Function at 0xffbaad3
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0xffebc20]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.ntvdm.exe_getMSW
xor esi, esi
inc esi
push 0x2710
and eax, esi
mov dword [0xffed3e0], eax
call sub.USER32.dll_ShowStartGlass
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, 0x3ff
cmp ax, 0x11
je 0xffbab1f
cmp ax, 0x12
je 0xffbab1f
cmp ax, 4
jne 0xffbab25
mov dword [0xffebc48], esi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ebx
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x108]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbab50
sub eax, esi
lea esi, [eax + 1]
mov ecx, esi
call fcn.0ffbaeed
mov dword [0xffed2ac], eax
mov ecx, esi
mov edi, eax
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0xffbab97
call fcn.0ffc32b4
push ebx
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xffbabaf
sub eax, ecx
lea ebx, [eax + 1]
mov ecx, ebx
call fcn.0ffbaeed
mov dword [0xffed2b0], eax
mov edi, eax
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 8]
call fcn.0ffbaeed
mov dword [0xffed2b4], eax
mov edi, eax
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xffed2b4]
mov byte [eax + ebx - 1], 0x5c
mov eax, dword [str.win.ini]
mov ecx, dword [0xffed2b4]
mov dword [ecx + ebx], eax
mov eax, dword [0xffe8118]
mov ecx, dword [0xffed2b4]
mov dword [ecx + ebx + 4], eax
push 0x19
pop ecx
xor eax, eax
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
push 0xffed380
lea eax, [ebp - 0x178]
xor esi, esi
push eax
mov dword [ebp - 0x178], 0xffc5b03
mov dword [ebp - 0x174], 0xffc5b2a
mov dword [ebp - 0x170], 0xffc5b7f
mov dword [ebp - 0x16c], 0xffc5bb3
mov dword [ebp - 0x168], 0xffc5bd8
mov dword [ebp - 0x164], 0xffc5c00
mov dword [ebp - 0x160], fcn.0ffb7211
mov dword [ebp - 0x15c], 0xffc5c25
mov dword [ebp - 0x158], 0xffc5c43
mov dword [ebp - 0x154], fcn.0ffd2c2f
mov dword [ebp - 0x150], 0xffb636c
mov dword [ebp - 0x14c], 0xffb63af
mov dword [ebp - 0x148], 0xffbc6ac
mov dword [ebp - 0x144], 0xffb63f0
mov dword [ebp - 0x140], 0xffb641f
mov dword [ebp - 0x13c], 0xffc733b
mov dword [ebp - 0x138], 0xffb3d90
mov dword [ebp - 0x134], 0xffc004d
mov dword [ebp - 0x130], 0xffc5c5e
mov dword [ebp - 0x12c], fcn.0ffd2a4c
mov dword [ebp - 0x128], fcn.0ffd6f8a
mov dword [ebp - 0x124], 0xffc40ec
mov dword [ebp - 0x120], 0xffc5a26
mov dword [ebp - 0x11c], 0xffdc944
mov dword [ebp - 0x118], esi
call sub.USER32.dll_UserRegisterWowHandlers
push fcn.0ffc6a25
mov dword [0xffebc40], eax
call sub.KERNEL32.dll_RegisterWowBaseHandlers
mov eax, dword fs:[0x18]
push 0x74
pop ecx
mov edi, eax
call fcn.0ffbaeed
mov edx, eax
push 0x1d
mov dword [edi + 0xc0], edx
pop ecx
mov edi, edx
add edx, 0x5c
xor eax, eax
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, esi
mov dword [0xffe8050], eax
je 0xffbaea7
lea eax, [ebp - 0x10c]
push eax
push 1
push esi
push 0xffb1fe4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xffbaea7
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop ebx
lea eax, [ebp - 0x114]
push eax
push 0xffed35c
lea eax, [ebp - 0x110]
push eax
push esi
push 0xffb1fd0
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], ebx
call edi
test eax, eax
jne 0xffbae02
cmp dword [ebp - 0x110], ebx
jne 0xffbae02
mov eax, dword [0xffed35c]
mov ecx, 0x20c49b
cmp eax, ecx
jb 0xffbae07
mov eax, ecx
jmp 0xffbae07
mov eax, 0xe10
imul eax, eax, 0x3e8
mov dword [0xffed35c], eax
lea eax, [ebp - 0x114]
push eax
push 0xffed368
lea eax, [ebp - 0x110]
push eax
push esi
push 0xffb1fc4
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], ebx
call edi
test eax, eax
jne 0xffbae45
cmp dword [ebp - 0x110], ebx
je 0xffbae5b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
xor ecx, ecx
cmp eax, 0x409
setne cl
mov dword [0xffed368], ecx
push dword [ebp - 0x10c]
call fcn.0ffbaf19
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0ffbb225
push esi
push 0xffb1fb8
push 0xffb1fb4
call dword [sym.imp.KERNEL32.dll_GetProfileIntA]
or dword [0xffed3d8], 0xffffffff
mov dword [0xffec094], eax
call fcn.0ffbb275
call fcn.0ffbb2c5
call fcn.0ffbb2e7
test eax, eax
jne 0xffbaeab
xor eax, eax
jmp 0xffbaec1
push 0x20
push dword [0xffed3d8]
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.0ffcf083
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0ffe11f0
leave
ret 4