Function at 0x43a960
Capabilities:
Create thread
Set registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x214], eax
mov edx, 0x4b731c
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b7324
push 0x24
push eax
mov ecx, str.TWEAK
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x43a9ce
xor eax, eax
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0048ea75
add esp, 0x21c
ret
call fcn.004771f0
mov eax, dword [0x4d9cc0]
cmp eax, 0x2999
jg 0x43aa9b
je 0x43aa91
sub eax, 0x2828
cmp eax, 0x27
ja case.0x43aab0.10703
movzx eax, byte [eax + 0x43ac74]
jmp dword [eax*4 + 0x43ac34]
call fcn.00440da0
jmp case.0x43aab0.10703
call fcn.00441160
jmp case.0x43aab0.10703
call fcn.004416c0
jmp case.0x43aab0.10703
call fcn.00441c00
jmp case.0x43aab0.10703
call fcn.004420a0
jmp case.0x43aab0.10703
call fcn.00442430
jmp case.0x43aab0.10703
call fcn.004426f0
jmp case.0x43aab0.10703
call fcn.00442a80
jmp case.0x43aab0.10703
call fcn.00443230
jmp case.0x43aab0.10703
call fcn.004435b0
jmp case.0x43aab0.10703
call fcn.00443950
jmp case.0x43aab0.10703
call fcn.00443cd0
jmp case.0x43aab0.10703
call fcn.00443f40
jmp case.0x43aab0.10703
call fcn.0043ad30
jmp case.0x43aab0.10703
call fcn.00439cb0
jmp case.0x43aab0.10703
sub eax, 0x29ce
cmp eax, 0x66
ja case.0x43aab0.10703
movzx eax, byte [eax + 0x43acbc]
jmp dword [eax*4 + 0x43ac9c]
call fcn.0047ace0
jmp case.0x43aab0.10703
call fcn.00444af0
jmp case.0x43aab0.10703
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x444e40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x43aab0.10703
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsOneDrive
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43ab56
push eax
push eax
push 0xf0
push 0x2a05
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.DisableFileSyncNGSC
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [esp + 4]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.CLSID018D5C66_4533_4307_9B53_224DE2ED1FE6
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne case.0x43aab0.10703
push eax
push eax
push 0xf0
push 0x2a06
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 4
push 0
push str.System.IsPinnedToNameSpaceTree
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x43aab0.10703
call fcn.00442e50
jmp case.0x43aab0.10703
call fcn.00448bc0
jmp case.0x43aab0.10703
call fcn.00449250
mov edx, 0x4b732c
mov ecx, str.TWEAK
call fcn.00478640
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 8]
mov edx, 0x4b7334
push 0x30
push eax
mov ecx, str.TWEAK
call fcn.00478640
push eax
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x214]
mov eax, 1
xor ecx, esp
call fcn.0048ea75
add esp, 0x21c
ret