Function at 0x439cc4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x218], 0
push 0x47b664
mov eax, dword [ebp + 8]
push eax
call fcn.00453660
add esp, 8
mov dword [ebp - 0x208], eax
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
cmp eax, dword [ebp - 0x208]
ja 0x439d31
mov dword [ebp - 0x208], 0
jmp 0x439d3b
mov dword [ebp - 0x208], 1
push 0x47b668
mov eax, dword [ebp + 8]
push eax
call fcn.0042fa7e
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jne 0x439e56
cmp dword [ebp - 0x208], 0
je 0x439e56
push 0x47b674
mov eax, dword [ebp + 8]
push eax
call fcn.0042fa7e
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x439e51
lea eax, [ebp - 0x200]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x200
lea eax, [ebp - 0x200]
push eax
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movsx eax, byte [ebp - 0x200]
test eax, eax
je 0x439e51
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x208]
add eax, 6
add eax, dword [ebp + 8]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 0x25
jne 0x439e51
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x5c
jmp 0x43a0ef
cmp dword [ebp - 0x210], 0
je 0x43a0ef
cmp dword [0x462284], 0
je 0x439e7a
mov dword [ebp - 0x218], 0x100
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x218]
or eax, 0x20019
push eax
push 0
push 0x47b684
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jne 0x43a0ea
lea eax, [ebp - 0x200]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
mov dword [ebp - 0x20c], 0x200
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x200]
push eax
push 0
push 0
push 0x47b6b4
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
je 0x43a05b
cmp dword [0x45e03c], 0
je 0x439f34
mov eax, dword [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x204]
push eax
push str._r_nLocalPatFixUpQ:_d_SR_not_found__x64_x_
call fcn.00452380
add esp, 0xc
lea eax, [ebp - 0x200]
mov dword [eax], 0
mov dword [eax + 4], 0
mov word [eax + 8], 0
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x47b6ec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
movsx eax, byte [ebp - 0x200]
test eax, eax
je 0x43a035
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
movsx eax, byte [ebp + ecx - 0x202]
cmp eax, 0x5c
je 0x439fae
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x47b6f8]
mov word [edi - 1], ax
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x208]
add eax, 0xa
add eax, dword [ebp + 8]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 0x25
jne 0x43a030
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x5c
jmp 0x43a056
cmp dword [0x45e03c], 0
je 0x43a056
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nSR_not_found___d_
call fcn.00452380
add esp, 8
jmp 0x43a0dd
mov eax, dword [ebp - 0x210]
add eax, dword [ebp - 0x208]
add eax, 0xa
add eax, dword [ebp + 8]
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x200]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
cmp eax, 0x25
jne 0x43a0dd
mov eax, dword [ebp + 0xc]
mov byte [eax], 0x5c
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43a0ef
pop edi
pop esi
pop ebx
leave
ret