x468], eax
call fcn.1012b9b2
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x480], esi
mov byte [ebp - 4], 2
test esi, esi
je 0x1003c0cc
push dword [ebp - 0x468]
push 0
push esi
call fcn.1012db70
mov edi, dword [ebp - 0x464]
push 0x43
call fcn.10010082
add esp, 0x10
test eax, eax
je 0x1003bff7
lea ecx, [ebp - 0x468]
push ecx
push esi
lea ecx, [ebp - 0x46c]
push ecx
push 0
push 0x101847f0
push edi
call eax
jmp 0x1003c014
lea eax, [ebp - 0x468]
push eax
push esi
lea eax, [ebp - 0x46c]
push eax
push 0
push 0x101847f0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003c0c7
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x42c]
push 0x3b
push eax
push esi
call fcn.100548cf
mov eax, dword [ebp - 0x428]
add esp, 0xc
mov ecx, dword [ebp - 0x42c]
xor edi, edi
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1003c0b8
lea ecx, [ecx + edi*4]
call fcn.1001f111
lea ecx, [ebp - 0x458]
push dword [eax]
call fcn.1002f77b
mov byte [ebp - 4], 4
lea eax, [ebp - 0x458]
push dword [ebp - 0x470]
lea ecx, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.1002e52d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x458]
call fcn.10008c86
mov eax, dword [ebp - 0x428]
inc edi
mov ecx, dword [ebp - 0x42c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x1003c05b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x42c]
call fcn.10008abd
mov edi, 0x101847f0
mov byte [ebp - 4], 1
push esi
call fcn.1012b7b2
pop ecx
push dword [ebp - 0x464]
call fcn.10017c01
test byte [ebp + 8], 2
je 0x1003c2d2
and dword [ebp - 0x464], 0
push 0x31
call fcn.10010082
pop ecx
test eax, eax
je 0x1003c114
lea ecx, [ebp - 0x464]
push ecx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x1003c12b
lea eax, [ebp - 0x464]
push eax
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1003c2d2
mov esi, dword [ebp - 0x464]
push 0x43
call fcn.10010082
pop ecx
test eax, eax
je 0x1003c15d
lea ecx, [ebp - 0x468]
push ecx
push 0
lea ecx, [ebp - 0x46c]
push ecx
push 0
push edi
push esi
call eax
jmp 0x1003c177
lea eax, [ebp - 0x468]
push eax
push 0
lea eax, [ebp - 0x46c]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x468]
test eax, eax
je 0x1003c2c7
add eax, 2
push 0x1024c714
push eax
mov dword [ebp - 0x468], eax
call fcn.1012b9b2
pop ecx
mov esi, eax
pop ecx
mov dword [ebp - 0x480], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x1003c2bc
push dword [ebp - 0x468]
push 0
push esi
call fcn.1012db70
mov edi, dword [ebp - 0x464]
push 0x43
call fcn.10010082
add esp, 0x10
test eax, eax
je 0x1003c1ec
lea ecx, [ebp - 0x468]
push ecx
push esi
lea ecx, [ebp - 0x46c]
push ecx
push 0
push 0x101847f0
push edi
call eax
jmp 0x1003c209
lea eax, [ebp - 0x468]
push eax
push esi
lea eax, [ebp - 0x46c]
push eax
push 0
push 0x101847f0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003c2bc
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x42c]
push 0x3b
push eax
push esi
call fcn.100548cf
mov eax, dword [ebp - 0x428]
add esp, 0xc
mov ecx, dword [ebp - 0x42c]
xor edi, edi
sub eax, ecx
sar eax, 2
test eax, eax
je 0x1003c2ad
lea ecx, [ecx + edi*4]
call fcn.1001f111
lea ecx, [ebp - 0x458]
push dword [eax]
call fcn.1002f77b
mov byte [ebp - 4], 7
lea eax, [ebp - 0x458]
push dword [ebp - 0x470]
lea ecx, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.1002e52d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x458]
call fcn.10008c86
mov eax, dword [ebp - 0x428]
inc edi
mov ecx, dword [ebp - 0x42c]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x1003c250
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x42c]
call fcn.10008abd
mov byte [ebp - 4], 1
push esi
call fcn.1012b7b2
pop ecx
push dword [ebp - 0x464]
call fcn.10017c01
mov eax, dword [ebp - 0x4c4]
mov esi, dword [eax]
cmp esi, eax
je 0x1003c457
lea eax, [esi + 8]
cmp dword [eax + 0x14], 8
jb 0x1003c2ed
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x464]
call fcn.100088c7
mov byte [ebp - 4], 8
lea eax, [ebp - 0x474]
push 1
push eax
lea ecx, [ebp - 0x464]
call fcn.10035ab2
mov byte [ebp - 4], 9
push 0x101811bc
push dword [eax]
call fcn.10131153
pop ecx
pop ecx
mov edi, eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x474]
lea ecx, [ecx - 0x10]
call fcn.100078bc
test edi, edi
je 0x1003c34b
push 0x1018cff4
lea ecx, [ebp - 0x464]
call fcn.10031252
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.1012db70
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x208
push eax
push dword [ebp - 0x464]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1003c3f4
cmp eax, 0x208
ja 0x1003c3f4
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x478]
call fcn.100088c7
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.1001f111
lea ecx, [ebp - 0x458]
push dword [eax]
call fcn.1002f77b
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x458]
push dword [ebp - 0x470]
lea ecx, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.1002e52d
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x458]
call fcn.10008c86
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x478]
lea ecx, [ecx - 0x10]
call fcn.100078bc
jmp 0x1003c437
push dword [ebp - 0x464]
lea ecx, [ebp - 0x438]
call fcn.1002f77b
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x438]
push dword [ebp - 0x470]
lea ecx, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x488]
push eax
call fcn.1002e52d
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x438]
call fcn.10008c86
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x464]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov esi, dword [esi]
cmp esi, dword [ebp - 0x4c4]
jne 0x1003c2e2
cmp dword [ebp - 0x4a0], 0
jbe 0x1003c603
cmp dword [ebx + 8], 0
jne 0x1003c47d
lea eax, [ebp - 0x4a8]
mov ecx, ebx
push eax
call fcn.100310dd
jmp 0x1003c603
lea ecx, [ebp - 0x440]
call fcn.1002f97a
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x460]
call fcn.1002f97a
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x440]
mov ecx, ebx
push eax
lea eax, [ebp - 0x460]
push eax
push ebx
call fcn.1003bbd2
mov eax, dword [ebp - 0x43c]
mov esi, dword [eax]
cmp esi, eax
jmp 0x1003c53d
push dword [ebp - 0x470]
lea eax, [esi + 8]
mov ecx, ebx
push eax
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x480]
push eax
call fcn.1003b77e
mov eax, dword [ebx + 0x24]
mov edi, dword [eax]
cmp edi, eax
je 0x1003c535
mov esi, dword [ebp - 0x478]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x1003c4fb
mov ecx, dword [esi]
lea eax, [edi + 8]
cmp dword [eax + 0x14], 8
jb 0x1003c506
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0x474]
mov ecx, ebx
push eax
call fcn.1003cbdb
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x474]
lea ecx, [ecx - 0x10]
call fcn.100078bc
mov edi, dword [edi]
cmp edi, dword [ebx + 0x24]
jne 0x1003c4f1
mov esi, dword [ebp - 0x464]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x43c]
mov dword [ebp - 0x464], esi
jne 0x1003c4c4
mov eax, dword [ebp - 0x45c]
mov esi, dword [eax]
cmp esi, eax
jmp 0x1003c5d9
lea eax, [esi + 8]
mov ecx, ebx
push eax
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x478]
push eax
call fcn.10038e9f
mov eax, dword [ebx + 4]
cmp dword [ebp - 0x478], eax
je 0x1003c58a
push esi
lea eax, [ebp - 0x484]
mov ecx, ebx
push eax
call fcn.10038b5b
mov eax, dword [ebx + 0x24]
mov edi, dword [eax]
cmp edi, eax
je 0x1003c5d1
mov esi, dword [ebp - 0x474]
push esi
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [edi + 0x20]
call fcn.10038e9f
mov eax, dword [ebp - 0x470]
cmp eax, dword [edi + 0x24]
je 0x1003c5c4
push eax
lea eax, [ebp - 0x47c]
push eax
lea ecx, [edi + 0x20]
call fcn.10038b5b
mov edi, dword [edi]
cmp edi, dword [ebx + 0x24]
jne 0x1003c599
mov esi, dword [ebp - 0x464]
mov esi, dword [esi]
cmp esi, dword [ebp - 0x45c]
mov dword [ebp - 0x464], esi
jne 0x1003c558
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x460]
call fcn.10030049
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x440]
call fcn.10030049
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4a8]
call fcn.10030049
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c8]
call fcn.10030049
xor eax, eax
inc eax
call fcn.1012b658
ret 4