Function at 0x406374
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40637b
call fcn.00490160
push dword [esp + 0x50]
call fcn.00446320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00446000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00446000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x4063cc
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048d8a0
call fcn.004901c0
mov edx, 0x54c848
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x406432
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048d940
lea eax, [esp + 4]
push eax
call fcn.00490090
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048d940
call fcn.004901c0
mov edx, 0x54c848
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x406498
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048d8a0
lea eax, [esp + 4]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4064b3
push 0x5649a0
push 0x24
push dword [esp + 0x54]
call fcn.0048eeb0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40653c
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40650a
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406c78
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00490090
cmp dword [esp + 0x14], 0
je 0x40651a
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54a03e
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x406c56
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4065c4
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406599
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406c78
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00490090
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54a03e
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x406c56
cmp dword [esp + 0x20], 0
je 0x40662f
push dword [esp + 0x20]
call fcn.0048ef20
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x40662f
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406604
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00446008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54a03e
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x406c56
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x4066bf
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406694
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406c78
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00490090
push dword [esp + 0x1c]
call fcn.0048f090
mov edx, 0x54a03e
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x406c56
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4066d2
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4068c1
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x40679d
mov dword [esp + 0x30], 0
jmp 0x4066fe
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x406798
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov edx, 0x54b382
push edx
call fcn.00490030
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
mov eax, 0x54b762
push eax
push 2
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048f0b0
cdq
push edx
push eax
call fcn.0048de80
call fcn.00446302
add dword [esp], edx
call fcn.0048df00
pop eax
mov edx, 0x54b53a
push edx
call fcn.00490030
lea eax, [esp + 0x14]
push eax
call fcn.00490090
inc dword [esp + 0x30]
jno 0x4066fe
jmp 0x406841
mov dword [esp + 0x30], 0
jmp 0x4067a7
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x406841
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov edx, 0x54b382
push edx
call fcn.00490030
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
mov eax, 0x54b762
push eax
push 2
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048f0b0
cdq
push edx
push eax
call fcn.0048de80
call fcn.00446302
add dword [esp], edx
call fcn.0048df00
pop eax
mov edx, 0x54b53a
push edx
call fcn.00490030
lea eax, [esp + 0x14]
push eax
call fcn.00490090
inc dword [esp + 0x30]
jno 0x4067a7
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048d8a0
lea eax, [esp + 0x14]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40688f
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00446320
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
add esp, 4
jmp 0x406c56
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40691e
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4068ee
mov eax, dword [esp + 0x20]
call fcn.004462c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.004462c0
cdq
push edx
push eax
call fcn.0048d6d0
lea eax, [esp + 0x14]
push eax
call fcn.00490090
jmp 0x406c24
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4069f4
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x4069ef
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.0048ef20
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x4069ed
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x4069e4
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.0048f0c0
lea eax, [esp + 0x14]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4069e4
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00490090
push dword [esp + 0x10]
call fcn.0048d910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.0048f090
jmp 0x4069ef
jmp 0x406c24
mov ebx, 7
cmp ebx, dword [esp]
jne 0x406b60
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x406abe
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.0048f0c0
call fcn.004901c0
mov edx, 0x54a03e
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x406a74
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov edx, 0x54a650
push edx
call fcn.00490030
lea eax, [esp + 0x14]
push eax
call fcn.00490090
jmp 0x406ab4
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.0048f0c0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00490090
add dword [esp + 0x30], 2
jmp 0x406a02
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.0048d940
call fcn.004901c0
mov edx, 0x54a650
call fcn.00446330
mov ecx, eax
call fcn.00446340
je 0x406b24
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0048d910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048d8a0
lea eax, [esp + 0x14]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406b5b
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00490090
push dword [esp + 0x10]
call fcn.0048d910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x406c24
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x406bc0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406b94
push dword [esp + 0x20]
call fcn.0048f130
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048f130
push edx
push eax
call fcn.0048d6d0
lea eax, [esp + 0x14]
push eax
call fcn.00490090
jmp 0x406c24
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406c24
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.0048fff0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048f140
lea eax, [esp + 0x14]
push eax
call fcn.00490090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406c24
mov edx, dword [esp + 0x10]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00490090
push dword [esp + 0x10]
call fcn.0048d910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.0048f090
mov edx, dword [esp + 0xc]
push edx
call fcn.0048fff0
pop edx
push eax
push edx
call fcn.00490030
pop eax
push eax
call fcn.004462f0
pop edx
add eax, edx
jmp 0x406c56
push dword [esp]
call fcn.004901f0
push dword [esp + 0xc]
call fcn.004901f0
push dword [esp + 4]
call fcn.004901f0
add esp, 0x30
pop ebx
pop ebp
ret 0x14