Function at 0x435675
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov ebx, 0x101
push edi
inc eax
xor edi, edi
mov dword [ebp - 0x628], eax
mov esi, edi
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x624]
push eax
push ebx
push edi
push 0x409670
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x624], edi
mov dword [ebp - 0x630], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4356f9
lea eax, [ebp - 0x624]
mov dword [ebp - 0x62c], 2
push eax
push ebx
push edi
push 0x409708
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4358d5
cmp dword [0x443534], 0xffffffff
push 4
pop ebx
jne 0x43570d
push ecx
mov edx, ebx
call fcn.0041e530
mov edx, 0x409784
mov ecx, ebx
call fcn.0041e988
cmp dword [ebp - 0x624], esi
je 0x4358b8
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push edi
push 0x4056d8
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4357e4
cmp dword [ebp - 0x628], 2
je 0x435770
cmp dword [ebp - 0x628], 1
jne 0x4357e4
xor esi, esi
inc esi
cmp dword [ebp - 0x628], 2
jne 0x4357e4
push 0x104
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4357b6
push ecx
lea eax, [ebp - 0x418]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x210]
call fcn.0040c197
test eax, eax
jns 0x4357e4
cmp dword [0x443534], 0xffffffff
jne 0x4357c7
push ecx
mov edx, ebx
call fcn.0041e530
mov edx, 0x4097a8
mov ecx, ebx
call fcn.0041e988
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4358d5
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4358b8
push edi
lea eax, [ebp - 0x624]
push eax
push edi
push 0x20106
push edi
push edi
push edi
push 0x4017c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x435844
push ebx
lea eax, [ebp - 0x62c]
push eax
push ebx
push edi
push 0x409160
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x62c], 2
jne 0x435852
call fcn.00434def
lea eax, [ebp - 0x210]
push 0x4097e0
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x4358b4
lea eax, [ebp - 0x210]
push 0x4097f8
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x4358b4
push eax
push 0x409800
lea eax, [ebp - 0x620]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x10
test eax, eax
js 0x4358b4
push 0xffff
push 1
lea edx, [ebp - 0x620]
xor ecx, ecx
call fcn.00421804
mov eax, esi
jmp 0x4358d7
cmp dword [0x443534], 0xffffffff
jne 0x4358c9
push ecx
mov edx, ebx
call fcn.0041e530
mov edx, 0x4097a8
mov ecx, ebx
call fcn.0041e988
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret