Function at 0x4168a4
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Set current directory
Set registry value

Disassembly:
mov eax, 0x42cd8e
call fcn.00421904
mov eax, 0x154c
call fcn.00420a50
mov al, byte [0x437ea8]
push ebx
push esi
push edi
push 0x40
mov byte [ebp - 0x144], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x143]
mov ebx, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x450]
push ebx
push eax
xor esi, esi
push dword [0x441fe4]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x750]
push 0x100
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.00406fd9
mov edi, str.first.ini
lea eax, [ebp - 0x750]
push edi
push eax
push 0x4320f0
lea eax, [ebp - 0x34c]
push ebx
push eax
call fcn.004209f2
mov eax, dword [ebp + 0x10]
and byte [ebp - 0x249], 0
push esi
push str.custom.ini
and byte [eax], 0
call fcn.00418962
push esi
push edi
call fcn.00418962
lea eax, [ebp - 0x750]
push eax
call fcn.00403c5e
push esi
push 0x4396b4
call fcn.00418962
push 0x29c0
call fcn.004223d2
add esp, 0x40
mov dword [ebp - 0x24], eax
cmp eax, esi
mov dword [ebp - 4], esi
je 0x41698d
mov ecx, eax
call fcn.0041dbe0
mov dword [ebp - 0x10], eax
jmp 0x416990
mov dword [ebp - 0x10], esi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
je 0x417047
push 1
push 0
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0041916b
push dword [ebp + 8]
mov dword [ebp - 0x1c], eax
call fcn.0041676b
add esp, 0x14
dec eax
dec eax
je 0x417013
dec eax
je 0x417047
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4169e3
cmp byte [edi], 0
jne 0x416a13
cmp byte [0x432a98], 0
je 0x416a13
push dword [ebp - 0x1c]
push 0xa1
push dword [0x441fe4]
call fcn.00407e2a
add esp, 0xc
cmp eax, 1
je 0x416a13
mov dword [ebp + 0xc], 0xfffffffe
jmp 0x417182
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x954]
push ebx
push eax
call fcn.0041ee5b
test eax, eax
jne 0x416a30
lea edi, [ebp - 0x954]
mov dword [ebp + 0xc], edi
test edi, edi
je 0x416a58
cmp byte [edi], 0
je 0x416a58
push edi
push 0x433d1c
lea eax, [ebp - 0x144]
push ebx
push eax
call fcn.004209f2
add esp, 0x10
and byte [ebp - 0x41], 0
jmp 0x416c1d
push 0x528
call fcn.004223d2
pop ecx
mov dword [ebp + 8], eax
test eax, eax
mov dword [ebp - 4], 1
je 0x416a7f
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.0041ce18
mov edi, eax
jmp 0x416a81
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], edi
test edi, edi
je 0x417047
push ebx
push edi
push 7
push dword [0x441fe4]
call esi
test eax, eax
je 0x417047
lea eax, [edi + 0x104]
push ebx
push eax
push 8
push dword [0x441fe4]
call esi
test eax, eax
je 0x417047
lea eax, [edi + 0x30c]
push ebx
push eax
push 9
push dword [0x441fe4]
call esi
test eax, eax
je 0x417047
lea eax, [edi + 0x208]
push 0x437ea8
push eax
call fcn.00420680
pop ecx
lea eax, [ebp - 0x248]
pop ecx
mov ecx, dword [ebp - 0x10]
push ebx
push eax
call fcn.0041ee5b
test eax, eax
jne 0x416b83
lea eax, [ebp - 0x248]
push eax
call fcn.00420cc0
pop ecx
lea ecx, [ebp - 0x248]
dec ecx
dec ecx
add eax, ecx
lea ecx, [ebp - 0x248]
cmp eax, ecx
jbe 0x416b2f
cmp byte [eax], 0x5c
je 0x416b2c
dec eax
jmp 0x416b1a
and byte [eax], 0
lea eax, [ebp - 0x248]
push eax
call fcn.004074ed
test eax, eax
pop ecx
je 0x416b83
lea eax, [ebp - 0x248]
push eax
call fcn.00420cc0
cmp eax, 2
pop ecx
jne 0x416b6e
cmp byte [ebp - 0x247], 0x3a
jne 0x416b6e
lea eax, [ebp - 0x248]
push 0x432a4c
push eax
call fcn.00420690
pop ecx
pop ecx
lea eax, [ebp - 0x248]
push eax
lea eax, [edi + 0x208]
push eax
call fcn.00420680
pop ecx
pop ecx
mov ecx, edi
call fcn.0041ccf3
test eax, eax
je 0x417047
lea eax, [edi + 0x410]
push 0x200000
push eax
call fcn.0041857a
pop ecx
test al, al
pop ecx
jne 0x416bf4
lea eax, [ebp - 0xc58]
push 0x100
push eax
push 0x34
push dword [0x441fe4]
call esi
lea eax, [ebp - 0x850]
push 0x100
push eax
push 0x35
push dword [0x441fe4]
call esi
lea eax, [ebp - 0x850]
push 0x30
push eax
lea eax, [ebp - 0xc58]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x416b83
lea eax, [edi + 0x410]
push ebx
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004208c0
and byte [ebp - 0x41], 0
add esp, 0xc
mov ecx, edi
call fcn.004227b3
push edi
call fcn.004223c7
pop ecx
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x450]
push ebx
push eax
push dword [0x441fe4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x108c
call fcn.004223d2
pop ecx
mov dword [ebp + 8], eax
test eax, eax
mov dword [ebp - 4], 2
je 0x416c66
push dword [0x441fe4]
lea ecx, [ebp - 0x450]
push ecx
mov ecx, eax
call fcn.004143ec
mov edi, eax
jmp 0x416c68
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], edi
test edi, edi
mov dword [ebp - 0x20], edi
je 0x417047
cmp dword [edi + 0x1088], 0
jne 0x416c8f
mov dword [ebp + 0xc], 0xfffffffc
jmp 0x4170ab
mov esi, dword [edi + 0x1088]
dec esi
mov dword [ebp + 8], esi
js 0x416d13
add esi, 0x41
shl esi, 4
add esi, edi
push dword [esi]
lea eax, [ebp - 0x144]
push eax
push 0x4320f0
lea eax, [ebp - 0x248]
push ebx
push eax
call fcn.004209f2
and byte [ebp - 0x145], 0
lea eax, [ebp - 0x248]
push eax
call fcn.00407d7e
add esp, 0x18
test al, al
je 0x416ce6
dec dword [ebp + 8]
sub esi, 0x10
cmp dword [ebp + 8], 0
jl 0x416d13
jmp 0x416ca3
push 0
push 0x418aad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0xcb
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 2
je 0x416fdf
jmp 0x416c8f
push 0
push 0x4165dc
push dword [ebp - 0x1c]
push 0x8a
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x417047
xor esi, esi
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, edi
call fcn.00414964
mov dword [0x446324], eax
mov dword [0x446328], esi
mov esi, dword [edi + 0x1088]
dec esi
js 0x416d97
push 0x4171ac
lea eax, [ebp - 0x144]
push esi
push eax
mov ecx, edi
call fcn.004148aa
mov ecx, dword [edi + 0x1088]
dec ecx
cmp esi, ecx
je 0x416d8c
test eax, eax
je 0x417047
dec esi
jns 0x416d65
test eax, eax
je 0x417047
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x433db0
push dword [0x446320]
call esi
lea eax, [ebp - 0xa54]
push 0x100
push eax
push 0xa
push dword [0x441fe4]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0xa54]
push eax
push dword [0x44631c]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x446320]
call edi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push 0x3eb
push dword [ebp - 0x14]
call esi
push eax
call edi
push 1
push 0x3eb
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x3eb
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push 0x3e9
push dword [ebp - 0x14]
call esi
push eax
call edi
push 5
push 0x3ed
push dword [ebp - 0x14]
call esi
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea eax, [ebp - 0x40]
push dword [ebp - 0x14]
push eax
call esi
test eax, eax
je 0x416e77
cmp eax, 0xffffffff
je 0x416e77
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push dword [ebp - 0x14]
lea eax, [ebp - 0x40]
push eax
jmp 0x416e4b
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x144]
push eax
call fcn.0041e130
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, 0x433dac
push str.HTML
push esi
lea eax, [ebp - 0x550]
push 0x100
push eax
call fcn.004209f2
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp - 0x550]
push eax
call fcn.0041e64d
test eax, eax
jne 0x417047
push str.Image
push esi
lea eax, [ebp - 0x550]
push 0x100
push eax
call fcn.004209f2
mov ecx, dword [ebp - 0x10]
add esp, 0x10
lea eax, [ebp - 0x550]
push eax
call fcn.0041e744
test eax, eax
jne 0x417047
lea eax, [ebp - 0xd58]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xd58]
push eax
call fcn.0041e576
test eax, eax
jne 0x417047
mov esi, dword [ebp - 0x24]
mov eax, dword [esi + 0x1088]
add eax, 0x40
shl eax, 4
push dword [eax + esi]
lea eax, [ebp - 0x144]
push eax
push 0x4320f0
lea eax, [ebp - 0xb58]
push ebx
push eax
call fcn.004209f2
push str._register
push str._nosplash
push str._addscut
push str._forcerun
push str._s__s__s__s
lea eax, [ebp - 0x1558]
push 0x400
push eax
call fcn.004209f2
xor edi, edi
push 0x437ea8
push edi
call fcn.00417d21
add esp, 0x38
lea eax, [ebp - 0x144]
push 1
push eax
lea eax, [ebp - 0x1558]
push eax
lea eax, [ebp - 0xb58]
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, esi
call fcn.00414462
push esi
call fcn.004223c7
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x20], edi
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.004179fc
add esp, 0xc
mov dword [ebp + 0xc], edi
jmp 0x41715c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x416feb
cmp byte [eax], 0
jne 0x416ff3
mov ecx, dword [ebp - 0x10]
call fcn.0041f7ad
lea ecx, [ebp - 0x34c]
push ecx
push eax
call fcn.00417b0b
pop ecx
mov dword [ebp + 0xc], 0xfffffffd
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
jmp 0x41716b
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41701f
cmp byte [eax], 0
jne 0x417027
mov ecx, dword [ebp - 0x10]
call fcn.0041f7ad
lea ecx, [ebp - 0x34c]
push ecx
push eax
call fcn.00417b0b
pop ecx
mov dword [ebp + 0xc], 0xfffffffd
pop ecx
mov ecx, dword [ebp + 0x10]
mov byte [ecx], al
jmp 0x417182
cmp byte [ebp - 0x144], 0
je 0x417058
lea eax, [ebp - 0x144]
jmp 0x41706c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x417064
cmp byte [eax], 0
jne 0x41706c
mov ecx, dword [ebp - 0x10]
call fcn.0041f7ad
push dword [ebp + 0x10]
lea ecx, [ebp - 0x34c]
push ecx
push eax
call fcn.00417267
add esp, 0xc
mov dword [ebp + 0xc], eax
test eax, eax
je 0x417145
cmp eax, 0xffffffff
je 0x417145
cmp eax, 0xfffffffe
je 0x417145
cmp eax, 0xfffffffd
je 0x417145
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
jne 0x417145
lea eax, [ebp - 0x650]
push 0x100
push eax
push 0x3b
push dword [0x441fe4]
call esi
lea eax, [ebp - 0x650]
push 0x445f1c
push eax
push str._s_n_s
lea eax, [ebp - 0x1158]
push 0x400
push eax
call fcn.004209f2
and byte [ebp - 0xd59], 0
add esp, 0x14
mov ebx, 0x40010
mov edi, 0x4422e0
push ebx
lea eax, [ebp - 0x1158]
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x650]
push 0x100
push eax
push 0x45
push dword [0x441fe4]
call esi
push ebx
lea eax, [ebp - 0x650]
push edi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x18], 0
je 0x41715c
mov ecx, dword [ebp - 0x18]
call fcn.004227b3
push dword [ebp - 0x18]
call fcn.004223c7
pop ecx
cmp dword [ebp - 0x14], 0
je 0x41716b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [ebp - 0x20], 0
je 0x417182
mov ecx, dword [ebp - 0x20]
call fcn.00414462
push dword [ebp - 0x20]
call fcn.004223c7
pop ecx
cmp dword [ebp - 0x1c], 0
pop edi
pop esi
pop ebx
je 0x417190
call fcn.00419129
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41719d
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
mov dword fs:[0], ecx
leave
ret