Function at 0x409f40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x598abc
mov eax, dword fs:[0]
push eax
sub esp, 0xe68
mov eax, dword [0x6102d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0xe74], ecx
push 0x602bfb
lea ecx, [ebp - 0xe5c]
mov dword [ebp - 0xe48], 0xf
mov dword [ebp - 0xe4c], 0
mov byte [ebp - 0xe5c], 0
call fcn.0040a8c0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0xe10], xmm0
mov dword [ebp - method.DRIVER::CRegistry.virtual_0], vtable.DRIVER::CRegistry.0
mov dword [ebp - 0xe0c], reloc.WS2_32.dll_bind
push str.SYSTEMControlSet001ControlCrashControl
lea ecx, [ebp - 0xe10]
mov byte [ebp - 4], 1
call fcn.0040b480
mov edi, dword [ebp - 0xe0c]
test eax, eax
je 0x40a280
test edi, edi
jne 0x40a004
push 0xd6
push 0x6033fc
push str.m_hKey
call fcn.0058079c
add esp, 0xc
lea eax, [ebp - 0xe2c]
mov dword [ebp - 0xe2c], 0xc8
push eax
lea eax, [ebp - 0xe08]
push eax
lea eax, [ebp - 0xe6c]
push eax
push 0
push str.MinidumpDir
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a047
lea eax, [ebp - 0xe08]
push eax
lea ecx, [ebp - 0xe5c]
call fcn.0040a8c0
test edi, edi
je 0x40a05a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0xe0c], edi
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.0056f980
xorps xmm0, xmm0
mov dword [ebp - 0xe60], 0
movq qword [ebp - 0xe68], xmm0
add esp, 0xc
mov dword [ebp - 0xe68], 0
mov dword [ebp - 0xe64], 0
mov dword [ebp - 0xe60], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x410]
push dword [ebp - 0xe4c]
cmp dword [ebp - 0xe48], 0x10
lea eax, [ebp - 0xe5c]
push ecx
cmovae eax, dword [ebp - 0xe5c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x602bfb
lea ecx, [ebp - 0xe44]
mov dword [ebp - 0xe30], 0xf
mov dword [ebp - 0xe34], 0
mov byte [ebp - 0xe44], 0
call fcn.0040a8c0
lea edx, [ebp - 0xe44]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x410]
call fcn.00409a40
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xe44]
mov dword [ebp - 0xe14], 0xf
push eax
lea ecx, [ebp - 0xe28]
mov dword [ebp - 0xe18], 0
mov byte [ebp - 0xe28], 0
call fcn.0040a9d0
mov ecx, dword [esi]
mov ebx, dword [ebp - 0xe28]
test ecx, ecx
jne 0x40a165
mov eax, dword [ebp - 0xe18]
test eax, eax
je 0x40a15d
add eax, 2
mov dword [esi], eax
jmp 0x40a1a2
mov dword [esi], 0
jmp 0x40a1a2
cmp ecx, dword [ebp - 0xe18]
mov esi, ecx
push ecx
cmova esi, dword [ebp - 0xe18]
push 0
push dword [ebp - 0xe74]
call fcn.0056f980
cmp dword [ebp - 0xe14], 0x10
lea eax, [ebp - 0xe28]
push esi
cmovae eax, ebx
push eax
push dword [ebp - 0xe74]
call fcn.0056ee80
add esp, 0x18
mov eax, dword [ebp - 0xe14]
mov byte [ebp - 0xe6d], 1
cmp eax, 0x10
jb 0x40a1ef
inc eax
mov ecx, ebx
cmp eax, 0x1000
jb 0x40a1e6
test cl, 0x1f
jne 0x40a2e7
mov ebx, dword [ebx - 4]
cmp ebx, ecx
jae 0x40a2ec
sub ecx, ebx
cmp ecx, 4
jb 0x40a2f1
cmp ecx, 0x23
ja 0x40a2f6
push ebx
call fcn.0045fc75
add esp, 4
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0xe14], 0xf
mov dword [ebp - 0xe18], 0
mov byte [ebp - 0xe28], 0
cmp eax, 0x10
jb 0x40a256
mov edx, dword [ebp - 0xe44]
inc eax
mov ecx, edx
cmp eax, 0x1000
jb 0x40a24d
test cl, 0x1f
jne 0x40a2fb
mov edx, dword [edx - 4]
cmp edx, ecx
jae 0x40a300
sub ecx, edx
cmp ecx, 4
jb 0x40a305
cmp ecx, 0x23
ja 0x40a30a
push edx
call fcn.0045fc75
add esp, 4
mov bl, byte [ebp - 0xe6d]
mov dword [ebp - 0xe30], 0xf
mov dword [ebp - 0xe34], 0
mov byte [ebp - 0xe44], 0
jmp 0x40a282
xor bl, bl
test edi, edi
je 0x40a28d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xe48]
cmp eax, 0x10
jb 0x40a2c9
mov edx, dword [ebp - 0xe5c]
inc eax
mov ecx, edx
cmp eax, 0x1000
jb 0x40a2c0
test cl, 0x1f
jne 0x40a30f
mov edx, dword [edx - 4]
cmp edx, ecx
jae 0x40a314
sub ecx, edx
cmp ecx, 4
jb 0x40a319
cmp ecx, 0x23
ja 0x40a31e
push edx
call fcn.0045fc75
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045ef18
mov esp, ebp
pop ebp
ret
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
call fcn.00572b79
int3