Function at 0x40b932
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x55c
mov eax, 0x43ef13
call fcn.004265cd
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x528]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x554], eax
xor eax, eax
push str.TypeLib_
mov word [ebp - 0x318], ax
call fcn.0040ab67
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.00401b6e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x528]
call fcn.00402405
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x52c]
push eax
push 0x20019
push esi
push dword [ebp - 0x528]
push SysReAllocString
call ebx
test eax, eax
je 0x40b9f2
push str.Wow6432NodeTypeLib_
lea ecx, [ebp - 0x528]
call fcn.00402979
push edi
call fcn.00401b6e
pop ecx
push eax
push edi
lea ecx, [ebp - 0x528]
call fcn.00402405
lea eax, [ebp - 0x52c]
push eax
push 0x20019
push esi
push dword [ebp - 0x528]
push SysReAllocString
call ebx
test eax, eax
jne 0x40bc39
lea eax, [ebp - 0x568]
mov dword [ebp - 0x548], 0x80
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], 0x40
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x550], esi
push eax
push esi
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bc29
lea eax, [ebp - 0x530]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x52c]
call ebx
test eax, eax
jne 0x40bbed
lea eax, [ebp - 0x560]
mov dword [ebp - 0x54c], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x90]
push eax
push esi
jmp 0x40bbc7
lea eax, [ebp - 0x53c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x530]
call ebx
test eax, eax
jne 0x40bba1
lea eax, [ebp - 0x534]
push eax
push 0x20019
push esi
push str.win32
push dword [ebp - 0x53c]
call ebx
test eax, eax
je 0x40bae8
lea eax, [ebp - 0x534]
push eax
push 0x20019
push esi
push str.win64
push dword [ebp - 0x53c]
call ebx
test eax, eax
jne 0x40bb99
lea eax, [ebp - 0x548]
mov dword [ebp - 0x548], 0x105
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x538]
push eax
push esi
push esi
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bb91
cmp dword [ebp - 0x538], 1
je 0x40bb2b
cmp dword [ebp - 0x538], 2
jne 0x40bb91
cmp dword [ebp - 0x538], 2
jne 0x40bb69
mov ebx, 0x104
lea eax, [ebp - 0x524]
push ebx
push eax
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40bb69
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x318]
push ebx
push eax
call fcn.0042f3c2
add esp, 0xc
push dword [ebp - 0x554]
lea eax, [ebp - 0x318]
push eax
push dword [ebp - 0x558]
call fcn.0040bc5d
mov ebx, eax
test ebx, ebx
jg 0x40bc51
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 0x534]
call edi
push dword [ebp - 0x53c]
call edi
mov eax, dword [ebp - 0x54c]
lea ecx, [ebp - 0x560]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x540]
inc eax
push ecx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x54c], eax
push ecx
push eax
push dword [ebp - 0x530]
mov dword [ebp - 0x540], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40ba84
push dword [ebp - 0x530]
call edi
mov eax, dword [ebp - 0x550]
lea ecx, [ebp - 0x568]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x544], 0x40
push ecx
lea ecx, [ebp - 0x110]
inc eax
push ecx
push eax
push dword [ebp - 0x52c]
mov dword [ebp - 0x550], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40ba3c
push dword [ebp - 0x52c]
call edi
mov ecx, dword [ebp - 0x528]
add ecx, 0xfffffff0
call fcn.00402052
mov eax, esi
call fcn.00426577
ret 0xc
push dword [ebp - 0x534]
call edi
mov esi, ebx
jmp 0x40bc39