Function at 0x4063ca
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4063d1
call fcn.0048f160
push dword [esp + 0x50]
call fcn.00445320
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00445000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00445000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x406422
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c8a0
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x406488
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c940
lea eax, [esp + 4]
push eax
call fcn.0048f090
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c940
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x4064ee
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c8a0
lea eax, [esp + 4]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406509
push 0x56387c
push 0x24
push dword [esp + 0x54]
call fcn.0048deb0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x406592
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406560
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406cce
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
cmp dword [esp + 0x14], 0
je 0x406570
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54903e
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x406cac
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40661a
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4065ef
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406cce
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54903e
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x406cac
cmp dword [esp + 0x20], 0
je 0x406685
push dword [esp + 0x20]
call fcn.0048df20
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x406685
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40665a
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00445008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x54903e
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x406cac
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x406715
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4066ea
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00406cce
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
push dword [esp + 0x1c]
call fcn.0048e090
mov edx, 0x54903e
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x406cac
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x406728
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x406917
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x4067f3
mov dword [esp + 0x30], 0
jmp 0x406754
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x4067ee
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov edx, 0x54a382
push edx
call fcn.0048f030
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov eax, 0x54a74e
push eax
push 2
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048e0b0
cdq
push edx
push eax
call fcn.0048ce80
call fcn.00445302
add dword [esp], edx
call fcn.0048cf00
pop eax
mov edx, 0x54a526
push edx
call fcn.0048f030
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
inc dword [esp + 0x30]
jno 0x406754
jmp 0x406897
mov dword [esp + 0x30], 0
jmp 0x4067fd
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x406897
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov edx, 0x54a382
push edx
call fcn.0048f030
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov eax, 0x54a74e
push eax
push 2
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0048e0b0
cdq
push edx
push eax
call fcn.0048ce80
call fcn.00445302
add dword [esp], edx
call fcn.0048cf00
pop eax
mov edx, 0x54a526
push edx
call fcn.0048f030
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
inc dword [esp + 0x30]
jno 0x4067fd
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048c8a0
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4068e5
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00445320
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
add esp, 4
jmp 0x406cac
mov ebx, 4
cmp ebx, dword [esp]
jne 0x406974
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406944
mov eax, dword [esp + 0x20]
call fcn.004452c0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov eax, dword [esp + 0x28]
call fcn.004452c0
cdq
push edx
push eax
call fcn.0048c6d0
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
jmp 0x406c7a
mov ebx, 2
cmp ebx, dword [esp]
jne 0x406a4a
push 0
push 0
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x406a45
inc dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
add ebx, ebx
mov dword [esp + 0x28], ebx
push dword [esp + 0x28]
call fcn.0048df20
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x406a43
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
and eax, eax
je 0x406a3a
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.0048e0c0
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406a3a
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048f090
push dword [esp + 0x10]
call fcn.0048c910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.0048e090
jmp 0x406a45
jmp 0x406c7a
mov ebx, 7
cmp ebx, dword [esp]
jne 0x406bb6
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x406b14
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.0048e0c0
call fcn.0048f1c0
mov edx, 0x54903e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x406aca
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov edx, 0x549650
push edx
call fcn.0048f030
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
jmp 0x406b0a
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.0048e0c0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
add dword [esp + 0x30], 2
jmp 0x406a58
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.0048c940
call fcn.0048f1c0
mov edx, 0x549650
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x406b7a
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048c8a0
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406bb1
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048f090
push dword [esp + 0x10]
call fcn.0048c910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x406c7a
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x406c16
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406bea
push dword [esp + 0x20]
call fcn.0048e130
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048e130
push edx
push eax
call fcn.0048c6d0
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
jmp 0x406c7a
mov ebx, 1
cmp ebx, dword [esp]
jne 0x406c7a
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0048e140
lea eax, [esp + 0x14]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x406c7a
mov edx, dword [esp + 0x10]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0048f090
push dword [esp + 0x10]
call fcn.0048c910
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.0048e090
mov edx, dword [esp + 0xc]
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048f030
pop eax
push eax
call fcn.004452f0
pop edx
add eax, edx
jmp 0x406cac
push dword [esp]
call fcn.0048f1f0
push dword [esp + 0xc]
call fcn.0048f1f0
push dword [esp + 4]
call fcn.0048f1f0
add esp, 0x30
pop ebx
pop ebp
ret 0x14