Function at 0x40e698
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40e69f
call fcn.00569a20
push dword [esp + 0x50]
call fcn.00519390
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00519000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00519000
mov dword [0x6ca001], 0x120001c7
mov dword [0x6ca001], 0x120001c8
mov dword [esp + 0x10], 0x20019
mov dword [0x6ca001], 0x120001cb
cmp dword [esp + 0x48], 0
je 0x40e718
mov dword [0x6ca001], 0x120001cb
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00566c40
call fcn.00569ae0
mov edx, 0x6d132a
pop ecx
push ecx
call fcn.005193a0
mov ecx, eax
call fcn.005193b0
je 0x40e79e
mov dword [0x6ca001], 0x120001cb
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 8]
call fcn.00566af0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00566cd0
lea eax, [esp + 4]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00566cd0
call fcn.00569ae0
mov edx, 0x6d132a
pop ecx
push ecx
call fcn.005193a0
mov ecx, eax
call fcn.005193b0
je 0x40e824
mov dword [0x6ca001], 0x120001cb
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 8]
call fcn.00566af0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00566c40
lea eax, [esp + 4]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40e85d
mov dword [0x6ca001], 0x120001cb
push 0x71085c
push 0x24
push dword [esp + 0x54]
call fcn.00568600
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 8], eax
mov dword [0x6ca001], 0x120001cb
cmp dword [esp + 8], 0
je 0x40e959
mov dword [0x6ca001], 0x120001cb
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40e8f5
mov dword [0x6ca001], 0x120001cb
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x6ca001], 0x120001cb
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040f544
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
cmp dword [esp + 0x14], 0
je 0x40e923
mov dword [0x6ca001], 0x120001cb
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cb
mov edx, 0x6cb1d2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
jmp 0x40f522
mov dword [0x6ca001], 0x120001cb
mov dword [0x6ca001], 0x120001cd
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
mov dword [0x6ca001], 0x120001ce
cmp dword [esp + 8], 0
je 0x40ea40
mov dword [0x6ca001], 0x120001cf
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40e9f7
mov dword [0x6ca001], 0x120001d0
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x6ca001], 0x120001d1
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040f544
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001d2
mov dword [0x6ca001], 0x120001d4
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x6ca001], 0x120001d5
mov edx, 0x6cb1d2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
jmp 0x40f522
mov dword [0x6ca001], 0x120001d6
mov dword [0x6ca001], 0x120001d8
cmp dword [esp + 0x20], 0
je 0x40eb21
mov dword [0x6ca001], 0x120001d9
push dword [esp + 0x20]
call fcn.00568650
mov dword [esp + 0x1c], eax
mov dword [0x6ca001], 0x120001da
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x40eb17
mov dword [0x6ca001], 0x120001db
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40eace
mov dword [0x6ca001], 0x120001dc
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov dword [0x6ca001], 0x120001dd
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00519008
mov dword [0x6ca001], 0x120001de
mov dword [0x6ca001], 0x120001e0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x6ca001], 0x120001e1
mov edx, 0x6cb1d2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
jmp 0x40f522
mov dword [0x6ca001], 0x120001e2
mov dword [0x6ca001], 0x120001e3
mov dword [0x6ca001], 0x120001e5
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
mov dword [0x6ca001], 0x120001e6
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x6ca001], 0x120001e7
cmp dword [esp + 8], 0
je 0x40ec1a
mov dword [0x6ca001], 0x120001e8
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40ebd1
mov dword [0x6ca001], 0x120001e9
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x6ca001], 0x120001ea
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040f544
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001eb
mov dword [0x6ca001], 0x120001ed
push dword [esp + 0x1c]
call fcn.00568670
mov dword [0x6ca001], 0x120001ee
mov edx, 0x6cb1d2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
jmp 0x40f522
mov dword [0x6ca001], 0x120001ef
mov dword [0x6ca001], 0x120001f1
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40ec4c
mov dword [0x6ca001], 0x120001f2
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
mov dword [0x6ca001], 0x120001f3
mov dword [0x6ca001], 0x120001f5
push dword [esp + 0x18]
mov dword [0x6ca001], 0x120001f6
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40ef19
mov dword [0x6ca001], 0x120001f7
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x40ed71
mov dword [0x6ca001], 0x120001f8
mov dword [esp + 0x30], 0
jmp 0x40ecb4
mov dword [0x6ca001], 0x120001f8
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x40ed62
mov dword [0x6ca001], 0x120001f9
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov edx, 0x6cd768
push edx
call fcn.00569980
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
mov eax, 0x6ce27a
push eax
push 2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00568690
cdq
push edx
push eax
call fcn.00566770
call fcn.00519372
add dword [esp], edx
call fcn.00566d50
pop eax
mov edx, 0x6ce09e
push edx
call fcn.00569980
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001fa
inc dword [esp + 0x30]
jno 0x40ecaa
mov dword [0x6ca001], 0x120001fb
jmp 0x40ee47
mov dword [0x6ca001], 0x120001fb
mov dword [0x6ca001], 0x120001fc
mov dword [esp + 0x30], 0
jmp 0x40ed99
mov dword [0x6ca001], 0x120001fc
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x40ee47
mov dword [0x6ca001], 0x120001fd
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov edx, 0x6cd768
push edx
call fcn.00569980
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
mov eax, 0x6ce27a
push eax
push 2
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00568690
cdq
push edx
push eax
call fcn.00566770
call fcn.00519372
add dword [esp], edx
call fcn.00566d50
pop eax
mov edx, 0x6ce09e
push edx
call fcn.00569980
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x120001fe
inc dword [esp + 0x30]
jno 0x40ed8f
mov dword [0x6ca001], 0x120001ff
mov dword [0x6ca001], 0x12000200
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00566af0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00566c40
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x12000201
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40eec9
mov dword [0x6ca001], 0x12000202
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
mov dword [0x6ca001], 0x12000203
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x6ca001], 0x12000204
mov dword [0x6ca001], 0x12000205
push dword [esp + 0x54]
call fcn.00519390
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
add esp, 4
jmp 0x40f522
mov dword [0x6ca001], 0x12000207
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40efc4
mov dword [0x6ca001], 0x12000208
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40ef75
mov dword [0x6ca001], 0x12000209
push dword [esp + 0x20]
pop eax
call fcn.00519320
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov dword [0x6ca001], 0x1200020a
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
mov dword [0x6ca001], 0x1200020b
mov dword [0x6ca001], 0x1200020c
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x28]
pop eax
call fcn.00519320
cdq
push edx
push eax
call fcn.00566e40
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200020e
jmp 0x40f4c8
mov dword [0x6ca001], 0x1200020e
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40f149
mov dword [0x6ca001], 0x12000210
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov dword [0x6ca001], 0x12000212
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x40f126
mov dword [0x6ca001], 0x12000214
mov ebx, dword [esp + 0x28]
add ebx, ebx
push ebx
call fcn.00568650
mov dword [esp + 0x2c], eax
mov dword [0x6ca001], 0x12000215
cmp dword [esp + 0x2c], 0
je 0x40f110
mov dword [0x6ca001], 0x12000217
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x40f0f3
mov dword [0x6ca001], 0x12000219
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x34]
call fcn.005685b0
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200021a
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40f0e9
mov dword [0x6ca001], 0x1200021b
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200021c
push dword [esp + 0x10]
call fcn.00566af0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x6ca001], 0x1200021d
mov dword [0x6ca001], 0x1200021e
mov dword [0x6ca001], 0x1200021f
push dword [esp + 0x2c]
call fcn.00568670
mov dword [0x6ca001], 0x12000220
mov dword [0x6ca001], 0x12000221
jmp 0x40f130
mov dword [0x6ca001], 0x12000221
mov dword [0x6ca001], 0x12000223
mov dword [0x6ca001], 0x12000225
jmp 0x40f4c8
mov dword [0x6ca001], 0x12000225
mov ebx, 7
cmp ebx, dword [esp]
jne 0x40f375
mov dword [0x6ca001], 0x12000226
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x40f27f
mov dword [0x6ca001], 0x12000227
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00568540
call fcn.00569ae0
mov edx, 0x6cb1d2
pop ecx
push ecx
call fcn.005193a0
mov ecx, eax
call fcn.005193b0
je 0x40f1fd
mov dword [0x6ca001], 0x12000228
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov edx, 0x6cbb56
push edx
call fcn.00569980
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x12000229
jmp 0x40f251
mov dword [0x6ca001], 0x12000229
mov dword [0x6ca001], 0x1200022a
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00568540
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200022b
mov dword [0x6ca001], 0x1200022c
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
mov dword [0x6ca001], 0x1200022d
jmp 0x40f161
mov dword [0x6ca001], 0x1200022e
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00566cd0
call fcn.00569ae0
mov edx, 0x6cbb56
pop ecx
push ecx
call fcn.005193a0
mov ecx, eax
call fcn.005193b0
je 0x40f2fb
mov dword [0x6ca001], 0x1200022f
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00566af0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00566c40
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x12000230
mov dword [0x6ca001], 0x12000231
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40f35c
mov dword [0x6ca001], 0x12000232
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x12000233
push dword [esp + 0x10]
call fcn.00566af0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x6ca001], 0x12000234
mov dword [0x6ca001], 0x12000236
jmp 0x40f4c8
mov dword [0x6ca001], 0x12000236
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x40f422
mov dword [0x6ca001], 0x12000237
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40f3d5
mov dword [0x6ca001], 0x12000238
push dword [esp + 0x20]
call fcn.005686a0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov dword [0x6ca001], 0x12000239
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
mov dword [0x6ca001], 0x1200023a
mov dword [0x6ca001], 0x1200023b
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x28]
call fcn.005686a0
push edx
push eax
call fcn.00566e40
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200023d
jmp 0x40f4c8
mov dword [0x6ca001], 0x1200023d
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40f4c8
mov dword [0x6ca001], 0x1200023e
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.005698b0
pop edx
push eax
push dword [esp + 0x28]
call fcn.005685b0
lea eax, [esp + 0x14]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x1200023f
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40f4be
mov dword [0x6ca001], 0x12000240
mov edx, dword [esp + 0x10]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.005698f0
mov dword [0x6ca001], 0x12000241
push dword [esp + 0x10]
call fcn.00566af0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x6ca001], 0x12000242
mov dword [0x6ca001], 0x12000243
pop eax
mov dword [0x6ca001], 0x12000245
push dword [esp + 0x1c]
call fcn.00568670
mov dword [0x6ca001], 0x12000247
mov edx, dword [esp + 0xc]
push edx
call fcn.005698b0
pop edx
push eax
push edx
call fcn.00569980
pop eax
push eax
call fcn.00519360
pop edx
add eax, edx
jmp 0x40f522
push dword [esp]
call fcn.00569a80
push dword [esp + 0xc]
call fcn.00569a80
push dword [esp + 4]
call fcn.00569a80
add esp, 0x30
pop ebx
pop ebp
ret 0x14