Function at 0xbc66288
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0xbc6d328]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x21c], 0
push edi
lea edx, [ebp - 0x210]
push edx
push 0x20019
mov edi, ecx
mov ecx, dword [ebp + 0x14]
push 0
push ecx
push eax
mov dword [ebp - 0x218], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xbc664c2
push esi
push 0x2c
call fcn.0bc4a105
pop ecx
test eax, eax
je 0xbc662e9
mov ecx, eax
call fcn.0bc65b89
mov esi, eax
jmp 0xbc662eb
xor esi, esi
push ebx
test esi, esi
je 0xbc6647a
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 0x18]
push eax
lea eax, [esi + 0x14]
push eax
push dword [ebp - 0x210]
mov ecx, edi
call fcn.0bc66020
mov ebx, eax
test ebx, ebx
jne 0xbc66493
lea eax, [esi + 4]
push eax
push dword [0xbc6d33c]
mov ecx, edi
push dword [ebp - 0x210]
call fcn.0bc66186
mov ebx, eax
test ebx, ebx
jne 0xbc6645a
and dword [ebp - 0x214], eax
lea eax, [ebp - 0x214]
push eax
push dword [0xbc6d348]
mov ecx, edi
push dword [ebp - 0x210]
call fcn.0bc66186
mov ebx, eax
test ebx, ebx
jne 0xbc66419
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0xbc6638f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0xbc66396
cmp eax, edi
jbe 0xbc6639a
push 8
pop ebx
test ebx, ebx
jne 0xbc66419
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0xbc663a3
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0bc4a105
pop ecx
mov dword [esi], eax
test eax, eax
jne 0xbc663d6
push 8
pop ebx
jmp 0xbc66419
lea ecx, [ebp - 0x20c]
push ecx
push edi
push eax
call fcn.0bc47085
test eax, eax
jge 0xbc66401
mov ecx, eax
and ecx, 0x1fff0000
cmp ecx, 0x70000
jne 0xbc663fd
movzx ebx, ax
jmp 0xbc66419
mov ebx, eax
jmp 0xbc66419
cmp edi, 1
jbe 0xbc66419
mov eax, dword [esi]
push 0x5c
lea eax, [eax + edi*2 - 4]
pop ecx
cmp cx, word [eax]
jne 0xbc66419
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x214], 0
je 0xbc6642e
push dword [ebp - 0x214]
call fcn.0bc4a123
pop ecx
mov edi, dword [ebp - 0x218]
test ebx, ebx
jne 0xbc66493
lea eax, [esi + 0xc]
push eax
push dword [0xbc6d350]
mov ecx, edi
push dword [ebp - 0x210]
call fcn.0bc66186
mov ebx, eax
cmp ebx, 2
jne 0xbc6647d
xor ebx, ebx
jmp 0xbc6647d
cmp ebx, 2
jne 0xbc66434
lea eax, [esi + 8]
push eax
push dword [0xbc6d34c]
mov ecx, edi
push dword [ebp - 0x210]
call fcn.0bc66186
mov ebx, eax
jmp 0xbc66434
push 8
pop ebx
test ebx, ebx
jne 0xbc66493
push esi
lea eax, [edi + 4]
push eax
mov ecx, edi
call fcn.0bc65db4
mov dword [ebp - 0x21c], eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0xbc664ad
cmp dword [ebp - 0x21c], 0
jne 0xbc664c1
test esi, esi
je 0xbc664c1
mov ecx, esi
call fcn.0bc65e34
push 1
mov ecx, esi
call fcn.0bc66262
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0bc64d0f
leave
ret 0x10