Function at 0x43a500
Capabilities:
Create thread
Set registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x214], eax
mov edx, 0x4b10dc
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b10e4
push 0x24
push eax
mov ecx, str.TWEAK
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43a56e
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0048d925
add esp, 0x21c
ret
call fcn.00475ff0
mov eax, dword [0x4d2c80]
cmp eax, 0x2999
jg 0x43a63b
je 0x43a631
sub eax, 0x2828
cmp eax, 0x27
ja case.0x43a650.10703
movzx eax, byte [eax + 0x43a814]
jmp dword [eax*4 + 0x43a7d4]
call fcn.00440200
jmp case.0x43a650.10703
call fcn.004405c0
jmp case.0x43a650.10703
call fcn.00440b20
jmp case.0x43a650.10703
call fcn.00441060
jmp case.0x43a650.10703
call fcn.00441500
jmp case.0x43a650.10703
call fcn.00441890
jmp case.0x43a650.10703
call fcn.00441b50
jmp case.0x43a650.10703
call fcn.00441ee0
jmp case.0x43a650.10703
call fcn.00442690
jmp case.0x43a650.10703
call fcn.00442a10
jmp case.0x43a650.10703
call fcn.00442db0
jmp case.0x43a650.10703
call fcn.00443130
jmp case.0x43a650.10703
call fcn.004433a0
jmp case.0x43a650.10703
call fcn.0043a8d0
jmp case.0x43a650.10703
call fcn.00439850
jmp case.0x43a650.10703
sub eax, 0x29ce
cmp eax, 0x66
ja case.0x43a650.10703
movzx eax, byte [eax + 0x43a85c]
jmp dword [eax*4 + 0x43a83c]
call fcn.00479b90
jmp case.0x43a650.10703
call fcn.00443f50
jmp case.0x43a650.10703
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x4442a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x43a650.10703
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsOneDrive
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43a6f6
push eax
push eax
push 0xf0
push 0x2a05
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.DisableFileSyncNGSC
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.CLSID018D5C66_4533_4307_9B53_224DE2ED1FE6
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne case.0x43a650.10703
push eax
push eax
push 0xf0
push 0x2a06
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.System.IsPinnedToNameSpaceTree
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x43a650.10703
call fcn.004422b0
jmp case.0x43a650.10703
call fcn.00447ff0
jmp case.0x43a650.10703
call fcn.00448680
mov edx, 0x4b10ec
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b10f4
push 0x30
push eax
mov ecx, str.TWEAK
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x214]
mov eax, 1
xor ecx, esp
call fcn.0048d925
add esp, 0x21c
ret