Function at 0x407dad
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x407db4
call fcn.00429ae0
push dword [esp + 0x50]
call fcn.00412380
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00412000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00412000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x407e05
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00427a90
call fcn.00429980
mov edx, 0x4b7554
pop ecx
push ecx
call fcn.00412300
mov ecx, eax
call fcn.00412310
je 0x407e6d
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 8]
call fcn.00427900
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00427a10
lea eax, [esp + 4]
push eax
call fcn.004299b0
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00427a10
call fcn.00429980
mov edx, 0x4b7554
pop ecx
push ecx
call fcn.00412300
mov ecx, eax
call fcn.00412310
je 0x407ed5
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 8]
call fcn.00427900
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00427a90
lea eax, [esp + 4]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x407ef0
push 0x4ba00c
push 0x24
push dword [esp + 0x54]
call fcn.00428ac0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x407f7a
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x407f48
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0xc]
call fcn.004088fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004299b0
cmp dword [esp + 0x14], 0
je 0x407f58
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x4b7024
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x4086b2
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x408003
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x407fd8
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0xc]
call fcn.004088fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004299b0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x4b7024
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x4086b2
cmp dword [esp + 0x20], 0
je 0x40806e
push dword [esp + 0x20]
call fcn.00428980
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x40806e
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x408043
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00412008
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x4b7024
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x4086b2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 8], 0
je 0x4080ff
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4080d4
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0xc]
call fcn.004088fc
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004299b0
push dword [esp + 0x1c]
call fcn.00428a10
mov edx, 0x4b7024
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x4086b2
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x408113
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x408304
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x4081de
mov dword [esp + 0x30], 0
jmp 0x40813f
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4081d9
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov edx, 0x4b7272
push edx
call fcn.00429a40
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov eax, 0x4b72c0
push eax
push 2
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00428c40
cdq
push edx
push eax
call fcn.00428400
call fcn.00412362
add dword [esp], edx
call fcn.00428480
pop eax
mov edx, 0x4b729c
push edx
call fcn.00429a40
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
inc dword [esp + 0x30]
jno 0x40813f
jmp 0x408282
mov dword [esp + 0x30], 0
jmp 0x4081e8
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x408282
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov edx, 0x4b7272
push edx
call fcn.00429a40
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov eax, 0x4b72c0
push eax
push 2
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00428c40
cdq
push edx
push eax
call fcn.00428400
call fcn.00412362
add dword [esp], edx
call fcn.00428480
pop eax
mov edx, 0x4b729c
push edx
call fcn.00429a40
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
inc dword [esp + 0x30]
jno 0x4081e8
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x18]
call fcn.00427900
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00427a90
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4082d2
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x54]
call fcn.00412380
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
add esp, 4
jmp 0x4086b2
mov ebx, 4
cmp ebx, dword [esp]
jne 0x408365
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x408334
push dword [esp + 0x20]
pop eax
call fcn.004122e0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x28]
pop eax
call fcn.004122e0
cdq
push edx
push eax
call fcn.00427b00
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
jmp 0x408680
mov ebx, 2
cmp ebx, dword [esp]
jne 0x408442
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x40843d
mov ebx, dword [esp + 0x28]
inc ebx
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.00428980
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x40843b
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x408432
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.004289a0
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x408432
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004299b0
push dword [esp + 0x10]
call fcn.00427900
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00428a10
jmp 0x40843d
jmp 0x408680
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4085ba
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x408514
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.004289a0
call fcn.00429980
mov edx, 0x4b7024
pop ecx
push ecx
call fcn.00412300
mov ecx, eax
call fcn.00412310
je 0x4084c4
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov edx, 0x4b708c
push edx
call fcn.00429a40
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
jmp 0x408504
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.004289a0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
jmp 0x408450
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00427a10
call fcn.00429980
mov edx, 0x4b708c
pop ecx
push ecx
call fcn.00412300
mov ecx, eax
call fcn.00412310
je 0x40857c
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x18]
call fcn.00427900
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00427a90
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4085b5
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004299b0
push dword [esp + 0x10]
call fcn.00427900
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
jmp 0x408680
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x40861a
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4085ee
push dword [esp + 0x20]
call fcn.00428c50
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x28]
call fcn.00428c50
push edx
push eax
call fcn.00427b00
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
jmp 0x408680
mov ebx, 1
cmp ebx, dword [esp]
jne 0x408680
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429940
pop edx
push eax
push dword [esp + 0x28]
call fcn.00428a30
lea eax, [esp + 0x14]
push eax
call fcn.004299b0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x408680
mov edx, dword [esp + 0x10]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004299b0
push dword [esp + 0x10]
call fcn.00427900
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00428a10
mov edx, dword [esp + 0xc]
push edx
call fcn.00429940
pop edx
push eax
push edx
call fcn.00429a40
pop eax
push eax
call fcn.00412350
pop edx
add eax, edx
jmp 0x4086b2
push dword [esp]
call fcn.00429b40
push dword [esp + 0xc]
call fcn.00429b40
push dword [esp + 4]
call fcn.00429b40
add esp, 0x30
pop ebx
pop ebp
ret 0x14