Function at 0x4026d0
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x438
lea ecx, [esp + 0x2a8]
push ebx
push ebp
push esi
push edi
xor ebp, ebp
call fcn.00402090
push ebp
lea eax, [esp + 0x124]
push 8
push eax
lea ecx, [esp + 0x2c4]
call fcn.004021b0
mov esi, dword [esp + 0x450]
test eax, eax
jne 0x4027c8
cmp dword [esp + 0x130], 2
jne 0x4027c8
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push str.Environment
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027c8
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
push ebp
push 0x40a3d8
push ecx
mov dword [esp + 0x2c], 0x104
call edi
test eax, eax
je 0x402794
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push ebp
push ebp
push str.temp
push ecx
call edi
test eax, eax
jne 0x4027ac
mov ebx, dword [esp + 0x44c]
lea edx, [esp + 0x1c]
push ebx
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebp, eax
jmp 0x4027b3
mov ebx, dword [esp + 0x44c]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x4028a5
jmp 0x4027cf
mov ebx, dword [esp + 0x44c]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push ebx
push esi
push 0x40a3d8
call edi
mov ebp, eax
test ebp, ebp
jne 0x4028a5
push ebx
push esi
push str.temp
call edi
mov ebp, eax
test ebp, ebp
jne 0x4028a5
mov ecx, 0x41
lea edi, [esp + 0x1b4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x1b4]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1b4]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00403800
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x12b], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x103
sub edx, ecx
lea eax, [esp + 0x28]
push edx
push str.temp_
push eax
call fcn.004036d0
add esp, 0x18
cmp ebx, 9
jae 0x40287c
mov ebp, 9
jmp 0x4028a5
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
sub edx, ecx
mov ebp, 8
push edx
push eax
push esi
call fcn.00403800
add esp, 0xc
mov byte [ebx + esi - 1], 0
push 0
lea ecx, [esp + 0x1c]
push 7
push ecx
lea ecx, [esp + 0x2c4]
mov dword [esp + 0x24], 0
call fcn.004021b0
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x4028d3
cmp eax, 5
jbe 0x402972
mov dl, byte [esi]
mov eax, 1
cmp dl, 0x5c
mov ecx, esi
je 0x4028ea
mov dl, byte [ecx + 1]
inc ecx
cmp dl, 0x5c
jne 0x4028e1
mov dl, byte [ecx + 1]
inc ecx
cmp dl, 0x5c
je 0x4028fc
mov dl, byte [ecx + 1]
inc ecx
cmp dl, 0x5c
jne 0x4028f3
lea ebx, [ecx + 1]
mov edi, ebx
mov cl, byte [edi]
cmp cl, 0x5c
je 0x40292c
test cl, cl
je 0x402928
and ecx, 0xff
push ecx
call fcn.004038fe
add esp, 4
test eax, eax
je 0x402931
mov cl, byte [edi + 1]
inc edi
cmp cl, 0x5c
jne 0x402908
test eax, eax
je 0x402931
cmp byte [edi], 0
jne 0x40296b
mov edi, str.BB443B11_7D12_450c_9F85_2D32804655F9_temp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.BB443B11_7D12_450c_9F85_2D32804655F9_temp
push ebx
call fcn.00403800
mov edi, str.BB443B11_7D12_450c_9F85_2D32804655F9_temp
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, ebx
mov byte [ecx], al
mov byte [ecx + 1], al
call fcn.00402650
add esp, 0x10
mov ebx, dword [esp + 0x44c]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [ecx - 1]
test edx, edx
jl 0x4029af
cmp byte [ecx + esi - 1], 0x5c
je 0x4029af
inc ebp
cmp ebp, ebx
ja 0x4029af
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub ebx, ecx
dec ebx
push ebx
push 0x40a0d0
push esi
call fcn.004036d0
add esp, 0xc
lea ecx, [esp + 0x2b8]
call fcn.004020e0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x438
ret