Function at 0x4ae970
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor eax, eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x10]
call fcn.004abc10
mov ebx, eax
lea edi, [ebp + 0x10]
call fcn.004abdf0
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x4ae9a3
call fcn.004ab850
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4ae9d7
cmp dword [eax + 0x10], 0x100
jne 0x4ae9bb
mov eax, dword [eax + 4]
add eax, 1
jmp 0x4ae9dc
xor esi, esi
push 0x2cf
push str.........UniversalREALstring.cpp
mov edx, 0x57e0a8
lea ecx, [esi + 4]
call fcn.004f1fc0
add esp, 8
mov eax, 0x5f4c08
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 4]
push ecx
push 0
lea edx, [ebp - 8]
push edx
push 0
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call edi
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x4aea09
cmp eax, 2
je 0x4aea09
cmp eax, 7
jne 0x4aea10
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4aea4b
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, 0x57e81c
mov eax, ebx
mov dword [ebx], 0
call fcn.004ab970
mov eax, dword [ebx]
test eax, eax
je 0x4aea34
mov dword [eax + 0x10], 0x600
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4aea40
call fcn.004ab850
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push eax
call fcn.005663ab
mov ebx, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
mov dword [ebp - 0xc], ebx
je 0x4aea8d
cmp dword [eax + 0x10], 0x100
jne 0x4aea71
mov eax, dword [eax + 4]
add eax, 1
jmp 0x4aea92
xor esi, esi
push 0x2cf
push str.........UniversalREALstring.cpp
mov edx, 0x57e0a8
lea ecx, [esi + 4]
call fcn.004f1fc0
add esp, 8
mov eax, 0x5f4c08
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp + 8]
push ebx
lea ecx, [ebp - 8]
push ecx
push 0
push eax
mov eax, dword [edx]
push eax
call edi
mov eax, 2
sub dword [ebp - 4], eax
xor edi, edi
cmp dword [ebp - 8], eax
mov dword [ebp + 8], edi
jne 0x4aeb10
cmp byte [ebp + 0x14], 0
je 0x4aeb10
mov esi, dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
push edi
push edi
push ebx
call esi
sub eax, 1
test eax, eax
jle 0x4aeb22
lea edi, [eax + eax]
lea ebx, [ebp + 8]
call fcn.004ab8c0
mov edi, dword [ebp + 8]
test edi, edi
je 0x4aeafa
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 4]
shr ecx, 1
push ecx
mov ecx, dword [ebp - 0xc]
add eax, 1
push eax
push ecx
call esi
mov ebx, dword [ebp - 0xc]
jmp 0x4aeb22
xor ecx, ecx
shr ecx, 1
push ecx
mov ecx, dword [ebp - 0xc]
mov eax, 0x57e81c
push eax
push ecx
call esi
mov ebx, dword [ebp - 0xc]
jmp 0x4aeb22
mov eax, dword [ebp - 4]
shr eax, 1
mov ecx, ebx
lea edx, [ebp + 8]
call fcn.004ab9d0
mov edi, dword [ebp + 8]
push ebx
call fcn.0056646e
add esp, 4
test edi, edi
je 0x4aeb53
cmp dword [edi + 0x10], 0x8000100
je 0x4aeb53
mov edx, dword [ebp + 0xc]
push 0x8000100
push ecx
mov eax, esp
mov dword [eax], edi
add dword [edi], 1
push edx
call fcn.00529150
add esp, 0xc
jmp 0x4aeb5f
test edi, edi
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
je 0x4aeb66
add dword [edi], 1
mov esi, edi
call fcn.004ab850
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x4aeb72
call fcn.004ab850
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10