Function at 0x423280
Capabilities:
Copy file
Delete file
Get common file path
Set registry value
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4b62a1
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x4ef7d0]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ef7d0]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
push str.FontRegistered
push str.SoftwareNotepad2
push 0x80000001
call fcn.00402520
test eax, eax
jne 0x4235e0
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x268], ebx
call fcn.0041bc60
push eax
push str.BINARY
lea eax, [esp + 0x2c]
push 0x159
push eax
call fcn.0042f460
add esp, 0x10
test al, al
mov eax, dword [esp + 0x28]
je 0x4235d3
cmp eax, ebx
je 0x4235e0
mov ecx, dword [esp + 0x2c]
sub ecx, eax
je 0x4235d3
push 1
push 0x14
lea edx, [esp + 0x5c]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x54]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x423340
mov ecx, dword [str.linedraw.ttf]
mov edx, dword [0x4c8938]
mov dword [eax], ecx
mov ecx, dword [0x4c893c]
mov dword [eax + 4], edx
mov dx, word [0x4c8940]
mov edi, 0xf
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x26c], 1
call fcn.0042d630
add esp, 4
push 0xd
push str.linedraw.ttf
lea ecx, [esp + 0x40]
call fcn.00407210
mov ebp, vtable.wpf::Reader.0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x3c]
mov esi, 0x10
cmp dword [esp + 0x50], esi
mov byte [esp + 0x268], 2
jae 0x4233cd
lea eax, [esp + 0x3c]
push 0x40000000
push eax
lea ecx, [esp + 0x20]
call fcn.0042bd80
test al, al
jne 0x423424
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], ebp
je 0x4233f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x50], esi
mov dword [esp + 0x1c], ebx
jb 0x42340a
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0049ea7d
add esp, 4
mov dword [esp + 0x50], edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.00417c70
jmp 0x4235e0
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
jne 0x423430
xor edi, edi
jmp 0x42343c
mov eax, dword [esp + 0x2c]
sub eax, ecx
cmp eax, ebx
mov edi, eax
ja 0x423445
call fcn.0049ed6a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x18]
push edx
push edi
push ecx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x14], ebx
jne 0x423499
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], ebp
je 0x423475
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x50], esi
mov dword [esp + 0x1c], ebx
jb 0x42348c
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0049ea7d
add esp, 4
mov dword [esp + 0x50], 0xf
jmp 0x42340e
cmp dword [esp + 0x50], esi
mov eax, dword [esp + 0x3c]
jae 0x4234a7
lea eax, [esp + 0x3c]
push ebx
lea edx, [esp + 0x58]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
push ebx
push ebx
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push CreateStatusWindowA
mov dword [esp + 0x38], ebx
call edi
cmp eax, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x423527
mov esi, dword [esp + 0x14]
push 0xd
push 0x4c88f0
push 1
push ebx
push str.MS_LineDraw__TrueType_
push esi
call ebp
cmp esi, ebx
je 0x423522
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x10
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareNotepad2
push 0x80000001
mov dword [esp + 0x38], ebx
call edi
cmp eax, ebx
jne 0x42357c
mov esi, dword [esp + 0x14]
push 4
lea edx, [esp + 0x24]
push edx
push 4
push ebx
push str.FontRegistered
push esi
mov dword [esp + 0x38], 1
call ebp
cmp esi, ebx
je 0x423577
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x10
cmp dword [esp + 0x50], esi
mov eax, dword [esp + 0x3c]
jae 0x42358a
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], vtable.wpf::Reader.0
je 0x4235a8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x50], esi
mov dword [esp + 0x1c], ebx
jb 0x4235bf
mov eax, dword [esp + 0x3c]
push eax
call fcn.0049ea7d
add esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp eax, ebx
je 0x4235e0
push eax
call fcn.0049ea7d
add esp, 4
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0049ec31
add esp, 0x258
ret