Function at 0x42365d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5a4
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
lea eax, [ebp - 0x20c]
xor esi, esi
mov dword [ebp - 0x5a0], esi
push dword [edi]
push 0x403130
push 0x4045a8
push 0x103
push eax
call fcn.00418481
add esp, 0x14
lea eax, [ebp - 0x5a0]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423d5e
push ebx
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x598], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x406578
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x104
push 2
pop ecx
test eax, eax
jne 0x4237b2
cmp dword [ebp - 0x598], 1
je 0x423726
cmp dword [ebp - 0x598], ecx
jne 0x4237b2
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x42372f
sub ecx, edx
sar ecx, 1
cmp ecx, 5
jbe 0x4237b2
push 2
pop eax
cmp dword [ebp - 0x598], eax
jne 0x423787
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x423d51
lea eax, [ebp - 0x414]
mov edx, ebx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x423d51
push 1
push ecx
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0x20c]
call fcn.0042834b
test eax, eax
js 0x4237b2
lea ecx, [ebp - 0x414]
call fcn.00425077
test eax, eax
je 0x423d51
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x406594
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4237fe
cmp dword [ebp - 0x598], 1
jne 0x4237fe
lea ecx, [edi + 0x20]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x4065ac
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42385d
cmp dword [ebp - 0x598], 1
jne 0x42385d
lea eax, [ebp - 0x20c]
push 0x401b58
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x42385d
mov dword [edi + 0x34], 1
jmp 0x423860
mov dword [edi + 0x34], esi
lea ecx, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push ecx
push dword [edi + 4]
lea eax, [ebp - 0x598]
push eax
push esi
push 0x401058
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4238a8
cmp dword [ebp - 0x598], 1
jne 0x4238a8
lea edx, [ebp - 0x20c]
lea ecx, [edi + 4]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x4065cc
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423d51
cmp dword [ebp - 0x598], 1
je 0x4238f9
push 2
pop eax
cmp dword [ebp - 0x598], eax
jne 0x423d51
lea ecx, [edi + 0x1c]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423d51
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x4065ec
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423d51
cmp dword [ebp - 0x598], 1
jne 0x423d51
lea ecx, [edi + 0x14]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423d51
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x406618
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423a53
cmp dword [ebp - 0x598], 1
jne 0x423a53
push 0x40
pop eax
mov edx, 0x103
mov word [ebp - 0x414], ax
lea ecx, [ebp - 0x412]
call fcn.00424ce1
test eax, eax
je 0x423a53
push ecx
lea eax, [ebp - 0x5a4]
mov edx, ebx
push eax
lea ecx, [ebp - 0x414]
call fcn.00418514
test eax, eax
js 0x423a0b
mov eax, dword [ebp - 0x5a4]
mov edx, ebx
push ecx
push 0x406648
push ecx
lea ecx, [ebp - 0x414]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00418577
push ecx
lea eax, [ebp - 0x5a4]
mov edx, ebx
push eax
lea ecx, [ebp - 0x414]
call fcn.00418514
test eax, eax
js 0x423a45
push ecx
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x5a4]
sub ebx, eax
push ecx
lea ecx, [ebp - 0x414]
mov edx, ebx
lea ecx, [ecx + eax*2]
call fcn.00418577
lea ecx, [edi + 0x18]
lea edx, [ebp - 0x414]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x406650
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x423aa1
cmp dword [ebp - 0x598], ebx
jne 0x423aa1
lea ecx, [edi + 0xc]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x404418
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423aec
cmp dword [ebp - 0x598], ebx
jne 0x423aec
lea ecx, [edi + 0x10]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x100
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x40653c
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423b64
cmp dword [ebp - 0x598], ebx
jne 0x423b64
lea eax, [ebp - 0x594]
push eax
push 0x42c820
push 0x406554
lea eax, [ebp - 0x494]
push 0x143
push eax
call fcn.00418481
add esp, 0x14
lea ecx, [edi + 0x30]
lea edx, [ebp - 0x494]
call fcn.00424d6e
test eax, eax
jne 0x423d51
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x100
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x406670
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423be6
cmp dword [ebp - 0x598], ebx
jne 0x423be6
lea ecx, [ebp - 0x594]
call fcn.0041e3a4
test eax, eax
je 0x423bd9
mov eax, ecx
push eax
push 0x42c820
push 0x406554
lea eax, [ebp - 0x494]
push 0x143
push eax
call fcn.00418481
add esp, 0x14
lea edx, [ebp - 0x494]
jmp 0x423bde
mov edx, 0x401064
lea ecx, [edi + 0x2c]
call fcn.00424d6e
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x40308c
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423c23
cmp dword [ebp - 0x598], ebx
je 0x423c60
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x4030a4
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423c78
cmp dword [ebp - 0x598], ebx
jne 0x423c78
lea ecx, [edi + 8]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423d51
jmp 0x423cf2
mov ecx, dword [edi]
push 2
pop ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x423c80
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0xb]
xor ecx, ecx
mov dword [ebp - 0x5a4], eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004293af
mov ebx, eax
pop ecx
test ebx, ebx
je 0x423d51
mov eax, dword [edi]
mov edx, dword [ebp - 0x5a4]
push 2
pop ecx
add eax, ecx
mov ecx, ebx
push eax
call fcn.00418392
mov edx, dword [ebp - 0x5a4]
mov ecx, ebx
push 0x406694
call fcn.00418407
lea ecx, [edi + 8]
mov edx, ebx
call fcn.00424d6e
test eax, eax
jne 0x423d51
push ebx
call fcn.004293bf
xor ebx, ebx
pop ecx
inc ebx
lea eax, [ebp - 0x59c]
mov dword [ebp - 0x59c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x598]
push eax
push esi
push 0x4066a0
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423d4c
cmp dword [ebp - 0x598], ebx
jne 0x423d4c
lea eax, [ebp - 0x20c]
push 0x401b58
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x423d4c
mov dword [edi + 0x38], ebx
jmp 0x423d4f
mov dword [edi + 0x38], esi
mov esi, ebx
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00429770
mov esp, ebp
pop ebp
ret