Function at 0x403f30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x964
mov eax, 0x4334de
call fcn.00432eed
mov dword [ebp - 0x958], edx
mov ebx, ecx
mov al, byte [ebp + 8]
xor ecx, ecx
mov byte [ebp - 0x926], al
mov dword [ebp - 0x954], ecx
mov byte [ebp - 0x92d], cl
mov byte [ebp - 0x925], cl
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x924], ecx
or dword [ebp - 0x950], 0xffffffff
mov edi, ecx
movzx eax, al
mov dword [ebp - 0x96c], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x94c], edi
sub eax, ecx
je 0x403fc3
sub eax, 1
je 0x403fc3
sub eax, 1
je 0x403fbc
sub eax, 1
je 0x403fb5
xor eax, eax
jmp 0x4048af
mov esi, str.shell_newcommand
jmp 0x403fc8
mov esi, str.shellprintcommand
jmp 0x403fc8
mov esi, 0x4377b8
mov ecx, edx
call fcn.0040553d
push 0x105
mov ecx, eax
mov dword [ebp - 0x964], eax
call fcn.0040a09d
test eax, eax
mov ecx, str.SOFTWAREMicrosoftSharedHTML
mov edx, str.SOFTWAREMicrosoftSharedMHTML
cmove edx, ecx
lea ecx, [ebp - 0x710]
call fcn.0040bfdc
push 0x105
mov edx, 0x4377b4
lea ecx, [ebp - 0x710]
call fcn.0040c02b
push 0x105
mov edx, ebx
lea ecx, [ebp - 0x710]
call fcn.0040c02b
xor eax, eax
inc eax
cmp word [ebx], 0x4f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40403c
mov byte [ebp - 0x92d], al
jmp 0x4041bf
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040c5c8
test eax, eax
jne 0x4041bf
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x95c], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push 0x43782c
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4040c4
cmp word [ebp - 0x430], di
je 0x4040c4
inc eax
mov byte [ebp - 0x925], al
jmp 0x404283
xor eax, eax
mov byte [ebp - 0x935], al
jmp 0x404193
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x924]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4041bf
cmp word [ebp - 0x220], di
je 0x4041bf
xor ecx, ecx
inc ecx
cmp byte [ebp - 0x935], 0
mov al, cl
mov dword [ebp - 0x948], eax
jne 0x404398
mov byte [ebp - 0x935], cl
lea edx, [ebp - 0x960]
lea ecx, [ebp - 0x220]
call fcn.00403ebd
test eax, eax
jne 0x404398
mov ecx, dword [ebp - 0x960]
test ecx, ecx
je 0x40416e
cmp ecx, 4
jne 0x404398
call fcn.004099ba
test eax, eax
je 0x404398
cmp dword [ebp - 0x924], edi
je 0x40418b
push dword [ebp - 0x924]
call ebx
xor eax, eax
mov dword [ebp - 0x924], eax
lea eax, [ebp - 0x924]
mov dword [ebp - 0x944], 0x20a
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov edx, esi
call fcn.0040c5c8
test eax, eax
je 0x4040d1
cmp dword [ebp - 0x92c], edi
je 0x4041cf
push dword [ebp - 0x92c]
call ebx
xor eax, eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x924], eax
je 0x4041e9
push dword [ebp - 0x924]
call ebx
xor eax, eax
mov dword [ebp - 0x924], eax
lea edx, [ebp - 0x710]
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call fcn.0040c5c8
test eax, eax
jne 0x404378
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x960], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push 0x43782c
push dword [ebp - 0x92c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4042e7
cmp word [ebp - 0x430], di
je 0x4042e7
inc eax
cmp byte [ebp - 0x92d], 0
mov byte [ebp - 0x925], al
jne 0x40429a
push 0x105
lea edx, [ebp - 0x430]
mov ecx, 0x463618
call fcn.0040bfdc
jmp 0x4042b2
lea edx, [ebp - 0x430]
mov ecx, 0x463618
call fcn.0040be84
test eax, eax
jne 0x40486b
xor edx, edx
lea ecx, [ebp - 0x430]
call fcn.0040bb9e
xor edx, edx
mov dword [ebp - 0x950], eax
lea ecx, [ebp - 0x430]
call fcn.0040c06a
mov edi, eax
xor eax, eax
mov dword [ebp - 0x94c], edi
mov dword [ebp - 0x948], eax
jmp 0x404550
xor eax, eax
mov dword [ebp - 0x95c], 0x20a
mov dword [ebp - 0x948], eax
mov edx, esi
lea eax, [ebp - 0x924]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
call fcn.0040c5c8
test eax, eax
jne 0x404378
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
xor esi, esi
inc esi
cmp dword [ebp - 0x934], esi
cmove eax, ecx
mov byte [ebp - 0x220], al
mov al, cl
mov dword [ebp - 0x948], eax
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x924]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404378
cmp word [ebp - 0x220], di
mov ecx, edi
movzx eax, al
cmovne eax, esi
mov dword [ebp - 0x948], eax
jmp 0x404384
mov ecx, dword [ebp - 0x93c]
mov eax, dword [ebp - 0x948]
test ecx, ecx
jne 0x404664
test al, al
je 0x4043fa
cmp byte [ebp - 0x92d], cl
jne 0x4043af
push 0x105
lea edx, [ebp - 0x220]
mov ecx, 0x463828
call fcn.0040bfdc
jmp 0x4043c7
lea edx, [ebp - 0x220]
mov ecx, 0x463828
call fcn.0040be84
test eax, eax
jne 0x404860
lea edx, [ebp - 0x94c]
lea ecx, [ebp - 0x220]
call fcn.0040bd10
mov ecx, dword [ebp - 0x92c]
mov esi, eax
mov edi, dword [ebp - 0x94c]
mov dword [ebp - 0x950], esi
mov dword [ebp - 0x93c], ecx
test ecx, ecx
jne 0x40466a
cmp byte [ebp - 0x925], 0
jne 0x40465d
cmp byte [ebp - 0x926], 3
jne 0x40465d
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x404421
push eax
call ebx
xor eax, eax
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x924], eax
je 0x40443b
push dword [ebp - 0x924]
call ebx
xor eax, eax
mov dword [ebp - 0x924], eax
lea edx, [ebp - 0x710]
lea eax, [ebp - 0x92c]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040c5c8
test eax, eax
je 0x404484
lea eax, [ebp - 0x92c]
push eax
push esi
push ecx
lea edx, [ebp - 0x710]
mov ecx, 0x80000002
call fcn.0040c5c8
test eax, eax
jne 0x40465d
lea eax, [ebp - 0x924]
mov dword [ebp - 0x960], 0x20a
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x92c]
mov edx, 0x4377b8
call fcn.0040c5c8
test eax, eax
jne 0x40465d
movzx eax, byte [ebp - 0x220]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0x934], edx
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x924]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40465d
cmp word [ebp - 0x220], ax
je 0x40465d
lea edx, [ebp - 0x94c]
lea ecx, [ebp - 0x220]
call fcn.0040bd10
mov edi, dword [ebp - 0x94c]
mov esi, eax
mov dword [ebp - 0x950], esi
cmp esi, 9
je 0x40465d
push 0x105
mov edx, edi
lea ecx, [ebp - 0x430]
call fcn.0040bfdc
xor eax, eax
inc eax
mov byte [ebp - 0x925], al
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x940]
mov esi, 0x20019
push eax
push esi
push ecx
lea edx, [ebp - 0x430]
mov ecx, Ordinal_1
call fcn.0040c5c8
test eax, eax
jne 0x404378
mov dword [ebp - 0x944], eax
mov edx, str.CurVer
lea eax, [ebp - 0x944]
mov dword [ebp - 0x95c], 0xca
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x940]
call fcn.0040c5c8
test eax, eax
jne 0x40462d
movzx eax, byte [ebp - 0x500]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0x934], edx
cmove eax, ecx
mov byte [ebp - 0x500], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x944]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40462d
cmp word [ebp - 0x500], ax
je 0x40462d
lea eax, [ebp - 0x968]
push eax
push esi
push ecx
lea edx, [ebp - 0x500]
mov ecx, Ordinal_1
call fcn.0040c5c8
test eax, eax
jne 0x40462d
cmp dword [ebp - 0x940], eax
je 0x404621
push dword [ebp - 0x940]
call ebx
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x944], 0
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x93c], ecx
je 0x404650
push dword [ebp - 0x944]
call ebx
mov ecx, dword [ebp - 0x93c]
xor eax, eax
mov dword [ebp - 0x944], eax
jmp 0x40437e
xor eax, eax
jmp 0x40485a
mov esi, dword [ebp - 0x950]
test edi, edi
je 0x40469a
mov eax, dword [ebp - 0x958]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x404686
call fcn.00401cf4
mov eax, dword [ebp - 0x958]
xor ecx, ecx
mov dword [eax + 0xc], edi
mov edi, ecx
mov ecx, eax
call fcn.0040553d
mov dword [ebp - 0x964], eax
cmp esi, 9
je 0x40471e
mov al, byte [ebp - 0x926]
cmp al, 2
je 0x40471e
xor ecx, ecx
inc ecx
cmp al, cl
jne 0x4046b8
mov esi, dword [0x437e20]
jmp 0x4046c5
mov edx, dword [ebp - 0x96c]
mov esi, dword [edx*4 + 0x437e20]
mov ecx, dword [ebp - 0x93c]
xor eax, eax
push eax
push dword [ebp - 0x958]
mov edx, esi
push dword [ebp - 0x950]
call fcn.00402bc0
mov dword [ebp - 0x954], eax
test eax, eax
jne 0x404860
cmp esi, dword [0x437e20]
jne 0x404860
mov edx, dword [0x437e24]
mov ecx, dword [ebp - 0x93c]
push eax
push dword [ebp - 0x958]
push dword [ebp - 0x950]
call fcn.00402bc0
jmp 0x40485a
push 0x104
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x40481f
cmp byte [ebp - 0x926], 3
jne 0x4047f3
cmp word [ebp - 0x920], 0
jne 0x4047f3
cmp dword [ebp - 0x924], 0
je 0x40476f
push dword [ebp - 0x924]
call ebx
xor eax, eax
mov dword [ebp - 0x968], 0x20a
mov dword [ebp - 0x924], eax
mov edx, str.shell_newcommand
lea eax, [ebp - 0x924]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x93c]
call fcn.0040c5c8
test eax, eax
jne 0x404860
movzx eax, byte [ebp - 0x920]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0x934], edx
cmove eax, ecx
mov byte [ebp - 0x920], al
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x934]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x924]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404860
cmp word [ebp - 0x920], ax
je 0x404860
mov ecx, dword [ebp - 0x964]
call fcn.0040bd8c
mov edx, dword [ebp - 0x964]
push ecx
mov ecx, dword [ebp - 0x958]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x920]
push eax
call fcn.00403948
jmp 0x40485a
mov cl, byte [ebp - 0x926]
test cl, cl
jne 0x404831
mov edx, dword [0x437e24]
jmp 0x40483e
mov edx, dword [ebp - 0x96c]
mov edx, dword [edx*4 + 0x437e20]
mov esi, dword [ebp - 0x964]
xor eax, eax
cmp cl, 2
push ecx
mov ecx, dword [ebp - 0x93c]
sete al
push eax
push esi
call fcn.004038ac
mov dword [ebp - 0x954], eax
test edi, edi
je 0x40486b
mov ecx, edi
call fcn.00401cf4
cmp dword [ebp - 0x924], 0
je 0x40487c
push dword [ebp - 0x924]
call ebx
xor eax, eax
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x940], eax
je 0x404896
push dword [ebp - 0x940]
call ebx
xor eax, eax
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x4048a9
push eax
call ebx
mov eax, dword [ebp - 0x954]
call fcn.00432ea2
ret 0x10