Function at 0x4be32c54
Capabilities:
Allocate thread local storage
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, 0x4be576f8
call fcn.4be44284
mov word [ebp - 0x22], 0
xor edx, edx
mov dword [ebp - 0x28], edx
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0x1f
xor eax, eax
mov dword [ebp - 0x38], eax
push 0
push 0
call sym.idapi32.dll_SysLock
mov word [ebp - 0x10], 8
mov edx, dword [0x4be56de0]
add edx, 0x14
push edx
push 4
push 0x30
call fcn.4be2fd28
mov ebx, eax
test bl, bl
jne 0x4be32cc5
mov word [ebp - 0x22], 0x250e
mov word [ebp - 0x10], 0
jmp 0x4be3306a
push 0x294
push 1
call sym.idapi32.dll__OsCallocShared
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x4be32cee
mov word [ebp - 0x22], 0x2501
mov word [ebp - 0x10], 0
jmp 0x4be3306a
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 8], 7
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x3b], 0xffffffff
test edi, edi
je 0x4be32d24
cmp byte [edi], 0
je 0x4be32d24
push edi
mov edx, dword [ebp - 0x28]
add edx, 0xc
push edx
call fcn.4be41cfc
add esp, 8
push 1
call sym.idapi32.dll_SysSetEnv
mov word [ebp - 0x22], ax
cmp word [ebp - 0x22], 0
jne 0x4be32d47
mov word [ebp - 0x22], 0x2a07
mov word [ebp - 0x10], 0
jmp 0x4be3306a
call sym.idapi32.dll_OsGetProcessId
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x28]
mov byte [eax + 0x30], bl
mov edx, dword [ebp - 0x28]
mov dword [edx], 0x4be576e0
test esi, esi
je 0x4be32d7c
cmp byte [esi], 0
je 0x4be32d7c
push esi
mov ecx, dword [ebp - 0x28]
add ecx, 0x3f
push ecx
call fcn.4be41cfc
add esp, 8
jmp 0x4be32d88
mov eax, dword [ebp - 0x28]
add eax, 0x3f
push eax
call sym.idapi32.dll_OsGetCurDirEx
mov byte [ebp - 0x58], 0
test esi, esi
je 0x4be32dae
cmp byte [esi + 0x20c], 0
je 0x4be32dae
add esi, 0x20c
push esi
lea eax, [ebp - 0x58]
push eax
call fcn.4be41cfc
add esp, 8
jmp 0x4be32df6
lea edx, [ebp - 0x30]
push edx
push 0x4be57780
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyA
test eax, eax
jne 0x4be32df6
push 0x1f
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.4be41c34
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
lea edx, [ebp - 0x58]
push edx
push 0
push 0
push 0x4be577a1
push dword [ebp - 0x30]
call sub.ADVAPI32.dll_RegQueryValueExA
push dword [ebp - 0x30]
call sub.ADVAPI32.dll_RegCloseKey
cmp byte [ebp - 0x58], 0
je 0x4be32e91
push 0x4be577aa
lea ecx, [ebp - 0x160]
push ecx
call fcn.4be41cfc
add esp, 8
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x160]
push edx
call fcn.4be41c6c
add esp, 8
push 0x4be577af
lea ecx, [ebp - 0x160]
push ecx
call fcn.4be41c6c
add esp, 8
lea eax, [ebp - 0x38]
push eax
push 0
lea edx, [ebp - 0x160]
push edx
call sym.idapi32.dll_OsLoadDll
mov word [ebp - 0x22], ax
cmp word [ebp - 0x22], 0
je 0x4be32e71
push 0x4be577b4
mov ecx, dword [ebp - 0x28]
add ecx, 0x14c
push ecx
call fcn.4be41cfc
add esp, 8
jmp 0x4be32ea8
push dword [ebp - 0x38]
call sub.KERNEL32.dll_FreeLibrary
lea eax, [ebp - 0x58]
push eax
mov edx, dword [ebp - 0x28]
add edx, 0x14c
push edx
call fcn.4be41cfc
add esp, 8
jmp 0x4be32ea8
push 0x4be577b9
mov ecx, dword [ebp - 0x28]
add ecx, 0x14c
push ecx
call fcn.4be41cfc
add esp, 8
xor eax, eax
mov al, bl
mov edx, dword [0x4be56de0]
mov ecx, dword [ebp - 0x28]
mov dword [edx + eax*4 + 0x10], ecx
mov eax, dword [0x4be56de0]
inc dword [eax + 0xc]
mov edx, dword [ebp - 0x28]
mov dword [0x4be576f0], edx
call fcn.4be33591
call sub.KERNEL32.dll_TlsAlloc
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x3b], eax
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x3b], 0xffffffff
jne 0x4be32ef4
mov word [ebp - 0x22], 0x2519
mov word [ebp - 0x10], 0
jmp 0x4be3306a
mov edx, dword [ebp - 0x28]
mov word [edx + 0x214], 0x20
push 4
mov ecx, dword [ebp - 0x28]
movzx eax, word [ecx + 0x214]
push eax
call sym.idapi32.dll__OsCallocShared
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x37], eax
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x37], 0
jne 0x4be32f35
mov word [ebp - 0x22], 0x2501
mov word [ebp - 0x10], 0
jmp 0x4be3306a
mov eax, dword [0x4be56de0]
add eax, 0x1ba
push eax
push 0
push dword [ebp - 0x28]
call fcn.4be30f8f
mov word [ebp - 0x22], ax
cmp word [ebp - 0x22], 0
je 0x4be32f68
push dword [ebp - 0x28]
call fcn.4be330c4
mov word [ebp - 0x10], 0
jmp 0x4be3306a
push dword [ebp - 0x28]
call fcn.4be0547f
push dword [ebp - 0x28]
call fcn.4be336c8
mov word [ebp - 0x22], ax
cmp word [ebp - 0x22], 0
je 0x4be32f96
push dword [ebp - 0x28]
call fcn.4be330c4
mov word [ebp - 0x10], 0
jmp 0x4be3306a
push 0xd80
push 1
call sym.idapi32.dll__OsCallocShared
add esp, 8
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x144], eax
push 0x480
push 0x4be4f97a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x144]
add eax, 0x900
push eax
call fcn.4be25be8
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x144]
mov word [ecx + 0x96c], 0
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x144]
mov word [edx + 0x96e], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx + 0x144]
mov word [eax + 0xa24], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [edx + 0x144]
mov word [ecx + 0xa54], 0
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [eax + 0x208], edx
push 0x4be576f4
push 0
push 0
call sym.idapi32.dll_OsMuxCreate
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
call sym.idapi32.dll_OsMuxCreate
push dword [ebp - 0x2c]
push 0xff0a
call sym.idapi32.dll_OsSetSharedPtr
cmp dword [ebp + 0x10], 0
je 0x4be33055
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
mov dword [eax], edx
mov word [ebp - 0x10], 0
jmp 0x4be3306a
cmp word [ebp - 0x22], 0
je 0x4be330a4
cmp dword [ebp - 0x28], 0
je 0x4be330a4
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x3b], 0xffffffff
je 0x4be3308b
mov eax, dword [ebp - 0x28]
push dword [eax + 0x3b]
call sub.KERNEL32.dll_TlsFree
call fcn.4be33623
push dword [ebp - 0x28]
call sym.idapi32.dll__OsFreeShared
pop ecx
xor edx, edx
mov dword [0x4be576f0], edx
mov dword [ebp - 0x28], edx
push 0
push 0
call sym.idapi32.dll_SysUnlock
mov ax, word [ebp - 0x22]
mov ecx, dword [ebp - 0x20]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc