Function at 0x1807cb9
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x488
push 0x1801720
call fcn.01808a24
mov eax, dword [0x18122e8]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x450], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x44c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x464], ecx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x180817e
test cl, 1
je 0x1807d0d
test cl, 0xe
jne 0x180817e
test cl, 2
je 0x1807d1b
test cl, 0xd
jne 0x180817e
test cl, 4
je 0x1807d29
test cl, 0xb
jne 0x180817e
test cl, 8
je 0x1807d37
test cl, 7
jne 0x180817e
push eax
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov ebx, eax
push edi
call esi
add ebx, eax
push 0x180122c
call esi
add ebx, eax
push 0x18016c8
call esi
add esp, 0x10
add ebx, eax
lea eax, [ebx + ebx + 2]
mov dword [ebp - 0x440], eax
and dword [ebp - 4], 0
add eax, 3
and eax, 0xfffffffc
call fcn.018089d0
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x498], ebx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x458]
push eax
push 0x80000002
push dword [0x1812314]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x1808183
mov ecx, dword [ebp - 0x440]
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0x18016c8
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp - 0x450]
push ebx
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
call esi
push 0x180122c
push ebx
call esi
push dword [ebp - 0x448]
push ebx
call esi
add esp, 0x20
lea eax, [ebp - 0x45c]
push eax
push 0x20019
xor edi, edi
push edi
push ebx
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
push dword [ebp - 0x458]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp ebx, edi
jne 0x1807e58
mov dword [ebp - 0x440], 0x20c
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x468]
push eax
push edi
push 0x18016a0
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
push dword [ebp - 0x45c]
call esi
cmp ebx, edi
je 0x1807e5f
mov eax, ebx
jmp 0x1808183
cmp dword [ebp - 0x468], 2
je 0x1807e72
mov eax, 0x65d
jmp 0x1808183
cmp dword [ebp - 0x440], edi
je 0x1807ea2
mov eax, 0x106
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, dword [ebp - 0x440]
jb 0x1807eac
mov eax, 0x3f7
jmp 0x1808183
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x43c], ebx
cmp ebx, edi
je 0x18080df
mov dword [ebp - 0x460], edi
cmp dword [ebp - 0x44c], edi
jne 0x1807f72
mov dword [ebp - 0x444], edi
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp + 0x14]
and eax, 0xf
mov dword [ebp - 0x488], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.018076a8
mov esi, eax
cmp esi, edi
je 0x1808011
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x1808183
push 0x1801694
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x1807f89
push 0x7f
pop esi
jmp 0x1807f64
mov dword [ebp - 0x444], edi
lea eax, [ebp - 0x444]
push eax
push edi
push dword [ebp - 0x44c]
push dword [ebp - 0x448]
call esi
cmp eax, 0x7a
jne 0x1808002
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x444]
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.018089d0
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x460], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
push ecx
push eax
push dword [ebp - 0x44c]
push dword [ebp - 0x448]
call esi
jmp 0x1808002
cmp eax, edi
je 0x1807ee1
mov esi, eax
jmp 0x1807f64
lea eax, [ebp - 0x494]
push eax
push ebx
push dword [ebp - 0x438]
call fcn.01807868
test byte [ebp + 0x16], 1
jne 0x1808042
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180816a
push edi
push edi
push edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
call esi
mov ebx, eax
cmp ebx, edi
jne 0x180806e
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18080df
push 0x18015bc
push edi
push edi
push edi
call esi
mov esi, eax
mov dword [ebp - 0x454], esi
cmp esi, edi
jne 0x18080a5
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18080df
push ebx
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
test eax, eax
jne 0x18080ea
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x454]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1808183
push 1
push 0x18069c1
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], esi
xor esi, esi
push 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x470]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
sub eax, edi
je 0x1808125
dec eax
jne 0x180813d
xor esi, esi
inc esi
jmp 0x180813d
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x43c]
push dword [ebp - 0x438]
call fcn.01807868
cmp esi, edi
je 0x1808105
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x454]
call esi
xor eax, eax
jmp 0x1808183
mov eax, 0x3ec
lea esp, [ebp - 0x4a4]
mov ecx, dword [ebp - 0x1c]
call fcn.01808732
call fcn.01808a5f
ret 0x1c