Function at 0x4ad09310
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.4ad0367b
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 2
pop ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 0x1024], 0x80000002
mov dword [ebp - 0x1020], 0x80000001
jl 0x4ad095f8
cmp byte [0x4ad4061c], 0
je 0x4ad0935c
mov byte [0x4ad24041], 1
push ebx
push esi
lea esi, [ebp - 0x1024]
sub esi, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x101c], esi
mov dword [ebp - 0x1018], ecx
mov ebx, 0x1000
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 0x1014]
push 0x4ad096e8
push dword [esi + eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4ad095d1
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
xor esi, esi
push esi
push 0x4ad096c4
push dword [ebp - 0x1010]
mov dword [ebp - 0x1008], esi
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad15cb4
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad096a0
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad09428
cmp dword [ebp - 0x1008], 4
jne 0x4ad0973a
cmp dword [ebp - 0x1004], esi
setne al
mov byte [0x4ad24041], al
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad0967c
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad15d0e
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad09660
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad094a0
cmp dword [ebp - 0x1008], 4
jne 0x4ad0974c
mov ax, word [ebp - 0x1004]
mov word [0x4ad2404a], ax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad09640
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad09501
cmp dword [ebp - 0x1008], 4
jne 0x4ad15d65
mov ax, word [ebp - 0x1004]
mov word [0x4ad24060], ax
cmp ax, si
je 0x4ad094f8
cmp ax, 0xd
je 0x4ad094f8
cmp ax, 0x20
jbe 0x4ad09501
mov word [0x4ad24060], 0x20
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad09618
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
jne 0x4ad0975e
cmp dword [ebp - 0x1008], 4
jne 0x4ad15d90
mov ax, word [ebp - 0x1004]
mov word [0x4ad24064], ax
cmp ax, si
je 0x4ad0955d
cmp ax, 0xd
je 0x4ad0955d
cmp ax, 0x20
jbe 0x4ad09567
mov ax, 0x20
mov word [0x4ad24064], ax
mov cx, word [0x4ad24060]
push 0x20
pop edx
cmp cx, dx
jne 0x4ad09732
cmp ax, dx
jb 0x4ad15dbb
jne 0x4ad0958e
cmp cx, dx
jb 0x4ad15dc6
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1008]
push eax
push esi
push 0x4ad09608
push dword [ebp - 0x1010]
mov dword [ebp - 0x100c], ebx
call edi
test eax, eax
je 0x4ad15dd2
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x101c]
add dword [ebp - 0x1014], 4
dec dword [ebp - 0x1018]
jne 0x4ad09384
push 0
call dword [sym.imp.msvcrt.dll_time]
push eax
call dword [sym.imp.msvcrt.dll_srand]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.4ad013fa
leave
ret 8
cmp ax, dx
jmp 0x4ad09583
cmp dword [ebp - 0x1008], 1
je 0x4ad15cf4
jmp 0x4ad09428
cmp dword [ebp - 0x1008], 1
je 0x4ad15d4e
jmp 0x4ad094a0
mov ax, word [0x4ad24064]
jmp 0x4ad09567
cmp dword [ebp - 0x1008], 4
jne 0x4ad15cc8
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad15cea
cmp dword [ebp - 0x1008], 1
jne 0x4ad093e0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad4063d], al
jmp 0x4ad093e0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
jmp 0x4ad09423
cmp dword [ebp - 0x1008], 4
jne 0x4ad15d22
cmp dword [ebp - 0x1004], esi
setne al
jmp 0x4ad15d44
cmp dword [ebp - 0x1008], 1
jne 0x4ad09459
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
dec eax
neg eax
sbb al, al
pop ecx
inc al
mov byte [0x4ad24042], al
jmp 0x4ad09459
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad0949a
cmp dword [ebp - 0x1008], 1
jne 0x4ad15d85
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad094e1
mov ax, word [0x4ad24060]
jmp 0x4ad094e7
cmp dword [ebp - 0x1008], 1
jne 0x4ad15db0
push esi
lea eax, [ebp - 0x1004]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
jmp 0x4ad09546
mov ax, word [0x4ad24064]
jmp 0x4ad0954c
mov word [0x4ad24060], ax
jmp 0x4ad0958e
mov word [0x4ad24064], cx
jmp 0x4ad0958e
cmp dword [ebp - 0x1008], 2
jne 0x4ad15e22
mov eax, dword [ebp - 0x100c]
shr eax, 1
mov ecx, 0x7fe
sub ecx, eax
lea esi, [ebp + eax*2 - 0x1000]
push ecx
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4ad15e18
push esi
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad01416
jmp 0x4ad15e20
and word [ebp - 0x1004], 0
xor esi, esi
cmp word [ebp - 0x1004], si
je 0x4ad095bf
lea eax, [ebp - 0x1004]
push eax
call fcn.4ad01ebf
mov ecx, dword [ebp - 0x1014]
mov dword [ecx], eax
jmp 0x4ad095bf