Function at 0x493160
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4d0f11
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x4ff108
call esi
mov ebp, eax
cmp ebp, edi
jne 0x49327f
lea eax, [esp + 0x20]
push eax
push str.SoftwareMicrosoftDebuggingTools
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4931ef
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push 0x4ff108
push edi
push edi
push str.Windbg
push edx
mov dword [esp + 0x34], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.DbgHelp.dll
push 0x104
push 0x4ff108
call fcn.004a146b
add esp, 0xc
jmp 0x493204
push 0x104
push 0x4ff108
push str._ProgramFiles_Debugging_Tools_for_Windowsdbghelp.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x4ff108
call esi
mov ebp, eax
cmp ebp, edi
jne 0x49327f
push str.C:Debuggersdbghelp.dll
push 0x104
push 0x4ff108
call fcn.0049ee55
add esp, 0xc
push 0x4ff108
call esi
mov ebp, eax
cmp ebp, edi
jne 0x49327f
push 0x4ff108
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4ed4a4
push 0x104
push 0x4ff108
call fcn.004a146b
add esp, 0xc
push 0x4ff108
call esi
mov ebp, eax
cmp ebp, edi
jne 0x49327f
push str.dbghelp.dll
call esi
mov ebp, eax
cmp ebp, edi
jne 0x49327f
push str.imagehlp.dll
call esi
mov ebp, eax
push str._PATH_
lea eax, [esp + 0x14]
call fcn.00442e40
push 0x5c
push 0x4ff108
mov dword [esp + 0x44], edi
call fcn.0049ec5c
add esp, 8
cmp eax, edi
je 0x4932c3
mov ecx, eax
sub ecx, 0x4ff108
sar ecx, 1
mov eax, 0x4ff108
lea esi, [esp + 0x28]
call fcn.00442d80
mov ebx, 1
jmp 0x4932d6
push 0x4ff108
lea ebx, [esp + 0x28]
call fcn.00402bd0
mov ebx, 2
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x4932e7
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x3c], 2
test bl, 2
je 0x493319
mov eax, dword [esp + 0x24]
and ebx, 0xfffffffd
mov dword [esp + 0x14], ebx
test eax, eax
je 0x493319
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x493319
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x3c], 3
test bl, 1
je 0x493341
mov eax, dword [esp + 0x28]
test eax, eax
je 0x493341
push eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x493341
push esi
call fcn.0049e96f
add esp, 4
push 0x4e65cc
lea ebx, [esp + 0x18]
call fcn.00402bd0
mov eax, ebx
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x48], 4
call fcn.004907a0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
mov bl, 5
push eax
mov byte [esp + 0x48], bl
call fcn.004907a0
mov edi, eax
mov byte [esp + 0x3c], 6
mov esi, dword [esp + 0x10]
test esi, esi
je 0x49339f
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49339f
push esi
call fcn.0049e96f
add esp, 4
mov edi, dword [edi]
mov dword [esp + 0x10], edi
test edi, edi
je 0x4933b0
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x3c], bl
mov eax, dword [esp + 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
je 0x4933d4
push eax
mov esi, eax
call ebx
test eax, eax
jne 0x4933d4
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x3c], 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4933f3
push eax
mov esi, eax
call ebx
test eax, eax
jne 0x4933f3
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x3c], 3
mov esi, dword [esp + 0x14]
test esi, esi
je 0x493410
push esi
call ebx
test eax, eax
jne 0x493410
push esi
call fcn.0049e96f
add esp, 4
test edi, edi
je 0x49341b
lea eax, [edi + 8]
test eax, eax
jne 0x493420
mov eax, 0x4d9064
push eax
push 0x4ed504
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x3c], 0
mov esi, dword [esp + 0x18]
test esi, esi
je 0x493449
push esi
call ebx
test eax, eax
jne 0x493449
push esi
call fcn.0049e96f
add esp, 4
mov dword [esp + 0x3c], 0xffffffff
test edi, edi
je 0x493465
push edi
call ebx
test eax, eax
jne 0x493465
push edi
call fcn.0049e96f
add esp, 4
push 0x104
push 0x4ff108
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, 0x4ff108
call fcn.00490a00
mov eax, dword [0x4feb84]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword [0x4feb4c], eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret