Function at 0x5ba759f5
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
push 0x13
xor edx, edx
mov esi, ecx
pop ecx
push edx
push 0x65
mov dword [ebp - 4], eax
mov ebx, 0x410
xor eax, eax
push ebx
push dword [esi + 0x34]
mov dword [ebp - 0x278], edx
lea edi, [ebp - 0x274]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x21c], edx
call edi
push 0
push 0x66
push ebx
push dword [esi + 0x34]
mov dword [ebp - 0x210], eax
call edi
cmp dword [ebp - 0x210], 0xffffffff
mov ebx, eax
je 0x5ba75ab2
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x274], 1
push 0x41d
push dword [esi + 0x34]
call edi
test byte [ebp - 0x270], 8
jne 0x5ba75ab2
cmp ebx, 0xffffffff
je 0x5ba75a9a
cmp ebx, dword [ebp - 0x210]
jle 0x5ba75ab2
mov eax, dword [esi + 0xc4]
and al, 1
dec al
neg al
sbb eax, eax
neg eax
mov dword [ebp - 0x214], eax
jmp 0x5ba75abc
mov dword [ebp - 0x214], 2
xor eax, eax
xor ebx, ebx
cmp dword [ebp - 0x214], ebx
setne al
xor edi, edi
inc edi
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x218]
push eax
push edi
push ebx
push 0x5ba4e634
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5ba75b9b
cmp dword [ebp - 0x210], ebx
mov dword [ebp - 0x228], edi
mov edi, 0x104
mov dword [ebp - 0x220], edi
mov eax, 0x5ba4e6cc
jne 0x5ba75b16
mov eax, 0x5ba4e6a8
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x108]
push ecx
lea ecx, [ebp - 0x224]
push ecx
push ebx
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ba75b9b
cmp dword [ebp - 0x224], 2
jne 0x5ba75b63
push edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [ebp - 0x20c]
jmp 0x5ba75b69
lea edi, [ebp - 0x108]
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x5ba75b7a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x4c], ebx
push 0x2050
push ebx
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.USER32.dll_LoadImageA]
cmp eax, ebx
mov dword [esi + 0x4c], eax
je 0x5ba75b9b
mov dword [ebp - 0x21c], 1
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x5ba75bae
cmp dword [ebp - 0x21c], ebx
jne 0x5ba75c57
cmp dword [esi + 0xac], ebx
mov edi, dword [ebp - 0x214]
je 0x5ba75bed
cmp edi, dword [esi + 0xb0]
jne 0x5ba75bed
cmp dword [ebp - 0x228], ebx
je 0x5ba75d61
cmp dword [ebp - 0x218], ebx
je 0x5ba75d61
push dword [ebp - 0x218]
call dword [entry0]
jmp 0x5ba75d61
cmp eax, ebx
je 0x5ba75bfb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x4c], ebx
mov eax, edi
sub eax, ebx
je 0x5ba75c27
dec eax
dec eax
je 0x5ba75c16
call fcn.5bad9ea8
neg eax
sbb eax, eax
and eax, 5
add eax, 0x20
jmp 0x5ba75c36
call fcn.5bad9ea8
neg eax
sbb eax, eax
and eax, 2
add eax, 0x21
jmp 0x5ba75c36
call fcn.5bad9ea8
neg eax
sbb eax, eax
and eax, 3
add eax, 0x1f
push 0x2040
push ebx
push ebx
movzx eax, ax
push ebx
push eax
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [esi + 0x4c], eax
mov dword [esi + 0xb0], edi
lea eax, [ebp - 0x2cc]
push eax
push 0x54
push dword [esi + 0x4c]
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [ebp - 0x21c], ebx
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x2c4]
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x70], eax
mov dword [ebp - 0x220], 4
je 0x5ba75cc6
cmp dword [ebp - 0x210], ebx
mov ecx, 0x5ba4e6dc
jne 0x5ba75ca2
mov ecx, 0x5ba4e6b4
lea edx, [ebp - 0x220]
push edx
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push ecx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5ba75ccc
mov eax, dword [esi + 0x78]
mov dword [esi + 0x74], eax
cmp dword [ebp - 0x21c], ebx
je 0x5ba75d0d
cmp dword [ebp - 0x210], ebx
mov eax, 0x5ba4e6ec
jne 0x5ba75ce6
mov eax, 0x5ba4e6c0
lea ecx, [ebp - 0x220]
push ecx
lea edi, [esi + 0x80]
push edi
lea ecx, [ebp - 0x224]
push ecx
push ebx
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5ba75d19
lea edi, [esi + 0x80]
mov dword [edi], 4
mov eax, dword [esi + 0x74]
imul eax, dword [edi]
push dword [esi + 0x4c]
mov dword [edi], eax
push dword [esi + 0x5c]
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push 1
push dword [esi + 0x5c]
call dword [sym.imp.GDI32.dll_GetPixel]
cmp dword [ebp - 0x228], ebx
mov dword [esi + 0x84], eax
je 0x5ba75d54
push dword [ebp - 0x218]
call dword [entry0]
push dword [ebp - 0x210]
mov ecx, esi
call fcn.5ba76b97
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.5bb3f314
leave
ret