Function at 0x4a8392
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x18], 0
sub esp, 0xc
push dword [ebp + 8]
call fcn.004a82a0
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4a83c2
mov dword [ebp - 0x20], 0
jmp 0x4a86a4
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x4a8422
cmp dword [ebp + 8], 0
je 0x4a83f4
mov dword [ebp - 0x20], 0
jmp 0x4a86a4
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x4a8422
mov dword [ebp - 0x20], 0
jmp 0x4a86a4
mov dword [ebp - 0x10], 1
sub esp, 8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x4a84b3
cmp dword [ebp + 8], 0
je 0x4a8453
jmp 0x4a8690
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
je 0x4a848f
mov dword [ebp - 0x20], 0
jmp 0x4a86a4
sub esp, 8
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x4a84b3
jmp 0x4a8690
sub esp, 0xc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a84d7
jmp 0x4a8690
sub esp, 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x4a8513
sub esp, 0xc
push dword [ebp - 0x18]
call sub.msvcrt.dll_free
add esp, 0x10
mov dword [ebp - 0x18], 0
jmp 0x4a8690
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x18]
mov byte [eax], 0
cmp dword [ebp - 0x14], 2
jne 0x4a8690
sub esp, 8
push 0x25
push dword [ebp - 0x18]
call sub.msvcrt.dll_strchr
add esp, 0x10
test eax, eax
je 0x4a8690
lea eax, [ebp - 0xc]
add dword [eax], 0x3e8
sub esp, 0xc
mov eax, dword [ebp - 0xc]
inc eax
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4a8565
jmp 0x4a8690
sub esp, 4
push dword [ebp - 0xc]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a861b
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x4a861b
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
sub esp, 0xc
mov eax, dword [ebp - 0xc]
inc eax
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4a85c4
jmp 0x4a8690
sub esp, 4
push dword [ebp - 0xc]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4a85fc
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x4a85fc
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
add esp, 0x10
jmp 0x4a8690
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov byte [eax], 0
sub esp, 0xc
push dword [ebp - 0x18]
call sub.msvcrt.dll_free
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x4a8690
cmp dword [ebp - 0x10], 0
je 0x4a8682
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
mov byte [eax], 0
sub esp, 0xc
push dword [ebp - 0x18]
call sub.msvcrt.dll_free
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_strlen
add esp, 4
inc eax
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4a8661
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x4a8690
sub esp, 8
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.msvcrt.dll_strcpy
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
add esp, 0x10
jmp 0x4a8690
sub esp, 0xc
push dword [ebp - 0x1c]
call sub.msvcrt.dll_free
add esp, 0x10
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
leave
ret