Function at 0x4049f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov al, byte [0x428120]
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x104
stosb byte es:[edi], al
mov dword [esp + 0xc], 1
call fcn.004046d0
cmp ax, 4
jb 0x404ae3
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.DataBasePath
push str.SYSTEMCurrentControlSetServicesTcpipParameters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x404ac6
mov ecx, 0x103
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x404a78
inc eax
dec ecx
jne 0x404a6a
jmp 0x404b04
test ecx, ecx
je 0x404b04
lea edx, [esp + 0xc]
test edx, edx
je 0x404a91
mov eax, 0x103
sub eax, ecx
jmp 0x404a95
mov eax, dword [esp + 0xc]
mov edx, 0x103
sub edx, eax
lea eax, [esp + eax + 0x14]
je 0x404b04
mov esi, str.HOSTS
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x404abc
mov byte [eax], cl
inc eax
dec edx
jne 0x404aa9
dec eax
mov byte [eax], 0
jmp 0x404b04
test edx, edx
jne 0x404ac1
dec eax
mov byte [eax], 0
jmp 0x404b04
push 0
lea eax, [esp + 0x18]
push 0x25
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x14]
push str.DRIVERSETCHOSTS
push ecx
jmp 0x404afe
push 0
lea edx, [esp + 0x18]
push 0x25
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x14]
push str.HOSTS
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ebp, dword [esp + 0x21c]
mov ecx, dword [0x42505c]
lea edx, [esp + 0x14]
test edx, edx
mov dword [ebp], ecx
je 0x404c2d
lea eax, [esp + 0x14]
shr eax, 0x10
jne 0x404bda
mov edx, dword [0x428118]
xor edi, edi
lea ecx, [esp + 0x14]
push pe_nt_image_headers32
mov eax, dword [edx + 8]
mov di, cx
lea ecx, [esp + 0x11c]
push ecx
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x404b5f
mov byte [esp + 0x118], al
mov edx, pe_nt_image_headers32
sub edx, eax
cmp edx, 2
jle 0x404b88
lea eax, [esp + 0x118]
mov ecx, ebp
push eax
call fcn.00407360
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x20c
ret 4
push 0x1ff
mov ecx, ebp
mov esi, 0x200
call fcn.00408450
test eax, eax
je 0x404bc3
push esi
push eax
push edi
call fcn.004088f0
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jg 0x404bc3
add esi, 0x100
mov ecx, ebp
lea edx, [esi - 1]
push edx
call fcn.00408450
test eax, eax
jne 0x404b9d
push 0xffffffffffffffff
mov ecx, ebp
call fcn.00408500
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x20c
ret 4
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x404c2d
lea ecx, [esi + 0xd]
push ecx
call fcn.0041a14f
add esp, 4
test eax, eax
je 0x404c2d
mov dword [eax], 1
lea edx, [esi + 1]
mov byte [eax + esi + 0xc], 0
lea edi, [eax + 0xc]
mov dword [eax + 4], esi
mov dword [eax + 8], esi
cmp edx, esi
mov dword [ebp], edi
jb 0x404c2d
mov ecx, esi
lea esi, [esp + 0x14]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x20c
ret 4