Function at 0x42e880
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
lea eax, [ebp - 0x124]
mov dword [ebp - 0x54], str.AFPL_Ghostscript
push edi
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x50], str.Aladdin_Ghostscript
mov dword [ebp - 0x4c], str.GPL_Ghostscript
mov dword [ebp - 0x48], str.GNU_Ghostscript
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x128], eax
call fcn.0040be50
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x88], 0x20219
lea ecx, [ecx]
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov edx, dword [ebp + ebx*4 - 0x54]
mov ecx, str.Software_
push 0
call fcn.00419a10
add esp, 4
mov esi, eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x88]
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42e9e9
push 0x20
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x84]
call edi
test eax, eax
jne 0x42e9dd
jmp 0x42e950
lea eax, [ebp - 0x44]
push eax
call fcn.004c91a0
mov edi, dword [ebp - 0x134]
lea ecx, [ebp - 0x134]
add esp, 4
mov dword [ebp - 0x80], eax
lea eax, [edi + 1]
push eax
call fcn.0040c470
test al, al
jne 0x42e97c
xor eax, eax
mov byte [eax], al
mov eax, dword [ebp - 0x128]
lea ebx, [eax + edi*4]
mov eax, dword [ebp - 0x134]
cmp eax, edi
jbe 0x42e9a2
sub eax, edi
shl eax, 2
push eax
lea eax, [ebx + 4]
push ebx
push eax
call fcn.004bdaf0
add esp, 0xc
lea eax, [edi + 1]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x80]
mov dword [ebx], eax
lea eax, [ebp - 0x44]
mov ebx, dword [ebp - 0x8c]
push 0x20
push eax
inc ebx
push ebx
push dword [ebp - 0x84]
mov dword [ebp - 0x8c], ebx
call edi
test eax, eax
je 0x42e950
mov ebx, dword [ebp - 0x7c]
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004bf8aa
inc ebx
add esp, 4
mov dword [ebp - 0x7c], ebx
cmp ebx, 4
jb 0x42e8f5
test dword [ebp - 0x88], 0x200
je 0x42ea49
cmp dword [0x56b4b4], 0
mov dword [ebp - 0x88], 0x20119
mov dword [ebp - 0x7c], 0
je 0x42ea49
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x56b4b4]
test eax, eax
je 0x42ea49
cmp dword [ebp - 0x7c], 1
sete al
test al, al
jne 0x42e8f0
push 0x401490
push 4
push dword [ebp - 0x134]
push dword [ebp - 0x128]
call fcn.004bf510
mov edx, dword [ebp - 0x134]
add esp, 0x10
mov dword [ebp - 0x8c], edx
test edx, edx
je 0x42ec1d
lea ebx, [edx*4 - 4]
mov dword [ebp - 0x88], ebx
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
lea ebx, [ebx]
mov eax, dword [ebp - 0x128]
push dword [ebx + eax]
push dword [ebp + ecx*4 - 0x54]
push str.Software_s_s
call fcn.00419f30
mov edi, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push str.GS_DLL
mov edx, edi
call fcn.00416c00
add esp, 0x10
mov dword [ebp - 0x84], eax
test eax, eax
jne 0x42eadb
push eax
call fcn.004bf8aa
push edi
call fcn.004bf8aa
add esp, 8
jmp 0x42ebef
mov ecx, eax
call fcn.0041cd60
mov esi, eax
xor edx, edx
test esi, esi
je 0x42eb01
lea ebx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42eaf0
sub eax, ebx
sar eax, 1
jmp 0x42eb03
xor eax, eax
movzx eax, word [esi + eax*2 - 2]
mov ecx, 0x5c
cmp cx, ax
je 0x42eb21
mov ecx, 0x2f
cmp cx, ax
je 0x42eb21
mov edx, 0x4f06a4
push str.gswin32c.exe
mov ecx, esi
call fcn.00419a10
mov ebx, eax
add esp, 4
mov dword [ebp - 0x80], ebx
test ebx, ebx
je 0x42eb54
lea eax, [ebp - 0x78]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x42eb54
test byte [ebp - 0x78], 0x10
je 0x42ece1
xor edx, edx
test esi, esi
je 0x42eb71
mov ecx, esi
lea ebx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42eb60
sub ecx, ebx
sar ecx, 1
jmp 0x42eb73
xor ecx, ecx
movzx eax, word [esi + ecx*2 - 2]
mov ecx, 0x5c
cmp cx, ax
je 0x42eb91
mov ecx, 0x2f
cmp cx, ax
je 0x42eb91
mov edx, 0x4f06a4
push str.gswin64c.exe
mov ecx, esi
call fcn.00419a10
push dword [ebp - 0x80]
mov ebx, eax
call fcn.004bf8aa
add esp, 8
test ebx, ebx
je 0x42ebc9
lea eax, [ebp - 0x78]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x42ebc9
test byte [ebp - 0x78], 0x10
je 0x42ece1
push ebx
call fcn.004bf8aa
push esi
call fcn.004bf8aa
push dword [ebp - 0x84]
call fcn.004bf8aa
push edi
call fcn.004bf8aa
mov ebx, dword [ebp - 0x88]
add esp, 0x10
mov ecx, dword [ebp - 0x7c]
inc ecx
mov dword [ebp - 0x7c], ecx
cmp ecx, 4
jb 0x42ea90
mov edx, dword [ebp - 0x8c]
sub ebx, 4
dec edx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], edx
test edx, edx
jne 0x42ea85
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
push str.PATH
call ebx
mov edi, eax
push 2
push edi
call fcn.004bf417
add esp, 8
mov esi, eax
test edi, edi
je 0x42ee6d
test esi, esi
je 0x42ee6d
push edi
push esi
push str.PATH
call ebx
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xd8], 0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x90], 0
mov dword [ebp - 0xd4], eax
call fcn.0040be50
push 1
push 0x4f1cd8
push esi
lea ecx, [ebp - 0xe0]
call fcn.00401330
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0xe0], eax
jbe 0x42edf1
jmp 0x42ecb0
lea ecx, [eax*4]
xor edx, edx
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x80], ecx
mov edi, dword [ecx + eax]
test edi, edi
je 0x42ed07
mov ecx, edi
lea ebx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ecd0
sub ecx, ebx
sar ecx, 1
jmp 0x42ed09
push 0
call fcn.004bf8aa
push esi
call fcn.004bf8aa
push dword [ebp - 0x84]
call fcn.004bf8aa
push edi
call fcn.004bf8aa
add esp, 0x10
jmp 0x42ee78
xor ecx, ecx
movzx eax, word [edi + ecx*2 - 2]
mov ecx, 0x5c
cmp cx, ax
je 0x42ed27
mov ecx, 0x2f
cmp cx, ax
je 0x42ed27
mov edx, 0x4f06a4
push str.gswin32c.exe
mov ecx, edi
call fcn.00419a10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x42ed57
lea eax, [ebp - 0x78]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x42ed57
test byte [ebp - 0x78], 0x10
je 0x42ee23
mov eax, dword [ebp - 0xd4]
xor edx, edx
mov edi, dword [ebp - 0x80]
mov edi, dword [edi + eax]
test edi, edi
je 0x42ed83
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 0x80], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x42ed71
sub ecx, dword [ebp - 0x80]
sar ecx, 1
jmp 0x42ed85
xor ecx, ecx
movzx eax, word [edi + ecx*2 - 2]
mov ecx, 0x5c
cmp cx, ax
je 0x42eda3
mov ecx, 0x2f
cmp cx, ax
je 0x42eda3
mov edx, 0x4f06a4
push str.gswin64c.exe
mov ecx, edi
call fcn.00419a10
push ebx
mov edi, eax
call fcn.004bf8aa
add esp, 8
test edi, edi
je 0x42edd5
lea eax, [ebp - 0x78]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x42edd5
test byte [ebp - 0x78], 0x10
je 0x42ee21
push edi
call fcn.004bf8aa
mov eax, dword [ebp - 0x7c]
add esp, 4
inc eax
mov dword [ebp - 0x7c], eax
cmp eax, dword [ebp - 0xe0]
jb 0x42ecb0
lea ecx, [ebp - 0xe0]
call fcn.0040c180
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
cmp ecx, eax
je 0x42ee6d
mov edx, dword [ebp - 0x90]
push ecx
test edx, edx
jne 0x42ee66
call fcn.004bf8aa
add esp, 4
jmp 0x42ee6d
mov ebx, edi
push 0
call fcn.004bf8aa
add esp, 4
lea ecx, [ebp - 0xe0]
call fcn.0040c180
mov ecx, dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
cmp ecx, eax
je 0x42ee6f
mov edx, dword [ebp - 0x90]
push ecx
test edx, edx
jne 0x42ee5d
call fcn.004bf8aa
add esp, 4
jmp 0x42ee6f
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
jmp 0x42ee6f
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
xor ebx, ebx
push esi
call fcn.004bf8aa
add esp, 4
lea ecx, [ebp - 0x134]
call fcn.0040c180
mov ecx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
cmp ecx, eax
je 0x42eec0
mov edx, dword [ebp - 0xe4]
push ecx
test edx, edx
jne 0x42eeb9
call fcn.004bf8aa
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcb15
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret