Function at 0x13a64d75
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x13a64de3
cmp eax, 2
jne 0x13a64e4d
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x13a64dd7
cmp dword [ebp + 0xc], 7
jne 0x13a64dbd
push eax
call fcn.13a623d5
add eax, eax
jmp 0x13a64dd2
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x13a64dc0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x13a64df5
push 2
push 0x13a02b90
jmp 0x13a64f5c
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x13a64df2
xor eax, eax
jmp 0x13a64fb0
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x13a64dff
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.13a6391c
mov esi, eax
test esi, esi
je 0x13a64ea6
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x13a64e40
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x13a64ef7
cmp eax, 2
je 0x13a64e58
push eax
push 0x13a02a28
jmp 0x13a64f5c
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x13a64eeb
cmp dword [ebp + 0xc], 7
push edi
jne 0x13a64ed8
call fcn.13a623d5
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x13a64ef7
push eax
push dword [ebp + 0x10]
push 0x13a029e0
call fcn.13a64941
add esp, 0xc
push esi
call fcn.13a639b4
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x13a64eb6
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x13a64deb
cmp dword [ebp + 0xc], 7
jne 0x13a64f68
push ebx
call fcn.13a623d5
add eax, eax
jmp 0x13a64f7f
push ebx
push esi
call fcn.13a5ad9a
test eax, eax
jge 0x13a64e7c
push eax
push 0x13a02b54
jmp 0x13a64f5c
push 0x13a02b00
call fcn.13a64941
jmp 0x13a64f62
cmp dword [ebp + 0xc], 2
jne 0x13a64f3a
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x13a64ea6
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.13a6391c
mov dword [ebp + 0x10], eax
test eax, eax
je 0x13a64ea6
push ebx
push eax
push esi
call edi
test eax, eax
je 0x13a64f48
cmp eax, ebx
jg 0x13a64f48
push esi
call fcn.13a639b4
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x13a64fae
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x13a64fae
push dword [ebp + 0x10]
call fcn.13a639b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x13a02aa8
call fcn.13a64941
pop ecx
pop ecx
jmp 0x13a64ea6
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x13a64f6d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.13a6391c
mov esi, eax
test esi, esi
je 0x13a64deb
cmp dword [ebp + 0xc], 7
jne 0x13a64fb7
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x13a64fae
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.13a5ad9a
test eax, eax
jge 0x13a64fa5
push eax
push 0x13a02a68
call fcn.13a64941
pop ecx
pop ecx
push esi
call fcn.13a639b4
jmp 0x13a64deb