Function at 0x403160
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 0xc]
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
push 0x40c528
lea ecx, [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4031dc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x10], 4
jne 0x4031fd
mov ecx, dword [0x40c528]
push ecx
push 0x40985c
push 0x40c528
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x40c528]
test cl, cl
mov byte [esp + eax + 0x228], cl
je 0x403219
inc eax
cmp eax, 0x104
jl 0x403200
xor ebx, ebx
mov dl, 0x25
lea ecx, [ecx]
mov al, byte [esp + ebx + 0x228]
cmp al, dl
je 0x403248
test al, al
je 0x4033fd
inc ebx
cmp ebx, 0x104
jl 0x403220
mov eax, 0x40c528
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x104
je 0x4033fd
lea eax, [ebx + 1]
mov ecx, eax
cmp ecx, 0x104
jge 0x403273
cmp byte [esp + ecx + 0x228], dl
je 0x4032b8
inc ecx
cmp ecx, 0x104
jl 0x403261
xor eax, eax
dec ebx
test ebx, ebx
jle 0x403295
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x228]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x18], 0x2d
mov byte [esp + eax + 0x19], 0x6d
mov byte [esp + eax + 0x1a], 0x61
mov byte [esp + eax + 0x1b], 0x69
mov byte [esp + eax + 0x1c], 0x6c
mov byte [esp + eax + 0x1d], 0
jmp 0x4033d7
mov edx, ecx
cmp eax, edx
mov dword [esp + 0xc], edx
jge 0x4032e3
mov ecx, eax
sub ecx, ebx
lea edi, [esp + ecx + 0x17]
mov ecx, edx
sub ecx, eax
lea esi, [esp + eax + 0x228]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub edx, ebx
push 0x104
lea ecx, [esp + 0x124]
mov byte [esp + edx + 0x1b], 0
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
test ebx, ebx
jle 0x403325
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x228]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, ebx
mov byte [esp + eax + 0x18], 0
xor eax, eax
lea edx, [esp + ebx + 0x18]
mov cl, byte [esp + eax + 0x120]
test cl, cl
mov byte [edx + eax], cl
je 0x4033a2
mov cl, byte [esp + eax + 0x121]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x19], cl
je 0x403392
mov cl, byte [esp + eax + 0x122]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1a], cl
je 0x403395
mov cl, byte [esp + eax + 0x123]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1b], cl
je 0x40339a
mov cl, byte [esp + eax + 0x124]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1c], cl
je 0x40339f
add eax, 5
cmp eax, 0x104
jl 0x403330
jmp 0x4033a2
inc eax
jmp 0x4033a2
add eax, 2
jmp 0x4033a2
add eax, 3
jmp 0x4033a2
add eax, 4
lea esi, [ebx + eax]
lea esi, [esp + esi + 0x18]
xor ecx, ecx
cmp eax, 0x104
mov byte [esi], 0
jge 0x4033d0
mov edi, dword [esp + 0xc]
lea edi, [esp + edi + 0x228]
mov dl, byte [edi + ecx + 1]
mov byte [esi + ecx], dl
cmp byte [edi + ecx], 0
je 0x4033d0
inc ecx
jmp 0x4033c0
add ecx, eax
mov byte [esp + ecx + 0x18], 0
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x18]
test cl, cl
mov byte [eax + 0x40c528], cl
je 0x4033f6
inc eax
cmp eax, 0x104
jl 0x4033e0
mov byte [eax + 0x40c528], 0
pop edi
pop esi
mov eax, 0x40c528
pop ebx
mov esp, ebp
pop ebp
ret