Function at 0x4c7b80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov edi, edx
mov ebx, ecx
mov eax, dword [ecx + 0xc0]
test eax, eax
je 0x4c7bc0
push eax
call fcn.004c5ce0
add esp, 4
test eax, eax
je 0x4c7dfb
test edi, edi
je 0x4c7be6
mov ecx, dword [0xb5ad44]
push eax
call dword [ecx]
add esp, 4
jmp 0x4c7bc8
test edi, edi
je 0x4c7d54
push str.CARES_HOSTS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
push eax
call fcn.004c5ce0
add esp, 4
test eax, eax
je 0x4c7dfb
mov dword [esp + 0x20], ebx
mov esi, dword [ebx + 0xc8]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
add esp, 8
test esi, esi
je 0x4c7c67
test eax, eax
setne al
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov ecx, edi
or ecx, ebx
sete cl
or cl, al
cmp cl, 1
jne 0x4c7c36
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov edi, eax
mov ebx, edx
add edi, 0xffffffc4
adc ebx, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4c7c67
cmp edi, dword [esi]
sbb ebx, dword [esi + 4]
jge 0x4c7c67
mov eax, dword [0xb5ad44]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
xor ebx, ebx
jmp 0x4c7e4c
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0xc8]
test esi, esi
je 0x4c7c9f
mov edi, dword [0xb5ad44]
push dword [esi + 8]
call dword [edi]
add esp, 4
push dword [esi + 0x10]
call fcn.004bc6f0
add esp, 4
push dword [esi + 0xc]
call fcn.004bc6f0
add esp, 4
push esi
call dword [edi]
add esp, 4
mov dword [ebx + 0xc8], 0
call fcn.004c40e0
mov esi, eax
test eax, eax
je 0x4c7e30
push esi
push dword [esp + 0x14]
call fcn.004c5bf0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4c7e35
push 0x18
call fcn.004b3420
add esp, 4
test eax, eax
je 0x4c7e30
mov ebx, eax
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov dword [ebx + 4], edx
mov dword [ebx], eax
push dword [esp + 0x10]
call fcn.004c5ce0
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
je 0x4c7e02
push 0x4c89b0
call fcn.004bc710
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4c7e02
push 0
call fcn.004bc710
add esp, 4
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4c7e02
mov dword [esp + 8], ebx
push esi
call fcn.004c4830
add esp, 4
test eax, eax
je 0x4c83a6
lea edi, [esp + 0x14]
jmp 0x4c7e7f
lea esi, [esp + 0x28]
push 0x104
push 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [esp + 0x24], 0x104
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4c7d9a
mov ebx, 4
jmp 0x4c7e4c
lea eax, [esp + 0x24]
lea edi, [esp + 0x130]
push eax
push edi
push 0
push 0
push str.DatabasePath
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [esp + eax + 0x28], 0x736f685c
mov dword [esp + eax + 0x2b], 0x737473
push esi
call fcn.004c5ce0
add esp, 4
test eax, eax
jne 0x4c7be6
mov ebx, 0xf
jmp 0x4c7e4c
mov edi, esi
mov esi, dword [0xb5ad44]
push dword [ebx + 8]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004bc6f0
add esp, 4
push dword [ebx + 0xc]
call fcn.004bc6f0
add esp, 4
push ebx
call dword [esi]
mov esi, edi
add esp, 4
mov ebx, 0xf
push esi
call fcn.004c4140
add esp, 4
mov eax, dword [0xb5ad44]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 0xf
je 0x4c8401
push 1
push esi
call fcn.004c4c80
add esp, 8
push esi
call fcn.004c4830
add esp, 4
test eax, eax
lea edi, [esp + 0x14]
je 0x4c83a6
mov byte [esp + 0x14], 0x23
push 0
push esi
call fcn.004c4b80
add esp, 8
push esi
call fcn.004c4830
add esp, 4
test eax, eax
je 0x4c83a6
push 1
push edi
push esi
call fcn.004c51a0
add esp, 0xc
test eax, eax
jne 0x4c7e5f
push esi
call fcn.004c4640
add esp, 4
push esi
call fcn.004c4c20
add esp, 4
push 0x41
lea edi, [esp + 0x2c]
push edi
push esi
call fcn.004c4760
add esp, 0xc
test eax, eax
jne 0x4c7e56
xorps xmm0, xmm0
movaps xmmword [esp + 0x130], xmm0
mov dword [esp + 0x140], 0
lea ebx, [esp + 0x134]
push ebx
push edi
push 2
call fcn.004bb560
add esp, 0xc
mov ecx, 2
test eax, eax
jg 0x4c7f21
push ebx
push edi
push 0x17
call fcn.004bb560
add esp, 0xc
mov ecx, 0x17
test eax, eax
jle 0x4c7e5f
mov dword [esp + 0x130], ecx
push 0x41
push edi
push ebx
push ecx
call fcn.004bb5d0
add esp, 0x10
test eax, eax
je 0x4c7e5f
push 0xc
call fcn.004b3420
add esp, 4
test eax, eax
je 0x4c8401
mov ebx, eax
mov eax, dword [0xb5ad44]
push dword [eax]
call fcn.004bcb70
add esp, 4
mov dword [esp + 4], ebx
mov dword [ebx + 4], eax
test eax, eax
je 0x4c83c4
push edi
call fcn.004c5ce0
add esp, 4
test eax, eax
je 0x4c83c4
mov edi, eax
push eax
mov ebx, dword [esp + 8]
push dword [ebx + 4]
call fcn.004bcba0
add esp, 8
test eax, eax
je 0x4c83ca
mov eax, dword [0xb5ad44]
push dword [eax]
call fcn.004bcb70
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
jne 0x4c7fcc
jmp 0x4c8442
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bce40
add esp, 4
test eax, eax
je 0x4c836d
push esi
call fcn.004c4830
add esp, 4
test eax, eax
je 0x4c80da
mov byte [esp + 0x130], 0x23
push 0
push esi
call fcn.004c4b80
add esp, 8
push esi
call fcn.004c4830
add esp, 4
test eax, eax
lea edi, [esp + 0x28]
je 0x4c80da
push 1
lea eax, [esp + 0x134]
push eax
push esi
call fcn.004c51a0
add esp, 0xc
test eax, eax
jne 0x4c80da
push esi
call fcn.004c4640
add esp, 4
push esi
call fcn.004c4c20
add esp, 4
test eax, eax
je 0x4c80da
push 0x100
push edi
push esi
call fcn.004c4760
add esp, 0xc
test eax, eax
jne 0x4c7fb5
push edi
call fcn.004c5fb0
add esp, 4
test eax, eax
je 0x4c7fcc
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4c80a6
mov edi, eax
push edi
call fcn.004bce30
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4c7fcc
push edi
call fcn.004bce10
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c8077
lea eax, [esp + 0x28]
push eax
call fcn.004c5ce0
add esp, 4
test eax, eax
je 0x4c8451
mov edi, eax
push eax
mov eax, dword [esp + 8]
push dword [eax + 8]
call fcn.004bcc00
add esp, 8
test eax, eax
jne 0x4c7fcc
jmp 0x4c8446
mov edi, dword [esp + 4]
push dword [edi + 8]
call fcn.004bce40
add esp, 4
test eax, eax
je 0x4c8371
push dword [edi + 8]
call fcn.004bce40
add esp, 4
mov dword [esp + 0x1c], eax
push dword [edi + 4]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4c813d
mov edi, eax
push edi
call fcn.004bce30
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004bc8e0
add esp, 8
test eax, eax
jne 0x4c8187
push edi
call fcn.004bce10
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c8111
mov ebx, dword [esp + 4]
push dword [ebx + 8]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4c8193
mov edi, eax
push edi
call fcn.004bce30
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004bc8e0
add esp, 8
test eax, eax
jne 0x4c819a
push edi
call fcn.004bce10
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c8152
mov eax, dword [esp + 4]
jmp 0x4c82a9
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x18], eax
jmp 0x4c820a
mov eax, ebx
jmp 0x4c82a9
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4c8202
mov edi, eax
jmp 0x4c81da
mov eax, dword [esp + 0xc]
push dword [eax + 4]
push edi
call fcn.004bd0c0
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bcda0
add esp, 4
mov edi, eax
test eax, eax
je 0x4c8202
push edi
call fcn.004bce30
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004bc8e0
add esp, 8
test eax, eax
je 0x4c81b5
push edi
call fcn.004bcf00
add esp, 4
jmp 0x4c81c5
mov dword [esp + 0x18], 0
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bcda0
add esp, 4
test eax, eax
je 0x4c826e
mov edi, eax
jmp 0x4c8246
mov eax, dword [esp + 0xc]
push dword [eax + 8]
push edi
call fcn.004bd0c0
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bcda0
add esp, 4
mov edi, eax
test eax, eax
je 0x4c826e
push edi
call fcn.004bce30
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004bc8e0
add esp, 8
test eax, eax
je 0x4c8221
push edi
call fcn.004bcf00
add esp, 4
jmp 0x4c8231
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c827d
dec eax
mov dword [edi], eax
jne 0x4c829e
push dword [edi + 8]
call fcn.004bd030
add esp, 4
push dword [edi + 4]
call fcn.004bd030
add esp, 4
push edi
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
cmp byte [esp + 0x18], 0
mov eax, dword [esp + 0xc]
jne 0x4c82f3
push dword [eax + 4]
mov ebx, eax
call fcn.004bce80
add esp, 4
push 0
mov dword [esp + 8], eax
push eax
mov edi, dword [esp + 0x10]
push dword [edi + 0xc]
call fcn.004bc880
add esp, 0xc
test eax, eax
je 0x4c82d4
mov eax, ebx
jmp 0x4c82f3
push ebx
push dword [esp + 8]
push dword [edi + 0xc]
call fcn.004bc800
add esp, 0xc
mov ecx, dword [ebx]
test eax, eax
mov eax, ebx
je 0x4c848a
inc ecx
mov dword [eax], ecx
mov dword [esp + 0xc], eax
push dword [eax + 8]
call fcn.004bce00
add esp, 4
test eax, eax
je 0x4c7e5f
mov ebx, eax
inc dword [esp + 0x1c]
jmp 0x4c8325
push ebx
call fcn.004bce20
add esp, 4
mov ebx, eax
test eax, eax
je 0x4c7e5f
push ebx
call fcn.004bce30
add esp, 4
dec dword [esp + 0x1c]
je 0x4c7e5f
mov edi, eax
push 0
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004bc880
add esp, 0xc
test eax, eax
jne 0x4c8312
push dword [esp + 0xc]
push edi
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004bc800
add esp, 0xc
test eax, eax
jne 0x4c8312
jmp 0x4c8401
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c8380
dec eax
mov dword [edi], eax
jne 0x4c7e5f
push dword [edi + 8]
call fcn.004bd030
add esp, 4
push dword [edi + 4]
call fcn.004bd030
add esp, 4
push edi
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
jmp 0x4c7e5f
push esi
call fcn.004c4140
add esp, 4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
mov dword [eax + 0xc8], ecx
xor ebx, ebx
jmp 0x4c7e3e
mov ebx, dword [esp + 4]
jmp 0x4c83d5
push edi
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x4c83e0
dec eax
mov dword [ebx], eax
jne 0x4c8401
push dword [ebx + 8]
call fcn.004bd030
add esp, 4
push dword [ebx + 4]
call fcn.004bd030
add esp, 4
push ebx
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
mov ebx, dword [esp + 8]
push esi
call fcn.004c4140
add esp, 4
push dword [ebx + 8]
mov esi, dword [0xb5ad44]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004bc6f0
add esp, 4
push dword [ebx + 0xc]
call fcn.004bc6f0
add esp, 4
push ebx
call dword [esi]
add esp, 4
mov ebx, 0xf
jmp 0x4c7e3e
mov edi, ebx
jmp 0x4c8455
push edi
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
mov ebx, dword [esp + 8]
je 0x4c8464
dec eax
mov dword [edi], eax
jne 0x4c8405
push dword [edi + 8]
call fcn.004bd030
add esp, 4
push dword [edi + 4]
call fcn.004bd030
add esp, 4
push edi
mov eax, dword [0xb5ad44]
call dword [eax]
add esp, 4
jmp 0x4c8405
test ecx, ecx
je 0x4c8497
dec ecx
mov dword [eax], ecx
jne 0x4c8401
mov edi, eax
push dword [eax + 8]
call fcn.004bd030
add esp, 4
push dword [edi + 4]
call fcn.004bd030
add esp, 4
push edi
jmp 0x4c83f7