Function at 0x401560
Capabilities:
Get common file path
Read .ini file

Disassembly:
mov r11, rsp
sub rsp, 0x5a8
mov rax, qword [0x0040f008]
mov qword [rsp + 0x580], rax
mov qword [r11 - 8], rbx
mov rbx, rdx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [r11 - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x30]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x360]
mov r8d, 0x104
repne scasb al, byte [rdi]
mov rax, qword [str.WININIT.INI]
mov rcx, rbx
mov qword [rdi - 1], rax
mov eax, dword [0x0040b538]
dec rdi
mov dword [rdi + 8], eax
movzx eax, byte [0x0040b53c]
mov byte [rdi + 0xc], al
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x470]
lea rdx, [0x0040b528]
lea rcx, str.Rename
mov dword [rsp + 0x20], 0x104
mov byte [rsp + 0x470], 0
mov byte [rsp + 0x140], 0
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x40163a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Get_Error___NUL___ld_n
mov edx, eax
call fcn.004012c0
cmp byte [rsp + 0x140], 0
je 0x401808
lea rdx, str.KCRESVDX
lea rcx, [rsp + 0x140]
call fcn.00402ca0
test rax, rax
jne 0x4016d2
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x140]
lea rdx, str.KCRESVDX0.TMP
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x40169a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Write_Error___KCRESVDX0.TMP___ld_n
mov edx, eax
call fcn.004012c0
lea r9, [rsp + 0x30]
lea r8, str.KCRESVDX.TMP
lea rdx, [0x0040b528]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x4016d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Write_Error___KCRESVDX.TMP___ld_n
mov edx, eax
call fcn.004012c0
mov qword [rsp + 0x598], rsi
xor esi, esi
mov dil, 1
mov ebx, esi
lea rdx, str.KCRESVDX_d.TMP
lea rcx, [rsp + 0x250]
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x140]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x250]
lea rcx, str.Rename
mov dword [rsp + 0x20], 0x104
mov byte [rsp + 0x470], sil
mov byte [rsp + 0x140], sil
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401761
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x250]
lea rcx, str.Get_Error____s___ld_n
mov r8d, eax
call fcn.004012c0
cmp byte [rsp + 0x140], sil
movzx edi, dil
cmove edi, esi
inc ebx
test dil, dil
jne 0x4016e1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0x250]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rsi, qword [rsp + 0x598]
test eax, eax
jne 0x4017ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0x250]
lea rcx, str.Write_Error____s___s___ld_n
mov r9d, eax
call fcn.004012c0
lea r9, [rsp + 0x30]
lea r8, str.KCRESVDX.TMP
lea rdx, [0x0040b528]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x40184a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Write_Error___NUL__KCRESVDX.TMP___ld_n
mov edx, eax
call fcn.004012c0
jmp 0x40184a
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x360]
lea rdx, [0x0040b528]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
test eax, eax
jne 0x40184a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x360]
lea rcx, str.Error___NUL___s___ld_n
mov r8d, eax
call fcn.004012c0
mov rdi, qword [rsp + 0x590]
mov rbx, qword [rsp + 0x5a0]
xor eax, eax
mov rcx, qword [rsp + 0x580]
call fcn.0040a3f0
add rsp, 0x5a8
ret