Function at 0x642c75de
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x642c764c
cmp eax, 2
jne 0x642c76b6
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x642c7640
cmp dword [ebp + 0xc], 7
jne 0x642c7626
push eax
call fcn.642c57b9
add eax, eax
jmp 0x642c763b
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x642c7629
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x642c765e
push 2
push 0x642c1cf8
jmp 0x642c77c5
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x642c765b
xor eax, eax
jmp 0x642c7819
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x642c7668
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.642c6e70
mov esi, eax
test esi, esi
je 0x642c770f
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x642c76a9
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x642c7760
cmp eax, 2
je 0x642c76c1
push eax
push 0x642c1b90
jmp 0x642c77c5
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x642c7754
cmp dword [ebp + 0xc], 7
push edi
jne 0x642c7741
call fcn.642c57b9
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x642c7760
push eax
push dword [ebp + 0x10]
push 0x642c1b48
call fcn.642d2f1b
add esp, 0xc
push esi
call fcn.642c6f08
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x642c771f
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x642c7654
cmp dword [ebp + 0xc], 7
jne 0x642c77d1
push ebx
call fcn.642c57b9
add eax, eax
jmp 0x642c77e8
push ebx
push esi
call fcn.642c57f2
test eax, eax
jge 0x642c76e5
push eax
push 0x642c1cbc
jmp 0x642c77c5
push 0x642c1c68
call fcn.642c7962
jmp 0x642c77cb
cmp dword [ebp + 0xc], 2
jne 0x642c77a3
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x642c770f
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.642c6e70
mov dword [ebp + 0x10], eax
test eax, eax
je 0x642c770f
push ebx
push eax
push esi
call edi
test eax, eax
je 0x642c77b1
cmp eax, ebx
jg 0x642c77b1
push esi
call fcn.642c6f08
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x642c7817
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x642c7817
push dword [ebp + 0x10]
call fcn.642c6f08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x642c1c10
call fcn.642c7962
pop ecx
pop ecx
jmp 0x642c770f
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x642c77d6
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.642c6e70
mov esi, eax
test esi, esi
je 0x642c7654
cmp dword [ebp + 0xc], 7
jne 0x642c7820
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x642c7817
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.642c57f2
test eax, eax
jge 0x642c780e
push eax
push 0x642c1bd0
call fcn.642d2f1b
pop ecx
pop ecx
push esi
call fcn.642c6f08
jmp 0x642c7654