Function at 0x4093d0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x409460
mov ebx, eax
cmp eax, 2
je 0x409550
xor edx, edx
test byte [0x418080], 2
jne 0x409480
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x4094c0
cmp eax, 2
jne 0x409474
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x4094c0
mov ebx, 0x70c
jmp 0x409424
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
call fcn.004090c0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.Error__d_while_reading_value__s_n
mov dword [esp + 8], 0x41a72c
mov dword [esp + 4], 0x418080
mov dword [esp], 1
call fcn.00408fd0
mov edx, dword [ebp - 0x2c]
jmp 0x40942f
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
add eax, 2
mov dword [ebp - 0x30], ecx
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
call eax
sub esp, 0xc
mov dword [ebp - 0x2c], eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x14], edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, dword [ebp - 0x2c]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x409426
mov eax, dword [ebp - 0x20]
xor ecx, ecx
and eax, 0xfffffffe
mov word [edx + eax], cx
cmp dword [ebp - 0x1c], 2
je 0x409560
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
mov edi, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call edi
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x409598
mov ebx, dword [ecx + 0x34]
jmp 0x409426
add eax, eax
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
mov edx, dword [ebp - 0x2c]
mov esi, eax
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call edi
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0x14]
sub esp, 0xc
mov dword [eax], esi
jmp 0x409453