Function at 0x426f40
Capabilities:
Get common file path
Set registry value

Disassembly:
sub esp, 0x874
mov eax, dword [0x43b640]
mov ecx, dword [0x43b588]
push ebx
mov edx, dword [0x43b590]
push ebp
push esi
push edi
push str.Function_Entry
push 0x43d2ec
push 4
push 0x162e
push eax
mov eax, dword [0x43b58c]
push ecx
push edx
xor ebx, ebx
push eax
push 1
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
call fcn.0040ee40
mov ebp, dword [esp + 0x8ac]
add esp, 0x24
cmp ebp, ebx
jne 0x426fa9
mov esi, 0x80000b03
mov ecx, 0x1634
mov eax, esi
jmp 0x427309
lea ecx, [esp + 0x1ac]
push 0x64
push ecx
call fcn.00426b30
lea edx, [esp + 0x218]
push 0x64
push edx
call fcn.00426c00
lea eax, [esp + 0x90]
push 0x64
push eax
call fcn.00426cc0
lea ecx, [esp + 0x160]
push 0x64
push ecx
call fcn.00426d90
lea edx, [esp + 0x104]
push 0x64
push edx
call fcn.00426e60
lea eax, [esp + 0x44]
push 0x64
push eax
call fcn.00426c00
mov ecx, 0x7d
xor eax, eax
lea edi, [esp + 0x6c0]
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5b8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2a4]
add esp, 0x30
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x37c]
push 0x106
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58c]
push ecx
stosw word es:[edi], ax
call esi
test eax, eax
jne 0x427071
mov esi, 0x80000b19
mov ecx, 0x164a
mov eax, esi
jmp 0x427309
lea edx, [esp + 0x274]
push 0x106
push edx
call fcn.004227b0
add esp, 8
cmp eax, ebx
je 0x427096
mov esi, eax
mov ecx, 0x1650
jmp 0x427309
lea eax, [esp + 0x37c]
push 0x20a
push eax
call esi
test eax, eax
jne 0x4270ba
mov esi, 0x80000b19
mov ecx, 0x1656
mov eax, esi
jmp 0x427309
lea edi, [esp + 0x37c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
cmp edx, 1
jl 0x4272fd
cmp edx, 0x104
jg 0x4272fd
mov byte [esp + edx + 0x37c], 0x5c
lea edi, [esp + 0x274]
or ecx, 0xffffffff
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 1
jl 0x4272ef
cmp ecx, 0x104
jg 0x4272ef
lea eax, [ecx + edx]
lea esi, [eax + 1]
cmp esi, 0x209
ja 0x4272ef
lea edi, [esp + edx + 0x37c]
mov edx, ecx
lea esi, [esp + 0x274]
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [esp + eax + 0x380], bl
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1b0]
push eax
push ecx
push ebp
call fcn.00425fe0
add esp, 0x10
cmp eax, ebx
jne 0x4272e6
cmp dword [esp + 0x14], ebx
je 0x4272e6
push ebx
lea edx, [esp + 0x694]
push 0x1f4
push edx
call fcn.00426840
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
test eax, eax
jne 0x4271b5
lea edi, [esp + 0x690]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x690]
push ecx
mov ecx, dword [esp + 0x18]
push eax
push 1
push ebx
push 0x444d84
push ecx
call ebp
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ebx
lea eax, [esp + 0x214]
push edx
push eax
push ecx
mov dword [esp + 0x20], ebx
call fcn.00425fe0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10
test eax, eax
jne 0x427239
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x427239
lea edx, [esp + 0x18]
push ebx
lea ecx, [esp + 0x84]
push edx
push ecx
push eax
call fcn.00425fe0
add esp, 0x10
test eax, eax
jne 0x427232
mov edx, dword [esp + 0x18]
cmp edx, ebx
je 0x427232
lea edi, [esp + 0x37c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x37c]
push ecx
push eax
push 1
push ebx
push 0x444d84
push edx
call ebp
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push ebx
lea ecx, [esp + 0x14c]
push eax
push ecx
push edx
mov dword [esp + 0x20], ebx
call fcn.00425fe0
add esp, 0x10
test eax, eax
jne 0x427287
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x427287
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x1c]
push ecx
push eax
push 1
push ebx
push 0x444d84
push edx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ebx
lea eax, [esp + 0xe8]
push edx
push eax
push ecx
mov dword [esp + 0x20], ebx
call fcn.00425fe0
add esp, 0x10
test eax, eax
jne 0x4272db
mov edx, dword [esp + 0x10]
cmp edx, ebx
je 0x4272db
lea edi, [esp + 0x588]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x588]
push ecx
push eax
push 1
push ebx
push 0x444d84
push edx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
xor esi, esi
jmp 0x427334
mov esi, eax
mov ecx, 0x1671
jmp 0x427309
mov esi, 0x80000b34
mov ecx, 0x1666
mov eax, esi
jmp 0x427309
mov esi, 0x80000b34
mov ecx, 0x165c
mov eax, esi
mov edx, dword [0x43b588]
push 0x65
push ecx
mov ecx, dword [0x43b640]
push ecx
mov ecx, dword [0x43b590]
push edx
mov edx, dword [0x43b58c]
push ecx
push edx
push eax
push esi
push 3
call fcn.0040fdd0
add esp, 0x24
mov eax, dword [0x43b640]
mov ecx, dword [0x43b588]
mov edx, dword [0x43b590]
push esi
push str.Function_Exit
push str._s__Rc__0x_08X
push 4
push 0x16c1
push eax
mov eax, dword [0x43b58c]
push ecx
push edx
push eax
push 1
call fcn.0040ee40
add esp, 0x28
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x874
ret