Function at 0x485ae9
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.0043dd7e
lea ecx, [ebp - 8]
call fcn.0043dd7e
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp word [eax], bx
mov edi, 0x80000001
mov dword [ebp - 0x20], ebx
jne 0x485b17
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp + 8]
cmp word [esi], bx
sete byte [ebp + 0xb]
cmp byte [ebp + 0xb], bl
jne 0x485b96
push 5
push esi
push 0x4b1f7c
call fcn.0043917b
add esp, 0xc
test al, al
je 0x485b3f
add esi, 0xa
jmp 0x485b8d
push 0x13
push esi
push 0x4b1f68
call fcn.0043917b
add esp, 0xc
test al, al
je 0x485b58
add esi, 0x24
jmp 0x485b8d
push 5
push esi
push 0x4b1f60
call fcn.0043917b
add esp, 0xc
test al, al
je 0x485b71
add esi, 0xa
jmp 0x485b88
push 0x13
push esi
push 0x4b1f4c
call fcn.0043917b
add esp, 0xc
test al, al
je 0x485b8d
add esi, 0x26
mov edi, 0x80000002
mov dword [ebp - 0x20], 2
jmp 0x485bb1
mov eax, dword [ebp - 0x20]
cmp eax, 3
jae 0x485dc5
shl eax, 2
mov edi, dword [eax + 0x4b1f40]
mov esi, dword [eax + 0x4b1f34]
lea eax, [ebp - 4]
push eax
movzx eax, word [0x4c0bc8]
or eax, 0xf003f
push eax
push ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp dword [ebp - 4], ebx
je 0x485da8
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
jne 0x485db0
mov eax, dword [ebp - 0x24]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0043dd9c
mov eax, dword [ebp - 0x28]
lea eax, [eax*4 + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043dd9c
cmp dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], ebx
jle 0x485d8a
mov eax, dword [ebp - 0x24]
shl eax, 2
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
shl eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
mov word [eax], bx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x38]
push ebx
push ebx
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegEnumValueW]
test eax, eax
jne 0x485d7b
mov eax, dword [ebp - 0x18]
cmp word [eax], bx
je 0x485d7b
cmp dword [ebp + 0xc], ebx
je 0x485c98
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x485d7b
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
shr eax, 1
mov word [ecx + eax*2], bx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
push eax
push 0x4b1f2c
mov dword [ebp - 0x2c], eax
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x485cf0
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
je 0x485ce6
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x485cdb
push 0x4b1f28
lea ecx, [ebp - 0xc]
call fcn.0043ddea
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.0043ddea
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x2c], 0x4b1f1c
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push esi
mov ecx, 0x4c0fb8
call fcn.0044bafc
push dword [ebp - 8]
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
cmp byte [ebp + 0xb], bl
je 0x485d7b
xor edi, edi
push dword [ebp - 0x2c]
lea esi, [edi + 0x4a7d6c]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x485d73
push 0x4b1f14
lea ecx, [ebp - 0x14]
call fcn.00446497
push dword [esi]
lea ecx, [ebp - 0x14]
call fcn.0043ddea
push 0x4b15a8
lea ecx, [ebp - 0x14]
call fcn.0043ddea
push dword [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.0043ddea
push 1
push ebx
push ebx
push dword [ebp - 0x14]
mov ecx, 0x4c0fb8
call fcn.004525b7
lea ecx, [ebp - 0x14]
call fcn.00437e1a
add edi, 8
cmp edi, 0x40
jb 0x485d15
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x30]
jl 0x485c39
lea ecx, [ebp - 0x10]
call fcn.00437e1a
lea ecx, [ebp - 0x18]
call fcn.00437e1a
cmp dword [ebp - 4], ebx
je 0x485da8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
inc dword [ebp - 0x20]
jmp 0x485b96
cmp dword [ebp - 4], ebx
je 0x485dbe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov dword [ebp - 4], ebx
mov ebx, esi
jmp 0x485dff
cmp dword [ebp + 0xc], ebx
je 0x485e13
push dword [ebp + 0xc]
push 0x4b1f2c
call fcn.004391ba
test al, al
pop ecx
pop ecx
je 0x485e13
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
mov ecx, 0x4c0fb8
call fcn.0044bafc
push dword [ebp - 8]
push 0x4b1f1c
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
lea ecx, [ebp - 8]
call fcn.00437e1a
lea ecx, [ebp - 0xc]
call fcn.00437e1a
mov eax, ebx
jmp 0x485e25
lea ecx, [ebp - 8]
call fcn.00437e1a
lea ecx, [ebp - 0xc]
call fcn.00437e1a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret