Function at 0x419090
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
push ebx
mov ebx, dword [esp + 0x224]
push esi
mov esi, ecx
push edi
mov ecx, ebx
mov dword [esp + 0x10], 0x104
call fcn.004a9baa
mov edi, str.DefaultUser
or ecx, 0xffffffff
xor eax, eax
add esi, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov edi, ecx
mov ecx, esi
call fcn.004aa003
push edi
push str.DefaultUser
push eax
call fcn.004756a3
add esp, 0xc
test eax, eax
jne 0x41926f
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x419121
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push str.Cannot_open_HKEY_LOCAL_MACHINE_s
call fcn.0045dcb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x21c
ret 4
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x124]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.ProfilesDirectory
push ecx
call ebp
test eax, eax
je 0x419175
mov edi, str._SystemRoot_Profiles
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4ee660
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
push str.DefaultUserProfile
push eax
call ebp
test eax, eax
je 0x4191ed
mov edi, str.Default_User
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
mov ecx, ebp
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
push 0x400
mov ecx, ebx
call fcn.004aa07a
push 0x400
push eax
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.004aa052
push str._ntuser.dat
mov ecx, ebx
call fcn.004a9faf
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x21c
ret 4
mov ecx, dword [esi]
lea edx, [esp + 0x18]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push 1
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4192c7
lea edx, [esp + 0x18]
push edx
push str.Cannot_open_HKEY_LOCAL_MACHINE_s
call fcn.0045dcb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x21c
ret 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x120]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.ProfileImagePath
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
mov edi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x419229
mov edx, dword [esi]
push edx
push str.Cannot_query_profile_path_for_user_SID___s
call fcn.0045dcb0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x21c
ret 4