Function at 0x536d120
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ecad9
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x54183c4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x88], ecx
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x98], edx
mov word [eax], cx
add esi, 0x3c
mov dword [ebp - 4], ebx
mov eax, esi
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x90], ebx
call fcn.052eba80
mov dword [ebp - 0x94], eax
cmp eax, dword [esi + 4]
je 0x536d1d6
mov ecx, dword [eax + 0x1c]
add eax, 0xc
cmp dword [eax + 0x14], 8
jb 0x536d1bc
mov eax, dword [eax]
mov edx, dword [edi + 0x10]
push ecx
push eax
push edx
push ebx
mov ecx, edi
call fcn.052ec3b0
test eax, eax
js 0x536d1d6
lea eax, [ebp - 0x94]
jmp 0x536d1e5
mov eax, dword [esi + 4]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x8c]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x40]
cmp ecx, eax
je 0x536d20a
mov ecx, edi
mov ebx, esi
call fcn.052eb630
mov edx, dword [eax]
mov dword [ebp - 0x90], edx
jmp 0x536d427
push 0x2b
xor eax, eax
push 0x54024e8
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x74], ebx
mov word [ebp - 0x84], ax
call fcn.052e5800
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x88]
push ecx
call fcn.052ebfb0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 2
call fcn.052eb8b0
mov ebx, 8
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], ebx
jb 0x536d276
mov edx, dword [ebp - 0x30]
push edx
call fcn.053504e7
add esp, 4
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x84]
call fcn.052eb8b0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x8c], 0
cmp dword [ebp - 0x70], ebx
jae 0x536d2a1
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x8c]
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x536d3f8
xor edx, edx
push edx
push 0x105
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], dx
call fcn.052e8e40
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], ebx
jae 0x536d2f7
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x8c]
lea ecx, [ebp - 0xb4]
push ecx
push eax
push 0
push 0
push 0x5402544
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x536d3c6
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + 0x4c]
xor ecx, ecx
push ecx
inc eax
mov word [ebp - 0x68], cx
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
call fcn.052e8e40
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x68]
cmp dword [ebp - 0x54], ebx
jae 0x536d354
lea ecx, [ebp - 0x68]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], ebx
jae 0x536d35f
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x58]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x54], ebx
jae 0x536d376
lea eax, [ebp - 0x68]
push 0x22
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x90], eax
test eax, eax
je 0x536d3a1
mov ecx, edi
mov ebx, esi
call fcn.052eb630
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov ebx, 8
cmp dword [ebp - 0x54], ebx
jb 0x536d3b2
mov edx, dword [ebp - 0x68]
push edx
call fcn.053504e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x54], 7
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], ax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1c], ebx
jb 0x536d3e4
mov edx, dword [ebp - 0x30]
push edx
call fcn.053504e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov byte [ebp - 4], 0
cmp dword [ebp - 0x70], ebx
jb 0x536d410
mov ecx, dword [ebp - 0x84]
push ecx
call fcn.053504e7
add esp, 4
xor edx, edx
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x74], 0
mov word [ebp - 0x84], dx
cmp dword [ebp - 0x90], 0
je 0x536d697
mov esi, dword [ebp - 0x98]
mov eax, dword [esi + 0x24]
add eax, esi
xor ebx, ebx
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x94], ecx
cmp ax, word [esi + 0x1a]
jb 0x536d516
mov edx, dword [ebp - 0x9c]
mov eax, dword [edx + 0x4c]
xor ecx, ecx
push ecx
inc eax
mov word [ebp - 0x4c], cx
mov esi, 7
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0
call fcn.052e8e40
mov eax, ebx
sub eax, edi
neg eax
sbb eax, eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x4c]
mov edi, 8
and eax, ebx
cmp dword [ebp - 0x38], edi
jae 0x536d4bd
lea ecx, [ebp - 0x4c]
mov edx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x98]
dec edx
push edx
mov edx, dword [ebp - 0x90]
push ecx
mov ecx, dword [eax + 0x14]
push 0
push ecx
push edx
push 0x3800
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x536d669
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
ja 0x536d649
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x4c]
call fcn.052e5320
jmp 0x536d656
mov ecx, dword [ebp - 0xa8]
lea edx, [ebp - 0x88]
cmp edx, edi
jae 0x536d591
mov eax, edx
cmp ebx, eax
ja 0x536d591
mov esi, edx
sub esi, ebx
sar esi, 2
cmp edi, ecx
jne 0x536d580
mov eax, edi
sub eax, ebx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x536d63f
sub ecx, ebx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x536d580
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x536d560
xor ecx, ecx
jmp 0x536d562
add ecx, edx
cmp ecx, eax
jae 0x536d568
mov ecx, eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.052ebad0
mov edi, dword [ebp - 0xac]
mov ebx, dword [ebp - 0xb0]
test edi, edi
je 0x536d589
mov ecx, dword [ebx + esi*4]
mov dword [edi], ecx
mov esi, dword [ebp - 0x98]
jmp 0x536d5f0
cmp edi, ecx
jne 0x536d5e4
mov eax, edi
sub eax, ebx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x536d63f
sub ecx, ebx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x536d5e4
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x536d5c4
xor ecx, ecx
jmp 0x536d5c6
add ecx, edx
cmp ecx, eax
jae 0x536d5cc
mov ecx, eax
push ecx
lea ecx, [ebp - 0xb0]
call fcn.052ebad0
mov edi, dword [ebp - 0xac]
mov ebx, dword [ebp - 0xb0]
test edi, edi
je 0x536d5f0
mov edx, dword [ebp - 0x88]
mov dword [edi], edx
mov eax, dword [ebp - 0x88]
add edi, 4
mov dword [ebp - 0xac], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x536d602
mov ecx, dword [ebp - 0x88]
sub eax, edx
sar eax, 1
lea edx, [ecx + eax*2 + 2]
mov eax, dword [ebp - 0x94]
movzx ecx, word [esi + 0x1a]
inc eax
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x94], eax
cmp eax, ecx
jl 0x536d510
jmp 0x536d476
push str.vector_T__too_long
call fcn.05328b02
sub eax, ecx
push 0
push eax
lea ecx, [ebp - 0x4c]
call fcn.052e6f00
mov ecx, dword [ebp - 0xa0]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x4c]
push eax
call fcn.052e53b0
cmp dword [ebp - 0x38], edi
jb 0x536d67a
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.053504e7
add esp, 4
xor edx, edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], dx
test ebx, ebx
je 0x536d697
push ebx
call fcn.053504e7
add esp, 4
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0534fc81
mov esp, ebp
pop ebp
ret 0xc