Function at 0x409520
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap flags
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x20]
lea esi, [ebp - 0x1c]
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x4095f8
mov ebx, eax
cmp eax, 2
je 0x4096a2
xor edx, edx
test byte [0x419080], 2
jne 0x4095b8
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edx
call fcn.00409210
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0x41b720
mov dword [esp + 8], 0x41b790
mov dword [esp + 4], 0x419080
mov dword [esp], 1
call fcn.00409120
mov edx, dword [ebp - 0x2c]
jmp 0x409583
mov eax, dword [ebp - 0x1c]
cmp eax, 1
je 0x409620
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x40960c
cmp eax, 2
je 0x409620
mov ebx, 0x70c
jmp 0x409578
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
add eax, 2
mov dword [esp + 8], eax
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
call eax
sub esp, 0xc
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [ebp - 0x2c], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, dword [ebp - 0x2c]
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x40957a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
and eax, 0xfffffffe
mov word [edx + eax], cx
cmp dword [ebp - 0x1c], 2
je 0x4096b0
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edx
mov ebx, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call ebx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x20], eax
jne 0x4096e8
mov ebx, dword [ecx + 0x34]
jmp 0x40957a
add eax, eax
mov dword [ebp - 0x2c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
call eax
mov esi, eax
mov eax, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x2c]
mov dword [esp], edx
call ebx
mov edx, dword [ebp - 0x2c]
xor ebx, ebx
sub esp, 0xc
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp + 0x14]
sub esp, 0xc
mov dword [eax], esi
jmp 0x4096a4