Function at 0x4c9740
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov edi, edx
mov ebx, ecx
mov eax, dword [ecx + 0xc0]
test eax, eax
je 0x4c9780
push eax
call fcn.004c78a0
add esp, 4
test eax, eax
je 0x4c99bb
test edi, edi
je 0x4c97a6
mov ecx, dword [0xad5c18]
push eax
call dword [ecx]
add esp, 4
jmp 0x4c9788
test edi, edi
je 0x4c9914
push str.CARES_HOSTS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
push eax
call fcn.004c78a0
add esp, 4
test eax, eax
je 0x4c99bb
mov dword [esp + 0x20], ebx
mov esi, dword [ebx + 0xc8]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
add esp, 8
test esi, esi
je 0x4c9827
test eax, eax
setne al
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov ecx, edi
or ecx, ebx
sete cl
or cl, al
cmp cl, 1
jne 0x4c97f6
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov edi, eax
mov ebx, edx
add edi, 0xffffffc4
adc ebx, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4c9827
cmp edi, dword [esi]
sbb ebx, dword [esi + 4]
jge 0x4c9827
mov eax, dword [0xad5c18]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
xor ebx, ebx
jmp 0x4c9a0c
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0xc8]
test esi, esi
je 0x4c985f
mov edi, dword [0xad5c18]
push dword [esi + 8]
call dword [edi]
add esp, 4
push dword [esi + 0x10]
call fcn.004be2b0
add esp, 4
push dword [esi + 0xc]
call fcn.004be2b0
add esp, 4
push esi
call dword [edi]
add esp, 4
mov dword [ebx + 0xc8], 0
call fcn.004c5ca0
mov esi, eax
test eax, eax
je 0x4c99f0
push esi
push dword [esp + 0x14]
call fcn.004c77b0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4c99f5
push 0x18
call fcn.004b4fe0
add esp, 4
test eax, eax
je 0x4c99f0
mov ebx, eax
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov dword [ebx + 4], edx
mov dword [ebx], eax
push dword [esp + 0x10]
call fcn.004c78a0
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
je 0x4c99c2
push 0x4ca570
call fcn.004be2d0
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4c99c2
push 0
call fcn.004be2d0
add esp, 4
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4c99c2
mov dword [esp + 8], ebx
push esi
call fcn.004c63f0
add esp, 4
test eax, eax
je 0x4c9f66
lea edi, [esp + 0x14]
jmp 0x4c9a3f
lea esi, [esp + 0x28]
push 0x104
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 0x24], 0x104
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4c995a
mov ebx, 4
jmp 0x4c9a0c
lea eax, [esp + 0x24]
lea edi, [esp + 0x130]
push eax
push edi
push 0
push 0
push str.DatabasePath
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [esp + eax + 0x28], 0x736f685c
mov dword [esp + eax + 0x2b], 0x737473
push esi
call fcn.004c78a0
add esp, 4
test eax, eax
jne 0x4c97a6
mov ebx, 0xf
jmp 0x4c9a0c
mov edi, esi
mov esi, dword [0xad5c18]
push dword [ebx + 8]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004be2b0
add esp, 4
push dword [ebx + 0xc]
call fcn.004be2b0
add esp, 4
push ebx
call dword [esi]
mov esi, edi
add esp, 4
mov ebx, 0xf
push esi
call fcn.004c5d00
add esp, 4
mov eax, dword [0xad5c18]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 0xf
je 0x4c9fc1
push 1
push esi
call fcn.004c6840
add esp, 8
push esi
call fcn.004c63f0
add esp, 4
test eax, eax
lea edi, [esp + 0x14]
je 0x4c9f66
mov byte [esp + 0x14], 0x23
push 0
push esi
call fcn.004c6740
add esp, 8
push esi
call fcn.004c63f0
add esp, 4
test eax, eax
je 0x4c9f66
push 1
push edi
push esi
call fcn.004c6d60
add esp, 0xc
test eax, eax
jne 0x4c9a1f
push esi
call fcn.004c6200
add esp, 4
push esi
call fcn.004c67e0
add esp, 4
push 0x41
lea edi, [esp + 0x2c]
push edi
push esi
call fcn.004c6320
add esp, 0xc
test eax, eax
jne 0x4c9a16
xorps xmm0, xmm0
movaps xmmword [esp + 0x130], xmm0
mov dword [esp + 0x140], 0
lea ebx, [esp + 0x134]
push ebx
push edi
push 2
call fcn.004bd120
add esp, 0xc
mov ecx, 2
test eax, eax
jg 0x4c9ae1
push ebx
push edi
push 0x17
call fcn.004bd120
add esp, 0xc
mov ecx, 0x17
test eax, eax
jle 0x4c9a1f
mov dword [esp + 0x130], ecx
push 0x41
push edi
push ebx
push ecx
call fcn.004bd190
add esp, 0x10
test eax, eax
je 0x4c9a1f
push 0xc
call fcn.004b4fe0
add esp, 4
test eax, eax
je 0x4c9fc1
mov ebx, eax
mov eax, dword [0xad5c18]
push dword [eax]
call fcn.004be730
add esp, 4
mov dword [esp + 4], ebx
mov dword [ebx + 4], eax
test eax, eax
je 0x4c9f84
push edi
call fcn.004c78a0
add esp, 4
test eax, eax
je 0x4c9f84
mov edi, eax
push eax
mov ebx, dword [esp + 8]
push dword [ebx + 4]
call fcn.004be760
add esp, 8
test eax, eax
je 0x4c9f8a
mov eax, dword [0xad5c18]
push dword [eax]
call fcn.004be730
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
jne 0x4c9b8c
jmp 0x4ca002
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bea00
add esp, 4
test eax, eax
je 0x4c9f2d
push esi
call fcn.004c63f0
add esp, 4
test eax, eax
je 0x4c9c9a
mov byte [esp + 0x130], 0x23
push 0
push esi
call fcn.004c6740
add esp, 8
push esi
call fcn.004c63f0
add esp, 4
test eax, eax
lea edi, [esp + 0x28]
je 0x4c9c9a
push 1
lea eax, [esp + 0x134]
push eax
push esi
call fcn.004c6d60
add esp, 0xc
test eax, eax
jne 0x4c9c9a
push esi
call fcn.004c6200
add esp, 4
push esi
call fcn.004c67e0
add esp, 4
test eax, eax
je 0x4c9c9a
push 0x100
push edi
push esi
call fcn.004c6320
add esp, 0xc
test eax, eax
jne 0x4c9b75
push edi
call fcn.004c7b70
add esp, 4
test eax, eax
je 0x4c9b8c
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4c9c66
mov edi, eax
push edi
call fcn.004be9f0
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4c9b8c
push edi
call fcn.004be9d0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c9c37
lea eax, [esp + 0x28]
push eax
call fcn.004c78a0
add esp, 4
test eax, eax
je 0x4ca011
mov edi, eax
push eax
mov eax, dword [esp + 8]
push dword [eax + 8]
call fcn.004be7c0
add esp, 8
test eax, eax
jne 0x4c9b8c
jmp 0x4ca006
mov edi, dword [esp + 4]
push dword [edi + 8]
call fcn.004bea00
add esp, 4
test eax, eax
je 0x4c9f31
push dword [edi + 8]
call fcn.004bea00
add esp, 4
mov dword [esp + 0x1c], eax
push dword [edi + 4]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4c9cfd
mov edi, eax
push edi
call fcn.004be9f0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004be4a0
add esp, 8
test eax, eax
jne 0x4c9d47
push edi
call fcn.004be9d0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c9cd1
mov ebx, dword [esp + 4]
push dword [ebx + 8]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4c9d53
mov edi, eax
push edi
call fcn.004be9f0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004be4a0
add esp, 8
test eax, eax
jne 0x4c9d5a
push edi
call fcn.004be9d0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c9d12
mov eax, dword [esp + 4]
jmp 0x4c9e69
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x18], eax
jmp 0x4c9dca
mov eax, ebx
jmp 0x4c9e69
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4c9dc2
mov edi, eax
jmp 0x4c9d9a
mov eax, dword [esp + 0xc]
push dword [eax + 4]
push edi
call fcn.004bec80
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004be960
add esp, 4
mov edi, eax
test eax, eax
je 0x4c9dc2
push edi
call fcn.004be9f0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004be4a0
add esp, 8
test eax, eax
je 0x4c9d75
push edi
call fcn.004beac0
add esp, 4
jmp 0x4c9d85
mov dword [esp + 0x18], 0
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004be960
add esp, 4
test eax, eax
je 0x4c9e2e
mov edi, eax
jmp 0x4c9e06
mov eax, dword [esp + 0xc]
push dword [eax + 8]
push edi
call fcn.004bec80
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004be960
add esp, 4
mov edi, eax
test eax, eax
je 0x4c9e2e
push edi
call fcn.004be9f0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004be4a0
add esp, 8
test eax, eax
je 0x4c9de1
push edi
call fcn.004beac0
add esp, 4
jmp 0x4c9df1
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c9e3d
dec eax
mov dword [edi], eax
jne 0x4c9e5e
push dword [edi + 8]
call fcn.004bebf0
add esp, 4
push dword [edi + 4]
call fcn.004bebf0
add esp, 4
push edi
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
cmp byte [esp + 0x18], 0
mov eax, dword [esp + 0xc]
jne 0x4c9eb3
push dword [eax + 4]
mov ebx, eax
call fcn.004bea40
add esp, 4
push 0
mov dword [esp + 8], eax
push eax
mov edi, dword [esp + 0x10]
push dword [edi + 0xc]
call fcn.004be440
add esp, 0xc
test eax, eax
je 0x4c9e94
mov eax, ebx
jmp 0x4c9eb3
push ebx
push dword [esp + 8]
push dword [edi + 0xc]
call fcn.004be3c0
add esp, 0xc
mov ecx, dword [ebx]
test eax, eax
mov eax, ebx
je 0x4ca04a
inc ecx
mov dword [eax], ecx
mov dword [esp + 0xc], eax
push dword [eax + 8]
call fcn.004be9c0
add esp, 4
test eax, eax
je 0x4c9a1f
mov ebx, eax
inc dword [esp + 0x1c]
jmp 0x4c9ee5
push ebx
call fcn.004be9e0
add esp, 4
mov ebx, eax
test eax, eax
je 0x4c9a1f
push ebx
call fcn.004be9f0
add esp, 4
dec dword [esp + 0x1c]
je 0x4c9a1f
mov edi, eax
push 0
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004be440
add esp, 0xc
test eax, eax
jne 0x4c9ed2
push dword [esp + 0xc]
push edi
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004be3c0
add esp, 0xc
test eax, eax
jne 0x4c9ed2
jmp 0x4c9fc1
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c9f40
dec eax
mov dword [edi], eax
jne 0x4c9a1f
push dword [edi + 8]
call fcn.004bebf0
add esp, 4
push dword [edi + 4]
call fcn.004bebf0
add esp, 4
push edi
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
jmp 0x4c9a1f
push esi
call fcn.004c5d00
add esp, 4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
mov dword [eax + 0xc8], ecx
xor ebx, ebx
jmp 0x4c99fe
mov ebx, dword [esp + 4]
jmp 0x4c9f95
push edi
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x4c9fa0
dec eax
mov dword [ebx], eax
jne 0x4c9fc1
push dword [ebx + 8]
call fcn.004bebf0
add esp, 4
push dword [ebx + 4]
call fcn.004bebf0
add esp, 4
push ebx
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
mov ebx, dword [esp + 8]
push esi
call fcn.004c5d00
add esp, 4
push dword [ebx + 8]
mov esi, dword [0xad5c18]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004be2b0
add esp, 4
push dword [ebx + 0xc]
call fcn.004be2b0
add esp, 4
push ebx
call dword [esi]
add esp, 4
mov ebx, 0xf
jmp 0x4c99fe
mov edi, ebx
jmp 0x4ca015
push edi
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
mov ebx, dword [esp + 8]
je 0x4ca024
dec eax
mov dword [edi], eax
jne 0x4c9fc5
push dword [edi + 8]
call fcn.004bebf0
add esp, 4
push dword [edi + 4]
call fcn.004bebf0
add esp, 4
push edi
mov eax, dword [0xad5c18]
call dword [eax]
add esp, 4
jmp 0x4c9fc5
test ecx, ecx
je 0x4ca057
dec ecx
mov dword [eax], ecx
jne 0x4c9fc1
mov edi, eax
push dword [eax + 8]
call fcn.004bebf0
add esp, 4
push dword [edi + 4]
call fcn.004bebf0
add esp, 4
push edi
jmp 0x4c9fb7