Function at 0x42f980
Capabilities:
Get common file path
Get program files directory
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x459b66
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x471660]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x471660]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x18], ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push str.SoftwareNetNucleousActiveCollector
push closesocket
mov dword [esp + 0xa7c], ebp
mov dword [esp + 0x38], ebp
call ebx
cmp eax, ebp
jne 0x42fa5e
mov esi, dword [esp + 0x14]
mov edx, dword [edi + 4]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebp
push str.MessageHWND
push esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42fab9
jle 0x42fa30
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov ebp, eax
je 0x42fcb8
push ebp
push str.keyWindow.SetDWORDValue_L_MessageHWND____DWORD__m_hWnd_
push 0x46
push str.L_d__FAILED:__s_with_HRESULT___x_r_n
push 0x474104
call fcn.00401190
add esp, 0x14
jmp 0x42fcb8
jle 0x42fa6a
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov esi, eax
je 0x42fa8f
push esi
push str.keyWindow.Create_hKeyParent__L_SoftwareNetNucleousActiveCollector__
push 0x45
push str.L_d__FAILED:__s_with_HRESULT___x_r_n
push 0x474104
call fcn.00401190
add esp, 0x14
mov eax, esi
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.00434fe0
add esp, 0xa48
ret
test esi, esi
je 0x42faf1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov dword [esp + 0x18], 0
je 0x42faf1
jle 0x42fadc
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov esi, eax
je 0x42fa8f
push esi
push str.keyWindow.Close__
push 0x48
jmp 0x42fa7d
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareAppDataLowSoftwareNetNucleousActiveCollector
push closesocket
mov dword [esp + 0x38], 0
call ebx
test eax, eax
jne 0x42fb3b
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x42fb2f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
je 0x42fb63
jle 0x42fb47
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov ebp, eax
je 0x42fcb8
push ebp
push str.keyWindow.Create_hKeyParent__L_SoftwareAppDataLowSoftwareNetNucleousActiveCollector__
push 0x4a
jmp 0x42fa47
mov eax, dword [edi + 4]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.MessageHWND
push ecx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42fbad
jle 0x42fb91
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov ebp, eax
je 0x42fcb8
push ebp
push str.keyWindow.SetDWORDValue_L_MessageHWND____DWORD__m_hWnd_
push 0x4b
jmp 0x42fa47
lea ecx, [esp + 0x18]
call fcn.004079f0
test eax, eax
je 0x42fbe2
jle 0x42fbc6
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov ebp, eax
je 0x42fcb8
push ebp
push str.keyWindow.Close__
push 0x4d
jmp 0x42fa47
push str.ChangeWindowMessageFilter
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42fc39
push 1
push 0x4a
call eax
test eax, eax
jne 0x42fc39
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42fc39
jle 0x42fc1d
and eax, 0xffff
or eax, 0x80070000
cmp byte [0x474100], 0
mov ebp, eax
je 0x42fcb8
push ebp
push str.GetLastError__
push 0x59
jmp 0x42fa47
push 0
push 0x26
lea eax, [esp + 0x950]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x948]
push ecx
push str._sNetNucleousActiveCollectorcommon.dll
push 0x4730d0
call fcn.00435956
add esp, 0xc
mov ecx, edi
call fcn.0042f590
test eax, eax
jne 0x42fca2
lea ecx, [esp + 0x20]
call fcn.0042d910
push 0x4730d0
lea ecx, [esp + 0x24]
mov byte [esp + 0xa5c], 1
call fcn.0042ede0
lea ecx, [esp + 0x20]
mov byte [esp + 0xa58], 0
call fcn.00434620
mov edx, dword [edi + 4]
push 0
push 0x1499700
push 0xd1b
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x42fcc7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x42fa91