Function at 0x4ad0550d
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
cmp ax, dx
jmp 0x4ad05785
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.4ad02bc6
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 2
pop edx
cmp dword [ebp + 0xc], edx
mov dword [ebp - 0x1024], 0x80000002
mov dword [ebp - 0x1020], 0x80000001
jl 0x4ad057f3
cmp byte [0x4ad40638], 0
je 0x4ad05559
mov byte [0x4ad24081], 1
push ebx
lea ecx, [ebp - 0x1024]
push esi
sub ecx, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], ecx
mov dword [ebp - 0x1018], edx
mov ebx, 0x1000
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 0x1014]
push 0x2000000
xor esi, esi
push esi
push 0x4ad058e0
push dword [ecx + eax]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ad057cd
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad058c0
push dword [ebp - 0x1010]
mov dword [ebp - 0x1008], esi
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad164e3
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad0589c
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad0562b
cmp dword [ebp - 0x1008], 4
jne 0x4ad05935
cmp dword [ebp - 0x1004], esi
setne al
mov byte [0x4ad24081], al
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad05878
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad1653d
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad0585c
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad056a3
cmp dword [ebp - 0x1008], 4
jne 0x4ad05947
mov ax, word [ebp - 0x1004]
mov word [0x4ad2408a], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad0583c
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad05704
cmp dword [ebp - 0x1008], 4
jne 0x4ad16594
mov ax, word [ebp - 0x1004]
mov word [0x4ad240a0], ax
cmp ax, si
je 0x4ad056fb
cmp ax, 0xd
je 0x4ad056fb
cmp ax, 0x20
jbe 0x4ad05704
push 0x20
pop eax
mov word [0x4ad240a0], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad05814
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad05959
cmp dword [ebp - 0x1008], 4
jne 0x4ad165bf
mov ax, word [ebp - 0x1004]
mov word [0x4ad240a4], ax
cmp ax, si
je 0x4ad05760
cmp ax, 0xd
je 0x4ad05760
cmp ax, 0x20
jbe 0x4ad05769
push 0x20
pop eax
mov word [0x4ad240a4], ax
mov cx, word [0x4ad240a0]
push 0x20
pop edx
cmp cx, dx
jne 0x4ad05500
cmp ax, dx
jb 0x4ad165ea
jne 0x4ad05790
cmp cx, dx
jb 0x4ad165f5
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad05804
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad16601
push dword [ebp - 0x1010]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
add dword [ebp - 0x1014], 4
dec dword [ebp - 0x1018]
jne 0x4ad0592a
push esi
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4ad0139d
leave
ret 8
mov ecx, dword [ebp - 0x101c]
jmp 0x4ad05581
cmp dword [ebp - 0x1008], 1
je 0x4ad16523
jmp 0x4ad0562b
cmp dword [ebp - 0x1008], 1
je 0x4ad1657d
jmp 0x4ad056a3
mov ax, word [0x4ad240a4]
jmp 0x4ad05769
cmp dword [ebp - 0x1008], 4
jne 0x4ad164f7
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad16519
cmp dword [ebp - 0x1008], 1
jne 0x4ad055e3
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad4066c], al
jmp 0x4ad055e3
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
jmp 0x4ad05626
cmp dword [ebp - 0x1008], 4
jne 0x4ad16551
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad16573
cmp dword [ebp - 0x1008], 1
jne 0x4ad0565c
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad24082], al
jmp 0x4ad0565c
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad0569d
cmp dword [ebp - 0x1008], 1
jne 0x4ad165b4
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad056e4
mov ax, word [0x4ad240a0]
jmp 0x4ad056ea
cmp dword [ebp - 0x1008], 1
jne 0x4ad165df
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad05749
mov ax, word [0x4ad240a4]
jmp 0x4ad0574f
mov word [0x4ad240a0], ax
jmp 0x4ad05790
mov word [0x4ad240a4], cx
jmp 0x4ad05790
cmp dword [ebp - 0x1008], 2
jne 0x4ad16652
mov eax, dword [ebp - 0x100c]
shr eax, 1
mov ecx, 0x7fe
sub ecx, eax
lea esi, [ebp + eax*2 - 0x1000]
push ecx
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4ad16647
push esi
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad017fb
jmp 0x4ad16650
xor eax, eax
mov word [ebp - 0x1004], ax
xor esi, esi
cmp word [ebp - 0x1004], si
je 0x4ad057c1
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad01b82
mov ecx, dword [ebp - 0x1014]
mov dword [ecx], eax
jmp 0x4ad057c1