Function at 0x40e610
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x80]
movzx esi, byte [rcx]
mov rbx, rcx
cmp sil, 0x24
jne 0x40e8f4
lea rax, [rbp - 0x34]
lea r12, str._tmp_ba87ca438b41d05f94d001f6340be22b
lea r14, [rbp - 0x38]
lea rdx, [rbx + 1]
mov qword [rbp - 0x48], rax
movzx eax, byte [rbx + 1]
test al, al
je 0x40e730
nop dword [rax + rax]
cmp al, 0x2f
je 0x40e730
cmp al, 0x5c
je 0x40e730
lea rcx, [rbx + 2]
movzx r8d, byte [rcx]
mov r9d, 1
mov eax, r9d
mov rdi, rcx
test r8b, r8b
je 0x40e6b0
add rcx, 1
cmp r8b, 0x5c
lea r10, [r9 + 1]
je 0x40e6b0
cmp r8b, 0x2f
je 0x40e6b0
movzx r8d, byte [rcx]
mov r9, r10
mov rdi, rcx
mov eax, r9d
test r8b, r8b
jne 0x40e689
nop
add eax, 1
mov r13, r9
cdqe
add rax, 0x1e
and rax, 0xfffffffffffffff0
call fcn.00459890
sub rsp, rax
mov r8, r13
lea r15, [rsp + 0x30]
mov rcx, r15
call sub.msvcrt.dll_strncpy
cmp sil, 0x40
mov byte [r15 + r13], 0
je 0x40e740
mov rcx, r15
call sub.msvcrt.dll_getenv
mov rsi, rax
test rax, rax
cmove rsi, r12
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.004388f0
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_free
movzx esi, byte [rdi]
cmp sil, 0x24
jne 0x40e802
mov rbx, rdi
movzx eax, byte [rbx + 1]
lea rdx, [rbx + 1]
test al, al
jne 0x40e660
nop
mov rdi, rdx
mov eax, 1
xor r13d, r13d
jmp 0x40e6b8
cmp qword [0x004718e0], 0xffffffffffffffff
je 0x40e820
mov ecx, 0x20
mov dword [rbp - 0x38], 0x20
call fcn.004386c0
xor r8d, r8d
mov rsi, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x48]
mov rdx, r15
mov rcx, qword [0x004718e0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
je 0x40e7a8
cmp dword [rbp - 0x34], 1
jne 0x40e7b2
test eax, eax
jne 0x40e7b2
test rsi, rsi
je 0x40e7ba
xor edx, edx
mov rcx, rdx
call sub.msvcrt.dll_free
jmp 0x40e6f5
cmp dword [rbp - 0x34], 1
je 0x40e85d
mov rcx, rsi
call sub.msvcrt.dll_free
lea rdx, str._ROOT
xor r8d, r8d
mov rcx, r15
call fcn.004388f0
mov rcx, rax
mov r13, rax
mov qword [rbp - 0x50], rax
call sub.msvcrt.dll_getenv
test rax, rax
mov rsi, rax
mov rdx, qword [rbp - 0x50]
jne 0x40e79b
mov rsi, qword [str._tmp_ba87ca438b41d05f94d001f6340be22b]
mov rcx, r13
call sub.msvcrt.dll_free
test rsi, rsi
cmove rsi, r12
jmp 0x40e6f5
cmp sil, 0x40
je 0x40e71b
mov rax, rdi
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [0x004718e0]
xor r8d, r8d
mov r9d, 0x20019
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e891
mov qword [0x004718e0], 0xffffffffffffffff
jmp 0x40e7ba
mov edx, dword [rbp - 0x38]
mov rcx, rsi
call fcn.00438740
mov qword [rsp + 0x28], r14
mov rsi, rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x48]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [0x004718e0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x40e78a
lea rax, [0x004718e0]
xor r8d, r8d
mov r9d, 0x20019
lea rdx, str.Free_Software_Foundation
mov rcx, qword [0x004718e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e84d
lea rax, [0x004718e0]
xor r8d, r8d
mov r9d, 0x20019
lea rdx, str.4.9.x
mov rcx, qword [0x004718e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40e74e
jmp 0x40e84d
cmp sil, 0x40
je 0x40e638
mov rdi, rcx
jmp 0x40e80c