Function at 0x401490
Capabilities:
Get common file path
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
mov dword [0x44987c], ebp
pushal
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0xa0], 0x80000002
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb0], 0x407024
mov dword [ebp - 0xbc], str.fegOpenKeyW
mov dword [ebp - 0xb4], 0x407048
mov ecx, dword [ebp - 0xc0]
movzx edx, byte [ecx]
cmp edx, 0x55
je 0x40150d
mov eax, dword [ebp - 0xc0]
movzx ecx, byte [eax]
cmp ecx, 0x8b
je 0x40150d
mov edx, dword [ebp - 0xc0]
movzx eax, byte [edx]
cmp eax, 0x6a
jne 0x401551
mov ecx, 0x61
mov edx, dword [ebp - 0xb0]
mov word [edx], cx
mov eax, 0x61
mov ecx, dword [ebp - 0xb0]
mov word [ecx + 6], ax
mov edx, 0x70
mov eax, dword [ebp - 0xb0]
mov word [eax + 8], dx
mov ecx, 0x69
mov edx, dword [ebp - 0xb0]
mov word [edx + 0xa], cx
mov eax, dword [ebp - 0xbc]
mov byte [eax], 0x52
mov ecx, dword [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x449884], eax
mov eax, 0x53
mov ecx, dword [ebp - 0xb4]
mov word [ecx + 4], ax
mov edx, 0x49
mov eax, dword [ebp - 0xb4]
mov word [eax + 6], dx
lea ecx, [ebp - 0xb8]
push ecx
mov edx, dword [ebp - 0xb4]
push edx
push 0x80000000
call dword [0x449884]
test eax, eax
je 0x4015b3
xor eax, eax
jmp 0x4018d3
call fcn.00401380
mov dword [ebp - 0x80], 0x64
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x80], 0x64
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x80], 0x64
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x18], 3
mov eax, dword [0x449878]
push eax
call fcn.004010d0
add esp, 4
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.00401000
add esp, 4
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x90]
push edx
push 0
mov eax, dword [ebp - 0x88]
push eax
call fcn.004010c0
add esp, 0xc
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x8c]
cmp edx, dword [ebp - 0x90]
jae 0x40170e
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.00401080
add esp, 8
mov dword [ebp - 0x9c], eax
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [0x449878]
add eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x88]
add ecx, dword [ebp - 0x8c]
push ecx
call fcn.00401120
add esp, 0xc
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x80]
add edx, dword [ebp - 0x54]
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x80]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x98]
sub ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x98], ecx
jmp 0x401693
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp - 0x88]
push eax
call fcn.004018e0
add esp, 8
mov dword [ebp - 0x54], 0
mov dword [ebp - 0xc4], 0
call fcn.004013b0
mov ecx, dword [0x449878]
push ecx
call fcn.004010d0
add esp, 4
mov dword [ebp - 0xc8], eax
mov edx, dword [ebp - 0xc8]
push edx
call fcn.00401000
add esp, 4
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc8]
push eax
push 0
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.004010c0
add esp, 0xc
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc8]
jae 0x4017fb
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0x80]
push edx
call fcn.00401080
add esp, 8
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [0x449878]
add ecx, dword [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x50]
add edx, dword [ebp - 0xc4]
push edx
call fcn.00401120
add esp, 0xc
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0xc4]
add ecx, dword [ebp - 0x80]
mov dword [ebp - 0xc4], ecx
mov edx, dword [ebp - 0xd0]
sub edx, dword [ebp - 0xd4]
mov dword [ebp - 0xd0], edx
jmp 0x401782
mov eax, dword [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.004018e0
add esp, 8
mov dword [ebp - 0xd8], 0x407044
push 0x104
push 0x449888
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edx, dword [ebp - 0xd8]
push edx
push 0x449888
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push pe_nt_image_headers32
push 3
push 0
push 3
push 1
push 0x449888
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x14], 0x401470
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
push 0x44000
call fcn.00401000
add esp, 4
mov dword [0x44998c], eax
push 0x41400
mov edx, dword [ebp - 0x88]
push edx
mov eax, dword [0x44998c]
add eax, 0x300
push eax
call fcn.00401120
add esp, 0xc
mov ecx, dword [0x44998c]
sub ecx, 0x400000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
mov eax, dword [ebp - 0x50]
push eax
call fcn.00401a50
add esp, 0xc
mov ecx, dword [0x44998c]
add ecx, 0x41420
mov dword [0x449880], ecx
popal
jmp dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret