Function at 0x4fa645
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4fa64c
mov eax, dword [esp + 0x4c]
mov dword [0x9b3e20], eax
mov edx, dword [esp + 0x44]
lea ecx, [esp]
call fcn.0051f000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 4]
call fcn.0051f000
mov dword [esp + 0x10], 0x20019
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x50]
call sub.ADVAPI32.dll_RegOpenKeyExW
and eax, eax
je 0x4fa6cf
cmp dword [esp + 0x14], 0
je 0x4fa6b2
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x6fb198
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4fad31
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
and eax, eax
je 0x4fa71a
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x6fb198
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4fad31
cmp dword [esp + 0x20], 0
je 0x4fa75c
push dword [esp + 0x20]
call fcn.005584b0
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4fa75c
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x6fb198
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4fad31
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x4fa7b6
push dword [esp + 0x1c]
call fcn.005585f0
mov edx, 0x6fb198
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4fad31
mov ebx, dword [esp + 0x30]
and ebx, ebx
je 0x4fa7ca
push dword [esp + 0x18]
mov ebp, dword [esp + 0x34]
pop eax
mov dword [ebp], eax
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4fa9a0
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x4fa88c
mov dword [esp + 0x30], 0
jmp 0x4fa7f6
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4fa887
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x6fdfca
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, 0x6fefb6
push eax
push 2
push dword [0x9b3e20]
push dword [0x9b3e20]
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00558680
cdq
push edx
push eax
call fcn.00557f00
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.00557770
pop eax
mov edx, 0x6fe984
push edx
call fcn.005597c0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
inc dword [esp + 0x30]
jno 0x4fa7f6
jmp 0x4fa927
mov dword [esp + 0x30], 0
jmp 0x4fa896
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4fa927
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x6fdfca
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
mov eax, 0x6fefb6
push eax
push 2
push dword [0x9b3e20]
push dword [0x9b3e20]
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00558680
cdq
push edx
push eax
call fcn.00557f00
mov edx, dword [0x9a36fc]
add dword [esp], edx
call fcn.00557770
pop eax
mov edx, 0x6fe984
push edx
call fcn.005597c0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
inc dword [esp + 0x30]
jno 0x4fa896
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x18]
call fcn.005565a0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00556870
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4fa973
push dword [esp + 0x20]
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 0x1c], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x50]
mov dword [0x9b3e20], eax
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
add esp, 4
jmp 0x4fad31
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4fa9fd
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4fa9d0
push dword [esp + 0x20]
pop eax
call fcn.0051f5b0
push eax
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x34]
mov dword [ebp + 4], 4
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x28]
pop eax
call fcn.0051f5b0
cdq
push edx
push eax
call fcn.005565d0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
jmp 0x4facfe
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4faad4
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x4faacf
mov ebx, dword [esp + 0x28]
inc ebx
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.005584b0
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x4faacd
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x4faac4
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.005588a0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4faac4
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebp, dword [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.00559740
push dword [esp + 0x10]
call fcn.005565a0
push eax
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.005585f0
jmp 0x4faacf
jmp 0x4facfe
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4fac42
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x4faba0
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.005588a0
add dword [0x9b3e20], 2
mov edx, 0x6fb198
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
je 0x4fab56
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov edx, 0x6fbc04
push edx
call fcn.005597c0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
jmp 0x4fab90
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.005588a0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
jmp 0x4faae2
push dword [0x9b3e20]
push dword [0x9b3e20]
push 1
push dword [esp + 0x1c]
call fcn.005567f0
add dword [0x9b3e20], 2
mov edx, 0x6fbc04
pop ecx
mov dword [0x9b3e20], ecx
add ecx, dword [0x9a36fc]
call fcn.0051f5d0
je 0x4fac06
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x18]
call fcn.005565a0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00556870
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4fac3d
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebp, dword [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.00559740
push dword [esp + 0x10]
call fcn.005565a0
push eax
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 4], eax
jmp 0x4facfe
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4fac9e
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4fac76
push dword [esp + 0x20]
call fcn.00558a30
push edx
push eax
mov ebp, dword [esp + 0x3c]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x34]
mov dword [ebp + 4], 8
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x28]
call fcn.00558a30
push edx
push eax
call fcn.005565d0
lea eax, [esp + 0x14]
push eax
call fcn.00559740
jmp 0x4facfe
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4facfe
push dword [0x9b3e20]
push dword [0x9b3e20]
push dword [esp + 0x28]
call fcn.00558610
lea eax, [esp + 0x14]
push eax
call fcn.00559740
mov ebx, dword [esp + 0x34]
and ebx, ebx
je 0x4facfe
mov edx, dword [esp + 0x10]
push dword [0x9b3e20]
push edx
call fcn.005597c0
mov ebp, dword [esp + 0x38]
lea eax, [ebp + 0x20]
push eax
call fcn.00559740
push dword [esp + 0x10]
call fcn.005565a0
push eax
mov ebp, dword [esp + 0x38]
pop eax
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.005585f0
mov edx, dword [esp + 0xc]
push dword [0x9b3e20]
push edx
call fcn.005597c0
pop eax
add eax, dword [0x9a36fc]
jmp 0x4fad31
push dword [esp]
call fcn.00559820
push dword [esp + 0xc]
call fcn.00559820
push dword [esp + 4]
call fcn.00559820
add esp, 0x34
pop ebx
pop ebp
ret 0xc