Function at 0x401a80
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x118
mov eax, dword [0x43b3f0]
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x114], eax
lea eax, [ecx - 0x24]
cmp eax, 0xda
push esi
push edi
mov dword [esp + 0xc], 0
ja case.0x401ab8.39
movzx eax, byte [eax + 0x401d6c]
jmp dword [eax*4 + 0x401d48]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x401cdb
push 0x104
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x401cdb
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x401cdb
push 0x104
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b15
sub eax, edx
cmp eax, 2
jbe 0x401cdb
mov byte [esp + 0x1a], cl
jmp 0x401cdb
push 0x104
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b47
sub eax, edx
cmp eax, 2
jbe 0x401cdb
lea edi, [esp + 0x18]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401b60
mov ecx, 6
mov esi, str.Downloaded_Program_Files
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x401cdb
lea eax, [esp + 8]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edx, dword [esp + 8]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ba1
sub eax, edx
cmp eax, 2
jbe 0x401cdb
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401bb8
mov ecx, 0xa
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x401cdb
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c31
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.ProgramFilesDir
push ecx
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401cdb
mov eax, dword [str.C:Program_Files]
mov ecx, dword [0x42e62c]
mov edx, dword [0x42e630]
mov dword [esp + 0x18], eax
mov eax, dword [0x42e634]
mov dword [esp + 0x1c], ecx
mov cl, byte [0x42e638]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], cl
jmp 0x401cdb
call section..text
cmp eax, 1
je case.0x401ab8.36
cmp eax, 2
je case.0x401ab8.36
push 0x104
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edi, [esp + 0x18]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401c90
mov eax, dword [str.driversetc_]
mov ecx, dword [0x42e61c]
mov edx, dword [0x42e620]
mov dword [edi], eax
mov ax, word [0x42e624]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov word [edi + 0xc], ax
jmp 0x401cdb
lea edx, [esp + 8]
push edx
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401d19
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401cf1
sub eax, edx
cmp byte [esp + eax + 0x17], 0x5c
je 0x401d1e
lea edi, [esp + 0x18]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401d06
mov ax, word [0x42e614]
mov word [edi], ax
jmp 0x401d1e
mov byte [esp + 0x18], 0
mov esi, dword [esp + 0x124]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.00401990
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
pop esi
call fcn.0040fed5
add esp, 0x118
ret