Function at 0x4a0ff0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, edx
mov ebp, ecx
test eax, eax
je 0x4a11d0
mov edi, str.HKEY_CLASSES_ROOT
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4a1054
mov edx, 0x80000000
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x4a10e8
add esp, 0x4c
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, str.HKEY_CURRENT_USER
mov ecx, 0x12
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4a11b0
mov edi, str.HKEY_LOCAL_MACHINE
mov ecx, 0x13
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4a11c0
mov edi, str.HKEY_USERS
mov ecx, 0xb
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4a1306
mov edi, str.HKEY_PERFORMANCE_DATA
mov ecx, 0x16
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4a1320
mov edi, str.HKEY_CURRENT_CONFIG
mov ecx, 0x14
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4a1048
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0x80000005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x4a1048
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x38], 1
call esi
sub esp, 0x18
test eax, eax
je 0x4a1146
mov edx, dword [esp + 0x30]
xor ebx, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], edx
call edi
push eax
mov eax, ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp], eax
mov dword [esp + 0x34], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x30]
mov ebx, eax
test eax, eax
je 0x4a1136
lea eax, [esp + 0x34]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], edx
call esi
sub esp, 0x18
test eax, eax
jne 0x4a1310
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x3c], 2
mov byte [ebx + eax], 0
je 0x4a1330
mov edx, dword [esp + 0x30]
jmp 0x4a1136
mov edx, 0x80000001
jmp 0x4a1018
mov edx, 0x80000002
jmp 0x4a1018
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 4], edx
mov dword [esp], 0x80000001
mov dword [esp + 0x28], eax
call eax
sub esp, 0x14
test eax, eax
je 0x4a1237
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x28]
sub esp, 0x14
test eax, eax
jne 0x4a1048
lea eax, [esp + 0x38]
mov dword [esp + 0x10], 0
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x38], 1
call esi
sub esp, 0x18
test eax, eax
je 0x4a1146
mov eax, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp], eax
call edi
push edx
lea eax, [esp + 0x30]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [esp + 0x28]
sub esp, 0x14
test eax, eax
jne 0x4a1048
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
je 0x4a114c
mov edx, dword [esp + 0x30]
xor ebx, ebx
jmp 0x4a1136
mov edx, 0x80000003
jmp 0x4a1018
mov dword [esp], ebx
call sub.msvcrt.dll_free
jmp 0x4a12fb
mov edx, 0x80000004
jmp 0x4a1018
mov dword [esp + 4], 0x25
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4a11aa
mov eax, dword [esp + 0x34]
lea ebp, [eax + 0x3e8]
add eax, 0x3e9
mov dword [esp], eax
mov dword [esp + 0x34], ebp
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x4a11aa
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call ebp
sub esp, 0xc
test eax, eax
mov dword [esp + 0x38], eax
jne 0x4a1398
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x4a11aa
cmp eax, dword [esp + 0x34]
ja 0x4a141c
mov byte [esi + eax], 0
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov eax, esi
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
xor ecx, 0xffffffff
and edx, ecx
and edx, 0x80808080
je 0x4a13ac
test edx, 0x8080
jne 0x4a13d2
shr edx, 0x10
add eax, 2
mov bl, dl
add bl, dl
sbb eax, 3
sub eax, esi
lea ebp, [eax + 1]
mov dword [esp], ebp
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x30]
mov ebx, eax
test eax, eax
je 0x4a1415
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [esp + 0x28], edx
call sub.msvcrt.dll_memcpy
mov dword [esp], esi
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x28]
jmp 0x4a1136
mov ebx, esi
jmp 0x4a1136
mov dword [esp], esi
mov dword [esp + 0x28], eax
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x28]
lea eax, [edx + 1]
mov dword [esp + 0x34], edx
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov edx, dword [esp + 0x28]
mov esi, eax
test eax, eax
je 0x4a11aa
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call ebp
sub esp, 0xc
test eax, eax
mov dword [esp + 0x38], eax
je 0x4a146b
cmp eax, dword [esp + 0x34]
ja 0x4a138b
mov byte [esi + eax], 0
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov ebx, esi
mov edx, dword [esp + 0x30]
jmp 0x4a1136