Function at 0x473558
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.00435d62
lea ecx, [ebp - 8]
call fcn.00435d62
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp word [eax], bx
mov edi, 0x80000001
mov dword [ebp - 0x20], ebx
jne 0x473586
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp + 8]
cmp word [esi], bx
sete byte [ebp + 0xb]
cmp byte [ebp + 0xb], bl
jne 0x473605
push 5
push esi
push 0x49e26c
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4735ae
add esi, 0xa
jmp 0x4735fc
push 0x13
push esi
push 0x49e258
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4735c7
add esi, 0x24
jmp 0x4735fc
push 5
push esi
push 0x49e250
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4735e0
add esi, 0xa
jmp 0x4735f7
push 0x13
push esi
push 0x49e23c
call fcn.004318b1
add esp, 0xc
test al, al
je 0x4735fc
add esi, 0x26
mov edi, 0x80000002
mov dword [ebp - 0x20], 2
jmp 0x473620
mov eax, dword [ebp - 0x20]
cmp eax, 3
jae 0x473834
shl eax, 2
mov edi, dword [eax + 0x49e230]
mov esi, dword [eax + 0x49e224]
lea eax, [ebp - 4]
push eax
movzx eax, word [0x4acb6c]
or eax, 0xf003f
push eax
push ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp dword [ebp - 4], ebx
je 0x473817
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
jne 0x47381f
mov eax, dword [ebp - 0x24]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.00435d80
mov eax, dword [ebp - 0x28]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.00435d80
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
jle 0x4737f9
mov eax, dword [ebp - 0x24]
shl eax, 2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov word [eax], bx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push ebx
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueW]
test eax, eax
jne 0x4737ea
mov eax, dword [ebp - 0x18]
cmp word [eax], bx
je 0x4737ea
cmp dword [ebp + 0xc], ebx
je 0x473707
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x4737ea
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
push eax
push 0x49e21c
mov dword [ebp - 0x2c], eax
call fcn.004318e1
test al, al
pop ecx
pop ecx
je 0x47375f
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
je 0x473755
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x47374a
push 0x49e218
lea ecx, [ebp - 0xc]
call fcn.00435dd0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.00435dd0
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x2c], 0x49e20c
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push esi
mov ecx, 0x4acf10
call fcn.0043d5b3
push dword [ebp - 8]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
cmp byte [ebp + 0xb], bl
je 0x4737ea
xor edi, edi
push dword [ebp - 0x2c]
lea esi, [edi + 0x495984]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x4737e2
push 0x49e204
lea ecx, [ebp - 0x14]
call fcn.004403c3
push dword [esi]
lea ecx, [ebp - 0x14]
call fcn.00435dd0
push 0x49d614
lea ecx, [ebp - 0x14]
call fcn.00435dd0
push dword [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.00435dd0
push 1
push ebx
push ebx
push dword [ebp - 0x14]
mov ecx, 0x4acf10
call fcn.0044de9b
lea ecx, [ebp - 0x14]
call fcn.0043092f
add edi, 8
cmp edi, 0x40
jb 0x473784
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jl 0x4736a8
lea ecx, [ebp - 0x10]
call fcn.0043092f
lea ecx, [ebp - 0x18]
call fcn.0043092f
cmp dword [ebp - 4], ebx
je 0x473817
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
inc dword [ebp - 0x20]
jmp 0x473605
cmp dword [ebp - 4], ebx
je 0x47382d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], ebx
mov ebx, esi
jmp 0x47386e
cmp dword [ebp + 0xc], ebx
je 0x473882
push dword [ebp + 0xc]
push 0x49e21c
call fcn.004318e1
test al, al
pop ecx
pop ecx
je 0x473882
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
mov ecx, 0x4acf10
call fcn.0043d5b3
push dword [ebp - 8]
push 0x49e20c
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
lea ecx, [ebp - 8]
call fcn.0043092f
lea ecx, [ebp - 0xc]
call fcn.0043092f
mov eax, ebx
jmp 0x473894
lea ecx, [ebp - 8]
call fcn.0043092f
lea ecx, [ebp - 0xc]
call fcn.0043092f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret