Function at 0x463a80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
test eax, eax
je 0x463b90
mov edi, str.HKEY_CLASSES_ROOT
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
jne 0x463af0
mov eax, 0x80000000
lea edx, [esp + 0x20]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x463bee
add esp, 0x30
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov edi, str.HKEY_CURRENT_USER
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x463d30
mov edi, str.HKEY_LOCAL_MACHINE
mov ecx, 0x13
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x463d40
mov edi, str.HKEY_USERS
mov ecx, 0xb
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x463d50
mov edi, str.HKEY_PERFORMANCE_DATA
mov ecx, 0x16
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x463d60
mov esi, eax
mov edi, str.HKEY_CURRENT_CONFIG
mov ecx, 0x14
mov eax, 0x80000005
repe cmpsb byte [esi], byte es:[edi]
seta dl
sbb dl, 0
test dl, dl
je 0x463ab3
jmp 0x463ae3
lea esi, [esp + 0x20]
mov dword [esp + 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp], 0x80000001
call edi
sub esp, 0x14
test eax, eax
je 0x463bee
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call edi
sub esp, 0x14
test eax, eax
jne 0x463ae3
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
jne 0x463d10
mov eax, dword [esp + 0x28]
add eax, 1
mov dword [esp], eax
mov dword [esp + 0x24], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov ebx, eax
test eax, eax
je 0x463d10
lea eax, [esp + 0x24]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
jne 0x463d00
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x2c], 2
mov byte [ebx + eax], 0
jne 0x463d12
mov dword [esp + 4], 0x25
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x463d12
mov eax, dword [esp + 0x24]
lea edx, [eax + 0x3e8]
add eax, 0x3e9
mov dword [esp], eax
mov dword [esp + 0x24], edx
call sub.libgcrypt_20.dll_gcry_malloc
mov esi, eax
test eax, eax
je 0x463d12
mov eax, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [esp + 8], eax
call edi
sub esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
jne 0x463d6a
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x463d12
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
lea esi, [esi]
nop
xor ebx, ebx
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
sub esp, 4
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, 0x80000001
jmp 0x463ab3
mov eax, 0x80000002
jmp 0x463ab3
mov eax, 0x80000003
jmp 0x463ab3
mov eax, 0x80000004
jmp 0x463ab3
cmp eax, dword [esp + 0x24]
ja 0x463db5
mov byte [esi + eax], 0
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov ebx, eax
test eax, eax
je 0x463dae
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x463d12
mov ebx, esi
jmp 0x463d12
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_free
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
add eax, 1
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_malloc
mov esi, eax
test eax, eax
je 0x463d12
mov eax, dword [esp + 0x24]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call edi
sub esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
je 0x463e00
cmp eax, dword [esp + 0x24]
ja 0x463cef
mov byte [esi + eax], 0
mov dword [esp], ebx
mov ebx, esi
call sub.libgcrypt_20.dll_gcry_free
jmp 0x463d12