Function at 0x405091
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405098
call fcn.0048bfd0
push dword [esp + 0x50]
call fcn.00442320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00442000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00442000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x4050e9
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004896a0
call fcn.0048c030
mov edx, 0x5489ca
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x40514f
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 8]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00489740
lea eax, [esp + 4]
push eax
call fcn.0048bf00
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00489740
call fcn.0048c030
mov edx, 0x5489ca
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x4051b5
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 8]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004896a0
lea eax, [esp + 4]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4051d0
push 0x5635f4
push 0x24
push dword [esp + 0x54]
call fcn.0048ad20
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x405259
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x405227
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00405995
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048bf00
cmp dword [esp + 0x14], 0
je 0x405237
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x546028
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
jmp 0x405973
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4052e1
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4052b6
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00405995
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048bf00
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x546028
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
jmp 0x405973
cmp dword [esp + 0x20], 0
je 0x40534c
push dword [esp + 0x20]
call fcn.0048ad90
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x40534c
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x405321
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00442008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x546028
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
jmp 0x405973
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x4053dc
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4053b1
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0xc]
call fcn.00405995
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048bf00
push dword [esp + 0x1c]
call fcn.0048af00
mov edx, 0x546028
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
jmp 0x405973
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4053ef
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4055de
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x4054ba
mov dword [esp + 0x30], 0
jmp 0x40541b
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4054b5
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov edx, 0x54715a
push edx
call fcn.0048bea0
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov eax, 0x5476f0
push eax
push 2
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048af20
cdq
push edx
push eax
call fcn.00489c80
call fcn.00442302
add dword [esp], edx
call fcn.00489d00
pop eax
mov edx, 0x547410
push edx
call fcn.0048bea0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
inc dword [esp + 0x30]
jno 0x40541b
jmp 0x40555e
mov dword [esp + 0x30], 0
jmp 0x4054c4
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x40555e
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov edx, 0x54715a
push edx
call fcn.0048bea0
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov eax, 0x5476f0
push eax
push 2
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048af20
cdq
push edx
push eax
call fcn.00489c80
call fcn.00442302
add dword [esp], edx
call fcn.00489d00
pop eax
mov edx, 0x547410
push edx
call fcn.0048bea0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
inc dword [esp + 0x30]
jno 0x4054c4
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x18]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004896a0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4055ac
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00442320
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
add esp, 4
jmp 0x405973
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40563b
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40560b
mov eax, dword [esp + 0x20]
call fcn.004422c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.004422c0
cdq
push edx
push eax
call fcn.00489540
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
jmp 0x405941
mov ebx, 2
cmp ebx, dword [esp]
jne 0x405711
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x40570c
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.0048ad90
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x40570a
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x405701
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.0048af30
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x405701
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048bf00
push dword [esp + 0x10]
call fcn.00489710
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.0048af00
jmp 0x40570c
jmp 0x405941
mov ebx, 7
cmp ebx, dword [esp]
jne 0x40587d
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x4057db
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.0048af30
call fcn.0048c030
mov edx, 0x546028
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x405791
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov edx, 0x546628
push edx
call fcn.0048bea0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
jmp 0x4057d1
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.0048af30
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
add dword [esp + 0x30], 2
jmp 0x40571f
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00489740
call fcn.0048c030
mov edx, 0x546628
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x405841
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x18]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004896a0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x405878
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048bf00
push dword [esp + 0x10]
call fcn.00489710
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x405941
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4058dd
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4058b1
push dword [esp + 0x20]
call fcn.0048afa0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048afa0
push edx
push eax
call fcn.00489540
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
jmp 0x405941
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405941
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048afb0
lea eax, [esp + 0x14]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x405941
mov edx, dword [esp + 0x10]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048bf00
push dword [esp + 0x10]
call fcn.00489710
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.0048af00
mov edx, dword [esp + 0xc]
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048bea0
pop eax
push eax
call fcn.004422f0
pop edx
add eax, edx
jmp 0x405973
push dword [esp]
call fcn.0048c060
push dword [esp + 0xc]
call fcn.0048c060
push dword [esp + 4]
call fcn.0048c060
add esp, 0x30
pop ebx
pop ebp
ret 0x14