Function at 0x42e5b0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
xor ebp, ebp
mov eax, dword [ebx]
mov dword [esp + 8], ebp
cmp eax, 0x14
je 0x42e5d1
pop ebp
mov eax, 3
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
push esi
push edi
mov eax, dword [eax]
cmp eax, 7
ja case.default.0x42e5e2
jmp dword [eax*4 + 0x42ea00]
xor ecx, ecx
call fcn.0042eeb0
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x1c], esi
je 0x42e88f
mov edx, dword [esp + 0x30]
push 0x499ea8
push ebp
mov ecx, esi
call fcn.0042ec00
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x18], ebp
je 0x42e7f1
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x28]
xor esi, esi
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push esi
push eax
push ebp
mov dword [esp + 0x48], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e7bc
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx + 0x10]
cmp eax, 2
mov dword [esp + 0x20], ecx
jne 0x42e729
mov edx, dword [esp + 0x28]
lea eax, [edx + 0x106]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
mov dword [esp + 0x30], edi
je 0x42e7bc
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
push esi
push edx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42e7bc
mov eax, dword [esp + 0x28]
push 0x106
lea esi, [eax + edi]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebp, eax
cmp ebp, 0x106
jbe 0x42e712
jmp 0x42e6bb
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
lea edx, [ecx + ebp]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x42e718
mov ecx, dword [esp + 0x28]
mov esi, edi
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [esp + 0x28]
push ebp
mov dword [esp + 0x34], ebx
mov edi, ebp
lea esi, [ebx + edx]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebp, eax
cmp ebp, edi
ja 0x42e6b7
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x28], ebp
jmp 0x42e72d
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x10], 5
jmp 0x42e7c4
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x42e7b2
cmp eax, ebp
jb 0x42e79c
test esi, esi
je 0x42e755
mov ebx, dword [esp + 0x38]
mov ecx, ebp
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x42e77a
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [esp + 0x28]
mov cl, 0x3b
mov al, byte [ebx + ebp - 2]
cmp al, 0x5c
je 0x42e78c
cmp al, 0x2f
je 0x42e78c
cmp al, cl
jne 0x42e7ae
mov byte [ebx + ebp - 2], 0
mov ebp, dword [esp + 0x28]
dec ebp
mov dword [esp + 0x28], ebp
jmp 0x42e77c
dec ebp
mov dword [esp + 0x10], 2
mov dword [ebx + 0x10], ebp
mov ebp, dword [esp + 0x18]
jmp 0x42e7c4
mov ebx, dword [esp + 0x2c]
dec ebp
mov dword [ebx + 0x10], ebp
mov ebp, dword [esp + 0x18]
jmp 0x42e7c4
mov dword [esp + 0x10], 5
mov ecx, ebp
call fcn.0042eaa0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x42e7da
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, esi
mov dword [esp + 0x10], 4
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor ecx, ecx
call fcn.0042eeb0
mov edi, eax
cmp edi, ebp
je 0x42e88f
mov edx, dword [esp + 0x30]
push 0x499eb4
push ebp
mov ecx, edi
call fcn.0042ec00
mov esi, eax
cmp esi, ebp
je 0x42e874
call fcn.0042ea20
cmp eax, ebp
je 0x42e852
mov dword [eax + 0x18], esi
mov ecx, edi
mov dword [ebx + 4], eax
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, esi
call fcn.0042eaa0
mov ecx, edi
mov dword [esp + 0x10], 0xff
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, edi
mov dword [esp + 0x10], 4
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
mov dword [esp + 0xc], 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [ebx + 4]
xor esi, esi
cmp edi, ebp
je 0x42e8d0
mov ecx, edi
call fcn.0042efd0
test eax, eax
je 0x42e8bc
cmp dword [edi + 0xc], ebp
jne 0x42e8f1
pop edi
mov dword [esp + 0xc], 0x64
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor ecx, ecx
call fcn.0042eeb0
mov esi, eax
cmp esi, ebp
je 0x42e941
call fcn.0042ea20
cmp eax, ebp
je 0x42e926
mov dword [eax + 0xc], esi
mov dword [ebx + 4], eax
mov esi, 1
mov edx, dword [esp + 0x30]
push 0x499ec0
push edx
mov edx, ebx
xor ecx, ecx
call fcn.0042eab0
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x42e935
cmp esi, ebp
je 0x42e935
mov ecx, edi
call fcn.0042ea70
mov eax, dword [esp + 0x10]
pop edi
mov dword [ebx + 4], ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, esi
call fcn.0042eaa0
mov dword [esp + 0x10], 0xff
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
pop edi
mov dword [esp + 0xc], 0x1f4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x30]
push 0x499ecc
push eax
mov edx, ebx
mov ecx, 1
call fcn.0042eab0
pop edi
pop esi
pop ebp
mov dword [esp + 4], eax
pop ebx
add esp, 0x14
ret
mov ecx, dword [ebx + 4]
call fcn.0042ea70
cmp eax, ebp
mov dword [esp + 0x10], eax
jne 0x42e935
pop edi
mov dword [ebx + 4], ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push 1
push ecx
push edx
mov edx, ebx
xor ecx, ecx
call fcn.0042ed00
pop edi
pop esi
pop ebp
mov dword [esp + 4], eax
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 1
push eax
push ecx
mov edx, ebx
mov ecx, 1
call fcn.0042ed00
pop edi
pop esi
pop ebp
mov dword [esp + 4], eax
pop ebx
add esp, 0x14
ret
mov ebx, dword [ebx + 4]
mov ecx, ebx
call fcn.0042efd0
test eax, eax
je 0x42e8bc
mov ecx, dword [ebx + 0x18]
call fcn.0042eaa0
mov eax, dword [esp + 0x10]
pop edi
mov dword [ebx + 0x18], ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret