Function at 0x40431e
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x954
mov eax, 0x42f469
call fcn.0042ed1b
mov eax, edx
mov dword [ebp - 0x954], eax
mov esi, ecx
mov bl, byte [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x94c], ecx
mov byte [ebp - 0x92d], cl
mov byte [ebp - 0x925], cl
mov dword [ebp - 0x92c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x93c], ecx
mov dword [ebp - 0x924], ecx
or dword [ebp - 0x950], 0xffffffff
mov edi, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x944], edi
cmp bl, 1
jbe 0x4043aa
cmp bl, 2
je 0x40439e
cmp bl, 3
jne 0x404397
mov dword [ebp - 0x938], str.shell_newcommand
jmp 0x4043b4
xor eax, eax
jmp 0x404c4b
mov dword [ebp - 0x938], str.shellprintcommand
jmp 0x4043b4
mov dword [ebp - 0x938], 0x4337e4
mov ecx, eax
call fcn.00405724
mov ecx, eax
mov dword [ebp - 0x960], eax
call fcn.0040a0bc
test eax, eax
mov ecx, str.SOFTWAREMicrosoftSharedHTML
mov edx, str.SOFTWAREMicrosoftSharedMHTML
cmove edx, ecx
lea ecx, [ebp - 0x710]
push 0x105
call main
push 0x105
mov edx, 0x4337e0
lea ecx, [ebp - 0x710]
call main
push 0x105
mov edx, esi
lea ecx, [ebp - 0x710]
call main
cmp word [esi], 0x4f
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
jne 0x404426
mov byte [ebp - 0x92d], 1
jmp 0x40458e
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, reloc.appvisvsubsystems32.dll_Ordinal_1
call main
test eax, eax
jne 0x40458e
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x958], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x958]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push 0x433858
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x4044a6
cmp word [ebp - 0x430], di
jne 0x404640
xor bh, bh
jmp 0x40455e
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x924]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x40458e
cmp word [ebp - 0x220], di
je 0x40458e
mov byte [ebp - 0x926], 1
test bh, bh
jne 0x4049f2
lea edx, [ebp - 0x948]
inc bh
lea ecx, [ebp - 0x220]
call main
test eax, eax
jne 0x4049f2
mov ecx, dword [ebp - 0x948]
test ecx, ecx
je 0x40453b
cmp ecx, 4
jne 0x4049f2
call main
test eax, eax
je 0x4049f2
cmp dword [ebp - 0x924], edi
je 0x404558
push dword [ebp - 0x924]
call esi
and dword [ebp - 0x924], edi
mov edx, dword [ebp - 0x938]
lea eax, [ebp - 0x924]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov dword [ebp - 0x95c], 0x20a
call main
test eax, eax
je 0x4044ad
cmp dword [ebp - 0x92c], edi
je 0x40459e
push dword [ebp - 0x92c]
call esi
and dword [ebp - 0x92c], edi
cmp dword [ebp - 0x924], edi
je 0x4045b4
push dword [ebp - 0x924]
call esi
and dword [ebp - 0x924], edi
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, 0x80000002
xor bh, bh
call main
test eax, eax
jne 0x40471d
movzx eax, byte [ebp - 0x430]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
mov dword [ebp - 0x948], 0x20a
cmove eax, ecx
mov byte [ebp - 0x430], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push 0x433858
push dword [ebp - 0x92c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x40469e
cmp word [ebp - 0x430], di
je 0x40469e
cmp byte [ebp - 0x92d], al
jne 0x404657
push 0x105
lea edx, [ebp - 0x430]
mov ecx, 0x45d898
call main
jmp 0x40466f
lea edx, [ebp - 0x430]
mov ecx, 0x45d898
call fcn.0040b9a2
test eax, eax
jne 0x404c08
xor edx, edx
lea ecx, [ebp - 0x430]
call main
xor edx, edx
mov dword [ebp - 0x950], eax
lea ecx, [ebp - 0x430]
call fcn.0040baeb
mov edi, eax
xor bh, bh
mov dword [ebp - 0x944], edi
jmp 0x4048d4
mov edx, dword [ebp - 0x938]
lea eax, [ebp - 0x924]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
xor bh, bh
mov dword [ebp - 0x958], 0x20a
call main
test eax, eax
jne 0x40471d
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x958]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x924]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x40471d
cmp word [ebp - 0x220], di
je 0x40471d
mov eax, edi
inc bh
mov cl, al
jmp 0x404729
mov eax, dword [ebp - 0x940]
mov cl, byte [ebp - 0x925]
test eax, eax
jne 0x404a1e
test bh, bh
je 0x404790
cmp byte [ebp - 0x92d], al
je 0x4049f8
lea edx, [ebp - 0x220]
mov ecx, 0x45daa8
call fcn.0040b9a2
test eax, eax
jne 0x404bfd
lea edx, [ebp - 0x944]
lea ecx, [ebp - 0x220]
call main
mov edi, dword [ebp - 0x944]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x940], eax
test eax, eax
jne 0x404a1e
mov cl, byte [ebp - 0x925]
test cl, cl
jne 0x404a12
cmp bl, 3
jne 0x404a12
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x4047ae
push eax
call esi
and dword [ebp - 0x92c], 0
cmp dword [ebp - 0x924], 0
je 0x4047c6
push dword [ebp - 0x924]
call esi
and dword [ebp - 0x924], 0
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, reloc.appvisvsubsystems32.dll_Ordinal_1
call main
test eax, eax
je 0x404813
lea eax, [ebp - 0x92c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x710]
mov ecx, 0x80000002
call main
test eax, eax
jne 0x404a12
lea eax, [ebp - 0x924]
mov dword [ebp - 0x948], 0x20a
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x92c]
mov edx, 0x4337e4
call main
test eax, eax
jne 0x404a12
movzx eax, byte [ebp - 0x220]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x924]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x404a12
cmp word [ebp - 0x220], ax
je 0x404a12
lea edx, [ebp - 0x944]
lea ecx, [ebp - 0x220]
call main
mov edi, dword [ebp - 0x944]
mov dword [ebp - 0x950], eax
cmp eax, 9
je 0x404a12
push 0x105
mov edx, edi
lea ecx, [ebp - 0x430]
call main
xor eax, eax
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x93c]
mov byte [ebp - 0x925], 1
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x430]
mov ecx, Ordinal_1
call main
test eax, eax
jne 0x40471d
and dword [ebp - 0x938], eax
mov edx, str.CurVer
lea eax, [ebp - 0x938]
mov dword [ebp - 0x958], 0xca
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x93c]
call main
test eax, eax
jne 0x4049bb
movzx eax, byte [ebp - 0x500]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x500], al
lea eax, [ebp - 0x958]
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x938]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x4049bb
cmp word [ebp - 0x500], ax
je 0x4049bb
lea eax, [ebp - 0x95c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x500]
mov ecx, Ordinal_1
call main
test eax, eax
jne 0x4049bb
cmp dword [ebp - 0x93c], eax
je 0x4049af
push dword [ebp - 0x93c]
call esi
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x940], eax
je 0x4049de
push dword [ebp - 0x938]
call esi
mov eax, dword [ebp - 0x940]
and dword [ebp - 0x938], 0
mov cl, 1
mov byte [ebp - 0x925], cl
jmp 0x404729
mov bh, byte [ebp - 0x926]
push 0x105
lea edx, [ebp - 0x220]
mov ecx, 0x45daa8
call main
jmp 0x404759
and dword [ebp - 0x94c], 0
jmp 0x404bfd
test edi, edi
je 0x404a4c
mov eax, dword [ebp - 0x954]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x404a3a
call fcn.00402061
mov eax, dword [ebp - 0x954]
mov dword [eax + 0xc], edi
mov ecx, eax
xor edi, edi
call fcn.00405724
mov dword [ebp - 0x960], eax
mov ecx, dword [ebp - 0x950]
cmp ecx, 9
je 0x404acd
cmp bl, 2
je 0x404acd
cmp bl, 1
jne 0x404a69
mov esi, dword [0x433e50]
jmp 0x404a73
movzx eax, bl
mov esi, dword [eax*4 + 0x433e50]
mov ebx, dword [ebp - 0x940]
mov edx, esi
push 0
push dword [ebp - 0x954]
push ecx
mov ecx, ebx
call fcn.00402f93
mov dword [ebp - 0x94c], eax
test eax, eax
jne 0x404ac2
cmp esi, dword [0x433e50]
jne 0x404ac2
mov edx, dword [0x433e54]
mov ecx, ebx
push eax
push dword [ebp - 0x954]
push dword [ebp - 0x950]
call fcn.00402f93
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x404bf7
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
jmp 0x404bfd
push 0x104
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x404bc5
cmp bl, 3
jne 0x404b99
cmp word [ebp - 0x920], 0
jne 0x404b99
cmp dword [ebp - 0x924], 0
je 0x404b1a
push dword [ebp - 0x924]
call esi
and dword [ebp - 0x924], 0
lea eax, [ebp - 0x924]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x940]
mov edx, str.shell_newcommand
mov dword [ebp - 0x948], 0x20a
call main
test eax, eax
jne 0x404bfd
movzx eax, byte [ebp - 0x920]
xor ecx, ecx
cmp dword [ebp - 0x934], 1
cmove eax, ecx
mov byte [ebp - 0x920], al
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x934]
push eax
push ecx
push ecx
push dword [ebp - 0x924]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x404bfd
cmp word [ebp - 0x920], ax
je 0x404bfd
mov ecx, dword [ebp - 0x960]
call fcn.0040b82d
mov edx, dword [ebp - 0x960]
push ecx
mov ecx, dword [ebp - 0x954]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
lea ecx, [ebp - 0x920]
push eax
call fcn.00403d62
jmp 0x404bf7
test bl, bl
jne 0x404bd1
mov edx, dword [0x433e54]
jmp 0x404bdb
movzx eax, bl
mov edx, dword [eax*4 + 0x433e50]
xor eax, eax
cmp bl, 2
mov ebx, dword [ebp - 0x960]
push ecx
mov ecx, dword [ebp - 0x940]
sete al
push eax
push ebx
call main
mov dword [ebp - 0x94c], eax
test edi, edi
je 0x404c08
mov ecx, edi
call fcn.00402061
cmp dword [ebp - 0x924], 0
je 0x404c19
push dword [ebp - 0x924]
call esi
and dword [ebp - 0x924], 0
cmp dword [ebp - 0x93c], 0
je 0x404c31
push dword [ebp - 0x93c]
call esi
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0x404c45
push eax
call esi
mov eax, dword [ebp - 0x94c]
call fcn.0042ecda
ret 0x10