Function at 0x441544
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
xor edi, edi
inc ebx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
test eax, eax
je 0x4417c0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 3
push edi
push edi
push edi
push 0x41cf00
push 0x80000002
call esi
test eax, eax
je 0x4415c3
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 1
push edi
push edi
push edi
push 0x41cf00
push 0x80000002
mov ebx, edi
call esi
test eax, eax
je 0x4415c3
xor eax, eax
jmp 0x4417bf
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x41d518
push dword [ebp - 0x418]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
call esi
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
mov edi, eax
jne 0x441643
test edi, edi
jne 0x441654
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, reloc.ADVAPI32.dll_TraceMessage
mov eax, 0x104
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042ca38
jmp 0x441778
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x441654
test edi, edi
je 0x441778
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x41d548
push dword [ebp - 0x418]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call esi
mov edi, eax
xor eax, eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
mov word [ebp - 6], ax
jne 0x441697
test edi, edi
je 0x4416fa
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov esi, 0x104
push eax
mov ecx, esi
call fcn.0045486d
test eax, eax
jne 0x4416f2
lea eax, reloc.ADVAPI32.dll_TraceMessage
test eax, eax
je 0x4416bf
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x26fd
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4416f2
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov eax, esi
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
xor edi, edi
test edi, edi
jne 0x4417ac
test ebx, ebx
je 0x441774
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x441709
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push ebx
push 0x41d518
push dword [ebp - 0x418]
call esi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x441746
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push ebx
push 0x41d560
push dword [ebp - 0x418]
call esi
test edi, edi
jne 0x4417ac
xor eax, eax
mov word [ebp - 6], ax
cmp dword [ebp + 0xc], eax
jne 0x441796
push 0x104
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
lea edx, reloc.ADVAPI32.dll_TraceMessage
mov eax, 0x104
call fcn.0042c88c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 8