Function at 0x4898b0
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x174
mov eax, dword [0x513010]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [esp + 0x128], str.AFPL_Ghostscript
push esi
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x134], str.Aladdin_Ghostscript
mov dword [esp + 0x138], str.GPL_Ghostscript
mov dword [esp + 0x13c], str.GNU_Ghostscript
call fcn.00460364
push ecx
push ecx
lea ecx, [esp + 0x54]
call fcn.004160d9
mov ebx, 0x20219
lea edi, [esp + 0x128]
push esi
push dword [edi]
call fcn.0046265e
mov edx, str.Software_
mov ecx, eax
call fcn.0045f798
pop ecx
pop ecx
or edx, 0xffffffff
mov ecx, eax
call fcn.00462840
lea ecx, [esp + 0xc]
push ecx
push ebx
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4899b1
push 0x20
lea eax, [esp + 0x13c]
mov dword [esp + 0x14], esi
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4899a7
or edx, 0xffffffff
lea ecx, [esp + 0x138]
call fcn.00462810
push ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00461461
push 0x20
lea eax, [esp + 0x13c]
inc esi
push eax
push esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x489971
xor esi, esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
lea eax, [esp + 0x138]
cmp edi, eax
jne 0x48991d
test ebx, 0x200
je 0x4899dd
mov ebx, 0x20119
call fcn.00464346
test al, al
jne 0x489916
push 0x461736
lea ecx, [esp + 0x1c]
call fcn.00461749
mov edi, dword [esp + 0x50]
test edi, edi
je 0x489aa9
lea ebx, [esp + 0x128]
lea eax, [edi - 1]
push eax
lea ecx, [esp + 0x1c]
call fcn.00461555
push eax
push dword [ebx]
push str.Software_s_s
call fcn.0045f9ea
add esp, 0xc
mov dword [esp + 0xc], eax
mov edx, eax
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push str.GS_DLL
call fcn.004644ae
pop ecx
test eax, eax
je 0x489a84
mov ecx, eax
call fcn.00462a91
push esi
mov edx, str.gswin32c.exe
mov dword [esp + 0x18], eax
mov ecx, eax
call fcn.00462922
pop ecx
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.0046330d
test al, al
jne 0x489b80
mov ecx, dword [esp + 0x14]
mov edx, str.gswin64c.exe
push esi
call fcn.00462922
pop ecx
mov ecx, eax
mov dword [esp + 0x10], eax
call fcn.0046330d
test al, al
jne 0x489b80
push dword [esp + 0xc]
call fcn.004c5e5a
add ebx, 4
lea eax, [esp + 0x13c]
pop ecx
cmp ebx, eax
jne 0x4899fe
sub edi, 1
jne 0x4899f7
push esi
push esi
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
push 2
lea ecx, [edi + 1]
push ecx
call fcn.004c7d3d
mov ebx, eax
mov dword [esp + 0x14], ebx
pop ecx
pop ecx
test edi, edi
je 0x489bb8
push edi
push ebx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push esi
lea ecx, [esp + 0xa8]
call fcn.00460364
push ecx
push ecx
lea ecx, [esp + 0xdc]
call fcn.004160d9
push 1
push 0x4f7da0
or edx, 0xffffffff
mov ecx, ebx
call fcn.00462810
mov edx, eax
lea ecx, [esp + 0xa8]
call fcn.0046179c
mov eax, dword [esp + 0xe0]
mov edi, esi
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x489ba0
push edi
lea ecx, [esp + 0xa4]
call fcn.00461555
push esi
mov edx, str.gswin32c.exe
mov dword [esp + 0x18], eax
mov ecx, eax
call fcn.00462922
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.0046330d
test al, al
jne 0x489b6c
mov ecx, dword [esp + 0x14]
mov edx, str.gswin64c.exe
push esi
call fcn.00462922
pop ecx
mov ebx, eax
mov ecx, ebx
call fcn.0046330d
test al, al
jne 0x489b92
inc edi
cmp edi, dword [esp + 0x10]
jne 0x489b2e
jmp 0x489ba0
mov edx, dword [esp + 0x10]
xor ecx, ecx
push 0xffffffffffffffff
call fcn.0045f484
pop ecx
mov esi, eax
jmp 0x489bb8
push 0xffffffffffffffff
mov edx, ebx
xor ecx, ecx
call fcn.0045f484
pop ecx
mov esi, eax
lea ecx, [esp + 0xd4]
call fcn.00415382
lea ecx, [esp + 0xa0]
call fcn.0046031d
push dword [esp + 0xc]
call fcn.004c5e5a
pop ecx
lea ecx, [esp + 0x4c]
call fcn.00415382
lea ecx, [esp + 0x18]
call fcn.0046031d
mov ecx, dword [esp + 0x17c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b7879
mov esp, ebp
pop ebp
ret