Function at 0x4ee562
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push 0x29c
mov eax, 0x5131f6
call fcn.004f41e2
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x29c], eax
test eax, eax
je 0x4ee591
mov ecx, eax
call fcn.004e2830
test esi, esi
je 0x4ee8b8
xor ebx, ebx
cmp word [esi], bx
je 0x4ee8b8
push esi
call fcn.004e5a5b
mov esi, eax
push esi
call fcn.004e5a3d
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
xor edx, edx
mov ecx, 0x522e88
test eax, eax
push ebx
cmovne ecx, edx
push ecx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x278]
call fcn.004e2531
mov esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2a8], 0x200
inc ebx
mov dword [ebp - 0x2a4], 0x100
mov dword [ebp - 0x280], esi
xor edx, edx
mov byte [ebp - 0x279], dl
test esi, esi
je 0x4ee618
call fcn.004e3cd3
xor edx, edx
test al, al
je 0x4ee618
mov eax, dword [ebp + esi*4 - 0x2ac]
jmp 0x4ee61a
mov eax, edx
cmp esi, 2
jne 0x4ee627
test eax, eax
je 0x4ee8a5
lea ecx, [ebp - 0x28c]
or eax, 0x20019
push ecx
push eax
push edx
lea ecx, [ebp - 0x278]
call fcn.0044612f
push eax
xor eax, eax
test esi, esi
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ee895
push 0x20a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x284], 0x208
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x288]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ee880
cmp dword [ebp - 0x288], ebx
jne 0x4ee6b8
lea esi, [ebp - 0x21c]
jmp 0x4ee6dc
cmp dword [ebp - 0x288], 2
jne 0x4ee880
lea eax, [ebp - 0x21c]
push eax
call fcn.004e2cec
mov esi, eax
pop ecx
test esi, esi
je 0x4ee87a
push ebx
push esi
call fcn.004e5ac5
mov edi, eax
push 0
push edi
call fcn.004e2e74
add esp, 0x10
test al, al
je 0x4ee87a
mov ecx, dword [ebp - 0x294]
push 0xffffffffffffffff
push edi
call fcn.004e2ad6
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x279], bl
cmp esi, eax
je 0x4ee71d
push esi
call fcn.004e1bea
pop ecx
cmp byte [ebp + 0x10], 0
je 0x4ee87a
xor ecx, ecx
lea eax, [ebp - 0x284]
push eax
push ecx
lea eax, [ebp - 0x288]
mov dword [ebp - 0x284], ecx
push eax
push ecx
push 0x52aa44
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ee87a
cmp dword [ebp - 0x284], eax
je 0x4ee87a
push 0x52aa44
call fcn.004e34b2
mov ecx, dword [ebp - 0x284]
mov edi, eax
add ecx, 4
push ebx
push ecx
call fcn.004e1c42
xor ecx, ecx
mov ebx, eax
add esp, 0xc
mov esi, ecx
mov dword [ebp - 0x2a0], esi
test ebx, ebx
je 0x4ee861
lea eax, [ebp - 0x284]
push eax
push ebx
lea eax, [ebp - 0x288]
push eax
push ecx
push 0x52aa44
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4ee85a
cmp word [ebx], ax
je 0x4ee85a
test edi, edi
je 0x4ee7d6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x298], eax
cmp esi, eax
jl 0x4ee817
movzx ecx, word [edi + eax*2]
cmp ecx, 0x3b
je 0x4ee7f5
test cx, cx
jne 0x4ee817
mov esi, ecx
xor ecx, ecx
push ebx
push edi
mov word [edi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb al, al
and al, 1
mov eax, dword [ebp - 0x298]
mov word [edi + eax*2], si
je 0x4ee854
mov eax, dword [ebp - 0x29c]
test eax, eax
je 0x4ee829
push edi
mov ecx, eax
call fcn.004e2aa8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push 0x547318
push ebx
call fcn.004e23a5
mov esi, eax
add esp, 0x24
test esi, esi
je 0x4ee85a
push esi
push 0x52aa44
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x4ee85a
mov esi, dword [ebp - 0x2a0]
push ebx
call fcn.004e1bea
pop ecx
test edi, edi
je 0x4ee86c
push edi
call fcn.004e1bea
pop ecx
test esi, esi
je 0x4ee877
push esi
call fcn.004e1bea
pop ecx
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x280]
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x279], 0
jne 0x4ee8a9
inc esi
mov dword [ebp - 0x280], esi
cmp esi, 3
jl 0x4ee5f8
xor eax, eax
mov bl, al
lea ecx, [ebp - 0x278]
call fcn.004e25e0
mov al, bl
jmp 0x4ee8ba
xor al, al
call fcn.004f418c
ret