Function at 0x42b78e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x94
mov eax, 0x449dd3
call fcn.0042f42b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xa0], ecx
xor ebx, ebx
push eax
lea ecx, [ebp - 0x4c]
mov dword [esi], ebx
call fcn.0040b3c2
push ebx
push ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], ebx
call fcn.0040cd7a
push 1
push ebx
push 0x4060f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.0040bf53
mov edi, eax
cmp edi, 0xffffffff
jne 0x42b801
lea ecx, [ebp - 0x88]
call fcn.0040c13b
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040aa24
xor al, al
jmp 0x42b9d7
push edi
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040d06d
mov eax, dword [ebp - 0x3c]
sub eax, edi
dec eax
push eax
inc edi
push edi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.0040d06d
push 0x4060e4
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040edd0
test eax, eax
je 0x42b8ec
push 0x4060bc
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8ec
push 0x4060b0
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8e5
push 0x40608c
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8e5
push 0x406080
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8de
push 0x40605c
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8de
push 0x406054
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8d7
push 0x40603c
lea ecx, [ebp - 0x30]
call fcn.0040edd0
test eax, eax
je 0x42b8d7
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.0040aa24
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0040aa24
jmp 0x42b7e4
mov ecx, 0x80000003
jmp 0x42b8f1
mov ecx, 0x80000000
jmp 0x42b8f1
mov ecx, 0x80000001
jmp 0x42b8f1
mov ecx, 0x80000002
cmp dword [ebp - 0x54], 8
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x99], bl
jae 0x42b906
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x74]
push edx
push 0x20019
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b9a5
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x70]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0xa0]
mov byte [ebp - 4], 4
push dword [ebp - 0x74]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
call edi
cmp eax, ebx
jne 0x42b99c
cmp dword [ebp - 0x70], ebx
jbe 0x42b99c
cmp dword [ebp - 0x6c], 1
je 0x42b9dd
cmp dword [ebp - 0x6c], 2
je 0x42b9dd
cmp dword [ebp - 0x6c], 4
jne 0x42b99c
cmp dword [ebp - 0x70], 4
jne 0x42b99c
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0xa0]
mov dword [ebp - 0x78], ebx
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x42b99c
mov eax, dword [ebp - 0x78]
mov dword [esi], 2
mov dword [esi + 0x20], eax
mov byte [ebp - 0x99], 1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.0040aa24
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.0040aa24
lea ecx, [ebp - 0x88]
call fcn.0040c13b
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040aa24
mov al, byte [ebp - 0x99]
call fcn.0042f496
ret
push ebx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x88]
call fcn.00422b90
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x6c]
push eax
push ebx
push dword [ebp - 0xa0]
push dword [ebp - 0x74]
call edi
cmp eax, ebx
jne 0x42b99c
xor eax, eax
inc eax
cmp dword [ebp - 0x6c], eax
jne 0x42ba27
push dword [ebp - 0x88]
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.0040b36d
jmp 0x42b995
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
push ebx
push dword [ebp - 0x88]
call edi
mov dword [ebp - 0xa0], eax
cmp eax, ebx
jbe 0x42b99c
lea ecx, [ebp - 0x78]
push ecx
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.0040c59b
push dword [ebp - 0xa0]
mov byte [ebp - 4], 5
push dword [ebp - 0x98]
push dword [ebp - 0x88]
call edi
cmp eax, ebx
jbe 0x42baa1
push dword [ebp - 0x98]
lea ecx, [esi + 4]
mov dword [esi], 1
call fcn.0040b36d
mov byte [ebp - 0x99], 1
lea ecx, [ebp - 0x98]
call fcn.0040c13b
jmp 0x42b99c