Function at 0x41388d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00417fb0
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
mov edi, ecx
mov dword [ebp - 0x101c], 0x80000002
lea ebx, [ebp - 0x101c]
mov dword [ebp - 0x1018], 0x80000001
pop esi
mov byte [0x443cd9], 1
sub ebx, edi
mov dword [ebp - 0x1014], esi
lea eax, [ebp - 0x1010]
push eax
push 0x2000000
push 0
push 0x402510
push dword [ebx + edi]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x413b64
and dword [ebp - 0x1008], eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x4024ec
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x41f7e1
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x4024c8
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41398b
cmp dword [ebp - 0x1008], 4
jne 0x41f829
cmp dword [ebp - 0x1004], eax
setne byte [0x443cd9]
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x4024a4
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x41f855
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x402488
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x413a15
cmp dword [ebp - 0x1008], 4
jne 0x41f89d
mov ax, word [ebp - 0x1004]
mov word [0x42d5a8], ax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x402468
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x413a85
cmp dword [ebp - 0x1008], 4
jne 0x41f8c3
mov ax, word [ebp - 0x1004]
mov word [0x42d0d8], ax
test ax, ax
je 0x41f8f0
push 0xd
pop ecx
push 0x20
cmp ax, cx
pop ecx
je 0x413a7e
cmp ax, cx
jbe 0x413a85
mov word [0x42d0d8], cx
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x402440
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41f92d
cmp dword [ebp - 0x1008], 4
jne 0x41f8f8
mov ax, word [ebp - 0x1004]
mov word [0x42d0d4], ax
test ax, ax
je 0x41f925
push 0xd
pop ecx
push 0x20
pop edx
cmp ax, cx
je 0x413af2
cmp ax, dx
jbe 0x413afa
mov eax, edx
mov word [0x42d0d4], ax
mov cx, word [0x42d0d8]
cmp cx, dx
jne 0x413b98
cmp ax, dx
jb 0x41f93b
jne 0x413b1e
cmp cx, dx
jb 0x413ba0
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0x402430
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x41f946
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
add edi, 4
sub esi, 1
mov dword [ebp - 0x1014], esi
jne 0x4138d7
push 0
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ce0
mov esp, ebp
pop ebp
ret
cmp ax, dx
jmp 0x413b13
mov word [0x42d0d4], cx
jmp 0x413b1e
cmp dword [ebp - 0x1008], 4
jne 0x41f7fd
cmp dword [ebp - 0x1004], 0
setne byte [0x448528]
jmp 0x41393b
cmp dword [ebp - 0x1008], 1
jne 0x41393b
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0x448528], al
jmp 0x41393b
cmp dword [ebp - 0x1008], 1
jne 0x41398b
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0x443cd9], al
jmp 0x41398b
cmp dword [ebp - 0x1008], 4
jne 0x41f871
cmp dword [ebp - 0x1004], 0
setne byte [0x443cd8]
jmp 0x4139c5
cmp dword [ebp - 0x1008], 1
jne 0x4139c5
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0x443cd8], al
jmp 0x4139c5
cmp dword [ebp - 0x1008], 1
jne 0x413a15
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x413a0f
cmp dword [ebp - 0x1008], 1
jne 0x41f8e5
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x413a5f
mov ax, word [0x42d0d8]
jmp 0x413a65
push 0x20
pop ecx
jmp 0x413a7e
cmp dword [ebp - 0x1008], 1
jne 0x41f91a
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x413ad3
mov ax, word [0x42d0d4]
jmp 0x413ad9
push 0x20
pop edx
jmp 0x413af2
mov ax, word [0x42d0d4]
push 0x20
pop edx
jmp 0x413afa
mov word [0x42d0d8], ax
jmp 0x413b1e
cmp dword [ebp - 0x1008], 2
jne 0x41f99c
mov ecx, dword [ebp - 0x100c]
lea esi, [ebp - 0x1000]
shr ecx, 1
mov eax, 0x7fe
sub eax, ecx
push eax
lea eax, [ebp - 0x1004]
lea esi, [esi + ecx*2]
push esi
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41f98d
push esi
mov edx, 0x800
lea ecx, [ebp - 0x1004]
call fcn.00410820
jmp 0x41f996
xor eax, eax
mov word [ebp - 0x1004], ax
mov esi, dword [ebp - 0x1014]
cmp word [ebp - 0x1004], 0
je 0x413b58
lea ecx, [ebp - 0x1004]
call fcn.0040ce50
mov dword [edi], eax
jmp 0x413b58