Function at 0x1003e4a
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa54
mov eax, dword [0x1008464]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, 0xffffffff
mov dword [ebp - 0xa3c], eax
jne 0x1003e75
xor eax, eax
jmp 0x10040f9
push 0x1001898
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
cmp eax, esi
mov dword [ebp - 0xa38], eax
jle 0x10040f7
mov dword [ebp - 0xa34], esi
jbe 0x10040f4
push ebx
push edi
lea eax, [ebp - 0xa54]
push eax
push dword [ebp - 0xa34]
push 0x1001898
push dword [ebp - 0xa3c]
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexW]
test eax, eax
je 0x10040da
push 1
lea eax, [ebp - 0xa54]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov edi, eax
test edi, edi
je 0x10040da
push 2
lea eax, [ebp - 0xa54]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov esi, eax
test esi, esi
je 0x10040da
push 3
lea eax, [ebp - 0xa54]
push eax
call sub.SETUPAPI.dll_pSetupGetField
mov ebx, eax
test ebx, ebx
je 0x10040da
lea eax, [ebp - 0xa30]
push eax
xor eax, eax
cmp dword [ebp + 0xc], eax
push 0x2001f
setne al
push 0
push 0x1001710
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10040da
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x61c]
je 0x1003f62
push 0x1001888
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1003f6a
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa44]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa30]
mov dword [ebp - 0xa40], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10040ce
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x100404a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
push ebx
push esi
lea eax, [ebp - 0x824]
push eax
call fcn.01002d89
test eax, eax
je 0x1004019
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push ebx
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1004090
lea eax, [ebp - 0x824]
push eax
push esi
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01002d89
test eax, eax
je 0x1004090
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push ebx
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
cmp dword [ebp + 0xc], edi
je 0x10040a8
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0100363b
push 4
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USERENV.dll_Ordinal_112]
test eax, eax
je 0x10040ce
lea eax, [ebp - 0x414]
push eax
call fcn.01002f27
push dword [ebp - 0xa30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xa34]
mov eax, dword [ebp - 0xa34]
cmp eax, dword [ebp - 0xa38]
jb 0x1003e9d
pop edi
pop ebx
xor esi, esi
inc esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0100637b
leave
ret 8