Function at 0x402420
Capabilities:
Get common file path
Read file on windows
Set registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42b607
push eax
mov eax, 0x514c
mov dword fs:[0], esp
call fcn.004111c0
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], bl
push 0x43bc70
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
stosb byte es:[edi], al
call fcn.0041ff21
push 0x43bc70
lea ecx, [esp + 0x1c]
mov dword [esp + 0x5168], ebx
call fcn.0041ff21
push 0x43bc70
lea ecx, [esp + 0x20]
mov byte [esp + 0x5168], 1
call fcn.0041ff21
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x134]
mov byte [esp + 0x5164], 2
push eax
push 0x104
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x4024e3
push ebx
push ebx
push str.GetCurrentDirectory_failed_
call fcn.00426fe8
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x34]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov edi, str.PciPorts.inf
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 3
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
push ebx
lea eax, [esp + 0x44]
push SysReAllocString
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x2c], edi
jne 0x402566
push ebx
push ebx
push str.CreateFile_failed
call fcn.00426fe8
lea ecx, [esp + 0x24]
push ebx
push ecx
lea edx, [esp + 0x344]
push 0x4e20
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, dword [esp + 0x516c]
xor esi, esi
push 0x43bc70
lea ecx, [esp + 0x18]
call fcn.0041ff21
lea eax, [esp + 0x33c]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x5168], 3
call fcn.0042003c
inc esi
lea ecx, [esp + 0x238]
push esi
push str.VID_PID_NAME_d
push ecx
call fcn.004111ef
add esp, 0xc
lea edx, [esp + 0x238]
lea ecx, [esp + 0x14]
push edx
call fcn.0042003c
mov eax, dword [esp + 0x14]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0041ee93
mov edx, eax
cmp edx, 0xffffffff
jne 0x402604
lea ecx, [esp + 0x14]
mov byte [esp + 0x5164], 2
call fcn.0041feb3
jmp 0x4026e9
mov edi, str.VEN_XXXXDEV_XXXX
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x14]
not ecx
dec ecx
push ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + edx + 3]
lea edx, [esp + 0x2c]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.0041ecfb
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x5168], 4
call fcn.0041ffec
lea ecx, [esp + 0x28]
mov byte [esp + 0x5164], 3
call fcn.0041feb3
push 0x2c
lea ecx, [esp + 0x14]
call fcn.0041ecaa
lea ecx, [esp + 0x10]
call fcn.0041f26a
lea ecx, [esp + 0x10]
call fcn.0041f21e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
call fcn.0041ffec
mov eax, dword [esp + 0x18]
cmp dword [eax - 8], ebx
jne 0x40269c
push str.VEN_9710DEV_9865
lea ecx, [esp + 0x1c]
call fcn.0042003c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x18]
push eax
push 1
push ebx
push ecx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4026d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x20]
push str.Error_RegSetValueEx___:__d
push edx
call fcn.0041f20b
add esp, 0xc
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x5164], 2
call fcn.0041feb3
mov edi, dword [esp + 0x2c]
cmp esi, 6
jl 0x402589
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x5164], 1
call fcn.0041feb3
lea ecx, [esp + 0x18]
mov byte [esp + 0x5164], bl
call fcn.0041feb3
lea ecx, [esp + 0x10]
mov dword [esp + 0x5164], 0xffffffff
call fcn.0041feb3
mov ecx, dword [esp + 0x515c]
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x5158
ret 4