Function at 0x4060f8
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4060ff
call fcn.00489fe0
push dword [esp + 0x50]
call fcn.00440320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00440000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00440000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x406150
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00487720
call fcn.0048a040
mov edx, 0x546960
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x4061b6
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 8]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004877c0
lea eax, [esp + 4]
push eax
call fcn.00489f10
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004877c0
call fcn.0048a040
mov edx, 0x546960
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x40621c
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 8]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00487720
lea eax, [esp + 4]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406237
push 0x560bdc
push 0x24
push dword [esp + 0x54]
call fcn.00488d30
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4062c0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40628e
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00489f10
cmp dword [esp + 0x14], 0
je 0x40629e
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x544028
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
jmp 0x4069da
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x406348
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40631d
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00489f10
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x544028
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
jmp 0x4069da
cmp dword [esp + 0x20], 0
je 0x4063b3
push dword [esp + 0x20]
call fcn.00488da0
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4063b3
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406388
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00440008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x544028
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
jmp 0x4069da
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x406443
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406418
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00489f10
push dword [esp + 0x1c]
call fcn.00488f10
mov edx, 0x544028
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
jmp 0x4069da
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406456
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x406645
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x406521
mov dword [esp + 0x30], 0
jmp 0x406482
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x40651c
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov edx, 0x5450a2
push edx
call fcn.00489eb0
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov eax, 0x545638
push eax
push 2
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00488f30
cdq
push edx
push eax
call fcn.00487d00
call fcn.00440302
add dword [esp], edx
call fcn.00487d80
pop eax
mov edx, 0x545358
push edx
call fcn.00489eb0
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
inc dword [esp + 0x30]
jno 0x406482
jmp 0x4065c5
mov dword [esp + 0x30], 0
jmp 0x40652b
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4065c5
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov edx, 0x5450a2
push edx
call fcn.00489eb0
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov eax, 0x545638
push eax
push 2
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00488f30
cdq
push edx
push eax
call fcn.00487d00
call fcn.00440302
add dword [esp], edx
call fcn.00487d80
pop eax
mov edx, 0x545358
push edx
call fcn.00489eb0
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
inc dword [esp + 0x30]
jno 0x40652b
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x18]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00487720
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406613
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00440320
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
add esp, 4
jmp 0x4069da
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4066a2
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406672
mov eax, dword [esp + 0x20]
call fcn.004402c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.004402c0
cdq
push edx
push eax
call fcn.00487550
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
jmp 0x4069a8
mov ebx, 2
cmp ebx, dword [esp]
jne 0x406778
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x406773
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.00488da0
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x406771
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x406768
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.00488f40
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406768
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00489f10
push dword [esp + 0x10]
call fcn.00487790
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00488f10
jmp 0x406773
jmp 0x4069a8
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4068e4
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x406842
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00488f40
call fcn.0048a040
mov edx, 0x544028
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x4067f8
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov edx, 0x544628
push edx
call fcn.00489eb0
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
jmp 0x406838
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00488f40
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
add dword [esp + 0x30], 2
jmp 0x406786
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.004877c0
call fcn.0048a040
mov edx, 0x544628
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x4068a8
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x18]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00487720
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4068df
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00489f10
push dword [esp + 0x10]
call fcn.00487790
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x4069a8
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x406944
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406918
push dword [esp + 0x20]
call fcn.00488fb0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x28]
call fcn.00488fb0
push edx
push eax
call fcn.00487550
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
jmp 0x4069a8
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4069a8
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x28]
call fcn.00488fc0
lea eax, [esp + 0x14]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4069a8
mov edx, dword [esp + 0x10]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00489f10
push dword [esp + 0x10]
call fcn.00487790
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00488f10
mov edx, dword [esp + 0xc]
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489eb0
pop eax
push eax
call fcn.004402f0
pop edx
add eax, edx
jmp 0x4069da
push dword [esp]
call fcn.0048a070
push dword [esp + 0xc]
call fcn.0048a070
push dword [esp + 4]
call fcn.0048a070
add esp, 0x30
pop ebx
pop ebp
ret 0x14