Function at 0x404efe
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5e5620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], ebx
push 0x104
xor edi, edi
push eax
mov dword [ebp - 0x228], edi
call fcn.00552893
add esp, 0xc
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x224], eax
test esi, esi
je 0x404f59
test ebx, ebx
je 0x404f59
xor eax, eax
mov word [esi], ax
mov dword [ebp - 0x21c], edi
mov ebx, edi
push dword [ebx*8 + 0x58a1b0]
call fcn.00552a19
push eax
push dword [ebx*8 + 0x58a1b0]
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00560383
add esp, 0x10
test eax, eax
jne 0x404fe8
mov eax, dword [ebp - 0x210]
lea ecx, [ebp - 0x20c]
push 0x5c
lea ecx, [ecx + eax*2]
pop eax
mov dword [ebp - 0x214], ecx
cmp word [ecx], ax
je 0x405097
push 3
pop eax
push eax
push 0x58a200
push ecx
call fcn.00560383
add esp, 0xc
test eax, eax
je 0x405091
push 3
pop eax
push eax
push 0x58a208
push dword [ebp - 0x214]
call fcn.00560383
add esp, 0xc
test eax, eax
je 0x405091
inc ebx
cmp ebx, 0xa
jb 0x404f61
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push 0x5c
pop ebx
test edx, edx
je 0x4052c6
push ebx
push eax
call fcn.0054f08a
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4052c6
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x228]
add ebx, 2
or eax, 0x20019
mov dword [ebp - 0x210], ebx
push eax
mov eax, dword [ebp - 0x224]
push edi
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4052c6
lea eax, [ebp - 0x220]
push eax
push edi
push edi
push edi
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4052c6
push 0x5c
pop eax
mov word [ebx - 2], ax
test esi, esi
jne 0x4050e7
xor eax, eax
inc eax
jmp 0x4052c8
mov ecx, dword [ebp - 0x214]
cmp dword [0x5ebc44], edi
je 0x4050b3
cmp word [ecx], 0x36
mov eax, edi
mov edx, 0x100
cmove eax, edx
mov dword [ebp - 0x228], eax
mov edx, dword [ebx*8 + 0x58a1b4]
push 3
pop eax
push 0x5c
pop ebx
cmp word [ecx], bx
push 1
pop ecx
cmove eax, ecx
mov dword [ebp - 0x21c], edx
add eax, dword [ebp - 0x210]
lea eax, [ebp + eax*2 - 0x20c]
mov dword [ebp - 0x224], eax
jmp 0x405001
push dword [ebp - 0x220]
call fcn.0041917f
or dword [ebp - 0x22c], 0xffffffff
mov ebx, eax
pop ecx
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x22c]
push eax
push edi
push dword [ebp - 0x210]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x22c]
cmp eax, 8
ja case.0x40512d.0
jmp dword [eax*4 + 0x4052da]
push dword [ebx]
push 0x588d64
push dword [ebp - 0x218]
push esi
call fcn.0040411b
add esp, 0x10
jmp 0x4052ba
push ebx
push dword [ebp - 0x218]
push esi
call fcn.00552893
add esp, 0xc
jmp 0x4052ba
push dword [ebp - 0x218]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x4052ba
xor eax, eax
mov dword [ebp - 0x214], esi
mov word [esi], ax
mov eax, ebx
mov dword [ebp - 0x210], ebx
cmp word [ebx], di
je 0x4052ba
push eax
call fcn.00552a19
mov edx, dword [ebp - 0x214]
pop ecx
mov dword [ebp - 0x224], eax
lea ecx, [eax*2 + 6]
mov eax, dword [ebp - 0x218]
sub ecx, esi
add ecx, edx
sar ecx, 1
cmp ecx, eax
jge 0x4052ba
cmp edx, esi
je 0x4051f7
mov ecx, edx
sub ecx, esi
sar ecx, 1
push 0x588d58
sub eax, ecx
push eax
push edx
call fcn.00552893
mov eax, dword [ebp - 0x214]
push edi
push eax
call fcn.0054efda
mov edx, eax
add esp, 0x14
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x214], edx
push dword [ebp - 0x210]
sub edx, esi
sar edx, 1
sub eax, edx
push eax
mov eax, dword [ebp - 0x214]
push eax
call fcn.00552893
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 0x224]
push edi
push dword [ebp - 0x210]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x214], eax
call fcn.0054efda
add eax, 2
add esp, 0x14
mov dword [ebp - 0x210], eax
cmp word [eax], di
jne 0x405193
jmp 0x4052ba
mov eax, dword [ebp - 0x218]
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x210], esi
cmp ecx, eax
jb 0x40526e
lea ecx, [eax - 1]
mov dword [ebp - 0x220], ecx
mov edx, esi
test ecx, ecx
je 0x4052ba
movzx eax, byte [edi + ebx]
mov ecx, edx
push eax
mov eax, dword [ebp - 0x218]
sub ecx, esi
sar ecx, 1
push 0x58a210
sub eax, ecx
push eax
push edx
call fcn.0040411b
mov edx, dword [ebp - 0x210]
add esp, 0x10
mov ecx, dword [ebp - 0x220]
inc edi
lea edx, [edx + eax*2]
mov dword [ebp - 0x210], edx
cmp edi, ecx
jb 0x405274
test ecx, ecx
je 0x4052ba
xor eax, eax
mov word [edx - 2], ax
push ebx
call fcn.00419175
pop ecx
jmp 0x405089
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054d24a
leave
ret