Function at 0x2a40b2ad
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
push 0x80000002
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2a438f47
cmp dword [ebp - 8], ebx
je 0x2a438f47
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 0x2a40c558
push dword [ebp - 8]
call esi
test eax, eax
jne 0x2a40b4ca
cmp dword [ebp - 0xc], ebx
je 0x2a40b4ca
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
jne 0x2a40b461
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x2a40b4ca
cmp dword [ebp - 0x10], ebx
je 0x2a40b4ca
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x2a40b4d4
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x2a40b4ca
cmp dword [ebp - 4], eax
je 0x2a40b4ca
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call edi
test eax, eax
jne 0x2a438f47
mov esi, dword [ebp - 0x18]
shr esi, 1
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.2a40b4f7
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x2a438f51
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push dword [ebp - 4]
call edi
test eax, eax
jne 0x2a438f47
mov eax, dword [ebp - 0x1c]
dec eax
je 0x2a40b43b
dec eax
jne 0x2a438f5b
xor ecx, ecx
push 2
lea edi, [esi + 0x104]
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.2a40b4f7
mov esi, eax
pop ecx
test esi, esi
je 0x2a438f51
push edi
push esi
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x2a40b4bf
push ebx
call fcn.2a40748e
pop ecx
mov dword [ebp - 0x14], esi
mov ebx, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x2a40b4bf
push 0x2a40899c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x2a40b4bf
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call eax
mov esi, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x2a40b475
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x2a40b47f
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x2a40b489
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 4], ebx
je 0x2a40b493
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x14], ebx
je 0x2a40b4a1
push dword [ebp - 0x14]
call fcn.2a40748e
pop ecx
mov edi, 0x8007000e
cmp esi, edi
je 0x2a438f9a
cmp esi, ebx
jl 0x2a438fa1
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x2a438f7b
mov esi, 0x80040154
jmp 0x2a40b463
mov esi, 0x80040150
jmp 0x2a40b463
mov esi, 0x8007000e
jmp 0x2a40b463
cmp byte [ebp + 0x20], 0
je 0x2a438f92
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoGetClassObject]
jmp 0x2a40b461
test eax, eax
jle 0x2a40b461
and eax, 0xffff
or eax, 0x80070000
jmp 0x2a40b461
mov esi, dword [ebp + 0x20]
jmp 0x2a40b463
mov eax, edi
jmp 0x2a40b4b8
cmp byte [ebp + 0x20], 0
je 0x2a40b4b6
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoGetClassObject]
cmp eax, ebx
jge 0x2a438fcc
cmp eax, edi
jne 0x2a40b4b6
mov esi, eax
jmp 0x2a40b4b6