Function at 0x4116f0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x214
push esi
xor esi, esi
test eax, eax
jne 0x411721
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
pop esi
add esp, 0x214
ret 0xc
push ebx
cmp eax, 1
push edi
jne 0x4117b5
lea edx, [esp + 0xc]
push edx
push 0x427720
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4119bb
mov ecx, 0x82
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
mov dword [esp + 0x20], 0x208
push 0x426fb8
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4119b0
cmp word [esp + 0x18], 0x25
je 0x411873
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
mov eax, dword [esp + 0x22c]
add esp, 4
cmp esi, eax
jae 0x411959
jmp 0x411941
cmp eax, 2
jne 0x411805
lea edx, [esp + 0xc]
push edx
push 0x427720
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4119bb
mov ecx, 0x82
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
mov dword [esp + 0x20], 0x208
push 0x426f9c
jmp 0x411772
cmp eax, 3
jne 0x4118bc
lea edx, [esp + 0xc]
push edx
push 0x426bac
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4119bb
mov ecx, 0x82
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x426fb8
push eax
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4119b0
cmp word [esp + 0x18], 0x25
jne 0x411926
lea ecx, [esp + 0x1a]
push 0x25
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
mov edi, eax
add esp, 8
test edi, edi
je 0x4119b0
mov edx, dword [esp + 0x228]
mov ebx, dword [esp + 0x22c]
push edx
lea eax, [esp + 0x1e]
push ebx
push eax
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x4119b0
jmp 0x411999
cmp eax, 4
jne 0x4119bb
lea edx, [esp + 0xc]
push edx
push 0x426bac
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4119bb
mov ecx, 0x82
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x426f9c
push eax
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4119b0
cmp word [esp + 0x18], 0x25
je 0x41195d
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
mov eax, dword [esp + 0x22c]
add esp, 4
cmp esi, eax
jae 0x411959
mov eax, dword [esp + 0x22c]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
jmp 0x4119b0
xor esi, esi
jmp 0x4119b0
lea ecx, [esp + 0x1a]
push 0x25
push ecx
call dword [sym.imp.MSVCRT.dll_wcschr]
mov edi, eax
add esp, 8
test edi, edi
je 0x4119b0
mov edx, dword [esp + 0x228]
mov ebx, dword [esp + 0x22c]
push edx
lea eax, [esp + 0x1e]
push ebx
push eax
mov word [edi], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x4119b0
add edi, 2
push edi
push ebx
call dword [sym.imp.MSVCRT.dll_wcscat]
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 0x214
ret 0xc