Function at 0x466f70
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4946a2
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x4ad1bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x468], 0
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 4], 0
call fcn.00402550
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x466ff7
push 0x80004005
call fcn.00402240
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.004760a0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004760a0
add esp, 0x18
call fcn.00402550
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x46706c
push 0x80004005
call fcn.00402240
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push ecx
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 3
call fcn.004674e0
test eax, eax
jne 0x4670e9
push 0x49cf5c
mov ecx, esi
call fcn.004028e0
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x424]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4670be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x440]
call fcn.00467580
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4670e2
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
jmp 0x46744e
push 0x2001f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push ecx
lea ecx, [ebp - 0x44c]
call fcn.004056a0
test eax, eax
je 0x46716f
push 0x49cf5c
mov ecx, esi
call fcn.004028e0
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x424]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x467133
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x440]
call fcn.00467580
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x467157
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x4670e2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x46744e
lea edx, [ebp - 0x440]
lea ecx, [ebp - 0x44c]
call fcn.004068a0
test eax, eax
jne 0x4671f4
push 0x49cf5c
mov ecx, esi
call fcn.004028e0
mov byte [ebp - 4], 2
or ebx, 0xffffffff
mov edx, dword [ebp - 0x424]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4671b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x440]
call fcn.00467580
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4671d8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x4670e2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x46744e
mov eax, dword [ebp - 0x43c]
xor ecx, ecx
mov esi, dword [ebp - 0x424]
or ebx, 0xffffffff
mov dword [ebp - 0x430], ecx
mov ecx, dword [ebp - 0x440]
sub eax, ecx
sar eax, 2
mov dword [ebp - 0x464], eax
test eax, eax
jle 0x4673e8
mov dword [ebp - 0x42c], ecx
nop word [eax + eax]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
lea ecx, [ebp - 0x45c]
call fcn.004028e0
push str._
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x458]
call fcn.004057d0
push dword [ebp - 0x42c]
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x454]
call fcn.00405cf0
add esp, 8
push 0x20019
push dword [eax]
push ecx
lea ecx, [ebp - 0x44c]
call fcn.004056a0
mov edx, dword [ebp - 0x454]
mov ecx, ebx
mov dword [ebp - 0x428], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4672a6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, ebx
mov edx, dword [ebp - 0x458]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4672c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x45c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4672e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x428], 0
jne 0x4673c8
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x460]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4673c8
mov eax, dword [ebp - 0x460]
cmp eax, 1
je 0x467343
cmp eax, 2
jne 0x4673c8
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x467360
test al, 1
jne 0x4673c8
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x467369
jmp 0x4673c8
xor eax, eax
mov word [ebp - 0x218], ax
push 0x104
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4673c8
lea eax, [ebp - 0x420]
mov ecx, esi
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4673b6
test dx, dx
je 0x4673b2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4673b6
add ecx, 4
add eax, 4
test dx, dx
jne 0x467390
xor eax, eax
jmp 0x4673bb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x46746a
mov eax, dword [ebp - 0x430]
add dword [ebp - 0x42c], 4
inc eax
mov dword [ebp - 0x430], eax
cmp eax, dword [ebp - 0x464]
jl 0x467230
mov ecx, dword [ebp - 0x434]
push 0x49cf5c
call fcn.004028e0
mov byte [ebp - 4], 2
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x467413
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x440]
call fcn.00467580
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x467437
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x467448
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047137e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x430]
mov ecx, dword [eax + ecx*4]
sub ecx, 0x10
call fcn.004049a0
mov ebx, dword [ebp - 0x434]
lea ecx, [ebp - 0x424]
add eax, 0x10
mov dword [ebx], eax
call fcn.004028c0
lea ecx, [ebp - 0x440]
call fcn.00467580
lea ecx, [ebp - 0x450]
call fcn.004028c0
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x4674be
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x46744e