Function at 0x40b840
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.004100c0
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x804]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x800
push 0
push eax
mov edi, ecx
call fcn.00411010
add esp, 0xc
mov dword [ebp - 0x1014], 1
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1018], 0x800
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
push esi
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x100c], eax
test eax, eax
jne 0x40bbc3
mov ecx, dword [ebp - 0x1014]
cmp ecx, 1
jne 0x40ba3e
lea esi, [ebp - 0x804]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40b8d2
sub esi, ecx
mov ecx, dword [ebx + 0x14]
sar esi, 1
mov dword [ebp - 0x1010], ecx
cmp esi, ecx
ja 0x40b92c
mov edi, ebx
cmp ecx, 7
jbe 0x40b8f7
mov edi, dword [ebx]
mov dword [ebx + 0x10], esi
lea eax, [ebp - 0x804]
add esi, esi
push esi
push eax
push edi
call fcn.00410960
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f104
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x7ffffffe
ja 0x40bbd6
mov edi, esi
or edi, 7
cmp edi, 0x7ffffffe
ja 0x40b978
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
ja 0x40b978
lea eax, [edx + ecx]
cmp edi, eax
cmovb edi, eax
mov dword [ebp - 0x1008], edi
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40bbe0
add eax, eax
jne 0x40b989
xor edi, edi
jmp 0x40b9c2
mov eax, 0x7fffffff
mov dword [ebp - 0x1008], 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x40b9b7
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40bbe0
push ecx
call fcn.0040f117
add esp, 4
test eax, eax
je 0x40bbdb
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x40b9c2
push eax
call fcn.0040f117
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0x1008]
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x804]
mov dword [ebx + 0x10], esi
add esi, esi
push esi
push eax
push edi
call fcn.00410960
xor eax, eax
add esp, 0xc
mov word [edi + esi], ax
mov eax, dword [ebp - 0x1010]
cmp eax, 7
jbe 0x40ba23
lea ecx, [eax*2 + 2]
mov eax, dword [ebx]
cmp ecx, 0x1000
jb 0x40ba19
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bbdb
mov eax, edx
push ecx
push eax
call fcn.0040f14c
add esp, 8
mov eax, dword [ebp - 0x100c]
mov dword [ebx], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f104
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x40bbbe
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
test eax, eax
je 0x40bba6
cmp eax, 0x400
ja 0x40bba6
lea esi, [ebp - 0x1004]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40ba82
sub esi, ecx
mov ecx, dword [ebx + 0x14]
sar esi, 1
mov dword [ebp - 0x1010], ecx
cmp esi, ecx
ja 0x40badc
mov edi, ebx
cmp ecx, 7
jbe 0x40baa7
mov edi, dword [ebx]
mov dword [ebx + 0x10], esi
lea eax, [ebp - 0x1004]
add esi, esi
push esi
push eax
push edi
call fcn.00410960
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
mov eax, dword [ebp - 0x100c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f104
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x7ffffffe
ja 0x40bbe5
mov edi, esi
or edi, 7
cmp edi, 0x7ffffffe
ja 0x40bb3a
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
ja 0x40bb3a
lea eax, [edx + ecx]
cmp edi, eax
cmovb edi, eax
mov dword [ebp - 0x1008], edi
lea eax, [edi + 1]
cmp eax, 0x7fffffff
ja 0x40bbe0
add eax, eax
jne 0x40bb4b
mov eax, dword [ebp - 0x1008]
xor edi, edi
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x1004]
jmp 0x40b9d1
mov eax, 0x7fffffff
mov dword [ebp - 0x1008], 0x7ffffffe
add eax, eax
cmp eax, 0x1000
jb 0x40bb87
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40bbe0
push ecx
call fcn.0040f117
add esp, 4
test eax, eax
je 0x40bbdb
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
mov eax, dword [ebp - 0x1008]
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x1004]
jmp 0x40b9d1
push eax
call fcn.0040f117
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x1008]
mov dword [ebx + 0x14], eax
lea eax, [ebp - 0x1004]
jmp 0x40b9d1
pop edi
pop esi
mov eax, 0xea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f104
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f104
mov esp, ebp
pop ebp
ret 8
call fcn.0040118c
call fcn.00417f31
call fcn.00401115
call fcn.0040118c
int3