Function at 0x1807cce
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x488
push 0x1801720
call fcn.01808a34
mov eax, dword [0x18122e8]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x450], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x44c], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x464], ecx
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x1808193
test cl, 1
je 0x1807d22
test cl, 0xe
jne 0x1808193
test cl, 2
je 0x1807d30
test cl, 0xd
jne 0x1808193
test cl, 4
je 0x1807d3e
test cl, 0xb
jne 0x1808193
test cl, 8
je 0x1807d4c
test cl, 7
jne 0x1808193
push eax
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov ebx, eax
push edi
call esi
add ebx, eax
push 0x180122c
call esi
add ebx, eax
push 0x18016c8
call esi
add esp, 0x10
add ebx, eax
lea eax, [ebx + ebx + 2]
mov dword [ebp - 0x440], eax
and dword [ebp - 4], 0
add eax, 3
and eax, 0xfffffffc
call fcn.018089e0
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x498], ebx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x458]
push eax
push 0x80000002
push dword [0x1812314]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x1808198
mov ecx, dword [ebp - 0x440]
mov edi, ebx
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push 0x18016c8
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
push dword [ebp - 0x450]
push ebx
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
call esi
push 0x180122c
push ebx
call esi
push dword [ebp - 0x448]
push ebx
call esi
add esp, 0x20
lea eax, [ebp - 0x45c]
push eax
push 0x20019
xor edi, edi
push edi
push ebx
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
push dword [ebp - 0x458]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp ebx, edi
jne 0x1807e6d
mov dword [ebp - 0x440], 0x20c
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x468]
push eax
push edi
push 0x18016a0
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
push dword [ebp - 0x45c]
call esi
cmp ebx, edi
je 0x1807e74
mov eax, ebx
jmp 0x1808198
cmp dword [ebp - 0x468], 2
je 0x1807e87
mov eax, 0x65d
jmp 0x1808198
cmp dword [ebp - 0x440], edi
je 0x1807eb7
mov eax, 0x106
mov dword [ebp - 0x440], eax
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, dword [ebp - 0x440]
jb 0x1807ec1
mov eax, 0x3f7
jmp 0x1808198
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x43c], ebx
cmp ebx, edi
je 0x18080f4
mov dword [ebp - 0x460], edi
cmp dword [ebp - 0x44c], edi
jne 0x1807f87
mov dword [ebp - 0x444], edi
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp + 0x14]
and eax, 0xf
mov dword [ebp - 0x488], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x474], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.018076a8
mov esi, eax
cmp esi, edi
je 0x1808026
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x1808198
push 0x1801694
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x1807f9e
push 0x7f
pop esi
jmp 0x1807f79
mov dword [ebp - 0x444], edi
lea eax, [ebp - 0x444]
push eax
push edi
push dword [ebp - 0x44c]
push dword [ebp - 0x448]
call esi
cmp eax, 0x7a
jne 0x1808017
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x444]
shl eax, 2
add eax, 3
and eax, 0xfffffffc
call fcn.018089e0
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x460], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x444]
push ecx
push eax
push dword [ebp - 0x44c]
push dword [ebp - 0x448]
call esi
jmp 0x1808017
cmp eax, edi
je 0x1807ef6
mov esi, eax
jmp 0x1807f79
lea eax, [ebp - 0x494]
push eax
push ebx
push dword [ebp - 0x438]
call fcn.01807868
test byte [ebp + 0x16], 1
jne 0x1808057
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180817f
push edi
push edi
push edi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
call esi
mov ebx, eax
cmp ebx, edi
jne 0x1808083
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18080f4
push 0x18015bc
push edi
push edi
push edi
call esi
mov esi, eax
mov dword [ebp - 0x454], esi
cmp esi, edi
jne 0x18080ba
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18080f4
push ebx
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_NotifyChangeEventLog]
test eax, eax
jne 0x18080ff
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x454]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1808198
push 1
push 0x18069c1
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], esi
xor esi, esi
push 1
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x470]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
sub eax, edi
je 0x180813a
dec eax
jne 0x1808152
xor esi, esi
inc esi
jmp 0x1808152
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x43c]
push dword [ebp - 0x438]
call fcn.01807868
cmp esi, edi
je 0x180811a
push dword [ebp - 0x43c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x454]
call esi
xor eax, eax
jmp 0x1808198
mov eax, 0x3ec
lea esp, [ebp - 0x4a4]
mov ecx, dword [ebp - 0x1c]
call fcn.01808747
call fcn.01808a6f
ret 0x1c