Function at 0x6d56172b
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0x6d583d30], 1
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
jne 0x6d56175e
or dword [0x6d583d30], 1
mov ecx, 0x6d583d18
call fcn.6d561080
push 0x6d57bea3
call fcn.6d536d68
pop ecx
mov esi, 0x6d583d18
mov ecx, esi
call fcn.6d56104f
test eax, eax
je 0x6d561763
xor ebx, ebx
cmp byte [edi + 4], bl
jne 0x6d5618aa
lea eax, [ebp - 4]
push eax
push 1
push ebx
push 0x6d5197dc
push dword [edi]
mov byte [edi + 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d5618aa
mov eax, dword [sym.imp.msvcrt.dll__osver]
test byte [eax + 1], 0x80
je 0x6d5618b6
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push 0x6d5197c8
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d5618ec
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.6d524ff7
mov edi, eax
cmp edi, ebx
pop ecx
je 0x6d5618ec
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x6d5197c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
je 0x6d56180c
push edi
jmp 0x6d56198f
mov eax, dword [ebp - 8]
mov byte [edi + eax], bl
cmp dword [ebp - 0x18], 2
jne 0x6d561855
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x6d561806
push eax
call fcn.6d524ff7
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x6d561806
push dword [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
mov dword [ebp - 8], eax
call fcn.6d524ff2
cmp dword [ebp - 8], ebx
mov edi, dword [ebp - 0x1c]
pop ecx
jne 0x6d56185b
jmp 0x6d561806
cmp dword [ebp - 0x18], 1
jne 0x6d561806
push ebx
push ebx
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jle 0x6d561806
add eax, eax
push eax
call fcn.6d524ff7
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x6d561806
push dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov dword [ebp - 0xc], eax
call fcn.6d524ff2
cmp dword [ebp - 0xc], ebx
pop ecx
jle 0x6d56198c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push 0x6d5197a4
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6d5618ec
mov eax, dword [ebp - 0x10]
shr eax, 1
add eax, eax
mov dword [ebp - 0x1c], eax
add eax, 2
push eax
call fcn.6d524ff7
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x6d5618f7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d5618aa
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x6d5197a4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x6d561806
mov eax, dword [ebp - 0x1c]
mov word [eax + edi], bx
cmp dword [ebp - 0x20], 1
jne 0x6d56193c
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], edi
jmp 0x6d5618aa
cmp dword [ebp - 0x20], 2
jne 0x6d561806
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x6d561806
add eax, eax
push eax
call fcn.6d524ff7
cmp eax, ebx
pop ecx
mov dword [ebp - 0x1c], eax
je 0x6d561806
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov dword [ebp - 0xc], eax
call fcn.6d524ff2
cmp dword [ebp - 0xc], ebx
pop ecx
jne 0x6d5618a1
push dword [ebp - 0x1c]
call fcn.6d524ff2
pop ecx
jmp 0x6d5618aa