Function at 0x4232ca
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x4a0]
xor esi, esi
push eax
push 0x20019
push esi
push 0x403130
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0x4a0], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x423646
push ebx
xor ebx, ebx
mov dword [ebp - 0x49c], esi
inc ebx
lea ecx, [edi + 0xc]
mov edx, 0x4064c8
mov dword [ebp - 0x498], ebx
call fcn.00424d6e
test eax, eax
jne 0x423639
mov edx, 0x4011a0
mov ecx, edi
call fcn.00424d6e
test eax, eax
jne 0x423639
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x49c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x4064d4
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], ebx
jne 0x423639
lea ecx, [edi + 0x10]
mov word [ebp - 6], ax
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423639
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x49c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x4064f0
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], ebx
jne 0x423639
lea ecx, [edi + 4]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423639
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x49c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x40650c
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], ebx
jne 0x423639
lea ecx, [edi + 0x18]
lea edx, [ebp - 0x20c]
call fcn.00424d6e
test eax, eax
jne 0x423639
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x49c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x403118
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], ebx
je 0x4234ac
cmp dword [ebp - 0x498], 2
jne 0x423639
lea eax, [ebp - 0x20c]
push eax
push 0x406528
push 0x103
push 0x42c820
call fcn.00418481
add esp, 0x10
lea ebx, [edi + 0x1c]
mov edx, 0x42c820
mov ecx, ebx
call fcn.00424d6e
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], 2
lea eax, [ebp - 0x20c]
jne 0x42350c
push 0x103
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x423639
lea eax, [ebp - 0x20c]
push eax
push 0x406534
push 0x103
push 0x42ca28
call fcn.00418481
add esp, 0x10
mov dword [ebp - 0x49c], 0x208
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x40653c
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423639
cmp dword [ebp - 0x498], 1
jne 0x423639
push 0x20
pop eax
cmp ax, word [ebp - 0x20c]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
lea eax, [ebp - 0x494]
jne 0x42358c
push 0x402918
jmp 0x423591
push 0x406554
push 0x143
push eax
call fcn.00418481
add esp, 0x14
lea ecx, [edi + 0x14]
lea edx, [ebp - 0x494]
call fcn.00424d6e
test eax, eax
jne 0x423639
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x49c], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push 0x406560
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x423636
cmp dword [ebp - 0x498], 1
jne 0x423636
push 0x20
pop eax
cmp ax, word [ebp - 0x20c]
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
lea eax, [ebp - 0x494]
jne 0x423615
push 0x402918
jmp 0x42361a
push 0x406554
push 0x143
push eax
call fcn.00418481
add esp, 0x14
lea ecx, [edi + 8]
lea edx, [ebp - 0x494]
call fcn.00424d6e
xor esi, esi
inc esi
push dword [ebp - 0x4a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00429770
mov esp, ebp
pop ebp
ret