Function at 0x42ef2f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4b8
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, edx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov ebx, 0x80004005
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test ecx, ecx
je 0x42f289
test edi, edi
je 0x42f289
test esi, esi
je 0x42f289
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push 0x401f70
push 0x80000002
call esi
test eax, eax
jne 0x42f21b
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
push dword [ebp - 0x4b4]
push dword [ebp - 0x4ac]
call esi
test eax, eax
jne 0x42f20b
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0
push dword [ebp - 0x49c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42f1ff
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x42f07c
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x42f07c
push 0x104
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0043a703
mov ebx, eax
test ebx, ebx
js 0x42f07c
mov edx, esi
mov eax, 0x104
mov esi, edi
call fcn.0042c88c
mov ebx, eax
test ebx, ebx
js 0x42f07c
xor eax, eax
inc eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x42f0b4
push 0x104
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0043a703
mov ebx, eax
test ebx, ebx
js 0x42f0b4
mov edx, esi
mov eax, 0x104
mov esi, edi
call fcn.0042c88c
mov ebx, eax
xor eax, eax
test ebx, ebx
setns al
jmp 0x42f0ba
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x42f1ff
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
xor edi, edi
inc edi
mov edx, 0x401424
mov eax, 0x104
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call fcn.0042c88c
test eax, eax
js 0x42f1f9
push edi
push 0x401fc8
mov eax, 0x208
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
pop ecx
pop ecx
test eax, eax
js 0x42f1f9
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x49c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42f1f9
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
cmp edi, 1
jbe 0x42f16c
push 0x401fd8
mov eax, 0x104
mov edi, esi
call fcn.0042c924
test eax, eax
js 0x42f1ed
lea eax, [ebp - 0x84]
push eax
mov eax, 0x104
mov edi, esi
call fcn.0042c924
test eax, eax
js 0x42f1ed
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
inc edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
cmp edi, 0x40
ja 0x42f1f7
push edi
push 0x401fc8
mov eax, 0x208
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
pop ecx
pop ecx
test eax, eax
js 0x42f1f7
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x49c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42f144
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test eax, eax
je 0x42f1f9
xor ebx, ebx
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push dword [ebp - 0x49c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jns 0x42f289
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x401448
push dword [ebp - 0x4b4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x42f242
mov esi, 0x104
push esi
push edi
push 0x470
jmp 0x42f261
push 0x40202c
push dword [ebp - 0x4b4]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x42f289
mov esi, 0x104
push esi
push edi
push 0x46f
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x42f289
mov eax, esi
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edx, reloc.KERNEL32.dll_LeaveCriticalSection
call fcn.0042c88c
test eax, eax
js 0x42f289
xor ebx, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4