Function at 0x409f30
Capabilities:
Copy file
Get common file path
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x290]
sub esp, 0x310
mov eax, dword [0x43fda4]
xor eax, ebp
mov dword [ebp + 0x28c], eax
push ebx
push esi
mov esi, dword [ebp + 0x298]
push edi
push 0x80
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x80], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x74]
push str.Fonts
push eax
call fcn.0041a570
push esi
call fcn.004194ab
add esp, 0xc
xor edi, edi
cmp word [esi + eax*2 - 2], 0x5c
jne 0x409f93
push esi
call fcn.004194ab
pop ecx
mov word [esi + eax*2 - 2], di
lea eax, [ebp - 0x78]
push eax
push str.EUDC936
push 0x80000001
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push esi
mov ebx, 0x433540
lea eax, [ebp + 0x18c]
push ebx
push eax
call fcn.0041a34e
lea eax, [ebp + 0x18c]
push edi
push eax
call fcn.0041a63d
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x14
test eax, eax
jne 0x40a01f
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8c]
push ebx
push eax
call fcn.0041a34e
add esp, 0xc
push edi
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ebx, ebx
inc ebx
test eax, eax
je 0x40a022
push 0xc
push 0x433530
push ebx
push edi
push 0x433528
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
call esi
jmp 0x40a022
xor ebx, ebx
inc ebx
push dword [ebp - 0x80]
lea eax, [ebp + 0x18c]
push 0x433514
push eax
call fcn.0041a34e
lea eax, [ebp + 0x18c]
push edi
push eax
call fcn.0041a63d
add esp, 0x14
test eax, eax
jne 0x40a091
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8c]
push 0x433514
push eax
call fcn.0041a34e
add esp, 0xc
push edi
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a091
push 0xc
push str.SO.
push ebx
push edi
push 0x4334fc
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
call esi
push dword [ebp - 0x80]
lea eax, [ebp + 0x18c]
push 0x4334e8
push eax
call fcn.0041a34e
lea eax, [ebp + 0x18c]
push edi
push eax
call fcn.0041a63d
add esp, 0x14
test eax, eax
jne 0x40a100
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8c]
push 0x4334e8
push eax
call fcn.0041a34e
add esp, 0xc
push edi
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a100
push 0xc
push 0x4334d8
push ebx
push edi
push 0x4334c4
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
call esi
push dword [ebp - 0x80]
lea eax, [ebp + 0x18c]
push 0x4334b0
push eax
call fcn.0041a34e
lea eax, [ebp + 0x18c]
push edi
push eax
call fcn.0041a63d
add esp, 0x14
test eax, eax
jne 0x40a16f
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x8c]
push 0x4334b0
push eax
call fcn.0041a34e
add esp, 0xc
push edi
lea eax, [ebp + 0x8c]
push eax
lea eax, [ebp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40a16f
push 0xc
push str.wiSO.
push ebx
push edi
push str.wiSO_
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
call esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x28c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00419911
add ebp, 0x290
leave
ret