Function at 0x40641e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edx, edx
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
xor eax, eax
inc eax
cmp dword [edi + 0x24], edx
mov ecx, 0x101
cmovne eax, ecx
push edx
mov dword [ebp + 8], eax
lea eax, [ebp - 8]
push eax
push dword [edi + 0x1c]
mov dword [ebp - 8], edx
push dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, edx
call fcn.00403a92
mov esi, eax
test esi, esi
jns 0x406477
push str.Failed_to_format_key_string.
jmp 0x406738
cmp dword [edi + 0x20], ebx
je 0x40649d
push 0
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x20]
push dword [ebp + 0xc]
call fcn.00403a92
mov esi, eax
test esi, esi
jns 0x40649d
push str.Failed_to_format_value_string.
jmp 0x406738
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push dword [ebp - 8]
push dword [edi + 0x18]
call fcn.004324d5
mov esi, eax
cmp esi, 0x80070002
jne 0x4064f3
push dword [ebp - 8]
push str.Registry_key_not_found._Key___ls
push 2
call fcn.00430f28
add esp, 0xc
push 0
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040465b
mov esi, eax
test esi, esi
jns 0x4064ec
push str.Failed_to_clear_variable.
jmp 0x406738
xor esi, esi
jmp 0x406757
test esi, esi
jns 0x406501
push str.Failed_to_open_registry_key.
jmp 0x406738
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call esi
cmp eax, 2
jne 0x406536
push dword [ebp - 0xc]
push dword [ebp - 8]
push str.Registry_value_not_found._Key___ls__Value___ls
push eax
call fcn.00430f28
add esp, 0x10
jmp 0x4064cb
test eax, eax
je 0x40656c
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x359
push str.search.cpp
call fcn.004300d9
push str.Failed_to_query_registry_key_value_size.
jmp 0x406738
mov eax, dword [ebp - 4]
push 1
add eax, 2
push eax
call fcn.00431078
mov ebx, eax
test ebx, ebx
jne 0x4065a7
mov esi, 0x8007000e
push esi
push 0x35c
push str.search.cpp
call fcn.004300d9
push str.Failed_to_allocate_memory_registry_value.
push esi
call fcn.00430a57
pop ecx
pop ecx
jmp 0x406744
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4065f0
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x35f
push str.search.cpp
call fcn.004300d9
push str.Failed_to_query_registry_key_value.
jmp 0x406738
mov eax, dword [ebp - 0x14]
dec eax
je 0x4066ea
dec eax
je 0x406651
dec eax
dec eax
je 0x406644
sub eax, 7
je 0x406621
push dword [ebp - 0x14]
mov esi, 0x80004001
push str.Unsupported_registry_key_value_type._Type___u
push esi
call fcn.00430a57
add esp, 0xc
jmp 0x406744
cmp dword [ebp - 4], 8
je 0x406631
mov esi, 0x8000ffff
jmp 0x406744
push dword [ebx + 4]
push dword [ebx]
lea eax, [ebp - 0x24]
push eax
call fcn.00418d81
jmp 0x4066f6
cmp dword [ebp - 4], 4
jne 0x406627
mov eax, dword [ebx]
cdq
push edx
push eax
jmp 0x406636
cmp dword [edi + 0x28], 0
je 0x4066ea
push dword [ebp - 4]
lea eax, [ebp - 0x24]
push eax
call fcn.00433bdf
mov esi, eax
test esi, esi
jns 0x406677
push str.Failed_to_allocate_string_buffer.
jmp 0x406738
push dword [ebp - 4]
mov dword [ebp - 0x1c], 2
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 4]
jbe 0x4066f8
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00433bdf
mov esi, eax
test esi, esi
js 0x40666d
push dword [ebp + 8]
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp + 8], eax
je 0x4066f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x380
push str.search.cpp
call fcn.004300d9
push str.Failed_to_get_expand_environment_string.
jmp 0x406738
push 0
push ebx
lea eax, [ebp - 0x24]
push eax
call fcn.00418dbd
mov esi, eax
test esi, esi
jns 0x406703
push str.Failed_to_read_registry_value.
jmp 0x406738
push dword [edi + 0x14]
lea eax, [ebp - 0x24]
push eax
call fcn.00418b53
mov esi, eax
test esi, esi
jns 0x40671c
push str.Failed_to_change_value_type.
jmp 0x406738
push 0
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
push dword [ebp + 0xc]
call fcn.0040465b
mov esi, eax
test esi, esi
jns 0x406757
push str.Failed_to_set_variable.
push esi
call fcn.00430a57
pop ecx
pop ecx
test esi, esi
jns 0x406757
push esi
push dword [ebp - 8]
push str.RegistrySearchValue_failed:_ID__ls__HRESULT_0x_x
push 2
call fcn.00430f28
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x406765
push dword [ebp - 8]
call fcn.004380ab
cmp dword [ebp - 0xc], 0
je 0x406773
push dword [ebp - 0xc]
call fcn.004380ab
cmp dword [ebp - 0x10], 0
je 0x406786
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
test ebx, ebx
je 0x406790
push ebx
call fcn.00431137
lea eax, [ebp - 0x24]
push eax
call fcn.00418e52
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8