Function at 0x4060da
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4060e1
call fcn.00485db0
push dword [esp + 0x50]
call fcn.0043c320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.0043c000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.0043c000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x406132
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00483710
call fcn.00485e10
mov edx, 0x542028
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x406198
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 8]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004837b0
lea eax, [esp + 4]
push eax
call fcn.00485ce0
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004837b0
call fcn.00485e10
mov edx, 0x542028
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x4061fe
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 8]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00483710
lea eax, [esp + 4]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406219
push 0x555b04
push 0x24
push dword [esp + 0x54]
call fcn.00484b00
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4062a2
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406270
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069de
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00485ce0
cmp dword [esp + 0x14], 0
je 0x406280
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54003e
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x4069bc
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40632a
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4062ff
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069de
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00485ce0
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54003e
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x4069bc
cmp dword [esp + 0x20], 0
je 0x406395
push dword [esp + 0x20]
call fcn.00484b70
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x406395
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40636a
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.0043c008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54003e
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x4069bc
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x406425
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4063fa
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0xc]
call fcn.004069de
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00485ce0
push dword [esp + 0x1c]
call fcn.00484ce0
mov edx, 0x54003e
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x4069bc
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406438
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x406627
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x406503
mov dword [esp + 0x30], 0
jmp 0x406464
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4064fe
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov edx, 0x540f4a
push edx
call fcn.00485c80
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
mov eax, 0x5412c6
push eax
push 2
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00484d00
cdq
push edx
push eax
call fcn.00483cf0
call fcn.0043c302
add dword [esp], edx
call fcn.00483d70
pop eax
mov edx, 0x541070
push edx
call fcn.00485c80
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
inc dword [esp + 0x30]
jno 0x406464
jmp 0x4065a7
mov dword [esp + 0x30], 0
jmp 0x40650d
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x4065a7
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov edx, 0x540f4a
push edx
call fcn.00485c80
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
mov eax, 0x5412c6
push eax
push 2
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.00484d00
cdq
push edx
push eax
call fcn.00483cf0
call fcn.0043c302
add dword [esp], edx
call fcn.00483d70
pop eax
mov edx, 0x541070
push edx
call fcn.00485c80
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
inc dword [esp + 0x30]
jno 0x40650d
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0x18]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00483710
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4065f5
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.0043c320
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
add esp, 4
jmp 0x4069bc
mov ebx, 4
cmp ebx, dword [esp]
jne 0x406684
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406654
mov eax, dword [esp + 0x20]
call fcn.0043c2c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.0043c2c0
cdq
push edx
push eax
call fcn.00483540
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
jmp 0x40698a
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40675a
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x406755
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.00484b70
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x406753
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x40674a
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.00484d10
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40674a
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00485ce0
push dword [esp + 0x10]
call fcn.00483780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00484ce0
jmp 0x406755
jmp 0x40698a
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4068c6
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x406824
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00484d10
call fcn.00485e10
mov edx, 0x54003e
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x4067da
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov edx, 0x540588
push edx
call fcn.00485c80
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
jmp 0x40681a
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00484d10
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
add dword [esp + 0x30], 2
jmp 0x406768
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.004837b0
call fcn.00485e10
mov edx, 0x540588
call fcn.0043c330
mov ecx, eax
call fcn.0043c340
je 0x40688a
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0x18]
call fcn.00483780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00483710
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4068c1
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00485ce0
push dword [esp + 0x10]
call fcn.00483780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x40698a
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x406926
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4068fa
push dword [esp + 0x20]
call fcn.00484d80
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0x28]
call fcn.00484d80
push edx
push eax
call fcn.00483540
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
jmp 0x40698a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40698a
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c40
pop edx
push eax
push dword [esp + 0x28]
call fcn.00484d90
lea eax, [esp + 0x14]
push eax
call fcn.00485ce0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40698a
mov edx, dword [esp + 0x10]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00485ce0
push dword [esp + 0x10]
call fcn.00483780
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00484ce0
mov edx, dword [esp + 0xc]
push edx
call fcn.00485c40
pop edx
push eax
push edx
call fcn.00485c80
pop eax
push eax
call fcn.0043c2f0
pop edx
add eax, edx
jmp 0x4069bc
push dword [esp]
call fcn.00485e40
push dword [esp + 0xc]
call fcn.00485e40
push dword [esp + 4]
call fcn.00485e40
add esp, 0x30
pop ebx
pop ebp
ret 0x14