Function at 0x40ecef
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x443baf
call fcn.00428c84
sub esp, 0x72c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x1c]
call fcn.00401621
xor eax, eax
xor esi, esi
mov word [ebp - 0x120], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], esi
cmp dword [eax - 0xc], esi
je 0x40f031
push 0x44af78
lea ecx, [ebp - 0x1c]
call fcn.0040d38f
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push dword [ebp - 0x1c]
push SysReAllocStringLen
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40eda3
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ed9e
cmp dword [ebp - 0x10], 1
jne 0x40ed9e
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x120]
push 0x40
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x120]
push eax
call fcn.004304f5
pop ecx
test eax, eax
je 0x40f031
push str.CLSID_
lea eax, [ebp - 0x220]
push 0x80
push eax
call fcn.0043283e
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x220]
push 0x80
push eax
call fcn.004327c9
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x220]
push eax
push SysReAllocStringLen
call edi
test eax, eax
je 0x40ee56
push str.Wow6432NodeCLSID_
lea eax, [ebp - 0x220]
push 0x80
push eax
call fcn.0043283e
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x220]
push 0x80
push eax
call fcn.004327c9
add esp, 0x18
lea eax, [ebp - 0x18]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x220]
push eax
push SysReAllocStringLen
call edi
test eax, eax
jne 0x40f031
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push str.TypeLib
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x40eece
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x80
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f02a
cmp dword [ebp - 0x10], 1
jne 0x40f02a
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.0040f35d
mov edi, eax
test edi, edi
jle 0x40f02a
push dword [ebp + 8]
call ebx
jmp 0x40f033
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push str.InprocServer32
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x40ef84
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x105
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40ef7f
cmp dword [ebp - 0x10], 1
je 0x40ef1b
cmp dword [ebp - 0x10], 2
jne 0x40ef7f
cmp dword [ebp - 0x10], 2
jne 0x40ef56
mov edi, 0x104
lea eax, [ebp - 0x738]
push edi
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40ef56
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x52c]
push edi
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0040f5fd
mov edi, eax
test edi, edi
jg 0x40eec4
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp + 8]
call ebx
lea eax, [ebp + 8]
push eax
push 0x20019
push esi
push str.LocalServer32
push dword [ebp - 0x18]
call edi
test eax, eax
jne 0x40f035
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x105
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f02a
cmp dword [ebp - 0x10], 1
je 0x40efd1
cmp dword [ebp - 0x10], 2
jne 0x40f02a
cmp dword [ebp - 0x10], 2
jne 0x40f00c
mov edi, 0x104
lea eax, [ebp - 0x738]
push edi
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40f00c
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x52c]
push edi
push eax
call fcn.0043283e
add esp, 0xc
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0040f5fd
jmp 0x40eeba
push dword [ebp + 8]
call ebx
jmp 0x40f035
mov edi, esi
mov esi, edi
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.00401b78
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8