Function at 0x438b90
Capabilities:
Create process on windows
Query environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x4566e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x218], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 5
jge 0x438c35
push 0
push str.RegEdit_RegEdit
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x438be9
jmp 0x438c35
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x21c]
add ecx, 1
mov dword [ebp - 0x21c], ecx
cmp eax, 5
jl 0x438c1b
push 0xfce
push 4
mov edx, dword [ebp + 8]
push edx
call fcn.00402760
add esp, 0xc
jmp 0x438df5
push 0
push 0
push 0x10
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x438bc8
push 0xff
lea ecx, [ebp - 0x210]
push ecx
push str._WINDIR_Regedit.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00423b10
add esp, 0x10
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x438df5
mov ecx, dword [ebp - 0x214]
push ecx
call fcn.00438430
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x438d11
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp - 0x218]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x438d11
mov edx, dword [ebp - 0x214]
push edx
call fcn.0040540f
add esp, 4
lea eax, [eax + eax + 2]
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
push ecx
mov edx, dword [ebp - 0x214]
push edx
push 1
push 0
push str.LastKey
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x438dbf
mov dword [ebp - 0x234], 0
xor edx, edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x280], 0x44
push 0x40
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.00405450
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x280]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x438db6
cmp dword [ebp - 0x230], 0
je 0x438d9e
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x234], 0
je 0x438db4
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x438dbf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x438dda
mov ecx, dword [ebp - 4]
push ecx
push 0xfc6
mov edx, dword [ebp + 8]
push edx
call fcn.00402900
add esp, 0xc
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
push ecx
call fcn.0040564f
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403b8c
mov esp, ebp
pop ebp
ret