Function at 0xa2c1cd
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00a247b5
mov eax, dword [0xa45214]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea eax, [ebp - 0x1020]
mov ebx, ecx
mov dword [ebp - 0x1020], 0x80000002
push 2
sub eax, ebx
mov dword [ebp - 0x101c], 0x80000001
pop esi
mov byte [0xa45044], 1
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x1014], esi
lea ecx, [ebp - 0x1010]
push ecx
push 0x2000000
push 0
push 0xa2c4d0
push dword [eax + ebx]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0xa2c494
and dword [ebp - 0x1008], eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c51c
push dword [ebp - 0x1010]
call edi
test eax, eax
je 0xa3c994
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c53c
push dword [ebp - 0x1010]
call edi
test eax, eax
jne 0xa2c2cf
cmp dword [ebp - 0x1008], 4
jne 0xa3c9dc
cmp dword [ebp - 0x1004], eax
setne byte [0xa45044]
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c560
push dword [ebp - 0x1010]
call edi
test eax, eax
je 0xa3ca08
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c584
push dword [ebp - 0x1010]
call edi
test eax, eax
jne 0xa2c351
cmp dword [ebp - 0x1008], 4
jne 0xa3ca50
mov ax, word [ebp - 0x1004]
mov word [0xa45054], ax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c5a0
push dword [ebp - 0x1010]
call edi
test eax, eax
jne 0xa2c3bd
cmp dword [ebp - 0x1008], 4
jne 0xa3ca76
mov ax, word [ebp - 0x1004]
mov word [0xa45050], ax
test ax, ax
je 0xa2c600
push 0xd
pop ecx
push 0x20
cmp ax, cx
pop ecx
je 0xa2c3b6
cmp ax, cx
jbe 0xa2c3bd
mov word [0xa45050], cx
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c5c0
push dword [ebp - 0x1010]
call edi
test eax, eax
jne 0xa3cad0
cmp dword [ebp - 0x1008], 4
jne 0xa3caa3
mov ax, word [ebp - 0x1004]
mov word [0xa4504c], ax
test ax, ax
je 0xa2c608
push 0xd
pop ecx
push 0x20
pop edx
cmp ax, cx
je 0xa2c426
cmp ax, dx
jbe 0xa2c42e
mov eax, edx
mov word [0xa4504c], ax
mov cx, word [0xa45050]
cmp cx, dx
jne 0xa2c5f8
cmp ax, dx
jb 0xa362e3
jne 0xa2c452
cmp cx, dx
jb 0xa362ee
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0xa2c5e8
push dword [ebp - 0x1010]
call edi
test eax, eax
je 0xa3cade
push dword [ebp - 0x1010]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp - 0x1018]
add ebx, 4
dec esi
mov dword [ebp - 0x1014], esi
jne 0xa2c223
push 0
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a213b9
mov esp, ebp
pop ebp
ret
cmp ax, dx
jmp 0xa2c447
push 0x20
pop ecx
jmp 0xa2c3b6
push 0x20
pop edx
jmp 0xa2c426
mov word [0xa45050], ax
jmp 0xa2c452
mov word [0xa4504c], cx
jmp 0xa2c452
cmp dword [ebp - 0x1008], 4
jne 0xa3c9b0
cmp dword [ebp - 0x1004], 0
setne byte [0xa60b40]
jmp 0xa2c283
cmp dword [ebp - 0x1008], 1
jne 0xa2c283
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0xa60b40], al
jmp 0xa2c283
cmp dword [ebp - 0x1008], 1
jne 0xa2c2cf
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0xa45044], al
jmp 0xa2c2cf
cmp dword [ebp - 0x1008], 4
jne 0xa3ca24
cmp dword [ebp - 0x1004], 0
setne byte [0xa45043]
jmp 0xa2c305
cmp dword [ebp - 0x1008], 1
jne 0xa2c305
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
pop ecx
sbb al, al
inc al
mov byte [0xa45043], al
jmp 0xa2c305
cmp dword [ebp - 0x1008], 1
jne 0xa2c351
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0xa2c34b
cmp dword [ebp - 0x1008], 1
jne 0xa3ca98
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0xa2c397
mov ax, word [0xa45050]
jmp 0xa2c39d
cmp dword [ebp - 0x1008], 1
jne 0xa3cac5
push 0
lea eax, [ebp - 0x1004]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0xa2c407
mov ax, word [0xa4504c]
jmp 0xa2c40d
mov ax, word [0xa4504c]
push 0x20
pop edx
jmp 0xa2c42e
cmp dword [ebp - 0x1008], 2
jne 0xa3cb34
mov ecx, dword [ebp - 0x100c]
lea esi, [ebp - 0x1000]
shr ecx, 1
mov eax, 0x7fe
sub eax, ecx
push eax
lea eax, [ebp - 0x1004]
lea esi, [esi + ecx*2]
push esi
push eax
call dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0xa3cb25
push esi
mov edx, 0x800
lea ecx, [ebp - 0x1004]
call fcn.00a21417
jmp 0xa3cb2e
xor eax, eax
mov word [ebp - 0x1004], ax
mov esi, dword [ebp - 0x1014]
cmp word [ebp - 0x1004], 0
je 0xa2c488
lea ecx, [ebp - 0x1004]
call fcn.00a22258
mov dword [ebx], eax
jmp 0xa2c488