Function at 0x498dd4
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4f75b8]
test eax, eax
je 0x498de4
mov eax, dword [0x4f75b4]
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x4d1d38
call sub.msvcrt.dll_getenv
test eax, eax
je 0x499114
mov dword [esp], str.kernel32
call sub.KERNEL32.dll_GetModuleHandleA
push ebx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x498fe0
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
test eax, eax
je 0x498fac
mov dword [ebp - 0x24], 0
lea edi, [ebp - 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
lea esi, [ebp - 0x28]
mov dword [esp + 4], esi
mov dword [esp], 8
call eax
sub esp, 0x10
test eax, eax
jne 0x498fac
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x80000005
jne 0x498fac
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x498fac
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x498fac
mov dword [esp + 0xc], edi
mov edi, eax
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x498f9e
mov ebx, dword [ebp - 0x28]
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x24]
add edx, eax
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [ebp - 0x44], eax
test eax, eax
je 0x498f9e
test ebx, ebx
je 0x498f8d
mov ebx, edi
mov edx, eax
mov dword [ebp - 0x3c], 0
nop
mov ax, word [ebx]
test ax, ax
je 0x499135
movzx ecx, al
cmp ax, cx
jne 0x49911c
cmp ax, 0x3a
je 0x49911c
mov ecx, esi
jmp 0x498f32
movzx edi, al
cmp ax, di
jne 0x49911c
cmp ax, 0x3a
je 0x49911c
inc ecx
mov byte [ecx - 1], al
add ebx, 2
mov ax, word [ebx]
test ax, ax
jne 0x498f1c
cmp edx, ecx
je 0x49911c
mov byte [ecx], 0
mov dword [esp], esi
call fcn.00499150
mov ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [esi + ecx - 1]
add ebx, 2
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x28]
jae 0x49911c
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x49910c
lea esi, [edx + 1]
mov byte [edx], 0x3a
jmp 0x498ef4
mov eax, dword [ebp - 0x44]
mov byte [eax], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea esi, [esi]
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x498fe0
call eax
movzx eax, ax
mov dword [esp], eax
call fcn.004991a4
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4990f0
nop
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4990ae
mov dword [ebp - 0x2c], 9
lea eax, [ebp - 0x2c]
mov dword [esp + 0x14], eax
lea ebx, [ebp - 0x24]
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov esi, eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
test esi, esi
jne 0x4990ae
cmp dword [ebp - 0x30], 1
jne 0x4990ae
mov eax, dword [ebp - 0x2c]
cmp eax, 9
ja 0x4990ae
jne 0x499145
cmp byte [ebp - 0x1c], 0
jne 0x4990ae
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004a7308
mov edx, dword [ebp - 0x28]
cmp edx, ebx
jbe 0x4990ae
cmp byte [edx], 0
jne 0x4990ae
mov dword [esp], eax
call fcn.0049a828
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4990f0
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x49913c
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x498db4
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], edx
call sub.KERNEL32.dll_EnumResourceLanguagesA
sub esp, 0x14
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [0x4f75b4], eax
mov dword [0x4f75b8], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, edx
jmp 0x498ef4
mov eax, dword [0x4f75b4]
jmp 0x499102
mov byte [edx], 0
cmp dword [ebp - 0x44], edx
jae 0x498f93
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4990f0
mov ecx, esi
jmp 0x498f41
mov dword [ebp - 0x44], 0
jmp 0x4990f0
mov byte [ebp + eax - 0x24], 0
jmp 0x49907c