Function at 0x10004f30
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x10011010]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
push edi
mov edi, dword [esp + 0x22c]
mov byte [esp + 0x14], 0
call fcn.1000a470
cmp eax, 3
jne 0x10004fd0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004fe9
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x11c]
push eax
push 0
push 0
push str.DatabasePath
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004fe9
cmp eax, 2
jne 0x10005151
push 0x104
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14]
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10004ff0
mov eax, dword [str.hosts]
mov dword [ecx], eax
mov ax, word [0x1000f288]
mov word [ecx + 4], ax
mov al, byte [0x1000f28a]
push ebx
mov byte [ecx + 6], al
call fcn.100052d0
add esp, 4
test eax, eax
jne 0x10005151
lea eax, [esp + 0x14]
push 0x1000f28c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
mov dword [esp + 0xc], esi
test esi, esi
jne 0x10005076
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
je 0x10005151
sub eax, 1
je 0x10005151
mov dword [edi], esi
lea eax, [esi + 0xe]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000de3c
add esp, 0x214
ret
push ebp
push edi
push dword [esp + 0x230]
push esi
call fcn.100017d0
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x100050f7
nop
mov ecx, dword [edi]
push ebx
push dword [ecx]
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
add esp, 8
test eax, eax
je 0x100050f7
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov eax, dword [esi]
test eax, eax
je 0x100050cf
nop dword [eax]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll__stricmp
add esp, 8
test eax, eax
je 0x100050ca
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x100050b0
jmp 0x100050cf
cmp dword [esi], 0
jne 0x100050f3
push dword [edi]
call sym.cares.dll_ares_free_hostent
mov esi, dword [esp + 0x14]
push edi
push dword [esp + 0x234]
push esi
call fcn.100017d0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10005090
jmp 0x100050f7
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
cmp ebp, 0xd
jne 0x1000512c
mov ebp, 4
mov dword [edi], 0
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000de3c
add esp, 0x214
ret
test ebp, ebp
je 0x10005136
mov dword [edi], 0
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.1000de3c
add esp, 0x214
ret
mov ecx, dword [esp + 0x21c]
mov eax, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1000de3c
add esp, 0x214
ret