Function at 0x4a3260
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x74c50c]
test eax, eax
je 0x4a3270
mov eax, dword [0x74c508]
ret
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x667dc0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a35d0
mov dword [esp], str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub esp, 4
test eax, eax
mov dword [esp + 0x24], eax
je 0x4a340f
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov dword [esp + 0x28], eax
call eax
sub esp, 8
test eax, eax
mov ebx, eax
je 0x4a3580
lea edi, [esp + 0x44]
lea esi, [esp + 0x40]
mov dword [esp + 0x44], 0
mov dword [esp + 8], 0
mov dword [esp], 8
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
call eax
sub esp, 0x10
test eax, eax
jne 0x4a3580
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80000005
jne 0x4a3580
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4a3580
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4a3580
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov edi, eax
mov dword [esp + 4], esi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x4a356b
mov ebx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
lea edx, [ebx + ebx*4]
lea eax, [eax + edx*2 + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x4a356b
test ebx, ebx
je 0x4a3563
mov ebx, edi
xor ebp, ebp
test ebp, ebp
je 0x4a3550
movzx edx, word [ebx]
lea edi, [eax + 1]
mov byte [eax], 0x3a
test dx, dx
je 0x4a35de
test dx, 0xff00
jne 0x4a33f3
cmp dx, 0x3a
je 0x4a33f3
mov ecx, edi
jmp 0x4a33bd
test dx, 0xff00
jne 0x4a33f3
cmp dx, 0x3a
je 0x4a33f3
add ecx, 1
add ebx, 2
mov byte [ecx - 1], dl
movzx edx, word [ebx]
test dx, dx
jne 0x4a33b0
cmp eax, ecx
je 0x4a33f3
mov byte [ecx], 0
mov dword [esp], edi
add ebx, 2
call fcn.004a3860
mov dword [esp], edi
add ebp, 1
call sub.msvcrt.dll_strlen
add eax, edi
cmp ebp, dword [esp + 0x40]
jb 0x4a3380
cmp esi, eax
mov byte [eax], 0
jae 0x4a3563
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004defc0
jmp 0x4a35ad
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4a3635
xor ebx, ebx
lea eax, [esp + 0x3c]
lea edi, [esp + 0x44]
mov dword [esp + 0x3c], 9
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
mov esi, eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
test esi, esi
jne 0x4a35d7
cmp dword [esp + 0x38], 1
jne 0x4a35d7
mov eax, dword [esp + 0x3c]
cmp eax, 9
ja 0x4a35d7
jne 0x4a362b
cmp byte [esp + 0x4c], 0
jne 0x4a35d7
lea eax, [esp + 0x40]
mov dword [esp + 8], 0x10
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strtoul
mov edx, dword [esp + 0x40]
cmp edx, edi
jbe 0x4a35d7
cmp byte [edx], 0
jne 0x4a35d7
mov dword [esp], eax
call fcn.004a4bc0
test eax, eax
mov esi, eax
jne 0x4a35ad
test bl, bl
je 0x4a35ad
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], 0
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x4a3240
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
sub esp, 0x14
mov esi, dword [esp + 0x44]
jmp 0x4a35ad
movzx edx, word [ebx]
test dx, dx
je 0x4a33f3
mov edi, eax
jmp 0x4a339a
mov dword [esp], esi
call fcn.004defc0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004defc0
mov esi, esi
lea edi, [edi]
mov eax, dword [esp + 0x24]
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov dword [esp], eax
call dword [esp + 0x28]
sub esp, 8
test eax, eax
je 0x4a35e5
call eax
movzx eax, ax
mov dword [esp], eax
call fcn.004a38d0
test eax, eax
mov esi, eax
je 0x4a35e5
mov dword [0x74c508], esi
mov dword [0x74c50c], 1
mov eax, esi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x74c508]
jmp 0x4a35bf
xor esi, esi
jmp 0x4a350b
mov ecx, edi
jmp 0x4a33ce
lea eax, [esp + 0x34]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
mov ebx, 1
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
lea edi, [esp + 0x44]
je 0x4a3449
jmp 0x4a3513
mov byte [esp + eax + 0x44], 0
jmp 0x4a34cc
xor esi, esi
jmp 0x4a35ad