Function at 0x40d218
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1bc]
sub esp, 0x23c
mov eax, dword [0x414050]
push ebx
push esi
push edi
push 0x403540
xor ebx, ebx
push 0xa
mov dword [ebp + 0x1b8], eax
mov dword [ebp - 0x7c], 0x104
mov dword [ebp - 0x5c], ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1cc]
push dword [eax]
push 0x403504
push ebx
call fcn.0040adfe
mov esi, dword [ebp + 0x1d4]
push esi
push 0x4034c4
push 0xa
call fcn.0040adfe
add esp, 0x20
lea eax, [ebp - 0x70]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, ebx
je 0x40d2c1
push edi
push esi
push 0x403468
push 0x14
call fcn.0040adfe
add esp, 0x10
push edi
push esi
push 0x80001393
call fcn.0040aba1
push 0x40343c
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
jmp 0x40d77b
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xb0]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x403424
push dword [ebp - 0x70]
mov byte [ebp + 0x1b4], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40d2fd
push eax
push esi
push 0x4033c8
push 0x14
call fcn.0040adfe
add esp, 0x10
jmp 0x40d379
lea eax, [ebp + 0xb0]
push eax
push 0x40338c
push 0xa
call fcn.0040adfe
add esp, 0xc
mov esi, 0x105
push esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, eax
cmp edi, ebx
je 0x40d350
cmp edi, esi
ja 0x40d350
lea eax, [ebp - 0x58]
push eax
push 0x403354
push 0xa
call fcn.0040adfe
add esp, 0xc
mov dword [ebp - 0x68], 1
jmp 0x40d37c
push edi
lea eax, [ebp + 0xb0]
push eax
push 0x4032f8
push 0x14
call fcn.0040adfe
add esp, 0x10
push edi
lea eax, [ebp + 0xb0]
push eax
push 0x40001397
call fcn.0040aba1
mov dword [ebp - 0x68], ebx
push 0x4032b8
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x1c8], ebx
mov dword [ebp - 0x64], ebx
jbe 0x40d759
mov edi, dword [ebp + 0x1c4]
mov dword [ebp + 0x1d4], edi
push dword [edi]
push dword [ebp - 0x64]
push 0x403284
push ebx
call fcn.0040adfe
mov ecx, dword [edi]
mov eax, ecx
add esp, 0x10
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d3c8
sub eax, esi
mov dword [ebp - 0x60], ecx
jmp 0x40d71f
push 0x403280
push dword [ebp - 0x60]
call dword [sym.imp.msvcrt.dll_strstr]
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x40d72a
sub eax, dword [edi]
inc esi
inc esi
mov dword [ebp - 0x78], eax
mov eax, esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x60], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d405
sub eax, ecx
mov dword [ebp + 0x1c4], eax
je 0x40d731
push esi
call dword [sym.imp.msvcrt.dll_atol]
cmp eax, ebx
pop ecx
mov dword [ebp + 0x1c4], eax
jne 0x40d456
cmp byte [esi], 0x30
je 0x40d456
push 0x403238
push 0xa
call fcn.0040adfe
pop ecx
lea eax, [esi - 1]
pop ecx
mov dword [ebp - 0x60], eax
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d448
sub eax, ecx
jmp 0x40d71f
cmp dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
je 0x40d4fa
lea esi, [ebp - 0x58]
push 0x3b
push esi
call dword [sym.imp.msvcrt.dll_strchr]
mov ebx, eax
xor edi, edi
cmp ebx, edi
pop ecx
pop ecx
je 0x40d47b
mov byte [ebx], 0
push esi
push dword [ebp + 0x1c4]
push 0x4031d8
push 0xa
call fcn.0040adfe
add esp, 0x10
push esi
call fcn.0040d1c2
cmp eax, edi
jne 0x40d4a1
push esi
call fcn.0040d109
cmp ebx, edi
je 0x40d4a8
mov byte [ebx], 0x3b
cmp eax, edi
mov dword [ebp - 0x5c], edi
je 0x40d4dc
push edi
push 0x50
lea ecx, [ebp - 0x5c]
push ecx
push edi
push dword [ebp + 0x1c4]
push eax
push 0xb00
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
mov dword [ebp - 0x6c], eax
jne 0x40d57f
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x5c], 0
mov esi, ebx
inc ebx
neg esi
sbb esi, esi
and esi, ebx
jne 0x40d465
xor ebx, ebx
push dword [ebp - 0x6c]
push 0x403188
push 0xa
call fcn.0040adfe
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
add esp, 0xc
push dword [ebp - 0x5c]
call esi
push 0x40314c
push 0xa
mov dword [ebp - 0x5c], ebx
call fcn.0040adfe
pop ecx
pop ecx
push ebx
push 0x50
lea eax, [ebp - 0x5c]
push eax
push ebx
push dword [ebp + 0x1c4]
push dword [ebp + 0x1d8]
push 0xb00
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edi, eax
cmp edi, ebx
jne 0x40d57f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
push 0x403108
push 0xa
call fcn.0040adfe
add esp, 0xc
push ebx
push dword [ebp + 0x1c4]
push 0x400013a0
call fcn.0040aa6d
push dword [ebp - 0x5c]
call esi
and dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x74]
push 2
pop ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d588
sub eax, esi
jmp 0x40d5c8
mov esi, dword [ebp - 0x60]
movsx eax, byte [esi]
push eax
call dword [sym.imp.msvcrt.dll_isdigit]
test eax, eax
pop ecx
je 0x40d5d0
xor eax, eax
mov al, byte [esi]
inc ebx
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x40d5b6
inc esi
inc esi
mov eax, esi
mov dword [ebp - 0x60], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d5bf
sub eax, edx
mov dword [ebp + 0x1c4], eax
jne 0x40d593
mov eax, dword [ebp + 0x1d4]
mov ecx, dword [eax]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d5dd
sub eax, esi
sub eax, ebx
lea esi, [eax + edi + 1]
mov eax, ecx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d5f1
sub eax, ecx
inc eax
push esi
push eax
push 0x4030b8
push 0
mov dword [ebp + 0x1c4], eax
call fcn.0040adfe
add esp, 0x10
cmp esi, dword [ebp + 0x1c4]
jbe 0x40d6a5
mov eax, dword [ebp + 0x1d4]
push esi
push dword [eax]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
mov esi, eax
test esi, esi
je 0x40d793
push esi
push 0x40307c
push 0xa
call fcn.0040adfe
mov eax, dword [ebp + 0x1d4]
mov dword [eax], esi
mov eax, dword [ebp - 0x78]
add esi, eax
lea eax, [edi + esi]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x1cc]
mov ecx, edi
sub ecx, ebx
add dword [eax], ecx
mov eax, dword [eax]
push eax
sub eax, edi
add eax, ebx
push eax
push 0x403030
push 0
call fcn.0040adfe
mov eax, esi
add esp, 0x1c
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d67e
sub eax, ecx
inc eax
push eax
mov eax, edi
sub eax, ebx
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
add eax, esi
push esi
push eax
call ebx
push edi
push dword [ebp - 0x5c]
push esi
call ebx
add esp, 0x18
jmp 0x40d6e0
push 0x402ff0
push 0xa
call fcn.0040adfe
mov esi, dword [ebp - 0x74]
mov eax, dword [ebp + 0x1cc]
sub dword [eax], ebx
dec esi
dec esi
add ebx, esi
pop ecx
mov eax, ebx
pop ecx
mov dword [ebp - 0x60], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d6ca
sub eax, ecx
inc eax
push eax
push ebx
push esi
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
test edi, edi
je 0x40d6f1
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x5c], 0
mov eax, dword [ebp + 0x1d4]
push dword [eax]
push 0x402fc4
push 0
call fcn.0040adfe
mov eax, dword [ebp - 0x60]
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d70e
mov edi, dword [ebp + 0x1d4]
sub eax, ecx
xor ebx, ebx
cmp eax, 2
ja 0x40d3d9
jmp 0x40d73e
push 0x402f88
jmp 0x40d736
push 0x402f4c
push ebx
call fcn.0040adfe
pop ecx
pop ecx
inc dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
add edi, 4
cmp eax, dword [ebp + 0x1c8]
mov dword [ebp + 0x1d4], edi
jb 0x40d3ae
mov eax, dword [ebp + 0x1cc]
push dword [eax]
push 0x402f14
push ebx
call fcn.0040adfe
push 0x402ee4
push 0xa
call fcn.0040adfe
add esp, 0x14
mov ecx, dword [ebp + 0x1b8]
pop edi
pop esi
pop ebx
call fcn.00412b38
add ebp, 0x1bc
leave
ret 0x18
push 0x402e88
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc0000bc6
call fcn.0040a918
mov eax, dword [ebp + 0x1cc]
push dword [eax]
push 0x402f14
push 0
call fcn.0040adfe
add esp, 0xc
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40d77b