Function at 0x427360
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1070
call fcn.00442470
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
xor eax, eax
cmp dword [ebp + 8], 3
push esi
push edi
mov edi, dword [ebx + 0x18]
mov esi, eax
mov dword [ebp - 0x1058], edi
je 0x4273b2
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x4273b2
call fcn.0041f47f
test eax, eax
je 0x4273b2
mov ecx, ebx
call fcn.00427193
mov esi, eax
test esi, esi
js 0x427caf
test edi, edi
jne 0x4273c0
mov eax, 0x80004003
jmp 0x427caf
mov ecx, edi
call fcn.0041f47f
test eax, eax
jne 0x4273d5
mov eax, 0x80070002
jmp 0x427caf
mov eax, dword [ebx + 0x2c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x427895
jle 0x42788b
cmp eax, 4
jle 0x4277c4
cmp eax, 5
je 0x427600
cmp eax, 6
jne 0x42788b
mov edi, 0x104
lea eax, [ebp - 0x214]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x40625c
test eax, eax
je 0x42746e
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x214]
call fcn.0040c131
test eax, eax
js 0x42746e
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x214]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x42746e
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42746e
test al, 0x10
je 0x4274e6
push 0x103
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4275d7
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x214]
call fcn.0040c131
test eax, eax
js 0x4275d7
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x214]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x4275d7
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4275d7
test al, 0x10
jne 0x4275d7
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
neg eax
sbb eax, eax
and eax, 0x200
add eax, 0x2c
test ecx, ecx
jne 0x427501
mov ecx, 0x4015c0
mov esi, dword [ebp - 0x1058]
push eax
push ecx
push esi
lea eax, [ebp - 0x214]
push eax
push 0x406408
lea eax, [ebp - 0x104c]
push 0x208
push eax
call fcn.0040c0b5
add esp, 0x1c
lea eax, [ebp - 0x624]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
mov edx, edi
lea ecx, [ebp - 0xa34]
call fcn.0040c010
lea eax, [ebp - 0xa34]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x427560
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x104c]
lea ecx, [ebp - 0x214]
call fcn.00421804
test eax, eax
je 0x42758e
xor esi, esi
jmp 0x4275aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x42759f
push 0x57
pop esi
test esi, esi
jle 0x4275aa
movzx esi, si
or esi, 0x80070000
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
js 0x427c93
call fcn.0041fb3a
test eax, eax
je 0x427c93
push ecx
push 0x406468
jmp 0x4277b3
cmp dword [0x443534], 0xffffffff
mov esi, 0x80070002
jne 0x4275ee
push ecx
push 2
pop edx
call fcn.0041e530
push 2
mov edx, 0x406350
pop ecx
call fcn.0041e988
jmp 0x427c93
mov edi, 0x104
lea eax, [ebp - 0x41c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x40625c
test eax, eax
je 0x427650
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040c131
test eax, eax
js 0x427650
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x41c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x427666
test al, 0x10
je 0x4276ce
push 0x103
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4276b0
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040c131
test eax, eax
js 0x4276b0
mov eax, dword [ebp - 0x1050]
sub edi, eax
push ecx
push esi
push ecx
lea ecx, [ebp - 0x41c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c197
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4275d7
test al, 0x10
jne 0x4275d7
lea eax, [ebp - 0x41c]
mov edi, 0x208
push eax
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c010
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
lea ecx, [ebp - 0x82c]
push eax
call fcn.0040c131
cmp dword [ebp + 8], 3
jne 0x42770e
test eax, eax
js 0x427731
push ecx
push 0x406278
jmp 0x427718
test eax, eax
js 0x427731
push ecx
push 0x4062d0
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
lea ecx, [ebp - 0x82c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
mov esi, dword [ebp - 0x1058]
lea ecx, [ebp - 0x82c]
push esi
mov edx, edi
call fcn.0040c045
cmp dword [ebx + 0x14], 0
je 0x42775b
push dword [ebx + 0x14]
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c045
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x82c]
lea ecx, [ebp - 0x41c]
call fcn.00421804
test eax, eax
je 0x42777c
xor esi, esi
jmp 0x4277a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x42778d
push 0x57
pop esi
test esi, esi
jle 0x427798
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x427c93
call fcn.0041fb3a
test eax, eax
je 0x427c93
push ecx
push 0x406334
push 8
call fcn.0041fbd1
mov esi, 0xd2af9
jmp 0x427c93
xor eax, eax
mov dword [ebp - 0x105c], 0x2a
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], eax
mov dword [ebp - 0x1070], eax
mov dword [ebp - 0x106c], eax
mov dword [ebp - 0x1068], eax
call fcn.0041fb3a
cmp dword [ebp + 8], 3
mov dword [0x443674], eax
mov dword [0x44367c], 1
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x1064], eax
mov eax, 0x4063a4
je 0x42781c
mov eax, dword [ebx + 0x14]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1070]
push eax
push edi
call fcn.0043b134
mov esi, eax
test esi, esi
jns 0x42786d
cmp byte [ebx + 0x60], 0
je 0x427853
or dword [0x444fa8], 4
push edi
push 0x4063b8
push 2
call fcn.0041ea5f
add esp, 0xc
xor esi, esi
jmp 0x42786d
mov eax, dword [ebx + 0x84]
mov dword [0x444fb0], esi
mov eax, dword [eax + 0x40]
add eax, dword [0x443538]
mov dword [0x444fac], eax
cmp dword [ebp - 0x1060], 0
je 0x427c93
push dword [ebp - 0x1060]
call fcn.00441807
pop ecx
jmp 0x427c93
mov esi, 0x80004005
jmp 0x427c93
mov dword [ebp - 0x1050], ecx
mov edx, 0x207
push edi
lea ecx, [ebp - 0x82c]
call fcn.0040c010
push ecx
lea eax, [ebp - 0x1054]
mov edi, 0x208
push eax
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c131
test eax, eax
js 0x4278e9
mov eax, dword [ebp - 0x1054]
mov edx, edi
push ecx
push 0x40607c
push ecx
lea ecx, [ebp - 0x82c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
cmp dword [ebx + 0x14], 0
je 0x4278ff
push dword [ebx + 0x14]
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c045
mov ecx, dword [ebx + 0x84]
xor edi, edi
push edi
call fcn.0042c4b2
mov ecx, 0x186a0
cmp edx, edi
ja 0x427921
jb 0x42791c
cmp eax, ecx
jae 0x427921
mov ecx, 0x2710
xor edx, edx
div ecx
mov dword [0x444fbc], eax
cmp eax, 0x64
jbe 0x42793d
push 0xa
xor edx, edx
pop ecx
div ecx
mov dword [0x444fbc], eax
jmp 0x42794a
push 0x14
pop ecx
cmp eax, ecx
jae 0x42794a
mov dword [0x444fbc], ecx
mov edi, dword [ebp - 0x1058]
push 0x4050a4
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x42798b
push 0x64
pop ecx
mov dword [0x444fc0], 1
mov dword [ebp - 0x1054], 0x1f4
call fcn.0041de27
mov eax, dword [0x443548]
mov dword [ebp - 0x1050], eax
jmp 0x4279f6
mov ecx, dword [0x444fbc]
and dword [0x444fc0], 0
mov dword [ebp - 0x1054], 0x1388
call fcn.0041de27
mov eax, dword [0x444f94]
test eax, eax
je 0x4279f6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4279f6
push 0x100
lea eax, [ebp - 0xa2c]
push eax
push 0x26ec
push dword [0x443af0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4279f6
lea eax, [ebp - 0xa2c]
push eax
push 0
push 0x5c5
push dword [0x444f94]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x423290
push dword [ebp - 0x1054]
push 0x2f00
push dword [0x444f94]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp - 0x1050], 0
je 0x427a60
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x82c]
mov ecx, edi
call fcn.00421804
test eax, eax
je 0x427a3b
xor esi, esi
jmp 0x427b65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x427a4c
push 0x57
pop esi
test esi, esi
jle 0x427b65
movzx esi, si
or esi, 0x80070000
jmp 0x427b65
push 0x4050a4
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x427b55
xor ecx, ecx
lea eax, [ebp - 0x1054]
push ecx
push eax
push ecx
push 3
push ecx
push ecx
push ecx
push 0x401848
push SysReAllocStringLen
mov dword [ebp - 0x1054], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x427b45
mov edi, 0x104
lea ecx, [ebp - 0xc3c]
mov edx, edi
call fcn.0041fda0
test eax, eax
je 0x427b33
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0xc3c]
call fcn.0040c131
test eax, eax
js 0x427b33
mov eax, dword [ebp - 0x1050]
sub edi, eax
push ecx
push 0x406080
push ecx
lea ecx, [ebp - 0xc3c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0041fb3c
test eax, eax
js 0x427b33
lea ecx, [ebp - 0xc3c]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x427b01
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc3c]
push eax
push 1
push edi
push 0x4060a0
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1058]
push 0x4060c0
push 4
call fcn.0041ea5f
pop ecx
pop ecx
jmp 0x427b65
push edi
push 0x406100
push 2
call fcn.0041ea5f
add esp, 0xc
cmp dword [0x444fc0], 0
je 0x427b73
push 0x64
pop ecx
jmp 0x427b79
mov ecx, dword [0x444fbc]
call fcn.0041dfa0
push 0x2f00
push dword [0x444f94]
call dword [sym.imp.USER32.dll_KillTimer]
test esi, esi
jns 0x427bb6
cmp byte [ebx + 0x60], 0
je 0x427bb6
or dword [0x444fa8], 1
push edi
push 0x406170
push 2
call fcn.0041ea5f
add esp, 0xc
xor eax, eax
mov esi, eax
jmp 0x427bb8
xor eax, eax
cmp dword [ebx + 0x5c], eax
je 0x427c16
cmp esi, 0x80070bc2
je 0x427c27
cmp esi, 0x8007f901
jne 0x427bd1
mov esi, eax
jmp 0x427c39
cmp esi, 0x8007f02a
jne 0x427be0
mov esi, 0xc00d2afb
jmp 0x427c39
test esi, esi
js 0x427bfa
call fcn.0041fb3a
mov dword [0x443674], eax
mov dword [0x44367c], 1
jmp 0x427c39
mov eax, dword [ebx + 0x84]
mov dword [0x444fb0], esi
mov eax, dword [eax + 0x40]
add eax, dword [0x443538]
mov dword [0x444fac], eax
jmp 0x427c39
test esi, esi
js 0x427c39
call fcn.0041fb3a
cmp dword [0x443674], eax
jae 0x427c39
push ecx
push 0x4061bc
push 8
call fcn.0041fbd1
mov esi, 0xd2af9
mov edx, esi
mov ecx, edi
call fcn.00423154
test eax, eax
jne 0x427c5b
or dword [0x444fa8], 2
push 0x4061d8
push 2
call fcn.0041ea5f
pop ecx
pop ecx
push 0x40622c
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x427c7f
push 0x406240
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x427c93
xor eax, eax
test esi, esi
js 0x427c8e
cmp esi, 0xd2af9
setne al
mov dword [0x443548], eax
push esi
push 0x406480
push 4
call fcn.0041ea5f
add esp, 0xc
xor eax, eax
mov ecx, ebx
push eax
call fcn.00425ea0
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret 0xc