Function at 0x43502b
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov ebx, 0x101
push edi
inc eax
xor edi, edi
mov dword [ebp - 0x628], eax
mov esi, edi
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x624]
push eax
push ebx
push edi
push 0x409670
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x630], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4350af
lea eax, [ebp - 0x624]
mov dword [ebp - 0x62c], 2
push eax
push ebx
push edi
push 0x409708
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x43528b
cmp dword [0x442534], 0xffffffff
push 4
pop ebx
jne 0x4350c3
push ecx
mov edx, ebx
call fcn.0041e30f
mov edx, 0x409784
mov ecx, ebx
call fcn.0041e767
cmp dword [ebp - 0x624], esi
je 0x43526e
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push edi
push 0x4056e8
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43519a
cmp dword [ebp - 0x628], 2
je 0x435126
cmp dword [ebp - 0x628], 1
jne 0x43519a
xor esi, esi
inc esi
cmp dword [ebp - 0x628], 2
jne 0x43519a
push 0x104
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x43516c
push ecx
lea eax, [ebp - 0x418]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x210]
call fcn.0040c1c3
test eax, eax
jns 0x43519a
cmp dword [0x442534], 0xffffffff
jne 0x43517d
push ecx
mov edx, ebx
call fcn.0041e30f
mov edx, 0x4097a8
mov ecx, ebx
call fcn.0041e767
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x43528b
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x43526e
push edi
lea eax, [ebp - 0x624]
push eax
push edi
push 0x20106
push edi
push edi
push edi
push 0x4017d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4351fa
push ebx
lea eax, [ebp - 0x62c]
push eax
push ebx
push edi
push 0x409160
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x62c], 2
jne 0x435208
call fcn.004347a7
lea eax, [ebp - 0x210]
push 0x4097e0
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x43526a
lea eax, [ebp - 0x210]
push 0x4097f8
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x43526a
push eax
push 0x409800
lea eax, [ebp - 0x620]
push 0x208
push eax
call fcn.0040c125
add esp, 0x10
test eax, eax
js 0x43526a
push 0xffff
push 1
lea edx, [ebp - 0x620]
xor ecx, ecx
call fcn.00421540
mov eax, esi
jmp 0x43528d
cmp dword [0x442534], 0xffffffff
jne 0x43527f
push ecx
mov edx, ebx
call fcn.0041e30f
mov edx, 0x4097a8
mov ecx, ebx
call fcn.0041e767
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave