Function at 0x40c976
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x4438c7
call fcn.00428c84
sub esp, 0xb38
push str.winmgmts
push dword [ebp + 8]
mov dword [ebp - 0x28], ecx
call fcn.00430849
pop ecx
pop ecx
test eax, eax
je 0x40cd30
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.00401621
xor eax, eax
xor ebx, ebx
mov word [ebp - 0x238], ax
mov word [ebp - 0x538], ax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], ebx
cmp dword [eax - 0xc], ebx
je 0x40cd22
push esi
push edi
push 0x44af78
lea ecx, [ebp - 0x20]
call fcn.0040d38f
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x14]
push eax
mov esi, 0x20019
push esi
push ebx
push dword [ebp - 0x20]
push SysReAllocStringLen
call edi
test eax, eax
jne 0x40ca4e
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x200
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ca3e
cmp dword [ebp - 0x10], 1
jne 0x40ca3e
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x538]
push 0x40
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x40cb75
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00401621
push str.CurVer
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0040d38f
lea eax, [ebp - 0x30]
push eax
push esi
push ebx
push dword [ebp - 0x1c]
push SysReAllocStringLen
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40cb67
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x200
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cb67
cmp dword [ebp - 0x10], 1
jne 0x40cb67
lea eax, [ebp - 0xb44]
push eax
lea ecx, [ebp + 8]
call fcn.00401621
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 2
cmp dword [eax - 0xc], 0
jne 0x40caef
lea ecx, [eax - 0x10]
call fcn.00401b78
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00401b78
jmp 0x40cd20
push 0x44af78
lea ecx, [ebp + 8]
call fcn.0040d38f
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push dword [ebp + 8]
push SysReAllocStringLen
call edi
test eax, eax
jne 0x40cb5c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x200
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cb57
cmp dword [ebp - 0x10], 1
jne 0x40cb57
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x538]
push 0x40
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00401b78
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00401b78
push str.CLSID_
lea eax, [ebp - 0x338]
push 0x80
push eax
call fcn.0043283e
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x338]
push 0x80
push eax
call fcn.004327c9
add esp, 0x18
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x338]
push eax
push SysReAllocStringLen
call edi
test eax, eax
jne 0x40cd20
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.TypeLib
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x40cc2d
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x80
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cd1b
cmp dword [ebp - 0x10], 1
jne 0x40cd1b
push dword [ebp - 0x14]
call esi
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0xb44]
push eax
call fcn.0040cd3e
jmp 0x40cd17
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.InprocServer32
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x40cc7b
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x105
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cc76
cmp dword [ebp - 0x10], 1
je 0x40ccc8
cmp dword [ebp - 0x10], 2
je 0x40ccce
push dword [ebp - 0x14]
call esi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.LocalServer32
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x40cd20
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x105
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cd1b
cmp dword [ebp - 0x10], 1
je 0x40ccc8
cmp dword [ebp - 0x10], 2
jne 0x40cd1b
cmp dword [ebp - 0x10], 2
jne 0x40cd03
mov edi, 0x104
lea eax, [ebp - 0x744]
push edi
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40cd03
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x238]
push edi
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp - 0x14]
call esi
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x238]
push eax
call fcn.0040cfb8
mov ebx, eax
jmp 0x40cd20
push dword [ebp - 0x14]
call esi
pop edi
pop esi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.00401b78
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 8