Function at 0x5906206e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x29c
push ebx
push esi
push edi
lea eax, [ebp + 0x78]
push eax
push dword [ebp + 0x78]
xor edi, edi
mov dword [ebp + 0x60], edi
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp dword [ebp + 0x7c], edi
mov dword [ebp + 0x64], edi
mov esi, 0x3f3
je 0x590620fb
push 7
call fcn.5901c67c
cmp eax, edi
je 0x59062131
mov ecx, dword [eax]
lea edx, [ebp + 0x6c]
push edx
push eax
mov dword [ebp + 0x6c], edi
call dword [ecx + 0x18]
push dword [ebp + 0x78]
lea eax, [ebp - 0x22c]
push dword [ebp + 0x6c]
push 0x5900a64c
push eax
call dword [sym.imp.vsansi.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp + 0x68]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x22c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.vsansi.dll_RegOpenKeyExW]
push dword [ebp + 0x6c]
mov esi, eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x59062131
push dword [ebp + 0x78]
lea eax, [ebp - 0x22c]
push 0x5900a61c
push eax
call dword [sym.imp.vsansi.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x68]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x22c]
push eax
push SysReAllocStringLen
call dword [sym.imp.vsansi.dll_RegOpenKeyExW]
mov esi, eax
push dword [ebp + 0x78]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp esi, edi
mov dword [ebp + 0x78], edi
jne 0x5906224f
cmp dword [ebp + 0x7c], edi
mov dword [ebp + 0x6c], 1
mov eax, 0x5900a5fc
jne 0x5906215b
mov eax, 0x5900232c
mov esi, dword [sym.imp.vsansi.dll_RegQueryValueExW]
lea ecx, [ebp + 0x64]
push ecx
push edi
lea ecx, [ebp + 0x6c]
push ecx
push edi
push eax
push dword [ebp + 0x68]
call esi
test eax, eax
jne 0x59062246
mov eax, dword [ebp + 0x64]
add eax, eax
push eax
call sub.MSVCR70.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x59062246
cmp dword [ebp + 0x7c], edi
mov eax, 0x5900a5fc
jne 0x5906219e
mov eax, 0x5900232c
lea ecx, [ebp + 0x64]
push ecx
push ebx
lea ecx, [ebp + 0x6c]
push ecx
push edi
push eax
push dword [ebp + 0x68]
call esi
test eax, eax
jne 0x5906223f
cmp dword [ebp + 0x6c], 2
jne 0x590621ed
mov esi, dword [sym.imp.vsansi.dll_ExpandEnvironmentStringsW]
push edi
push edi
push ebx
call esi
mov dword [ebp + 0x7c], eax
lea eax, [eax + eax + 2]
push eax
call sub.MSVCR70.dll_void____cdecl_operator_new___unsigned_int_
cmp eax, edi
pop ecx
mov dword [ebp + 0x5c], eax
je 0x590621ed
push dword [ebp + 0x7c]
push eax
push ebx
call esi
push ebx
call sub.MSVCR70.dll_void___cdecl_operator_delete___void__
mov ebx, dword [ebp + 0x5c]
pop ecx
push 0x22
xor eax, eax
test ebx, ebx
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x2c], 0x88
je 0x59062223
push ebx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.590aa0d0
mov eax, esp
push 0
push esi
push ebx
push eax
call fcn.5902b731
push 0x4000
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.kernel32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x5906223f
mov dword [ebp + 0x60], 1
push ebx
call sub.MSVCR70.dll_void___cdecl_operator_delete___void__
pop ecx
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x60]
lea esp, [ebp - 0x238]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8