Function at 0x4061ee
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4061f5
call fcn.0048afd0
push dword [esp + 0x50]
call fcn.00441320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00441000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00441000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x406246
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00488710
call fcn.0048b030
mov edx, 0x547a00
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x4062ac
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 8]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004887b0
lea eax, [esp + 4]
push eax
call fcn.0048af00
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004887b0
call fcn.0048b030
mov edx, 0x547a00
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x406312
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 8]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00488710
lea eax, [esp + 4]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40632d
push 0x561fa0
push 0x24
push dword [esp + 0x54]
call fcn.00489d20
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4063b6
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406384
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406af2
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048af00
cmp dword [esp + 0x14], 0
je 0x406394
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x545028
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
jmp 0x406ad0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40643e
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406413
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406af2
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048af00
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x545028
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
jmp 0x406ad0
cmp dword [esp + 0x20], 0
je 0x4064a9
push dword [esp + 0x20]
call fcn.00489d90
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4064a9
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40647e
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00441008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x545028
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
jmp 0x406ad0
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x406539
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40650e
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406af2
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048af00
push dword [esp + 0x1c]
call fcn.00489f00
mov edx, 0x545028
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
jmp 0x406ad0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40654c
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40673b
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x406617
mov dword [esp + 0x30], 0
jmp 0x406578
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x406612
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov edx, 0x5461b0
push edx
call fcn.0048aea0
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov eax, 0x546746
push eax
push 2
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00489f20
cdq
push edx
push eax
call fcn.00488cf0
call fcn.00441302
add dword [esp], edx
call fcn.00488d70
pop eax
mov edx, 0x546466
push edx
call fcn.0048aea0
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
inc dword [esp + 0x30]
jno 0x406578
jmp 0x4066bb
mov dword [esp + 0x30], 0
jmp 0x406621
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4066bb
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov edx, 0x5461b0
push edx
call fcn.0048aea0
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov eax, 0x546746
push eax
push 2
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00489f20
cdq
push edx
push eax
call fcn.00488cf0
call fcn.00441302
add dword [esp], edx
call fcn.00488d70
pop eax
mov edx, 0x546466
push edx
call fcn.0048aea0
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
inc dword [esp + 0x30]
jno 0x406621
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x18]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00488710
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406709
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00441320
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
add esp, 4
jmp 0x406ad0
mov ebx, 4
cmp ebx, dword [esp]
jne 0x406798
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406768
mov eax, dword [esp + 0x20]
call fcn.004412c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.004412c0
cdq
push edx
push eax
call fcn.00488540
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
jmp 0x406a9e
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40686e
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x406869
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.00489d90
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x406867
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x40685e
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.00489f30
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40685e
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048af00
push dword [esp + 0x10]
call fcn.00488780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00489f00
jmp 0x406869
jmp 0x406a9e
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4069da
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x406938
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00489f30
call fcn.0048b030
mov edx, 0x545028
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x4068ee
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov edx, 0x54560e
push edx
call fcn.0048aea0
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
jmp 0x40692e
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00489f30
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
add dword [esp + 0x30], 2
jmp 0x40687c
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.004887b0
call fcn.0048b030
mov edx, 0x54560e
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x40699e
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x18]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00488710
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4069d5
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048af00
push dword [esp + 0x10]
call fcn.00488780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x406a9e
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x406a3a
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406a0e
push dword [esp + 0x20]
call fcn.00489fa0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x28]
call fcn.00489fa0
push edx
push eax
call fcn.00488540
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
jmp 0x406a9e
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406a9e
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x28]
call fcn.00489fb0
lea eax, [esp + 0x14]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406a9e
mov edx, dword [esp + 0x10]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048af00
push dword [esp + 0x10]
call fcn.00488780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00489f00
mov edx, dword [esp + 0xc]
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048aea0
pop eax
push eax
call fcn.004412f0
pop edx
add eax, edx
jmp 0x406ad0
push dword [esp]
call fcn.0048b060
push dword [esp + 0xc]
call fcn.0048b060
push dword [esp + 4]
call fcn.0048b060
add esp, 0x30
pop ebx
pop ebp
ret 0x14