Function at 0x40fd20
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x113c
call fcn.0045db90
mov eax, dword [0x4920c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov ecx, 0x800
lea eax, [ebp - 0x8d0]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x40fd43
cmp byte [0x495bc0], cl
jne 0x40fd63
cmp byte [0x495bc1], cl
jne 0x40fd63
push str._ProgramFiles__
jmp 0x40fd68
push str._ProgramFiles_x86___
lea eax, [ebp - 0xd0]
push 0x64
push eax
call fcn.004513ee
add esp, 0xc
cmp dword [0x495aac], 8
lea ecx, [ebp - 0x10d8]
push ecx
push 0xf023f
mov eax, 0x495a98
cmovae eax, dword [0x495a98]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40fe01
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x8d0]
push eax
push 0
push 0
push str.Inno_Setup:_App_Path
push dword [ebp - 0x10d8]
mov dword [ebp - 0x10d4], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fdf0
lea ecx, [ebp - 0x8d0]
call fcn.0040fb00
test al, al
jne 0x40fdf9
xor eax, eax
mov word [ebp - 0x8d0], ax
push dword [ebp - 0x10d8]
call esi
lea ecx, [ebp - 0x8d0]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fe10
sub ecx, edx
sar ecx, 1
jne 0x40fea7
cmp dword [0x495a94], 8
lea ecx, [ebp - 0x10d8]
push ecx
push 0xf023f
mov eax, 0x495a80
cmovae eax, dword [0x495a80]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fea7
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x8d0]
push eax
push 0
push 0
push str.Inno_Setup:_App_Path
push dword [ebp - 0x10d8]
mov dword [ebp - 0x10d4], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fe96
lea ecx, [ebp - 0x8d0]
call fcn.0040fb00
test al, al
jne 0x40fe9f
xor eax, eax
mov word [ebp - 0x8d0], ax
push dword [ebp - 0x10d8]
call esi
lea ecx, [ebp - 0x8d0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40feb0
mov esi, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
sub ecx, edx
sar ecx, 1
jne 0x40ff5a
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.004513ee
add esp, 0xc
lea eax, [ebp - 0x1124]
push 0
push eax
mov ecx, 0x495a20
call fcn.0040a370
cmp dword [eax + 0x14], 8
jb 0x40ff01
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebp - 0x1110], 8
jb 0x40ff2d
push dword [ebp - 0x1124]
call fcn.00450920
add esp, 4
push 0x400
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
lea ecx, [ebp - 0x8d0]
call fcn.0040fb00
test al, al
jne 0x40ff5a
xor eax, eax
mov word [ebp - 0x8d0], ax
lea ecx, [ebp - 0x8d0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ff63
sub ecx, edx
sar ecx, 1
jne 0x410007
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.004513ee
add esp, 0xc
lea eax, [ebp - 0x10f4]
push 0
push eax
mov ecx, 0x495a10
call fcn.0040a370
cmp dword [eax + 0x14], 8
jb 0x40ffae
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebp - 0x10e0], 8
jb 0x40ffda
push dword [ebp - 0x10f4]
call fcn.00450920
add esp, 4
push 0x400
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
lea ecx, [ebp - 0x8d0]
call fcn.0040fb00
test al, al
jne 0x410007
xor eax, eax
mov word [ebp - 0x8d0], ax
lea ecx, [ebp - 0x8d0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410010
sub ecx, edx
sar ecx, 1
jne 0x4100e4
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.004513ee
add esp, 0xc
cmp dword [0x496430], 3
push 0
jne 0x41008a
lea eax, [ebp - 0x110c]
push eax
mov ecx, 0x495a20
call fcn.0040a370
cmp dword [eax + 0x14], 8
jb 0x410064
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebp - 0x10f8], 8
jb 0x4100cf
push dword [ebp - 0x110c]
jmp 0x4100c7
lea eax, [ebp - 0x113c]
push eax
mov ecx, 0x495a10
call fcn.0040a370
cmp dword [eax + 0x14], 8
jb 0x4100a3
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x10d0]
push 0x400
push eax
call fcn.00451274
add esp, 0xc
cmp dword [ebp - 0x1128], 8
jb 0x4100cf
push dword [ebp - 0x113c]
call fcn.00450920
add esp, 4
push 0x400
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
cmp word [ebp - 0x8d0], 0
jne 0x4100f2
xor ecx, ecx
jmp 0x41010f
lea ecx, [ebp - 0x8d0]
lea edx, [ecx + 2]
jmp 0x410100
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410100
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x8d0]
push eax
mov ecx, 0x495d04
call fcn.004023a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044fdac
mov esp, ebp
pop ebp
ret