Function at 0x401168
Capabilities:
Create thread
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [0x4050b4]
xor eax, esp
mov dword [esp + 0x98], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 1
push esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
call fcn.00401c97
test al, al
je 0x4011c4
push fcn.0040177f
push fcn.00401a65
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ImmWorker]
mov dword [esp + 0x18], eax
push 0x40136c
call fcn.00401c38
push 0x401394
mov dword [esp + 0x24], eax
call fcn.00401c38
push 0x4013bc
mov dword [esp + 0x14], eax
call fcn.00401c38
mov edi, eax
mov dword [esp + 0x2c], edi
test edi, edi
jne 0x401358
mov edi, esi
mov ebx, dword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_SetEnvironmentVariableW]
push esi
push 0x40136c
call ebx
push esi
push 0x401394
call ebx
push esi
push 0x4013bc
call ebx
call fcn.00401fb1
mov esi, eax
call fcn.00401c97
test al, al
je 0x40122e
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_SetupHotKeyForKeyboardLayout]
call fcn.00401c97
test al, al
je 0x401247
push edi
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_ProcessTermSrvIniFiles]
cmp eax, 1
je 0x402f10
call fcn.00401c97
test al, al
je 0x401256
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_CreateExplorerSessionKey]
test esi, esi
jne 0x402f18
call fcn.00401646
push 0x40148c
push 0x401490
mov dword [esp + 0x14], eax
call ebx
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push 0
mov edx, ebx
call fcn.004014c1
push 0
mov eax, edi
call fcn.00401513
mov esi, dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
push ebx
call esi
push dword [esp + 0x10]
call esi
push edi
call esi
push 0xfffffffffffffffe
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetCurrentThread]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetThreadPriority]
call fcn.00401c97
test al, al
je 0x4012da
mov ecx, dword fs:[0x30]
mov eax, dword [reloc.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
cmp eax, dword [ecx + reloc.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
sete al
movzx eax, al
push eax
push dword [esp + 0x28]
call dword [sym.imp.ext_ms_win_session_userinit_l1_1_0.dll_LoadRemoteFontsAndInitMiscWorker]
lea eax, [esp + 0x34]
push eax
xor ebx, ebx
push ebx
lea eax, [esp + 0x14]
push eax
push 0x401005
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x40130d
push 0x493e0
push esi
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WaitForSingleObject]
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push 0x401098
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x402f4a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40133f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_1_1.dll_FreeLibrary]
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004013ef
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edi
mov edx, edi
cmp word [edi], si
je 0x4011fa
jmp 0x402ece
push 0x2c
pop edi
push 2
pop ebx
cmp word [ecx], di
jne 0x402ee7
add ecx, ebx
cmp word [ecx], di
je 0x402ee7
sub ecx, ebx
xor eax, eax
mov word [ecx], ax
cmp ecx, edx
je 0x402ef1
mov ax, word [ecx]
mov word [edx], ax
add ecx, ebx
add edx, ebx
cmp word [ecx], si
jne 0x402ed4
mov edi, dword [esp + 0x2c]
cmp edx, ecx
je 0x4011fa
xor eax, eax
mov word [edx], ax
jmp 0x4011fa
xor esi, esi
inc esi
jmp 0x401247
push 0x40148c
push 0x401490
call ebx
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
push esi
mov edx, ebx
call fcn.004014c1
push esi
mov eax, edi
call fcn.00401513
call fcn.00401646
mov dword [esp + 0xc], eax
jmp 0x40128d
push 4
pop esi
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push 0x402fb4
push dword [esp + 0x28]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x48], esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x402fa5
cmp dword [esp + 0x28], esi
jne 0x402fa5
cmp dword [esp + 0x1c], ebx
je 0x402fa5
push 0x32
mov edx, 0x402fdc
pop eax
lea ecx, [esp + 0x38]
call fcn.00402115
push ebx
push 1
push ebx
push ebx
push ebx
lea eax, [esp + 0x4c]
push eax
call fcn.00401a65
push dword [esp + 0x14]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x401330