Function at 0x41d8d4
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x210], 1
xor esi, esi
mov ebx, edx
test edi, edi
jne 0x41d90e
xor eax, eax
jmp 0x41dc03
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
cmp eax, 0x208
jb 0x41db6d
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x403a38
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41da8f
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push 0
push 0x403ac4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d9d1
mov eax, dword [ebp - 0x210]
cmp eax, 1
jne 0x41d98e
mov ecx, edi
call fcn.00424fe2
test eax, eax
jne 0x41d9c9
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x41d9d1
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41d9d1
mov edx, dword [ebx]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004183cc
test eax, eax
js 0x41d9d1
mov ecx, edi
call fcn.00424fe2
test eax, eax
je 0x41d9d1
xor esi, esi
inc esi
jmp 0x41da7b
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push 0
push 0x403ae0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41da7b
mov eax, dword [ebp - 0x210]
cmp eax, 1
jne 0x41da1b
mov ecx, edi
call fcn.00424fe2
test eax, eax
jne 0x41da56
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x41da7b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x41da7b
mov edx, dword [ebx]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004183cc
test eax, eax
js 0x41da7b
mov ecx, edi
call fcn.00424fe2
test eax, eax
je 0x41da7b
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [ebx]
mov ecx, edi
push 0x403af0
call fcn.00418442
mov ecx, edi
call fcn.00424fe2
mov esi, eax
neg esi
sbb esi, esi
and esi, 1
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41dbf9
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x403b48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41db6d
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push 0
push 0x403ac4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41daf9
cmp dword [ebp - 0x210], 1
jne 0x41daf9
mov ecx, edi
call fcn.00424fe2
test eax, eax
je 0x41daf9
xor esi, esi
inc esi
jmp 0x41db59
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push 0
push 0x403ae0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41db57
cmp dword [ebp - 0x210], 1
jne 0x41db57
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [ebx]
mov ecx, edi
push 0x403af0
call fcn.00418442
mov ecx, edi
call fcn.00424fe2
mov esi, eax
neg esi
sbb esi, esi
and esi, 1
jmp 0x41db59
xor esi, esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41dbf9
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x403bd0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41dbf9
push 0x96
lea eax, [ebp - 0x130]
push eax
push 0x9d
push dword [0x42c790]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x41dbed
mov eax, dword [ebx]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push 0
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41dbeb
cmp dword [ebp - 0x210], 1
jne 0x41dbeb
xor esi, esi
inc esi
jmp 0x41dbed
xor esi, esi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x218]
mov eax, esi
mov dword [ebx], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret