Function at 0x40a3d4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 6
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor edx, edx
push edx
mov dword [ebp - 8], edx
mov ebx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [edi + 0x24]
neg eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
sbb eax, eax
mov dword [ebp - 4], edx
and eax, 0x100
inc eax
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1c]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
test esi, esi
jns 0x40a42f
mov ecx, esi
mov eax, str.Failed_to_format_key_string.
jmp 0x40a706
cmp dword [edi + 0x20], ebx
je 0x40a457
push 0
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x20]
push dword [ebp + 0xc]
call fcn.00407303
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a457
mov eax, str.Failed_to_format_value_string.
jmp 0x40a706
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 0x18]
call fcn.00440823
mov esi, eax
mov ecx, esi
cmp esi, 0x80070002
jne 0x40a4af
push dword [ebp - 8]
push str.Registry_key_not_found._Key___ls
push 2
call fcn.0043fff0
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408259
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a4a8
mov eax, str.Failed_to_clear_variable.
jmp 0x40a706
xor esi, esi
jmp 0x40a726
test esi, esi
jns 0x40a4bd
mov eax, str.Failed_to_open_registry_key.
jmp 0x40a706
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 2
jne 0x40a4f2
push dword [ebp - 0x10]
push dword [ebp - 8]
push str.Registry_value_not_found._Key___ls__Value___ls
push eax
call fcn.0043fff0
add esp, 0x10
jmp 0x40a487
test esi, esi
je 0x40a526
jle 0x40a503
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a50a
mov esi, 0x80004005
push esi
push 0x36f
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
mov ecx, esi
mov eax, str.Failed_to_query_registry_key_value_size.
jmp 0x40a706
mov eax, dword [ebp - 4]
push 1
add eax, 2
push eax
call fcn.004039df
mov ebx, eax
test ebx, ebx
jne 0x40a561
mov esi, 0x8007000e
push esi
push 0x372
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
push str.Failed_to_allocate_memory_registry_value.
push esi
call fcn.0043fb09
pop ecx
pop ecx
jmp 0x40a713
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x40a5ae
jle 0x40a58b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a592
mov esi, 0x80004005
push esi
push 0x375
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
mov ecx, esi
mov eax, str.Failed_to_query_registry_key_value.
jmp 0x40a706
mov eax, dword [ebp - 0x14]
sub eax, 1
je 0x40a6b4
sub eax, 1
je 0x40a615
dec eax
sub eax, 1
je 0x40a608
sub eax, 7
je 0x40a5e5
push dword [ebp - 0x14]
mov esi, 0x80004001
push str.Unsupported_registry_key_value_type._Type___u
push esi
call fcn.0043fb09
add esp, 0xc
jmp 0x40a713
cmp dword [ebp - 4], 8
je 0x40a5f5
mov esi, 0x8000ffff
jmp 0x40a713
push dword [ebx + 4]
push dword [ebx]
lea eax, [ebp - 0x2c]
push eax
call fcn.004202fb
jmp 0x40a6c0
cmp dword [ebp - 4], 4
jne 0x40a5eb
mov eax, dword [ebx]
cdq
push edx
push eax
jmp 0x40a5fa
cmp dword [edi + 0x28], 0
je 0x40a6b4
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.00401fe0
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a63d
mov eax, str.Failed_to_allocate_string_buffer.
jmp 0x40a706
push dword [ebp - 4]
mov dword [ebp - 0x1c], 2
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 4]
jbe 0x40a6c2
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00401fe0
mov esi, eax
mov ecx, esi
test esi, esi
js 0x40a633
push dword [ebp + 8]
push dword [ebp - 0x2c]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp + 8], eax
je 0x40a6c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x40a694
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x40a69b
mov esi, 0x80004005
push esi
push 0x396
push str.c:_agent_work66_s_src_burnengine_search.cpp
call fcn.004038ba
mov ecx, esi
mov eax, str.Failed_to_get_expand_environment_string.
jmp 0x40a706
push 0
push ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.0042033f
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a6cf
mov eax, str.Failed_to_read_registry_value.
jmp 0x40a706
push dword [edi + 0x14]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ff10
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a6ea
mov eax, str.Failed_to_change_value_type.
jmp 0x40a706
lea eax, [ebp - 0x2c]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.00408259
mov esi, eax
mov ecx, esi
test esi, esi
jns 0x40a726
mov eax, str.Failed_to_set_variable.
push eax
push ecx
call fcn.0043fb09
pop ecx
pop ecx
test esi, esi
jns 0x40a726
push esi
push dword [ebp - 8]
push str.RegistrySearchValue_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.0043fff0
add esp, 0x10
push dword [ebp - 8]
call fcn.0040287d
push dword [ebp - 0x10]
call fcn.0040287d
cmp dword [ebp - 0xc], 0
je 0x40a749
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0xc], 0
test ebx, ebx
je 0x40a753
push ebx
call fcn.00403aa4
lea eax, [ebp - 0x2c]
push eax
call fcn.004204e3
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8