Function at 0x4311f8
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x80
mov eax, 0x4557a2
call fcn.004331ee
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x5c]
push eax
mov dword [edi], ebx
call fcn.00410573
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
push ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call fcn.00414469
mov esi, 0x405c84
mov byte [ebp - 4], 1
push esi
call fcn.0041193d
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x5c]
call fcn.00414607
mov esi, eax
cmp esi, 0xffffffff
jne 0x431278
lea ecx, [ebp - 0x44]
call fcn.0041449a
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.00411703
xor al, al
jmp 0x4314a7
push esi
push ebx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00414b43
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x5c]
sub eax, esi
mov byte [ebp - 4], 2
dec eax
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00414b43
mov esi, 0x405ca0
mov byte [ebp - 4], 3
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313d5
mov esi, 0x405cfc
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313d5
mov esi, 0x405c94
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313ce
mov esi, 0x405cd8
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313ce
mov esi, 0x405c88
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313c7
mov esi, 0x405cb4
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313c7
mov esi, 0x405cac
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313c0
mov esi, 0x405d24
push esi
call fcn.0041193d
pop ecx
push eax
push esi
push dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ebx
call fcn.00415be8
test eax, eax
je 0x4313c0
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.00411703
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.00411703
jmp 0x43125e
mov eax, 0x80000003
jmp 0x4313da
mov eax, 0x80000000
jmp 0x4313da
mov eax, 0x80000001
jmp 0x4313da
mov eax, 0x80000002
cmp dword [ebp - 0x60], 8
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], ebx
mov byte [ebp - 0x79], bl
jae 0x4313ec
lea ecx, [ebp - 0x74]
lea edx, [ebp - 0x78]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43147b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
push ebx
push dword [ebp - 0x80]
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x20], ebx
call esi
test eax, eax
jne 0x431472
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x431472
cmp dword [ebp - 0x1c], 1
je 0x4314ad
cmp dword [ebp - 0x1c], 2
je 0x4314ad
cmp dword [ebp - 0x1c], 4
jne 0x431472
cmp eax, 4
jne 0x431472
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x431472
mov eax, dword [ebp - 0x18]
mov dword [edi], 2
mov dword [edi + 0x1c], eax
mov byte [ebp - 0x79], 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.00411703
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.00411703
lea ecx, [ebp - 0x44]
call fcn.0041449a
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.00411703
mov al, byte [ebp - 0x79]
call fcn.0043313b
ret
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0042a5df
mov esi, dword [ebp - 0x44]
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x80]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x431472
inc eax
cmp dword [ebp - 0x1c], eax
jne 0x4314f8
push esi
mov dword [edi], eax
call fcn.0041193d
pop ecx
push eax
push esi
lea ecx, [edi + 4]
call fcn.004117eb
jmp 0x43146e
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x80], eax
test eax, eax
je 0x431472
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push ecx
push eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
call fcn.00414469
push dword [ebp - 0x80]
mov byte [ebp - 4], 5
push dword [ebp - 0x8c]
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43156e
push dword [ebp - 0x8c]
mov dword [edi], 1
call fcn.0041193d
pop ecx
push eax
push dword [ebp - 0x8c]
lea ecx, [edi + 4]
call fcn.004117eb
mov byte [ebp - 0x79], 1
lea ecx, [ebp - 0x8c]
call fcn.0041449a
jmp 0x431472