Function at 0x4a8948
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x50d838]
test eax, eax
je 0x4a8958
mov eax, dword [0x50d834]
ret
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp], 0x4eb724
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4a8c88
mov dword [esp], str.kernel32
call sub.KERNEL32.dll_GetModuleHandleA
push ebx
mov dword [ebp - 0x40], eax
test eax, eax
je 0x4a8b54
mov dword [esp + 4], str.GetUserPreferredUILanguages
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4a8b20
mov dword [ebp - 0x24], 0
lea edi, [ebp - 0x24]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
lea esi, [ebp - 0x28]
mov dword [esp + 4], esi
mov dword [esp], 8
call eax
sub esp, 0x10
test eax, eax
jne 0x4a8b20
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x80000005
jne 0x4a8b20
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4a8b20
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4a8b20
mov dword [esp + 0xc], edi
mov edi, eax
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], 8
call ebx
sub esp, 0x10
test eax, eax
je 0x4a8b12
mov ebx, dword [ebp - 0x28]
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x24]
add edx, eax
lea eax, [edx + eax + 1]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov esi, eax
mov dword [ebp - 0x44], eax
test eax, eax
je 0x4a8b12
test ebx, ebx
je 0x4a8b01
mov ebx, edi
mov edx, eax
mov dword [ebp - 0x3c], 0
nop
mov ax, word [ebx]
test ax, ax
je 0x4a8ca9
movzx ecx, al
cmp ax, cx
jne 0x4a8c90
cmp ax, 0x3a
je 0x4a8c90
mov ecx, esi
jmp 0x4a8aa6
movzx edi, al
cmp ax, di
jne 0x4a8c90
cmp ax, 0x3a
je 0x4a8c90
inc ecx
mov byte [ecx - 1], al
add ebx, 2
mov ax, word [ebx]
test ax, ax
jne 0x4a8a90
cmp edx, ecx
je 0x4a8c90
mov byte [ecx], 0
mov dword [esp], esi
call fcn.004a8cc4
mov ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea edx, [esi + ecx - 1]
add ebx, 2
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x28]
jae 0x4a8c90
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x4a8c80
lea esi, [edx + 1]
mov byte [edx], 0x3a
jmp 0x4a8a68
mov eax, dword [ebp - 0x44]
mov byte [eax], 0
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
lea esi, [esi]
mov dword [esp + 4], str.GetUserDefaultUILanguage
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x4a8b54
call eax
movzx eax, ax
mov dword [esp], eax
call fcn.004a8d18
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4a8c64
nop
lea eax, [ebp - 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelDesktopResourceLocale
mov dword [esp], 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4a8c22
mov dword [ebp - 0x2c], 9
lea eax, [ebp - 0x2c]
mov dword [esp + 0x14], eax
lea ebx, [ebp - 0x24]
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov esi, eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
push eax
test esi, esi
jne 0x4a8c22
cmp dword [ebp - 0x30], 1
jne 0x4a8c22
mov eax, dword [ebp - 0x2c]
cmp eax, 9
ja 0x4a8c22
jne 0x4a8cb9
cmp byte [ebp - 0x1c], 0
jne 0x4a8c22
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strtoul
mov edx, dword [ebp - 0x28]
cmp edx, ebx
jbe 0x4a8c22
cmp byte [edx], 0
jne 0x4a8c22
mov dword [esp], eax
call fcn.004aa39c
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x4a8c64
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x4a8cb0
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4a8928
mov dword [esp + 8], 1
mov dword [esp + 4], 0x10
mov dword [esp], edx
call sub.KERNEL32.dll_EnumResourceLanguagesA
sub esp, 0x14
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [0x50d834], eax
mov dword [0x50d838], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, edx
jmp 0x4a8a68
mov eax, dword [0x50d834]
jmp 0x4a8c76
mov byte [edx], 0
cmp dword [ebp - 0x44], edx
jae 0x4a8b07
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x4a8c64
mov ecx, esi
jmp 0x4a8ab5
mov dword [ebp - 0x44], 0
jmp 0x4a8c64
mov byte [ebp + eax - 0x24], 0
jmp 0x4a8bf0