Function at 0x40b3d6
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
mov eax, 0x16a0
call fcn.00410150
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x7fe
push esi
lea eax, [ebp - 0xe2a]
push edi
push eax
mov dword [ebp + 0x70], edi
mov word [ebp - 0xe2c], di
call sub.MSVCRT.dll_memset
push 0x206
lea eax, [ebp - 0x62a]
push edi
push eax
mov word [ebp - 0x62c], di
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x162a]
push edi
push eax
mov word [ebp - 0x162c], di
call sub.MSVCRT.dll_memset
push dword [ebp + 0x7c]
call fcn.00403bbc
xor ecx, ecx
add esp, 0x28
cmp word [eax], 0x40
mov dword [ebp + 0x7c], eax
sete cl
cmp ecx, edi
mov dword [ebp + 0x6c], ecx
je 0x40b458
inc eax
inc eax
mov dword [ebp + 0x7c], eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp + 0x64]
push eax
push 0x40201c
mov ebx, 0x4019c8
push ebx
mov edi, 0x80000001
push edi
mov dword [ebp + 0x64], 1
mov dword [ebp + 0x68], 0x104
call esi
test eax, eax
je 0x40b504
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp + 0x64]
push eax
push 0x402014
push ebx
push edi
call esi
test eax, eax
je 0x40b504
cmp dword [ebp + 0x6c], 0
jne 0x40b4fc
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0x3c]
push eax
push 0x2715
push dword [0x4122d8]
call esi
push 0x50
lea eax, [ebp - 0xdc]
push eax
push 0x2716
push dword [0x4122d8]
call esi
push 0x10
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [0x4122d4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
jmp 0x40b787
push 0x400
lea eax, [ebp - 0xe2c]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0xe2c]
push eax
call fcn.004025b7
test eax, eax
pop ecx
je 0x40b539
lea eax, [ebp - 0xe2c]
mov dword [0x412108], eax
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x50
lea eax, [ebp - 0x424]
push eax
push 0x2717
push dword [0x4122d8]
call edi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xe2c]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x162c]
push eax
call esi
add esp, 0xc
push 0x402004
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40b615
push 0x50
lea eax, [ebp - 0x3c]
push eax
push 0x2718
push dword [0x4122d8]
call edi
push 0x50
lea eax, [ebp - 0xdc]
push eax
push 0x2719
push dword [0x4122d8]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x162c]
push eax
call esi
cmp dword [ebp + 0x6c], 0
jne 0x40b5f2
push 0x24
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x162c]
push eax
push dword [0x4122d4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40b784
push 0x401ee0
lea eax, [ebp - 0xe2c]
push eax
call esi
lea eax, [ebp - 0xe2c]
push eax
call fcn.004067f2
pop ecx
mov dword [ebp + 0x70], eax
jmp 0x40b784
push 0x401ff4
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40b784
push 0x50
lea eax, [ebp - 0x3c]
push eax
push 0x271a
push dword [0x4122d8]
call edi
push 0x50
lea eax, [ebp - 0xdc]
push eax
push 0x271b
push dword [0x4122d8]
call edi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x162c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x24
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x162c]
push eax
push dword [0x4122d4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40b784
push 0x50
lea eax, [ebp - 0x384]
push eax
push 0x271c
push dword [0x4122d8]
call edi
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0xe2c]
push 1
push eax
call fcn.0040b1ba
mov edi, eax
add esp, 0xc
test edi, edi
mov dword [ebp + 0x7c], edi
je 0x40b784
push edi
call fcn.004025b7
test eax, eax
pop ecx
jne 0x40b6d7
push edi
call fcn.00402570
pop ecx
push edi
call fcn.004025b7
test eax, eax
pop ecx
je 0x40b784
push edi
push ebx
mov edi, 0x4019b0
push edi
lea eax, [ebp - 0x2e4]
push 0x401fd8
push eax
call esi
lea eax, [ebp - 0x2e4]
push eax
call fcn.004041e2
push dword [ebp + 0x7c]
lea eax, [ebp - 0x2e4]
push ebx
push edi
push 0x401fbc
push eax
call esi
lea eax, [ebp - 0x2e4]
push eax
call fcn.004041e2
push dword [ebp + 0x7c]
lea eax, [ebp - 0x2e4]
push 0x401fac
push eax
call esi
xor edi, edi
push edi
lea eax, [ebp - 0x2e4]
push 1
push eax
call fcn.004045f0
add esp, 0x48
push dword [ebp + 0x7c]
mov dword [ebp + 0x70], eax
lea eax, [ebp - 0x2e4]
push 0x401f9c
push eax
call esi
push edi
lea eax, [ebp - 0x2e4]
push 1
push eax
call fcn.004045f0
add dword [ebp + 0x70], eax
push edi
push edi
push 0x40195c
call fcn.004045f0
add esp, 0x24
add dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x70]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret