Function at 0x4015c0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x42a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x228]
mov esi, ecx
push eax
push 0x20219
push 0
push str.SoftwareIime
push 0x80000002
mov dword [ebp - 0x230], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40160f
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004113fe
mov esp, ebp
pop ebp
ret
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00412cc0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x210]
add esp, 0xc
mov dword [ebp - 0x210], 0x208
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.Clsid
push dword [ebp - 0x228]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
test eax, eax
je 0x40167d
push str.83DB39EE_30A2_4143_9062_0C4FD8274968
lea eax, [ebp - 0x20c]
push eax
call edi
push esi
mov esi, dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.Guid
push dword [ebp - 0x228]
call ebx
test eax, eax
je 0x4016d7
push str.F0970D4D_3985_46B0_B882_0EC7BA3D3BD1
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x230]
add eax, 0x10
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.SetupLocation
push dword [ebp - 0x228]
call ebx
test eax, eax
je 0x4017e7
movups xmm0, xmmword [0x4202a0]
xor eax, eax
push str.Shell32.dll
movups xmmword [ebp - 0x224], xmm0
mov word [ebp - 0x20c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4017ae
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40179b
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0
push ecx
push 0
push 0
lea ecx, [ebp - 0x224]
push ecx
call eax
push dword [ebp - 0x22c]
lea eax, [ebp - 0x20c]
push eax
call edi
push dword [ebp - 0x22c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x4017ae
push 0
push 0x26
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x28
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
je 0x4017d5
lea ecx, [ebp - 0x20c]
sub eax, ecx
sar eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x20e], cx
push str.Iime
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4017f0
mov esi, dword [ebp - 0x230]
lea eax, [ebp - 0x20c]
sub ecx, edx
add esi, 0x20
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00401dd0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x214], 1
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DataLocation
push dword [ebp - 0x228]
call ebx
test eax, eax
je 0x401877
cmp dword [esi + 0x14], 7
jbe 0x40185b
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x20c]
push eax
call edi
push str.IimeData
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401880
mov esi, dword [ebp - 0x230]
lea eax, [ebp - 0x20c]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [esi + 0x38]
call fcn.00401dd0
lea ecx, [ebp - 0x210]
mov dword [esi + 0x50], 0
push ecx
lea eax, [esi + 0x50]
mov dword [ebp - 0x210], 4
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 4
push eax
push 0
push str.Portable
push dword [ebp - 0x228]
call ebx
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.004113fe
mov esp, ebp
pop ebp
ret