Function at 0x4ad07e13
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
cmp ax, dx
jmp 0x4ad0808b
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.4ad02c26
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 2
pop edx
cmp dword [ebp + 0xc], edx
mov dword [ebp - 0x1024], 0x80000002
mov dword [ebp - 0x1020], 0x80000001
jl 0x4ad080f9
cmp byte [0x4ad40670], 0
je 0x4ad07e5f
mov byte [0x4ad24081], 1
push ebx
lea ecx, [ebp - 0x1024]
push esi
sub ecx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edx
mov ebx, 0x1000
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 0x1014]
push 0x2000000
xor esi, esi
push esi
push 0x4ad081e8
push dword [ecx + eax]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ad080d3
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad081c4
push dword [ebp - 0x1010]
mov dword [ebp - 0x1008], esi
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad164bf
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad081a0
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad07f31
cmp dword [ebp - 0x1008], 4
jne 0x4ad0823d
cmp dword [ebp - 0x1004], esi
setne al
mov byte [0x4ad24081], al
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad0817c
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad16519
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad08160
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad07fa9
cmp dword [ebp - 0x1008], 4
jne 0x4ad0824f
mov ax, word [ebp - 0x1004]
mov word [0x4ad2408a], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad08140
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad0800a
cmp dword [ebp - 0x1008], 4
jne 0x4ad16570
mov ax, word [ebp - 0x1004]
mov word [0x4ad240a0], ax
cmp ax, si
je 0x4ad08001
cmp ax, 0xd
je 0x4ad08001
cmp ax, 0x20
jbe 0x4ad0800a
push 0x20
pop eax
mov word [0x4ad240a0], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad08118
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad08261
cmp dword [ebp - 0x1008], 4
jne 0x4ad1659b
mov ax, word [ebp - 0x1004]
mov word [0x4ad240a4], ax
cmp ax, si
je 0x4ad08066
cmp ax, 0xd
je 0x4ad08066
cmp ax, 0x20
jbe 0x4ad0806f
push 0x20
pop eax
mov word [0x4ad240a4], ax
mov cx, word [0x4ad240a0]
push 0x20
pop edx
cmp cx, dx
jne 0x4ad07e06
cmp ax, dx
jb 0x4ad165c6
jne 0x4ad08096
cmp cx, dx
jb 0x4ad165d1
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad08108
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad165dd
push dword [ebp - 0x1010]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
add dword [ebp - 0x1014], 4
dec dword [ebp - 0x1018]
jne 0x4ad08232
push esi
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4ad013a9
leave
ret 8
mov ecx, dword [ebp - 0x101c]
jmp 0x4ad07e87
cmp dword [ebp - 0x1008], 1
je 0x4ad164ff
jmp 0x4ad07f31
cmp dword [ebp - 0x1008], 1
je 0x4ad16559
jmp 0x4ad07fa9
mov ax, word [0x4ad240a4]
jmp 0x4ad0806f
cmp dword [ebp - 0x1008], 4
jne 0x4ad164d3
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad164f5
cmp dword [ebp - 0x1008], 1
jne 0x4ad07ee9
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad406b0], al
jmp 0x4ad07ee9
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
jmp 0x4ad07f2c
cmp dword [ebp - 0x1008], 4
jne 0x4ad1652d
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad1654f
cmp dword [ebp - 0x1008], 1
jne 0x4ad07f62
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad24082], al
jmp 0x4ad07f62
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad07fa3
cmp dword [ebp - 0x1008], 1
jne 0x4ad16590
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad07fea
mov ax, word [0x4ad240a0]
jmp 0x4ad07ff0
cmp dword [ebp - 0x1008], 1
jne 0x4ad165bb
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad0804f
mov ax, word [0x4ad240a4]
jmp 0x4ad08055
mov word [0x4ad240a0], ax
jmp 0x4ad08096
mov word [0x4ad240a4], cx
jmp 0x4ad08096
cmp dword [ebp - 0x1008], 2
jne 0x4ad1662e
mov eax, dword [ebp - 0x100c]
shr eax, 1
mov ecx, 0x7fe
sub ecx, eax
lea esi, [ebp + eax*2 - 0x1000]
push ecx
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4ad16623
push esi
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad0185a
jmp 0x4ad1662c
xor eax, eax
mov word [ebp - 0x1004], ax
xor esi, esi
cmp word [ebp - 0x1004], si
je 0x4ad080c7
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad019d6
mov ecx, dword [ebp - 0x1014]
mov dword [ecx], eax
jmp 0x4ad080c7