Function at 0x402342
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402349
mov eax, dword [esp + 0x50]
mov dword [0x41c20c], eax
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00404000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00404000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x402395
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push dword [0x41c20c]
push dword [0x41c20c]
push 1
push dword [esp + 0xc]
call fcn.0040e590
add dword [0x41c20c], 2
mov edx, 0x41a0c8
pop ecx
mov dword [0x41c20c], ecx
add ecx, dword [0x41a9e0]
call fcn.00404070
je 0x4023fb
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 8]
call fcn.0040e600
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0040e630
lea eax, [esp + 4]
push eax
call fcn.0040fa40
push dword [0x41c20c]
push dword [0x41c20c]
push 1
push dword [esp + 0xc]
call fcn.0040e630
add dword [0x41c20c], 2
mov edx, 0x41a0c8
pop ecx
mov dword [0x41c20c], ecx
add ecx, dword [0x41a9e0]
call fcn.00404070
je 0x402461
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 8]
call fcn.0040e600
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0040e590
lea eax, [esp + 4]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40247c
push 0x41a790
push 0x24
push dword [esp + 0x54]
call fcn.0040ed30
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4024ff
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4024d2
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push dword [0x41c20c]
push dword [esp + 0xc]
call fcn.00402c0e
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0040fa40
cmp dword [esp + 0x14], 0
je 0x4024e2
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x41a028
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
jmp 0x402bec
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x402581
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40255b
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push dword [0x41c20c]
push dword [esp + 0xc]
call fcn.00402c0e
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0040fa40
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x41a028
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
jmp 0x402bec
cmp dword [esp + 0x20], 0
je 0x4025e7
push dword [esp + 0x20]
call fcn.0040ed80
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4025e7
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4025c1
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00404008
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x41a028
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
jmp 0x402bec
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 8], 0
je 0x402671
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40264b
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push dword [0x41c20c]
push dword [esp + 0xc]
call fcn.00402c0e
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0040fa40
push dword [esp + 0x1c]
call fcn.0040eda0
mov edx, 0x41a028
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
jmp 0x402bec
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x402685
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40285b
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x402747
mov dword [esp + 0x30], 0
jmp 0x4026b1
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x402742
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov edx, 0x41a068
push edx
call fcn.0040f9e0
push dword [0x41c20c]
push dword [0x41c20c]
mov eax, 0x41a0ba
push eax
push 2
push dword [0x41c20c]
push dword [0x41c20c]
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0040edc0
cdq
push edx
push eax
call fcn.0040e7e0
mov edx, dword [0x41a9e0]
add dword [esp], edx
call fcn.0040e860
pop eax
mov edx, 0x41a0b2
push edx
call fcn.0040f9e0
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
inc dword [esp + 0x30]
jno 0x4026b1
jmp 0x4027e2
mov dword [esp + 0x30], 0
jmp 0x402751
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4027e2
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov edx, 0x41a068
push edx
call fcn.0040f9e0
push dword [0x41c20c]
push dword [0x41c20c]
mov eax, 0x41a0ba
push eax
push 2
push dword [0x41c20c]
push dword [0x41c20c]
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0040edc0
cdq
push edx
push eax
call fcn.0040e7e0
mov edx, dword [0x41a9e0]
add dword [esp], edx
call fcn.0040e860
pop eax
mov edx, 0x41a0b2
push edx
call fcn.0040f9e0
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
inc dword [esp + 0x30]
jno 0x402751
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x18]
call fcn.0040e600
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0040e590
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40282e
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [0x41c20c], eax
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
add esp, 4
jmp 0x402bec
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4028b8
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40288b
push dword [esp + 0x20]
pop eax
call fcn.00404060
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x28]
pop eax
call fcn.00404060
cdq
push edx
push eax
call fcn.0040e950
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
jmp 0x402bb9
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40298f
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x40298a
mov ebx, dword [esp + 0x28]
inc ebx
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.0040ed80
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x402988
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x40297f
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.0040edd0
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40297f
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0040fa40
push dword [esp + 0x10]
call fcn.0040e600
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.0040eda0
jmp 0x40298a
jmp 0x402bb9
mov ebx, 7
cmp ebx, dword [esp]
jne 0x402afd
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x402a5b
push dword [0x41c20c]
push dword [0x41c20c]
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.0040edd0
add dword [0x41c20c], 2
mov edx, 0x41a028
pop ecx
mov dword [0x41c20c], ecx
add ecx, dword [0x41a9e0]
call fcn.00404070
je 0x402a11
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov edx, 0x41a04a
push edx
call fcn.0040f9e0
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
jmp 0x402a4b
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
push dword [0x41c20c]
push dword [0x41c20c]
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.0040edd0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
jmp 0x40299d
push dword [0x41c20c]
push dword [0x41c20c]
push 1
push dword [esp + 0x1c]
call fcn.0040e630
add dword [0x41c20c], 2
mov edx, 0x41a04a
pop ecx
mov dword [0x41c20c], ecx
add ecx, dword [0x41a9e0]
call fcn.00404070
je 0x402ac1
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x18]
call fcn.0040e600
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0040e590
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402af8
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0040fa40
push dword [esp + 0x10]
call fcn.0040e600
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
jmp 0x402bb9
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x402b59
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402b31
push dword [esp + 0x20]
call fcn.0040ee40
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x28]
call fcn.0040ee40
push edx
push eax
call fcn.0040e950
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
jmp 0x402bb9
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402bb9
push dword [0x41c20c]
push dword [0x41c20c]
push dword [esp + 0x28]
call fcn.0040ee50
lea eax, [esp + 0x14]
push eax
call fcn.0040fa40
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402bb9
mov edx, dword [esp + 0x10]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0040fa40
push dword [esp + 0x10]
call fcn.0040e600
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.0040eda0
mov edx, dword [esp + 0xc]
push dword [0x41c20c]
push edx
call fcn.0040f9e0
pop eax
add eax, dword [0x41a9e0]
jmp 0x402bec
push dword [esp]
call fcn.0040fac0
push dword [esp + 0xc]
call fcn.0040fac0
push dword [esp + 4]
call fcn.0040fac0
add esp, 0x30
pop ebx
pop ebp
ret 0x14