Function at 0x55e4b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
test eax, eax
je 0x55e5e0
mov edi, str.HKEY_CLASSES_ROOT
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x55e580
mov eax, 0x80000000
mov ebx, dword [esp + 0x64]
lea edx, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov dword [esp + 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x55e7d1
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x55e69b
xor esi, esi
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, esi
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, str.HKEY_CURRENT_USER
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x55e7e0
mov edi, str.HKEY_LOCAL_MACHINE
mov ecx, 0x13
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x55e7f0
mov edi, str.HKEY_USERS
mov ecx, 0xb
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x55e800
mov edi, str.HKEY_PERFORMANCE_DATA
mov ecx, 0x16
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x55e7b0
mov eax, 0x80000004
jmp 0x55e4dc
mov eax, dword [esp + 0x64]
lea ebp, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
mov dword [esp + 0x10], ebp
mov dword [esp + 4], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x2c], eax
call eax
sub esp, 0x14
test eax, eax
je 0x55e64b
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call dword [esp + 0x2c]
sub esp, 0x14
test eax, eax
jne 0x55e7d1
mov eax, dword [esp + 0x68]
lea esi, [esp + 0x38]
mov dword [esp + 0x38], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x55e820
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x38]
add eax, 1
mov dword [esp], eax
mov dword [esp + 0x34], eax
call sym.__gpgrt_malloc
test eax, eax
mov esi, eax
je 0x55e560
lea eax, [esp + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x55e810
mov eax, dword [esp + 0x38]
mov byte [esi + eax], 0
cmp dword [esp + 0x3c], 2
jne 0x55e562
mov dword [esp + 4], 0x25
mov dword [esp], esi
call sym._strchr
test eax, eax
je 0x55e562
mov eax, dword [esp + 0x34]
lea ecx, [eax + 0x3e8]
add eax, 0x3e9
mov dword [esp], eax
mov dword [esp + 0x34], ecx
call sym.__gpgrt_malloc
test eax, eax
mov ebx, eax
je 0x55e562
mov eax, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [esp + 8], eax
call ebp
sub esp, 0xc
test eax, eax
mov dword [esp + 0x38], eax
je 0x55e7a1
cmp eax, dword [esp + 0x34]
ja 0x55e8a1
mov byte [ebx + eax], 0
mov dword [esp], esi
call sym.__gpgrt_free
mov dword [esp], ebx
call sym._strlen
add eax, 1
mov dword [esp], eax
call sym.__gpgrt_malloc
test eax, eax
mov esi, eax
je 0x55e8ff
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._strcpy
mov dword [esp], ebx
call sym.__gpgrt_free
jmp 0x55e562
mov ecx, 0x14
mov esi, eax
mov edi, str.HKEY_CURRENT_CONFIG
repe cmpsb byte [esi], byte es:[edi]
mov eax, 0x80000005
seta cl
setb dl
cmp cl, dl
je 0x55e4dc
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x80000001
jmp 0x55e4dc
mov eax, 0x80000002
jmp 0x55e4dc
mov eax, 0x80000003
jmp 0x55e4dc
mov dword [esp], esi
call sym.__gpgrt_free
jmp 0x55e560
mov eax, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [esp + 0x64]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call dword [esp + 0x2c]
sub esp, 0x14
test eax, eax
jne 0x55e7d1
mov eax, dword [esp + 0x68]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
jne 0x55e560
jmp 0x55e69b
mov dword [esp], ebx
call sym.__gpgrt_free
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], eax
add eax, 1
mov dword [esp], eax
call sym.__gpgrt_malloc
test eax, eax
mov ebx, eax
je 0x55e562
mov eax, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call ebp
sub esp, 0xc
test eax, eax
mov dword [esp + 0x38], eax
je 0x55e8ec
cmp eax, dword [esp + 0x34]
ja 0x55e7a1
mov byte [ebx + eax], 0
mov dword [esp], esi
mov esi, ebx
call sym.__gpgrt_free
jmp 0x55e562
mov esi, ebx
jmp 0x55e562