Function at 0x408ed5
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x408edc
call fcn.00475020
push dword [esp + 0x50]
call fcn.0042b320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.0042b000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.0042b000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x408f2d
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00472790
call fcn.00475080
mov edx, 0x530a1e
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x408f93
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 8]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00472800
lea eax, [esp + 4]
push eax
call fcn.00474f50
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00472800
call fcn.00475080
mov edx, 0x530a1e
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x408ff9
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 8]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00472790
lea eax, [esp + 4]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x409014
push 0x53f9f0
push 0x24
push dword [esp + 0x54]
call fcn.00473d70
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40909d
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40906b
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004099ff
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00474f50
cmp dword [esp + 0x14], 0
je 0x40907b
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x52f028
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
jmp 0x4097b7
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x409125
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4090fa
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004099ff
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00474f50
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x52f028
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
jmp 0x4097b7
cmp dword [esp + 0x20], 0
je 0x409190
push dword [esp + 0x20]
call fcn.00473de0
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x409190
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x409165
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.0042b008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x52f028
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
jmp 0x4097b7
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x409220
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4091f5
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004099ff
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00474f50
push dword [esp + 0x1c]
call fcn.00473f50
mov edx, 0x52f028
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
jmp 0x4097b7
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x409233
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x409422
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x4092fe
mov dword [esp + 0x30], 0
jmp 0x40925f
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4092f9
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov edx, 0x52f9c2
push edx
call fcn.00474ef0
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov eax, 0x52fd6a
push eax
push 2
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00473f70
cdq
push edx
push eax
call fcn.00472d40
call fcn.0042b302
add dword [esp], edx
call fcn.00472dc0
pop eax
mov edx, 0x52fbca
push edx
call fcn.00474ef0
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
inc dword [esp + 0x30]
jno 0x40925f
jmp 0x4093a2
mov dword [esp + 0x30], 0
jmp 0x409308
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4093a2
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov edx, 0x52f9c2
push edx
call fcn.00474ef0
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov eax, 0x52fd6a
push eax
push 2
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00473f70
cdq
push edx
push eax
call fcn.00472d40
call fcn.0042b302
add dword [esp], edx
call fcn.00472dc0
pop eax
mov edx, 0x52fbca
push edx
call fcn.00474ef0
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
inc dword [esp + 0x30]
jno 0x409308
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00472790
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4093f0
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.0042b320
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
add esp, 4
jmp 0x4097b7
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40947f
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40944f
mov eax, dword [esp + 0x20]
call fcn.0042b2c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.0042b2c0
cdq
push edx
push eax
call fcn.00472590
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
jmp 0x409785
mov ebx, 2
cmp ebx, dword [esp]
jne 0x409555
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x409550
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.00473de0
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x40954e
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x409545
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.00473f80
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x409545
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00474f50
push dword [esp + 0x10]
call fcn.00472760
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00473f50
jmp 0x409550
jmp 0x409785
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4096c1
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x40961f
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00473f80
call fcn.00475080
mov edx, 0x52f028
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x4095d5
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov edx, 0x52f372
push edx
call fcn.00474ef0
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
jmp 0x409615
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00473f80
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
add dword [esp + 0x30], 2
jmp 0x409563
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00472800
call fcn.00475080
mov edx, 0x52f372
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x409685
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00472790
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4096bc
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00474f50
push dword [esp + 0x10]
call fcn.00472760
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x409785
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x409721
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4096f5
push dword [esp + 0x20]
call fcn.00473ff0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x28]
call fcn.00473ff0
push edx
push eax
call fcn.00472590
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
jmp 0x409785
mov ebx, 1
cmp ebx, dword [esp]
jne 0x409785
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x28]
call fcn.00474000
lea eax, [esp + 0x14]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x409785
mov edx, dword [esp + 0x10]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00474f50
push dword [esp + 0x10]
call fcn.00472760
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00473f50
mov edx, dword [esp + 0xc]
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474ef0
pop eax
push eax
call fcn.0042b2f0
pop edx
add eax, edx
jmp 0x4097b7
push dword [esp]
call fcn.004750b0
push dword [esp + 0xc]
call fcn.004750b0
push dword [esp + 4]
call fcn.004750b0
add esp, 0x30
pop ebx
pop ebp
ret 0x14