Function at 0x437b81
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x5b8]
sub esp, 0x638
mov eax, dword [0x44de1c]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp + 0x5b4], eax
lea eax, [ebp - 0x78]
push eax
push 1
xor edi, edi
push edi
push 0x4030d4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x70], 0x80004005
mov dword [ebp - 0x78], edi
call esi
mov ebx, eax
cmp ebx, edi
jne 0x437d6a
lea eax, [ebp - 0x80]
push eax
push 1
push edi
push 0x42325c
push dword [ebp - 0x78]
call esi
cmp eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 0x104
jne 0x437c37
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x4ac]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x423254
push dword [ebp - 0x80]
mov dword [ebp - 0x74], esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x437c2a
cmp dword [ebp - 0x7c], 1
jne 0x437c27
mov eax, dword [ebp - 0x74]
cmp eax, 2
jb 0x437c27
mov byte [ebp + eax + 0x4ac], bl
jmp 0x437c2a
push 0xd
pop ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x437c74
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x4ac]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x423248
push dword [ebp - 0x78]
mov dword [ebp - 0x74], esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x437d58
cmp dword [ebp - 0x7c], 1
jne 0x437cb6
mov eax, dword [ebp - 0x74]
cmp eax, 2
jb 0x437cb6
mov byte [ebp + eax + 0x4ac], bl
lea eax, [ebp + 0x4ac]
push eax
mov edi, 0x208
push edi
lea eax, [ebp + 0x1a0]
push eax
call fcn.004113c0
lea eax, [ebp + 0x1a0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437c96
sub eax, edx
cmp byte [ebp + eax + 0x19f], 0x5c
lea eax, [ebp + 0x1a0]
jne 0x437cbe
push 0x423240
jmp 0x437cc3
push 0xd
pop ebx
jmp 0x437d58
push 0x423238
push edi
push eax
call fcn.0040a5b7
lea eax, [ebp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x437d50
push 0x40
pop ecx
xor eax, eax
mov byte [ebp + 0x3a8], 0
lea edi, [ebp + 0x3a9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp + 0x3a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp + 0x4ac]
push eax
mov edi, 0x20b
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.004113c0
push 0x437db0
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0040a5b7
lea eax, [ebp + 0x3a8]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
call fcn.0040a5b7
lea eax, [ebp - 0x6c]
push eax
push 0x437da8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x437d50
and dword [ebp - 0x70], 0
jmp 0x437d58
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x70], 0x80004005
jne 0x437d8d
test ebx, ebx
mov edx, 0xffff
mov ecx, 0x80070000
mov eax, ebx
jle 0x437d7e
and eax, edx
or eax, ecx
test eax, eax
jge 0x437d8d
test ebx, ebx
jle 0x437d8a
and ebx, edx
or ebx, ecx
mov dword [ebp - 0x70], ebx
mov ecx, dword [ebp + 0x5b4]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
pop ebx
call fcn.00417bd0
add ebp, 0x5b8
leave
ret