Function at 0x494a00
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd38
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xd18]
push eax
push 0x20019
mov esi, ecx
push 0
push esi
push ebx
mov dword [ebp - 0xd24], esi
mov dword [ebp - 0xd1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x494c5b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x494a50
mov eax, 0x100
lea ecx, [ebp - 0xd38]
push ecx
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd30], eax
lea edx, [ebp - 0xd28]
push edx
lea eax, [ebp - 0x910]
push eax
mov eax, dword [ebp - 0xd1c]
push 0
lea ecx, [ebp - 0xd30]
push ecx
mov ecx, dword [ebp - 0xd18]
lea edx, [ebp - 0x410]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0xd1c]
test eax, eax
jne 0x494c43
push esi
lea edx, [ebp - 0x308]
push edx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4e28bc
lea eax, [ebp - 0x308]
push eax
call esi
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x308]
push edx
call esi
mov esi, dword [0x4f8b78]
lea eax, [ebp - 0xd14]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x308]
push ecx
push ebx
mov byte [ebp - 0x810], 0
mov byte [ebp - 0xd10], 0
mov dword [0x4f8b78], 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x494b58
mov eax, dword [0x4f8b78]
or eax, 0x100
lea edx, [ebp - 0xd14]
push edx
push eax
mov dword [0x4f8b78], eax
push 0
lea eax, [ebp - 0x308]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x494b58
push 0x4e27f8
lea ecx, [ebp - 0x108]
push ecx
call edi
mov dword [0x4f8b78], esi
jmp 0x494c2a
lea edx, [ebp - 0xd2c]
push edx
mov edx, dword [ebp - 0xd14]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xd20]
push ecx
push 0
push 0x4eaf30
push edx
mov dword [0x4f8b78], esi
mov dword [ebp - 0xd2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x494ba9
mov eax, dword [ebp - 0xd14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4e27f8
jmp 0x494c21
cmp dword [ebp - 0xd20], 2
jne 0x494bdb
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0xd10]
push eax
call edi
push 0x3ff
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xd10]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [ebp - 0xd20], 4
jne 0x494beb
mov byte [ebp - 0x810], 0
mov eax, dword [ebp - 0xd14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x100
jle 0x494c1a
push 0x4e27f8
lea edx, [ebp - 0x108]
push edx
jmp 0x494c28
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x108]
push ecx
call edi
mov al, byte [ebp - 0x108]
cmp al, 4
je 0x494c6d
cmp al, 5
je 0x494c8f
mov esi, dword [ebp - 0xd24]
jmp 0x494a50
cmp eax, 0x103
jne 0x494a50
mov ecx, dword [ebp - 0xd18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xd18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xd18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 5
pop esi
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret