Function at 0x401157
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x4050b4]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [esp + 0x20], eax
push edi
push esi
push esi
push 1
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
call fcn.0040200e
test al, al
je 0x4011b3
push fcn.00401766
push fcn.00401a6b
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ImmWorker]
mov dword [esp + 0x18], eax
mov ecx, 0x40135c
call fcn.00401ef9
mov ecx, 0x401384
mov dword [esp + 0x20], eax
call fcn.00401ef9
mov ecx, 0x4013ac
mov dword [esp + 0x10], eax
call fcn.00401ef9
mov edi, eax
mov dword [esp + 0x2c], edi
test edi, edi
jne 0x401348
mov edi, esi
mov ebx, dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetEnvironmentVariableW]
push esi
push 0x40135c
call ebx
push esi
push 0x401384
call ebx
push esi
push 0x4013ac
call ebx
call fcn.004020fc
mov esi, eax
call fcn.0040200e
test al, al
je 0x40121d
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_SetupHotKeyForKeyboardLayout]
call fcn.0040200e
test al, al
je 0x401236
push edi
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ProcessTermSrvIniFiles]
cmp eax, 1
je 0x402fe8
call fcn.0040200e
test al, al
je 0x401245
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_CreateExplorerSessionKey]
test esi, esi
jne 0x402ff0
call fcn.00401613
push 0x40147c
push 0x401480
mov dword [esp + 0x14], eax
call ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push ecx
push 0
mov ecx, ebx
call fcn.004014b1
xor edx, edx
mov ecx, edi
call fcn.0040150a
mov esi, dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
push ebx
call esi
push dword [esp + 0x10]
call esi
push edi
call esi
push 0xfffffffffffffffe
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadPriority]
call fcn.0040200e
test al, al
je 0x4012ca
mov ecx, dword fs:[0x30]
mov eax, dword [0x7ffe02d8]
cmp eax, dword [ecx + 0x1d4]
sete al
movzx eax, al
push eax
push dword [esp + 0x28]
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_LoadRemoteFontsAndInitMiscWorker]
lea eax, [esp + 0x34]
xor ebx, ebx
push eax
push ebx
lea eax, [esp + 0x14]
push eax
push 0x401005
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4012fd
push 0x493e0
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x401098
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x403024
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40132f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov ecx, dword [esp + 0xa4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004013df
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edi
mov edx, edi
cmp word [edi], si
je 0x4011e9
jmp 0x402fa6
push 0x2c
pop edi
push 2
pop ebx
cmp word [ecx], di
jne 0x402fbf
add ecx, ebx
cmp word [ecx], di
je 0x402fbf
sub ecx, ebx
xor eax, eax
mov word [ecx], ax
cmp ecx, edx
je 0x402fc9
mov ax, word [ecx]
mov word [edx], ax
add ecx, ebx
add edx, ebx
cmp word [ecx], si
jne 0x402fac
mov edi, dword [esp + 0x2c]
cmp edx, ecx
je 0x4011e9
xor eax, eax
mov word [edx], ax
jmp 0x4011e9
xor esi, esi
inc esi
jmp 0x401236
push 0x40147c
push 0x401480
call ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push ecx
push esi
mov ecx, ebx
call fcn.004014b1
mov edx, esi
mov ecx, edi
call fcn.0040150a
call fcn.00401613
mov dword [esp + 0xc], eax
jmp 0x40127d
push 4
pop esi
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ebx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], esi
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push 0x403090
push dword [esp + 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x403081
cmp dword [esp + 0x28], esi
jne 0x403081
cmp dword [esp + 0x1c], ebx
je 0x403081
push ecx
push 0x4030b8
push ecx
push 0x32
pop edx
lea ecx, [esp + 0x44]
call fcn.00401eb1
push ebx
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x4c]
push eax
call fcn.00401a6b
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x401320