Function at 0x402f50
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 0xc]
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebp + 8]
push 0x40a518
lea ecx, [esp + 0x18]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x402fcc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x10], 4
jne 0x402fed
mov ecx, dword [0x40a518]
push ecx
push 0x408810
push 0x40a518
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x40a518]
test cl, cl
mov byte [esp + eax + 0x228], cl
je 0x403009
inc eax
cmp eax, 0x104
jl 0x402ff0
xor ebx, ebx
mov dl, 0x25
lea ecx, [ecx]
mov al, byte [esp + ebx + 0x228]
cmp al, dl
je 0x403038
test al, al
je 0x4031ed
inc ebx
cmp ebx, 0x104
jl 0x403010
mov eax, 0x40a518
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x104
je 0x4031ed
lea eax, [ebx + 1]
mov ecx, eax
cmp ecx, 0x104
jge 0x403063
cmp byte [esp + ecx + 0x228], dl
je 0x4030a8
inc ecx
cmp ecx, 0x104
jl 0x403051
xor eax, eax
dec ebx
test ebx, ebx
jle 0x403085
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x228]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x18], 0x2d
mov byte [esp + eax + 0x19], 0x6d
mov byte [esp + eax + 0x1a], 0x61
mov byte [esp + eax + 0x1b], 0x69
mov byte [esp + eax + 0x1c], 0x6c
mov byte [esp + eax + 0x1d], 0
jmp 0x4031c7
mov edx, ecx
cmp eax, edx
mov dword [esp + 0xc], edx
jge 0x4030d3
mov ecx, eax
sub ecx, ebx
lea edi, [esp + ecx + 0x17]
mov ecx, edx
sub ecx, eax
lea esi, [esp + eax + 0x228]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub edx, ebx
push 0x104
lea ecx, [esp + 0x124]
mov byte [esp + edx + 0x1b], 0
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor eax, eax
test ebx, ebx
jle 0x403115
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x228]
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, ebx
mov byte [esp + eax + 0x18], 0
xor eax, eax
lea edx, [esp + ebx + 0x18]
mov cl, byte [esp + eax + 0x120]
test cl, cl
mov byte [edx + eax], cl
je 0x403192
mov cl, byte [esp + eax + 0x121]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x19], cl
je 0x403182
mov cl, byte [esp + eax + 0x122]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1a], cl
je 0x403185
mov cl, byte [esp + eax + 0x123]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1b], cl
je 0x40318a
mov cl, byte [esp + eax + 0x124]
test cl, cl
lea esi, [ebx + eax]
mov byte [esp + esi + 0x1c], cl
je 0x40318f
add eax, 5
cmp eax, 0x104
jl 0x403120
jmp 0x403192
inc eax
jmp 0x403192
add eax, 2
jmp 0x403192
add eax, 3
jmp 0x403192
add eax, 4
lea esi, [ebx + eax]
lea esi, [esp + esi + 0x18]
xor ecx, ecx
cmp eax, 0x104
mov byte [esi], 0
jge 0x4031c0
mov edi, dword [esp + 0xc]
lea edi, [esp + edi + 0x228]
mov dl, byte [edi + ecx + 1]
mov byte [esi + ecx], dl
cmp byte [edi + ecx], 0
je 0x4031c0
inc ecx
jmp 0x4031b0
add ecx, eax
mov byte [esp + ecx + 0x18], 0
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x18]
test cl, cl
mov byte [eax + 0x40a518], cl
je 0x4031e6
inc eax
cmp eax, 0x104
jl 0x4031d0
mov byte [eax + 0x40a518], 0
pop edi
pop esi
mov eax, 0x40a518
pop ebx
mov esp, ebp
pop ebp
ret