Function at 0x401157
Capabilities:
Create thread
Query or enumerate registry value
Set environment variable

Disassembly:
test cl, cl
jne 0x401c83
mov al, byte [esi]
test al, al
jne 0x4031ac
test byte [ebp - 0x3c], 1
je 0x401c90
movzx eax, word [ebp - 0x38]
push eax
push esi
push ebx
push 0x400000
call 0x401157
mov dword [0x405084], eax
cmp dword [0x40508c], 0
jne 0x403206
push eax
call dword [sym.imp.msvcrt.dll_exit]
nop
nop
nop
nop
nop
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x4050b4]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [esp + 0x20], eax
push edi
push esi
push esi
push 1
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
call fcn.0040200e
test al, al
je 0x4011b3
push fcn.00401766
push fcn.00401a6b
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ImmWorker]
mov dword [esp + 0x18], eax
mov ecx, 0x40135c
call fcn.00401ef9
mov ecx, 0x401384
mov dword [esp + 0x20], eax
call fcn.00401ef9
mov ecx, 0x4013ac
mov dword [esp + 0x10], eax
call fcn.00401ef9
mov edi, eax
mov dword [esp + 0x2c], edi
test edi, edi
jne 0x401348
mov edi, esi
mov ebx, dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetEnvironmentVariableW]
push esi
push 0x40135c
call ebx
push esi
push 0x401384
call ebx
push esi
push 0x4013ac
call ebx
call fcn.004020fc
mov esi, eax
call fcn.0040200e
test al, al
je 0x40121d
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_SetupHotKeyForKeyboardLayout]
call fcn.0040200e
test al, al
je 0x401236
push edi
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ProcessTermSrvIniFiles]
cmp eax, 1
je 0x402fe8
call fcn.0040200e
test al, al
je 0x401245
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_CreateExplorerSessionKey]
test esi, esi
jne 0x402ff0
call fcn.00401613
push 0x40147c
push 0x401480
mov dword [esp + 0x14], eax
call ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push ecx
push 0
mov ecx, ebx
call fcn.004014b1
xor edx, edx
mov ecx, edi
call fcn.0040150a
mov esi, dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
push ebx
call esi
push dword [esp + 0x10]
call esi
push edi
call esi
push 0xfffffffffffffffe
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThread]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_SetThreadPriority]
call fcn.0040200e
test al, al
je 0x4012ca
mov ecx, dword fs:[0x30]
mov eax, dword [0x7ffe02d8]
cmp eax, dword [ecx + 0x1d4]
sete al
movzx eax, al
push eax
push dword [esp + 0x28]
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_LoadRemoteFontsAndInitMiscWorker]
lea eax, [esp + 0x34]
xor ebx, ebx
push eax
push ebx
lea eax, [esp + 0x14]
push eax
push 0x401005
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x4012fd
push 0x493e0
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x401098
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x403024
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40132f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
mov ecx, dword [esp + 0xa4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004013df
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edi
mov edx, edi
cmp word [edi], si
je 0x4011e9
jmp 0x402fa6
xor esi, esi
inc esi
jmp 0x401ce4
test edi, edi
je 0x401114
jmp 0x401d7b
push 0xa
pop eax
jmp 0x40112c
push 0x58
push 0x401dc0
call fcn.004015c9
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_1.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
mov edx, 0x4050a4
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x403154
cmp dword [0x40509c], 1
je 0x40315e
cmp dword [0x40509c], ebx
jne 0x40317b
mov dword [0x40509c], 1
push 0x401db8
push 0x401dac
call fcn.00401c5a
pop ecx
pop ecx
test eax, eax
jne 0x40322a
cmp dword [0x40509c], 1
jne 0x401d44
push 0x401da8
push 0x401da0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40509c], 2
test esi, esi
jne 0x401d51
xor eax, eax
mov ecx, 0x4050a4
xchg dword [ecx], eax
cmp dword [0x4053f8], 0
jne 0x40318a
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
nop
nop
nop
nop
nop
mov cl, byte [esi]
cmp cl, 0x20
jbe 0x40110c
cmp cl, 0x22
je 0x4031bd
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
jne 0x4031ce
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x401d70
call fcn.0040223e
jmp 0x401c98
push 0x2c
pop edi
push 2
pop ebx
cmp word [ecx], di
jne 0x402fbf
add ecx, ebx
cmp word [ecx], di
je 0x402fbf
sub ecx, ebx
xor eax, eax
mov word [ecx], ax
cmp ecx, edx
je 0x402fc9
mov ax, word [ecx]
mov word [edx], ax
add ecx, ebx
add edx, ebx
cmp word [ecx], si
jne 0x402fac
mov edi, dword [esp + 0x2c]
cmp edx, ecx
je 0x4011e9
xor eax, eax
mov word [edx], ax
jmp 0x4011e9
xor esi, esi
inc esi
jmp 0x401236
push 0x40147c
push 0x401480
call ebx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push ecx
push esi
mov ecx, ebx
call fcn.004014b1
mov edx, esi
mov ecx, edi
call fcn.0040150a
call fcn.00401613
mov dword [esp + 0xc], eax
jmp 0x40127d
push 4
pop esi
lea eax, [esp + 0x30]
mov dword [esp + 0x1c], ebx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x34], esi
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push 0x403090
push dword [esp + 0x28]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x403081
cmp dword [esp + 0x28], esi
jne 0x403081
cmp dword [esp + 0x1c], ebx
je 0x403081
push ecx
push 0x4030b8
push ecx
push 0x32
pop edx
lea ecx, [esp + 0x44]
call fcn.00401eb1
push ebx
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x4c]
push eax
call fcn.00401a6b
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x401320
cmp eax, edi
je 0x401c7e
jmp 0x40316b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x401d20
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x401ccf
mov dword [0x4053fc], 1
jmp 0x401d20
push 0x4053f8
call fcn.00403d5b
pop ecx
test eax, eax
je 0x401d5e
push ebx
push 2
push ebx
call dword [0x4053f8]
jmp 0x401d5e
cmp al, 0x20
ja 0x40111e
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x401114
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
jmp 0x401d84
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x401d97
cmp dword [0x4053fc], 0
jne 0x40321a
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x405084]
mov dword [ebp - 4], 0xfffffffe
jmp 0x403236
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00401c02
ret