Function at 0x404600
Capabilities:
Create directory
Get common file path
Set registry value

Disassembly:
push 0x60
mov eax, 0x41b0cc
call fcn.0041a746
mov ecx, dword [0x427864]
xor edx, edx
inc edx
call fcn.004016a5
push eax
lea ecx, [ebp - 0x40]
call fcn.00401c80
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], ebx
je 0x404a6b
lea ecx, [ebp - 0x30]
call fcn.00401df6
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 1
or dword [ebp - 0x54], 0xffffffff
mov ecx, eax
push 0x104
mov dword [ebp - 0x5c], eax
call fcn.0040241a
push eax
push ebx
push ebx
push 0x1c
push ebx
mov dword [ebp - 0x58], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.00401766
test esi, esi
je 0x4046a2
cmp byte [ebp + 8], bl
jne 0x404a38
push str.Unable_to_get_AppData_location.
lea ecx, [ebp - 0x2c]
call fcn.00402545
mov byte [ebp - 4], 2
xor edx, edx
lea ecx, [ebp - 0x2c]
push ebx
inc edx
call fcn.004012ff
pop ecx
lea ecx, [ebp - 0x2c]
jmp 0x404a33
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404f60
mov edi, str.OutlookFreeware.com
mov esi, eax
push edi
call fcn.0040d7ad
pop ecx
push eax
push edi
mov ecx, esi
call fcn.0040392f
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push dword [ebp - 0x30]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4046fe
call esi
cmp eax, 0xb7
je 0x4046fe
cmp byte [ebp + 8], 0
jne 0x404a38
push str.Unable_to_create_AppData_folder.
lea ecx, [ebp - 0x2c]
call fcn.00402545
mov byte [ebp - 4], 3
jmp 0x40468d
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404f60
push str.Schemas_
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x34]
call fcn.0040184e
pop ecx
push ebx
mov byte [ebp - 4], 4
push dword [ebp - 0x34]
call edi
test eax, eax
jne 0x40475f
call esi
cmp eax, 0xb7
je 0x40475f
cmp byte [ebp + 8], 0
jne 0x404a30
push str.Unable_to_create_destination_folder.
lea ecx, [ebp - 0x2c]
call fcn.00402545
xor edx, edx
mov byte [ebp - 4], 0xc
push ebx
inc edx
lea ecx, [ebp - 0x2c]
call fcn.004012ff
pop ecx
lea ecx, [ebp - 0x2c]
jmp 0x404a64
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x34]
push dword [eax - 0xc]
push eax
call fcn.0040392f
push ecx
push dword [ebp - 0x34]
mov ecx, dword [0x427864]
call fcn.004016e8
pop ecx
pop ecx
test al, al
je 0x404a3d
cmp byte [ebp + 8], 0
jne 0x4047cb
push ecx
mov ecx, dword [ebp - 0x40]
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x38], esi
call fcn.00401cec
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 5
mov esi, esp
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], esi
lea ecx, [ecx - 0x10]
call fcn.00401cec
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 4
call fcn.00404193
pop ecx
pop ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 6
push eax
push 0x4013a5
push 0xa
push dword [0x427864]
push dword [0x426c90]
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
cmp dword [ebp - 0x4c], 0
jle 0x404a26
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x404a26
push str.SOFTWAREOutlookFreeware.comNewRules_
lea ecx, [ebp - 0x2c]
call fcn.00401c80
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x6c]
test esi, esi
jne 0x40483b
mov eax, ebx
jmp 0x404842
push esi
call fcn.0040d7ad
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040392f
push dword [ebp - 0x6c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
sub esp, 0x14
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5c]
push dword [ebp - 0x2c]
push 0x80000001
call fcn.00406d79
mov edi, dword [ebp - 0x5c]
test eax, eax
jne 0x404a13
push ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x5c]
push ebx
call fcn.00406e3a
mov ecx, dword [0x427864]
push ebx
push 3
pop edx
call fcn.0040167c
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ecx
test eax, eax
je 0x4048bd
mov eax, dword [eax]
push 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push ebx
push str.Flags
push edi
call esi
mov ecx, dword [0x427864]
push ebx
push 0xc
pop edx
call fcn.0040167c
pop ecx
test eax, eax
je 0x4048e7
mov eax, dword [eax]
push 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push ebx
push str.Version
push edi
call esi
mov eax, ebx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x4c], eax
jle 0x404a13
mov esi, dword [0x427864]
lea ecx, [ebp - 0x50]
push eax
call fcn.004017bf
mov ecx, esi
movzx eax, word [eax]
push eax
push 0xa
pop edx
call fcn.0040167c
mov esi, dword [0x427864]
pop ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x38], eax
call fcn.004017bf
mov ecx, esi
movzx eax, word [eax]
push eax
push 0xb
pop edx
call fcn.0040167c
mov esi, dword [ebp - 0x3c]
pop ecx
push esi
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x28], eax
call fcn.004017bf
xor ecx, ecx
cmp cx, word [eax]
je 0x4049dc
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
lea ecx, [ebp - 0x44]
call fcn.00401df6
push esi
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0xa
call fcn.004017bf
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x44]
push 0x42244c
push eax
call fcn.00401994
push ecx
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x68]
push edi
call fcn.00406d79
test eax, eax
jne 0x4049b9
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x68]
push str.Name
call fcn.00406e3a
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4049b9
push ecx
push eax
push str.Description
lea ecx, [ebp - 0x68]
call fcn.00406e3a
lea ecx, [ebp - 0x44]
call fcn.004020ac
mov byte [ebp - 4], 8
cmp dword [ebp - 0x68], 0
je 0x4049d7
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
jmp 0x404a03
push ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x5c]
push str.Name
call fcn.00406e3a
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x404a03
push ecx
push eax
push str.Description
lea ecx, [ebp - 0x5c]
call fcn.00406e3a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, dword [ebp - 0x4c]
jl 0x4048f5
test edi, edi
je 0x404a1e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call fcn.004020ac
lea ecx, [ebp - 0x50]
mov bl, 1
call fcn.004019a8
lea ecx, [ebp - 0x34]
call fcn.004020ac
lea ecx, [ebp - 0x30]
jmp 0x404a91
cmp byte [ebp + 8], 0
jne 0x404a30
push str.Unable_to_extract_data.
lea ecx, [ebp - 0x28]
call fcn.00402545
xor edx, edx
mov byte [ebp - 4], 0xb
push ebx
inc edx
lea ecx, [ebp - 0x28]
call fcn.004012ff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004020ac
jmp 0x404a30
cmp byte [ebp + 8], bl
jne 0x404a96
push str.Unable_to_get_destination_file_name.
lea ecx, [ebp - 0x28]
call fcn.00402545
xor edx, edx
mov byte [ebp - 4], 0xd
push ebx
inc edx
lea ecx, [ebp - 0x28]
call fcn.004012ff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.004020ac
lea ecx, [ebp - 0x40]
call fcn.004020ac
mov al, bl
call fcn.0041a6f5
ret