Function at 0x403db6
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x954
mov eax, 0x4188ff
call fcn.00418297
mov eax, edx
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x950], ecx
mov bl, byte [ebp + 8]
xor ecx, ecx
cmp bl, 2
mov byte [ebp - 0x92d], cl
mov esi, ecx
mov byte [ebp - 0x921], cl
mov byte [ebp - 0x922], cl
sete byte [ebp - 0x935]
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x928], ecx
or dword [ebp - 0x954], 0xffffffff
mov edi, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x948], ecx
mov dword [ebp - 0x94c], edi
cmp bl, 1
jbe 0x403e52
cmp bl, 2
je 0x403e46
cmp bl, 3
jne 0x403e3f
mov dword [ebp - 0x93c], str.shell_newcommand
jmp 0x403e5c
xor eax, eax
jmp 0x404758
mov dword [ebp - 0x93c], str.shellprintcommand
jmp 0x403e5c
mov dword [ebp - 0x93c], 0x41b664
mov ecx, eax
call fcn.00405237
mov ecx, eax
mov dword [ebp - 0x960], eax
call fcn.00409bed
test eax, eax
mov ecx, str.SOFTWAREMicrosoftSharedHTML
mov edx, str.SOFTWAREMicrosoftSharedMHTML
cmove edx, ecx
lea ecx, [ebp - 0x710]
push 0x105
call fcn.0040b4cf
push 0x105
mov edx, 0x41b660
lea ecx, [ebp - 0x710]
call fcn.0040b51a
mov edx, dword [ebp - 0x950]
lea ecx, [ebp - 0x710]
push 0x105
call fcn.0040b51a
mov eax, dword [ebp - 0x950]
cmp word [eax], 0x4f
jne 0x403ed2
mov byte [ebp - 0x92d], 1
jmp 0x40404b
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x40404b
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x95c], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push 0x41b6d8
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403f55
cmp word [ebp - 0x430], di
je 0x403f55
mov bh, 1
jmp 0x404105
xor bh, bh
jmp 0x40401b
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40404b
cmp word [ebp - 0x220], di
je 0x40404b
mov byte [ebp - 0x922], 1
test bh, bh
jne 0x4044c4
lea edx, [ebp - 0x944]
inc bh
lea ecx, [ebp - 0x220]
call fcn.00403d42
test eax, eax
jne 0x4044c4
mov ecx, dword [ebp - 0x944]
test ecx, ecx
je 0x403fec
cmp ecx, 4
jne 0x4044c4
call fcn.00409251
test eax, eax
je 0x4044c4
cmp dword [ebp - 0x928], edi
je 0x40400d
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x928], eax
mov byte [ebp - 0x922], al
mov edx, dword [ebp - 0x93c]
lea eax, [ebp - 0x928]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov dword [ebp - 0x950], 0x20a
call fcn.0040bac7
test eax, eax
je 0x403f5c
cmp dword [ebp - 0x92c], edi
je 0x40405f
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x92c], edi
cmp dword [ebp - 0x928], edi
je 0x404079
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x928], edi
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, 0x80000002
call fcn.0040bac7
test eax, eax
jne 0x4041e6
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x944], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push 0x41b6d8
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404161
cmp word [ebp - 0x430], di
je 0x404161
mov bh, 1
cmp byte [ebp - 0x92d], al
jne 0x40411c
push 0x105
lea edx, [ebp - 0x430]
mov ecx, 0x43dfd8
call fcn.0040b4cf
jmp 0x404134
lea edx, [ebp - 0x430]
mov ecx, 0x43dfd8
call fcn.0040b412
test eax, eax
jne 0x40470e
xor edx, edx
lea ecx, [ebp - 0x430]
call fcn.0040b0d2
xor edx, edx
mov dword [ebp - 0x954], eax
lea ecx, [ebp - 0x430]
call fcn.0040b555
mov edi, eax
mov dword [ebp - 0x94c], edi
jmp 0x4043ab
mov edx, dword [ebp - 0x93c]
lea eax, [ebp - 0x928]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov dword [ebp - 0x95c], 0x20a
call fcn.0040bac7
test eax, eax
jne 0x4041e6
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4041e6
cmp word [ebp - 0x220], di
je 0x4041e6
mov al, 1
mov ecx, edi
mov byte [ebp - 0x922], al
mov bh, cl
jmp 0x4041f8
mov bh, byte [ebp - 0x921]
mov ecx, dword [ebp - 0x948]
mov al, byte [ebp - 0x922]
test ecx, ecx
jne 0x4044ed
test al, al
je 0x40425b
cmp byte [ebp - 0x92d], cl
je 0x4044ca
lea edx, [ebp - 0x220]
mov ecx, 0x43e1e8
call fcn.0040b412
test eax, eax
jne 0x4046f3
lea edx, [ebp - 0x94c]
lea ecx, [ebp - 0x220]
call fcn.0040b240
mov edi, dword [ebp - 0x94c]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x92c]
mov ecx, eax
mov dword [ebp - 0x948], ecx
test eax, eax
jne 0x4044ed
test bh, bh
jne 0x4044e4
cmp bl, 3
jne 0x4044e4
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x40427d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x928], 0
je 0x404299
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x928], 0
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040bac7
test eax, eax
je 0x4042e6
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, 0x80000002
call fcn.0040bac7
test eax, eax
jne 0x4044e4
lea eax, [ebp - 0x928]
mov dword [ebp - 0x944], 0x20a
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov edx, 0x41b664
call fcn.0040bac7
test eax, eax
jne 0x4044e4
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4044e4
cmp word [ebp - 0x220], ax
je 0x4044e4
lea edx, [ebp - 0x94c]
lea ecx, [ebp - 0x220]
call fcn.0040b240
mov edi, dword [ebp - 0x94c]
mov dword [ebp - 0x954], eax
cmp eax, 9
je 0x4044e4
push 0x105
mov edx, edi
lea ecx, [ebp - 0x430]
call fcn.0040b4cf
xor eax, eax
mov bh, 1
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x940]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x430]
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x4041ec
and dword [ebp - 0x93c], eax
mov edx, str.CurVer
lea eax, [ebp - 0x93c]
mov dword [ebp - 0x95c], 0xca
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x940]
call fcn.0040bac7
test eax, eax
jne 0x404491
movzx eax, byte [ebp - 0x500]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x500], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x93c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404491
cmp word [ebp - 0x500], ax
je 0x404491
lea eax, [ebp - 0x950]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x500]
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x404491
cmp dword [ebp - 0x940], eax
je 0x404485
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x93c], 0
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x948], ecx
je 0x4044b8
push dword [ebp - 0x93c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x948]
and dword [ebp - 0x93c], 0
jmp 0x4041f2
mov bh, byte [ebp - 0x921]
push 0x105
lea edx, [ebp - 0x220]
mov ecx, 0x43e1e8
call fcn.0040b4cf
jmp 0x404228
xor ebx, ebx
mov esi, ebx
jmp 0x4046f5
xor edx, edx
je 0x40450e
mov dl, byte [ebp - 0x922]
test dl, dl
jne 0x404506
mov dl, bl
call fcn.00403c7f
test eax, eax
je 0x4044e4
xor esi, esi
inc esi
jmp 0x4046f3
test edi, edi
je 0x404540
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x40452c
call fcn.00401e39
mov eax, dword [ebp - 0x958]
xor edx, edx
mov dword [eax + 0xc], edi
mov ecx, eax
mov edi, edx
call fcn.00405237
mov dword [ebp - 0x960], eax
xor edx, edx
mov ecx, dword [ebp - 0x954]
mov bh, byte [ebp - 0x935]
cmp ecx, 9
je 0x4045bf
test bh, bh
jne 0x4045bf
cmp bl, 1
jne 0x404562
mov esi, dword [0x41bd50]
jmp 0x40456c
movzx eax, bl
mov esi, dword [eax*4 + 0x41bd50]
mov ebx, dword [ebp - 0x948]
push edx
push dword [ebp - 0x958]
mov edx, esi
push ecx
mov ecx, ebx
call fcn.00402ab2
mov dword [ebp - 0x944], eax
test eax, eax
jne 0x4045b4
cmp esi, dword [0x41bd50]
jne 0x4045b4
mov edx, dword [0x41bd54]
mov ecx, ebx
push eax
push dword [ebp - 0x958]
push dword [ebp - 0x954]
call fcn.00402ab2
jmp 0x4046f1
mov esi, dword [ebp - 0x944]
jmp 0x4046f3
push 0x104
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x4046c4
cmp bl, 3
jne 0x404694
cmp word [ebp - 0x920], 0
jne 0x404694
cmp dword [ebp - 0x928], 0
je 0x404610
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x944], 0x20a
mov dword [ebp - 0x928], eax
mov edx, str.shell_newcommand
lea eax, [ebp - 0x928]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x948]
call fcn.0040bac7
test eax, eax
jne 0x4046f3
movzx eax, byte [ebp - 0x920]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
xor ebx, ebx
mov byte [ebp - 0x920], al
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x934]
push eax
push ebx
push ebx
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4046f5
cmp word [ebp - 0x920], bx
jne 0x404696
jmp 0x4046f5
xor ebx, ebx
mov eax, dword [ebp - 0x958]
push ecx
mov ecx, dword [ebp - 0x960]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0040b2d4
mov edx, dword [ebp - 0x960]
lea ecx, [ebp - 0x920]
push eax
call fcn.0040377f
mov esi, eax
jmp 0x4046f5
test bl, bl
jne 0x4046d0
mov edx, dword [0x41bd54]
jmp 0x4046da
movzx eax, bl
mov edx, dword [eax*4 + 0x41bd50]
mov esi, dword [ebp - 0x960]
push ecx
mov ecx, dword [ebp - 0x948]
movzx eax, bh
push eax
push esi
call fcn.004036e1
mov esi, eax
xor ebx, ebx
test edi, edi
je 0x40470e
test ebx, ebx
je 0x404707
push ebx
mov edx, edi
mov ecx, ebx
call fcn.0040b4cf
mov ecx, edi
call fcn.00401e39
cmp dword [ebp - 0x928], 0
je 0x404723
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x928], ebx
cmp dword [ebp - 0x940], ebx
je 0x40473f
push dword [ebp - 0x940]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x940], ebx
test eax, eax
je 0x404756
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0041824c
ret 0x10