Function at 0x409940
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
lea edi, [ebp - 0x20]
sub esp, 0x4c
mov eax, dword [ebp + 0x14]
lea esi, [ebp - 0x1c]
mov dword [eax], 0
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x4099d0
cmp eax, 2
mov ebx, eax
je 0x409ac0
xor edx, edx
test byte [0x4190a0], 2
jne 0x4099f0
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x409a38
cmp eax, 2
jne 0x4099e4
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jne 0x409a38
mov ebx, 0x70c
jmp 0x409990
mov eax, dword [ebp + 0xc]
mov esi, 0x41b70c
mov edi, 0x4190a0
mov dword [ebp - 0x2c], edx
call fcn.00409620
mov ecx, str.Error__d_while_reading_value__s_n
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 1
mov dword [esp + 0x14], eax
call fcn.00409540
mov edx, dword [ebp - 0x2c]
jmp 0x40999b
mov eax, dword [ebp - 0x20]
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x30], ecx
add eax, 2
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
call eax
xor edx, edx
mov dword [ebp - 0x2c], eax
sub esp, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, dword [ebp - 0x2c]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x409992
mov eax, dword [ebp - 0x20]
and eax, 0xfffffffe
mov word [edx + eax], 0
cmp dword [ebp - 0x1c], 2
je 0x409ad0
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
xor eax, eax
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
call edi
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
sub esp, 0xc
test eax, eax
jne 0x409b00
mov ebx, dword [ecx + 0x34]
jmp 0x409992
mov dword [ebp - 0x30], ecx
add eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call edi
mov edx, dword [ebp - 0x2c]
xor eax, eax
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
sub esp, 0xc
jmp 0x4099bd