Function at 0x441b10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
test eax, eax
je 0x441c20
mov edi, str.HKEY_CLASSES_ROOT
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
jne 0x441b80
mov eax, 0x80000000
lea edx, [esp + 0x20]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x441c7e
add esp, 0x30
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov edi, str.HKEY_CURRENT_USER
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x441dc0
mov edi, str.HKEY_LOCAL_MACHINE
mov ecx, 0x13
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x441dd0
mov edi, str.HKEY_USERS
mov ecx, 0xb
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x441de0
mov edi, str.HKEY_PERFORMANCE_DATA
mov ecx, 0x16
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x441df0
mov esi, eax
mov edi, str.HKEY_CURRENT_CONFIG
mov ecx, 0x14
mov eax, 0x80000005
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x441b43
jmp 0x441b73
lea esi, [esp + 0x20]
mov dword [esp + 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
je 0x441c7e
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call edi
sub esp, 0x14
test eax, eax
jne 0x441b73
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
jne 0x441da0
mov eax, dword [esp + 0x28]
add eax, 1
mov dword [esp], eax
mov dword [esp + 0x24], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov ebx, eax
test eax, eax
je 0x441da0
lea eax, [esp + 0x24]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
jne 0x441d90
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x2c], 2
mov byte [ebx + eax], 0
jne 0x441da2
mov dword [esp + 4], 0x25
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x441da2
mov eax, dword [esp + 0x24]
lea edx, [eax + 0x3e8]
add eax, 0x3e9
mov dword [esp], eax
mov dword [esp + 0x24], edx
call sub.libgcrypt_20.dll_gcry_malloc
mov esi, eax
test eax, eax
je 0x441da2
mov eax, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [esp + 8], eax
call edi
sub esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
jne 0x441dfa
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x441da2
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
lea esi, [esi]
nop
xor ebx, ebx
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, 0x80000001
jmp 0x441b43
mov eax, 0x80000002
jmp 0x441b43
mov eax, 0x80000003
jmp 0x441b43
mov eax, 0x80000004
jmp 0x441b43
cmp eax, dword [esp + 0x24]
ja 0x441e45
mov byte [esi + eax], 0
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov ebx, eax
test eax, eax
je 0x441e3e
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x441da2
mov ebx, esi
jmp 0x441da2
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
add eax, 1
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov esi, eax
test eax, eax
je 0x441da2
mov eax, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call edi
sub esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
je 0x441e90
cmp eax, dword [esp + 0x24]
ja 0x441d7f
mov byte [esi + eax], 0
mov dword [esp], ebx
mov ebx, esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x441da2