Function at 0x495f9a
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00443f5b
lea ecx, [ebp - 8]
call fcn.00443f5b
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp word [eax], bx
mov edi, 0x80000001
mov dword [ebp - 0x20], ebx
jne 0x495fc8
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp + 8]
cmp word [esi], bx
sete byte [ebp + 0xb]
cmp byte [ebp + 0xb], bl
jne 0x496047
push 5
push esi
push 0x4c8edc
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x495ff0
add esi, 0xa
jmp 0x49603e
push 0x13
push esi
push 0x4c8ec8
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x496009
add esi, 0x24
jmp 0x49603e
push 5
push esi
push 0x4c8ec0
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x496022
add esi, 0xa
jmp 0x496039
push 0x13
push esi
push 0x4c8eac
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x49603e
add esi, 0x26
mov edi, 0x80000002
mov dword [ebp - 0x20], 2
jmp 0x496062
mov eax, dword [ebp - 0x20]
cmp eax, 3
jae 0x496276
shl eax, 2
mov edi, dword [eax + 0x4c8ea0]
mov esi, dword [eax + 0x4c8e94]
lea eax, [ebp - 4]
push eax
movzx eax, word [0x4d7c1c]
or eax, 0xf003f
push eax
push ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp dword [ebp - 4], ebx
je 0x496259
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
jne 0x496261
mov eax, dword [ebp - 0x24]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00443f79
mov eax, dword [ebp - 0x28]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00443f79
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
jle 0x49623b
mov eax, dword [ebp - 0x24]
shl eax, 2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov word [eax], bx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push ebx
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueW]
test eax, eax
jne 0x49622c
mov eax, dword [ebp - 0x18]
cmp word [eax], bx
je 0x49622c
cmp dword [ebp + 0xc], ebx
je 0x496149
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x49622c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
push eax
push 0x4c8e8c
mov dword [ebp - 0x2c], eax
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x4961a1
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
je 0x496197
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x49618c
push 0x4c8e88
lea ecx, [ebp - 0xc]
call fcn.00443fc7
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.00443fc7
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x2c], 0x4c8e7c
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push esi
mov ecx, 0x4d80e8
call fcn.004537c3
push dword [ebp - 8]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
cmp byte [ebp + 0xb], bl
je 0x49622c
xor edi, edi
push dword [ebp - 0x2c]
lea esi, [edi + 0x4bdfe4]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x496224
push 0x4c8e74
lea ecx, [ebp - 0x14]
call fcn.0044cd74
push dword [esi]
lea ecx, [ebp - 0x14]
call fcn.00443fc7
push 0x4c7984
lea ecx, [ebp - 0x14]
call fcn.00443fc7
push dword [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.00443fc7
push 1
push ebx
push ebx
push dword [ebp - 0x14]
mov ecx, 0x4d80e8
call fcn.0045acea
lea ecx, [ebp - 0x14]
call fcn.0043db4f
add edi, 8
cmp edi, 0x40
jb 0x4961c6
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jl 0x4960ea
lea ecx, [ebp - 0x10]
call fcn.0043db4f
lea ecx, [ebp - 0x18]
call fcn.0043db4f
cmp dword [ebp - 4], ebx
je 0x496259
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
inc dword [ebp - 0x20]
jmp 0x496047
cmp dword [ebp - 4], ebx
je 0x49626f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], ebx
mov ebx, esi
jmp 0x4962b0
cmp dword [ebp + 0xc], ebx
je 0x4962c4
push dword [ebp + 0xc]
push 0x4c8e8c
call fcn.0043ef29
test al, al
pop ecx
pop ecx
je 0x4962c4
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
mov ecx, 0x4d80e8
call fcn.004537c3
push dword [ebp - 8]
push 0x4c8e7c
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
lea ecx, [ebp - 8]
call fcn.0043db4f
lea ecx, [ebp - 0xc]
call fcn.0043db4f
mov eax, ebx
jmp 0x4962d6
lea ecx, [ebp - 8]
call fcn.0043db4f
lea ecx, [ebp - 0xc]
call fcn.0043db4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret