Function at 0x4c8130
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x240
mov edi, edx
mov ebx, ecx
mov eax, dword [ecx + 0xc0]
test eax, eax
je 0x4c8170
push eax
call fcn.004c6290
add esp, 4
test eax, eax
je 0x4c83ab
test edi, edi
je 0x4c8196
mov ecx, dword [0xaaa684]
push eax
call dword [ecx]
add esp, 4
jmp 0x4c8178
test edi, edi
je 0x4c8304
push str.CARES_HOSTS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
push eax
call fcn.004c6290
add esp, 4
test eax, eax
je 0x4c83ab
mov dword [esp + 0x20], ebx
mov esi, dword [ebx + 0xc8]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64]
add esp, 8
test esi, esi
je 0x4c8217
test eax, eax
setne al
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x54]
mov ecx, edi
or ecx, ebx
sete cl
or cl, al
cmp cl, 1
jne 0x4c81e6
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov edi, eax
mov ebx, edx
add edi, 0xffffffc4
adc ebx, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
push dword [esi + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4c8217
cmp edi, dword [esi]
sbb ebx, dword [esi + 4]
jge 0x4c8217
mov eax, dword [0xaaa684]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
xor ebx, ebx
jmp 0x4c83fc
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0xc8]
test esi, esi
je 0x4c824f
mov edi, dword [0xaaa684]
push dword [esi + 8]
call dword [edi]
add esp, 4
push dword [esi + 0x10]
call fcn.004bcca0
add esp, 4
push dword [esi + 0xc]
call fcn.004bcca0
add esp, 4
push esi
call dword [edi]
add esp, 4
mov dword [ebx + 0xc8], 0
call fcn.004c4690
mov esi, eax
test eax, eax
je 0x4c83e0
push esi
push dword [esp + 0x14]
call fcn.004c61a0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4c83e5
push 0x18
call fcn.004b39d0
add esp, 4
test eax, eax
je 0x4c83e0
mov ebx, eax
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov dword [ebx + 4], edx
mov dword [ebx], eax
push dword [esp + 0x10]
call fcn.004c6290
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
je 0x4c83b2
push 0x4c8f60
call fcn.004bccc0
add esp, 4
mov dword [ebx + 0xc], eax
test eax, eax
je 0x4c83b2
push 0
call fcn.004bccc0
add esp, 4
mov dword [ebx + 0x10], eax
test eax, eax
je 0x4c83b2
mov dword [esp + 8], ebx
push esi
call fcn.004c4de0
add esp, 4
test eax, eax
je 0x4c8956
lea edi, [esp + 0x14]
jmp 0x4c842f
lea esi, [esp + 0x28]
push 0x104
push 0
push esi
call fcn.00786b68
add esp, 0xc
mov dword [esp + 0x24], 0x104
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4c834a
mov ebx, 4
jmp 0x4c83fc
lea eax, [esp + 0x24]
lea edi, [esp + 0x130]
push eax
push edi
push 0
push 0
push str.DatabasePath
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov dword [esp + eax + 0x28], 0x736f685c
mov dword [esp + eax + 0x2b], 0x737473
push esi
call fcn.004c6290
add esp, 4
test eax, eax
jne 0x4c8196
mov ebx, 0xf
jmp 0x4c83fc
mov edi, esi
mov esi, dword [0xaaa684]
push dword [ebx + 8]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004bcca0
add esp, 4
push dword [ebx + 0xc]
call fcn.004bcca0
add esp, 4
push ebx
call dword [esi]
mov esi, edi
add esp, 4
mov ebx, 0xf
push esi
call fcn.004c46f0
add esp, 4
mov eax, dword [0xaaa684]
push dword [esp + 0x10]
call dword [eax]
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 0xf
je 0x4c89b1
push 1
push esi
call fcn.004c5230
add esp, 8
push esi
call fcn.004c4de0
add esp, 4
test eax, eax
lea edi, [esp + 0x14]
je 0x4c8956
mov byte [esp + 0x14], 0x23
push 0
push esi
call fcn.004c5130
add esp, 8
push esi
call fcn.004c4de0
add esp, 4
test eax, eax
je 0x4c8956
push 1
push edi
push esi
call fcn.004c5750
add esp, 0xc
test eax, eax
jne 0x4c840f
push esi
call fcn.004c4bf0
add esp, 4
push esi
call fcn.004c51d0
add esp, 4
push 0x41
lea edi, [esp + 0x2c]
push edi
push esi
call fcn.004c4d10
add esp, 0xc
test eax, eax
jne 0x4c8406
xorps xmm0, xmm0
movaps xmmword [esp + 0x130], xmm0
mov dword [esp + 0x140], 0
lea ebx, [esp + 0x134]
push ebx
push edi
push 2
call fcn.004bbb10
add esp, 0xc
mov ecx, 2
test eax, eax
jg 0x4c84d1
push ebx
push edi
push 0x17
call fcn.004bbb10
add esp, 0xc
mov ecx, 0x17
test eax, eax
jle 0x4c840f
mov dword [esp + 0x130], ecx
push 0x41
push edi
push ebx
push ecx
call fcn.004bbb80
add esp, 0x10
test eax, eax
je 0x4c840f
push 0xc
call fcn.004b39d0
add esp, 4
test eax, eax
je 0x4c89b1
mov ebx, eax
mov eax, dword [0xaaa684]
push dword [eax]
call fcn.004bd120
add esp, 4
mov dword [esp + 4], ebx
mov dword [ebx + 4], eax
test eax, eax
je 0x4c8974
push edi
call fcn.004c6290
add esp, 4
test eax, eax
je 0x4c8974
mov edi, eax
push eax
mov ebx, dword [esp + 8]
push dword [ebx + 4]
call fcn.004bd150
add esp, 8
test eax, eax
je 0x4c897a
mov eax, dword [0xaaa684]
push dword [eax]
call fcn.004bd120
add esp, 4
mov dword [ebx + 8], eax
test eax, eax
jne 0x4c857c
jmp 0x4c89f2
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bd3f0
add esp, 4
test eax, eax
je 0x4c891d
push esi
call fcn.004c4de0
add esp, 4
test eax, eax
je 0x4c868a
mov byte [esp + 0x130], 0x23
push 0
push esi
call fcn.004c5130
add esp, 8
push esi
call fcn.004c4de0
add esp, 4
test eax, eax
lea edi, [esp + 0x28]
je 0x4c868a
push 1
lea eax, [esp + 0x134]
push eax
push esi
call fcn.004c5750
add esp, 0xc
test eax, eax
jne 0x4c868a
push esi
call fcn.004c4bf0
add esp, 4
push esi
call fcn.004c51d0
add esp, 4
test eax, eax
je 0x4c868a
push 0x100
push edi
push esi
call fcn.004c4d10
add esp, 0xc
test eax, eax
jne 0x4c8565
push edi
call fcn.004c6560
add esp, 4
test eax, eax
je 0x4c857c
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4c8656
mov edi, eax
push edi
call fcn.004bd3e0
add esp, 4
lea ecx, [esp + 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4c857c
push edi
call fcn.004bd3c0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c8627
lea eax, [esp + 0x28]
push eax
call fcn.004c6290
add esp, 4
test eax, eax
je 0x4c8a01
mov edi, eax
push eax
mov eax, dword [esp + 8]
push dword [eax + 8]
call fcn.004bd1b0
add esp, 8
test eax, eax
jne 0x4c857c
jmp 0x4c89f6
mov edi, dword [esp + 4]
push dword [edi + 8]
call fcn.004bd3f0
add esp, 4
test eax, eax
je 0x4c8921
push dword [edi + 8]
call fcn.004bd3f0
add esp, 4
mov dword [esp + 0x1c], eax
push dword [edi + 4]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4c86ed
mov edi, eax
push edi
call fcn.004bd3e0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004bce90
add esp, 8
test eax, eax
jne 0x4c8737
push edi
call fcn.004bd3c0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c86c1
mov ebx, dword [esp + 4]
push dword [ebx + 8]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4c8743
mov edi, eax
push edi
call fcn.004bd3e0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004bce90
add esp, 8
test eax, eax
jne 0x4c874a
push edi
call fcn.004bd3c0
add esp, 4
mov edi, eax
test eax, eax
jne 0x4c8702
mov eax, dword [esp + 4]
jmp 0x4c8859
mov dword [esp + 0xc], eax
mov al, 1
mov dword [esp + 0x18], eax
jmp 0x4c87ba
mov eax, ebx
jmp 0x4c8859
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4c87b2
mov edi, eax
jmp 0x4c878a
mov eax, dword [esp + 0xc]
push dword [eax + 4]
push edi
call fcn.004bd670
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 4]
call fcn.004bd350
add esp, 4
mov edi, eax
test eax, eax
je 0x4c87b2
push edi
call fcn.004bd3e0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0xc]
call fcn.004bce90
add esp, 8
test eax, eax
je 0x4c8765
push edi
call fcn.004bd4b0
add esp, 4
jmp 0x4c8775
mov dword [esp + 0x18], 0
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4c881e
mov edi, eax
jmp 0x4c87f6
mov eax, dword [esp + 0xc]
push dword [eax + 8]
push edi
call fcn.004bd670
add esp, 8
mov eax, dword [esp + 4]
push dword [eax + 8]
call fcn.004bd350
add esp, 4
mov edi, eax
test eax, eax
je 0x4c881e
push edi
call fcn.004bd3e0
add esp, 4
push eax
mov eax, dword [esp + 0xc]
push dword [eax + 0x10]
call fcn.004bce90
add esp, 8
test eax, eax
je 0x4c87d1
push edi
call fcn.004bd4b0
add esp, 4
jmp 0x4c87e1
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c882d
dec eax
mov dword [edi], eax
jne 0x4c884e
push dword [edi + 8]
call fcn.004bd5e0
add esp, 4
push dword [edi + 4]
call fcn.004bd5e0
add esp, 4
push edi
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
cmp byte [esp + 0x18], 0
mov eax, dword [esp + 0xc]
jne 0x4c88a3
push dword [eax + 4]
mov ebx, eax
call fcn.004bd430
add esp, 4
push 0
mov dword [esp + 8], eax
push eax
mov edi, dword [esp + 0x10]
push dword [edi + 0xc]
call fcn.004bce30
add esp, 0xc
test eax, eax
je 0x4c8884
mov eax, ebx
jmp 0x4c88a3
push ebx
push dword [esp + 8]
push dword [edi + 0xc]
call fcn.004bcdb0
add esp, 0xc
mov ecx, dword [ebx]
test eax, eax
mov eax, ebx
je 0x4c8a3a
inc ecx
mov dword [eax], ecx
mov dword [esp + 0xc], eax
push dword [eax + 8]
call fcn.004bd3b0
add esp, 4
test eax, eax
je 0x4c840f
mov ebx, eax
inc dword [esp + 0x1c]
jmp 0x4c88d5
push ebx
call fcn.004bd3d0
add esp, 4
mov ebx, eax
test eax, eax
je 0x4c840f
push ebx
call fcn.004bd3e0
add esp, 4
dec dword [esp + 0x1c]
je 0x4c840f
mov edi, eax
push 0
push eax
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004bce30
add esp, 0xc
test eax, eax
jne 0x4c88c2
push dword [esp + 0xc]
push edi
mov eax, dword [esp + 0x10]
push dword [eax + 0x10]
call fcn.004bcdb0
add esp, 0xc
test eax, eax
jne 0x4c88c2
jmp 0x4c89b1
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
je 0x4c8930
dec eax
mov dword [edi], eax
jne 0x4c840f
push dword [edi + 8]
call fcn.004bd5e0
add esp, 4
push dword [edi + 4]
call fcn.004bd5e0
add esp, 4
push edi
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
jmp 0x4c840f
push esi
call fcn.004c46f0
add esp, 4
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 8]
mov dword [eax + 0xc8], ecx
xor ebx, ebx
jmp 0x4c83ee
mov ebx, dword [esp + 4]
jmp 0x4c8985
push edi
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x4c8990
dec eax
mov dword [ebx], eax
jne 0x4c89b1
push dword [ebx + 8]
call fcn.004bd5e0
add esp, 4
push dword [ebx + 4]
call fcn.004bd5e0
add esp, 4
push ebx
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
mov ebx, dword [esp + 8]
push esi
call fcn.004c46f0
add esp, 4
push dword [ebx + 8]
mov esi, dword [0xaaa684]
call dword [esi]
add esp, 4
push dword [ebx + 0x10]
call fcn.004bcca0
add esp, 4
push dword [ebx + 0xc]
call fcn.004bcca0
add esp, 4
push ebx
call dword [esi]
add esp, 4
mov ebx, 0xf
jmp 0x4c83ee
mov edi, ebx
jmp 0x4c8a05
push edi
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
mov edi, dword [esp + 4]
mov eax, dword [edi]
test eax, eax
mov ebx, dword [esp + 8]
je 0x4c8a14
dec eax
mov dword [edi], eax
jne 0x4c89b5
push dword [edi + 8]
call fcn.004bd5e0
add esp, 4
push dword [edi + 4]
call fcn.004bd5e0
add esp, 4
push edi
mov eax, dword [0xaaa684]
call dword [eax]
add esp, 4
jmp 0x4c89b5
test ecx, ecx
je 0x4c8a47
dec ecx
mov dword [eax], ecx
jne 0x4c89b1
mov edi, eax
push dword [eax + 8]
call fcn.004bd5e0
add esp, 4
push dword [edi + 4]
call fcn.004bd5e0
add esp, 4
push edi
jmp 0x4c89a7