Function at 0x4a2220
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00449480
lea ecx, [esp + 0x10]
call fcn.00449480
mov eax, dword [esp + 0x48]
xor ebx, ebx
xor ebp, ebp
cmp word [eax], bx
mov edi, SysReAllocStringLen
mov dword [esp + 0x28], ebp
jne 0x4a2253
mov dword [esp + 0x48], ebx
mov esi, dword [esp + 0x44]
cmp word [esi], bx
sete al
cmp al, bl
mov byte [esp + 0x44], al
jne 0x4a230a
push 5
push esi
push str.HKCU_
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4a2291
mov dword [esp + 0x28], 2
mov ebp, dword [esp + 0x28]
add esi, 0xa
jmp 0x4a2321
push 0x13
push esi
push str.HKEY_CURRENT_USER_
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4a22b6
mov dword [esp + 0x28], 2
mov ebp, dword [esp + 0x28]
add esi, 0x24
jmp 0x4a2321
push 5
push esi
push str.HKLM_
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4a22e0
mov dword [esp + 0x28], 2
mov ebp, dword [esp + 0x28]
add esi, 0xa
mov edi, SysReAllocStringLen
jmp 0x4a2321
push 0x13
push esi
push str.HKEY_LOCAL_MACHINE_
call fcn.004449d0
add esp, 0xc
test al, al
je 0x4a22fc
add esi, 0x26
mov edi, SysReAllocStringLen
mov dword [esp + 0x28], 2
mov ebp, dword [esp + 0x28]
jmp 0x4a2321
cmp ebp, 3
jae 0x4a259b
mov edi, dword [ebp*4 + 0x4fbbe4]
mov esi, dword [ebp*4 + 0x4fbbd8]
movzx edx, word [0x51c734]
lea ecx, [esp + 0x1c]
push ecx
or edx, 0xf003f
push edx
push ebx
push esi
push edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4a2562
push ebx
push ebx
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x44]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
jne 0x4a256c
mov edx, dword [esp + 0x2c]
lea eax, [edx*4 + 8]
push eax
lea ecx, [esp + 0x28]
call fcn.004494b0
mov ecx, dword [esp + 0x30]
lea edx, [ecx*4 + 8]
push edx
lea ecx, [esp + 0x1c]
call fcn.004494b0
mov eax, dword [esp + 0x34]
xor ebp, ebp
cmp eax, ebx
jle 0x4a253d
lea esp, [esp]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
lea ecx, [eax*4]
lea eax, [edx*4]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov word [ecx], bx
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push ebx
push ebx
lea ecx, [esp + 0x4c]
push ecx
push edx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a2530
mov ecx, dword [esp + 0x24]
cmp word [ecx], bx
je 0x4a2530
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x4a2434
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a2530
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
shr ecx, 1
mov word [edx + ecx*2], bx
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
push edi
push str.PATH
call fcn.00444a10
add esp, 8
test al, al
je 0x4a2493
mov eax, dword [esp + 0x18]
cmp word [eax], bx
je 0x4a248a
mov ecx, dword [esp + 0x14]
cmp word [ecx], bx
je 0x4a247c
push 0x4fbbcc
lea ecx, [esp + 0x18]
call fcn.00449510
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x18]
call fcn.00449510
mov esi, dword [esp + 0x14]
mov edi, 0x4fbbc0
push ebx
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
push esi
mov ecx, 0x51d2a0
call fcn.00452ca0
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [esp + 0x44], bl
je 0x4a2530
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi + 0x4f44cc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4a2528
push 0x4fbbb8
lea ecx, [esp + 0x24]
call fcn.00456550
mov edx, dword [esi + 0x4f44cc]
push edx
lea ecx, [esp + 0x24]
call fcn.00449510
push 0x4fb0ac
lea ecx, [esp + 0x24]
call fcn.00449510
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
call fcn.00449510
mov ecx, dword [esp + 0x20]
push 1
push ebx
push ebx
push ecx
mov ecx, 0x51d2a0
call fcn.0046cb80
lea ecx, [esp + 0x20]
call fcn.00443880
add esi, 8
cmp esi, 0x40
jb 0x4a24c0
mov eax, dword [esp + 0x34]
inc ebp
cmp ebp, eax
jl 0x4a23c0
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4a255e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x28]
inc ebp
mov dword [esp + 0x28], ebp
jmp 0x4a230a
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4a257b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], ebx
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov eax, dword [esp + 0x48]
cmp eax, ebx
je 0x4a25dc
push eax
push str.PATH
call fcn.00444a10
add esp, 8
test al, al
je 0x4a25dc
mov eax, dword [esp + 0x14]
push ebx
push 0xffffffffffffffff
lea edx, [esp + 0x18]
push edx
push eax
mov ecx, 0x51d2a0
call fcn.00452ca0
mov ecx, dword [esp + 0x10]
push ecx
push 0x4fbbc0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [esp + 0x10]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30
ret