Function at 0x6be655
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x6be65c
call fcn.004159e0
push dword [esp + 0x50]
call fcn.00401220
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.004011b0
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.004011b0
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x6be6ad
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00413f50
call fcn.00415b40
mov edx, 0x523cb6
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6be713
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 8]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00414940
lea eax, [esp + 4]
push eax
call fcn.00415900
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00414940
call fcn.00415b40
mov edx, 0x523cb6
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6be779
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 8]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00413f50
lea eax, [esp + 4]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be794
push 0x53d538
push 0x24
push dword [esp + 0x54]
call fcn.00415290
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x6be81d
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be7eb
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0xc]
call fcn.006bef59
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00415900
cmp dword [esp + 0x14], 0
je 0x6be7fb
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x521028
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x6bef37
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x6be8a5
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be87a
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0xc]
call fcn.006bef59
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00415900
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x521028
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x6bef37
cmp dword [esp + 0x20], 0
je 0x6be910
push dword [esp + 0x20]
call fcn.004151f0
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x6be910
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be8e5
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.004011b8
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x521028
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x6bef37
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x6be9a0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be975
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0xc]
call fcn.006bef59
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00415900
push dword [esp + 0x1c]
call fcn.00415350
mov edx, 0x521028
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x6bef37
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x6be9b3
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x6beba2
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x6bea7e
mov dword [esp + 0x30], 0
jmp 0x6be9df
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x6bea79
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov edx, 0x52208c
push edx
call fcn.00415a20
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov eax, 0x522622
push eax
push 2
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004153f0
cdq
push edx
push eax
call fcn.00413e50
call fcn.004011f2
add dword [esp], edx
call fcn.00414150
pop eax
mov edx, 0x522342
push edx
call fcn.00415a20
lea eax, [esp + 0x14]
push eax
call fcn.00415900
inc dword [esp + 0x30]
jno 0x6be9df
jmp 0x6beb22
mov dword [esp + 0x30], 0
jmp 0x6bea88
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x6beb22
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov edx, 0x52208c
push edx
call fcn.00415a20
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov eax, 0x522622
push eax
push 2
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004153f0
cdq
push edx
push eax
call fcn.00413e50
call fcn.004011f2
add dword [esp], edx
call fcn.00414150
pop eax
mov edx, 0x522342
push edx
call fcn.00415a20
lea eax, [esp + 0x14]
push eax
call fcn.00415900
inc dword [esp + 0x30]
jno 0x6bea88
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x18]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00413f50
lea eax, [esp + 0x14]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6beb70
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00401220
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
add esp, 4
jmp 0x6bef37
mov ebx, 4
cmp ebx, dword [esp]
jne 0x6bebff
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6bebcf
push dword [esp + 0x20]
call fcn.00415400
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x28]
call fcn.00415400
cdq
push edx
push eax
call fcn.00414a10
lea eax, [esp + 0x14]
push eax
call fcn.00415900
jmp 0x6bef05
mov ebx, 2
cmp ebx, dword [esp]
jne 0x6becd5
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x6becd0
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.004151f0
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x6becce
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x6becc5
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.00415420
lea eax, [esp + 0x14]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6becc5
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00415900
push dword [esp + 0x10]
call fcn.00413fc0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00415350
jmp 0x6becd0
jmp 0x6bef05
mov ebx, 7
cmp ebx, dword [esp]
jne 0x6bee41
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x6bed9f
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00415420
call fcn.00415b40
mov edx, 0x521028
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6bed55
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov edx, 0x521648
push edx
call fcn.00415a20
lea eax, [esp + 0x14]
push eax
call fcn.00415900
jmp 0x6bed95
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00415420
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00415900
add dword [esp + 0x30], 2
jmp 0x6bece3
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00414940
call fcn.00415b40
mov edx, 0x521648
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6bee05
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x18]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00413f50
lea eax, [esp + 0x14]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6bee3c
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00415900
push dword [esp + 0x10]
call fcn.00413fc0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x6bef05
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x6beea1
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6bee75
push dword [esp + 0x20]
call fcn.00415410
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x28]
call fcn.00415410
push edx
push eax
call fcn.00414a10
lea eax, [esp + 0x14]
push eax
call fcn.00415900
jmp 0x6bef05
mov ebx, 1
cmp ebx, dword [esp]
jne 0x6bef05
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x28]
call fcn.00415490
lea eax, [esp + 0x14]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x6bef05
mov edx, dword [esp + 0x10]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00415900
push dword [esp + 0x10]
call fcn.00413fc0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00415350
mov edx, dword [esp + 0xc]
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415a20
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x6bef37
push dword [esp]
call fcn.00415a70
push dword [esp + 0xc]
call fcn.00415a70
push dword [esp + 4]
call fcn.00415a70
add esp, 0x30
pop ebx
pop ebp
ret 0x14