Function at 0x4af58c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x101c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004052cc
mov eax, dword [ebp - 8]
call fcn.004052cc
xor eax, eax
push ebp
push 0x4af834
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404e30
call fcn.004af4a0
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x4af7fc
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, esi
mov eax, dword [ebp - 0x14]
call fcn.0042b3f8
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.0042b53c
test al, al
je 0x4af7e6
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042be70
test al, al
je 0x4af7e6
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004052dc
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
push eax
call fcn.0040767c
mov eax, dword [ebp - 0x10]
dec eax
je 0x4af65c
dec eax
je 0x4af66e
add eax, 0xfffffffe
sub eax, 2
jb 0x4af6b2
dec eax
je 0x4af6c9
jmp 0x4af703
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042bc70
jmp 0x4af7de
mov ecx, ebx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042bc70
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1015]
push eax
mov eax, dword [ebx]
call fcn.004052dc
push eax
call fcn.00407714
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4af7de
mov eax, ebx
lea edx, [ebp - 0x1015]
call fcn.00405028
jmp 0x4af7de
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042bce8
mov edx, ebx
call fcn.0040a434
jmp 0x4af7de
mov eax, ebx
call fcn.00404e30
cmp dword [ebp - 0xc], 0xffffffff
jle 0x4af7de
mov eax, dword [ebp - 0xc]
add eax, eax
push eax
lea ecx, [ebp - 0x1015]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042bd30
mov eax, ebx
lea edx, [ebp - 0x1015]
call fcn.00405028
jmp 0x4af7de
mov eax, ebx
call fcn.00404e30
cmp dword [ebp - 0xc], 0xffffffff
jle 0x4af7de
cmp dword [ebp - 0xc], 0x1001
jle 0x4af724
mov dword [ebp - 0xc], 0x1001
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1015]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.0042bd30
cmp byte [ebp + 0xc], 0
je 0x4af79b
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4af788
inc esi
lea edi, [ebp - 0x1015]
lea eax, [ebp - 0x101c]
push eax
movzx eax, byte [edi]
mov dword [ebp - 0x1024], eax
mov byte [ebp - 0x1020], 0
lea edx, [ebp - 0x1024]
xor ecx, ecx
mov eax, 0x4af84c
call fcn.0040b9ac
mov edx, dword [ebp - 0x101c]
mov eax, ebx
call fcn.00405118
inc edi
dec esi
jne 0x4af74e
mov eax, dword [ebx]
call fcn.0040510c
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040556c
jmp 0x4af7de
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4af7de
inc esi
lea edi, [ebp - 0x1015]
movzx eax, byte [edi]
sub al, 0x20
jae 0x4af7bf
mov eax, ebx
mov edx, 0x4af85c
call fcn.00405118
jmp 0x4af7da
lea eax, [ebp - 0x1028]
movzx edx, byte [edi]
call fcn.00405018
mov edx, dword [ebp - 0x1028]
mov eax, ebx
call fcn.00405118
inc edi
dec esi
jne 0x4af7aa
mov eax, dword [ebp - 0x14]
call fcn.0042b3c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af803
mov eax, dword [ebp - 0x14]
call fcn.00403ef0
ret