Function at 0x4062f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edx, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
cmp dword [edi + 0x24], edx
mov ecx, 0x101
cmovne eax, ecx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1c]
mov dword [ebp - 8], edx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, edx
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x406349
push str.Failed_to_format_key_string.
jmp 0x40660a
cmp dword [edi + 0x20], ebx
je 0x40636f
push 0
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x20]
push dword [ebp + 0xc]
call fcn.0040395f
mov esi, eax
test esi, esi
jns 0x40636f
push str.Failed_to_format_value_string.
jmp 0x40660a
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 0x18]
call fcn.004322f5
mov esi, eax
cmp esi, 0x80070002
jne 0x4063c5
push dword [ebp - 8]
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00430d48
add esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040452d
mov esi, eax
test esi, esi
jns 0x4063be
push str.Failed_to_clear_variable.
jmp 0x40660a
xor esi, esi
jmp 0x406629
test esi, esi
jns 0x4063d3
push str.Failed_to_open_registry_key.
jmp 0x40660a
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call esi
cmp eax, 2
jne 0x406408
push dword [ebp - 0xc]
push dword [ebp - 8]
push str.Registry_value_not_found._Key___ls__Value___ls
push eax
call fcn.00430d48
add esp, 0x10
jmp 0x40639d
test eax, eax
je 0x40643e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x359
push str.search.cpp
call fcn.0042fef9
push str.Failed_to_query_registry_key_value_size.
jmp 0x40660a
mov eax, dword [ebp - 4]
push 1
add eax, 2
push eax
call fcn.00430e98
mov ebx, eax
test ebx, ebx
jne 0x406479
mov esi, 0x8007000e
push esi
push 0x35c
push str.search.cpp
call fcn.0042fef9
push str.Failed_to_allocate_memory_registry_value.
push esi
call fcn.00430877
pop ecx
pop ecx
jmp 0x406616
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4064c2
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x35f
push str.search.cpp
call fcn.0042fef9
push str.Failed_to_query_registry_key_value.
jmp 0x40660a
mov eax, dword [ebp - 0x14]
dec eax
je 0x4065bc
dec eax
je 0x406523
dec eax
dec eax
je 0x406516
sub eax, 7
je 0x4064f3
push dword [ebp - 0x14]
mov esi, 0x80004001
push str.Unsupported_registry_key_value_type._Type___u
push esi
call fcn.00430877
add esp, 0xc
jmp 0x406616
cmp dword [ebp - 4], 8
je 0x406503
mov esi, 0x8000ffff
jmp 0x406616
push dword [ebx + 4]
push dword [ebx]
lea eax, [ebp - 0x24]
push eax
call fcn.00418c37
jmp 0x4065c8
cmp dword [ebp - 4], 4
jne 0x4064f9
mov eax, dword [ebx]
cdq
push edx
push eax
jmp 0x406508
cmp dword [edi + 0x28], 0
je 0x4065bc
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push eax
call fcn.004339ff
mov esi, eax
test esi, esi
jns 0x406549
push str.Failed_to_allocate_string_buffer.
jmp 0x40660a
push dword [ebp - 4]
mov dword [ebp - 0x1c], 2
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 4]
jbe 0x4065ca
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004339ff
mov esi, eax
test esi, esi
js 0x40653f
push dword [ebp + 8]
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp + 8], eax
je 0x4065ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x380
push str.search.cpp
call fcn.0042fef9
push str.Failed_to_get_expand_environment_string.
jmp 0x40660a
push 0
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.00418c73
mov esi, eax
test esi, esi
jns 0x4065d5
push str.Failed_to_read_registry_value.
jmp 0x40660a
push dword [edi + 0x14]
lea eax, [ebp - 0x24]
push eax
call fcn.00418a09
mov esi, eax
test esi, esi
jns 0x4065ee
push str.Failed_to_change_value_type.
jmp 0x40660a
push 0
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040452d
mov esi, eax
test esi, esi
jns 0x406629
push str.Failed_to_set_variable.
push esi
call fcn.00430877
pop ecx
pop ecx
test esi, esi
jns 0x406629
push esi
push dword [ebp - 8]
push str.RegistrySearchValue_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00430d48
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x406637
push dword [ebp - 8]
call fcn.00434266
cmp dword [ebp - 0xc], 0
je 0x406645
push dword [ebp - 0xc]
call fcn.00434266
cmp dword [ebp - 0x10], 0
je 0x406658
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
test ebx, ebx
je 0x406662
push ebx
call fcn.00430f57
lea eax, [ebp - 0x24]
push eax
call fcn.00418d08
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8