Function at 0x426f4e
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1070
call fcn.004419d0
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, ecx
xor eax, eax
cmp dword [ebp + 8], 3
push esi
push edi
mov edi, dword [ebx + 0x18]
mov esi, eax
mov dword [ebp - 0x1058], edi
je 0x426fa0
mov ecx, dword [ebx + 0x1c]
test ecx, ecx
je 0x426fa0
call fcn.0041f21e
test eax, eax
je 0x426fa0
mov ecx, ebx
call fcn.00426d83
mov esi, eax
test esi, esi
js 0x427897
test edi, edi
jne 0x426fae
mov eax, 0x80004003
jmp 0x427897
mov ecx, edi
call fcn.0041f21e
test eax, eax
jne 0x426fc3
mov eax, 0x80070002
jmp 0x427897
mov eax, dword [ebx + 0x2c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x42747d
jle 0x427473
cmp eax, 4
jle 0x4273b2
cmp eax, 5
je 0x4271ee
cmp eax, 6
jne 0x427473
mov edi, 0x104
lea eax, [ebp - 0x214]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x40626c
test eax, eax
je 0x42705c
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x214]
call fcn.0040c15d
test eax, eax
js 0x42705c
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x214]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
test eax, eax
js 0x42705c
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42705c
test al, 0x10
je 0x4270d4
push 0x103
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4271c5
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x214]
call fcn.0040c15d
test eax, eax
js 0x4271c5
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x214]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
test eax, eax
js 0x4271c5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4271c5
test al, 0x10
jne 0x4271c5
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx + 0x14]
neg eax
sbb eax, eax
and eax, 0x200
add eax, 0x2c
test ecx, ecx
jne 0x4270ef
mov ecx, 0x4015d0
mov esi, dword [ebp - 0x1058]
push eax
push ecx
push esi
lea eax, [ebp - 0x214]
push eax
push 0x406418
lea eax, [ebp - 0x104c]
push 0x208
push eax
call fcn.0040c0e1
add esp, 0x1c
lea eax, [ebp - 0x624]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
mov edx, edi
lea ecx, [ebp - 0xa34]
call fcn.0040c040
lea eax, [ebp - 0xa34]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x42714e
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x104c]
lea ecx, [ebp - 0x214]
call fcn.00421540
test eax, eax
je 0x42717c
xor esi, esi
jmp 0x427198
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x42718d
push 0x57
pop esi
test esi, esi
jle 0x427198
movzx esi, si
or esi, 0x80070000
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
js 0x42787b
call fcn.0041f8bf
test eax, eax
je 0x42787b
push ecx
push 0x406478
jmp 0x4273a1
cmp dword [0x442534], 0xffffffff
mov esi, 0x80070002
jne 0x4271dc
push ecx
push 2
pop edx
call fcn.0041e30f
push 2
mov edx, 0x406360
pop ecx
call fcn.0041e767
jmp 0x42787b
mov edi, 0x104
lea eax, [ebp - 0x41c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, 0x40626c
test eax, eax
je 0x42723e
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040c15d
test eax, eax
js 0x42723e
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
push esi
push ecx
lea ecx, [ebp - 0x41c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x427254
test al, 0x10
je 0x4272bc
push 0x103
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x42729e
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0x41c]
call fcn.0040c15d
test eax, eax
js 0x42729e
mov eax, dword [ebp - 0x1050]
sub edi, eax
push ecx
push esi
push ecx
lea ecx, [ebp - 0x41c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4271c5
test al, 0x10
jne 0x4271c5
lea eax, [ebp - 0x41c]
mov edi, 0x208
push eax
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c040
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
lea ecx, [ebp - 0x82c]
push eax
call fcn.0040c15d
cmp dword [ebp + 8], 3
jne 0x4272fc
test eax, eax
js 0x42731f
push ecx
push 0x406288
jmp 0x427306
test eax, eax
js 0x42731f
push ecx
push 0x4062e0
mov eax, dword [ebp - 0x1050]
mov edx, edi
push ecx
lea ecx, [ebp - 0x82c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
mov esi, dword [ebp - 0x1058]
lea ecx, [ebp - 0x82c]
push esi
mov edx, edi
call fcn.0040c075
cmp dword [ebx + 0x14], 0
je 0x427349
push dword [ebx + 0x14]
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c075
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x82c]
lea ecx, [ebp - 0x41c]
call fcn.00421540
test eax, eax
je 0x42736a
xor esi, esi
jmp 0x42738e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x42737b
push 0x57
pop esi
test esi, esi
jle 0x427386
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x42787b
call fcn.0041f8bf
test eax, eax
je 0x42787b
push ecx
push 0x406344
push 8
call fcn.0041f954
mov esi, 0xd2af9
jmp 0x42787b
xor eax, eax
mov dword [ebp - 0x105c], 0x2a
mov dword [ebp - 0x1060], eax
mov dword [ebp - 0x1070], eax
mov dword [ebp - 0x106c], eax
mov dword [ebp - 0x1068], eax
call fcn.0041f8bf
cmp dword [ebp + 8], 3
mov dword [0x442674], eax
mov dword [0x44267c], 1
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0x1064], eax
mov eax, 0x4063b4
je 0x427404
mov eax, dword [ebx + 0x14]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x1070]
push eax
push edi
call fcn.0043aa4f
mov esi, eax
test esi, esi
jns 0x427455
cmp byte [ebx + 0x60], 0
je 0x42743b
or dword [0x443fa8], 4
push edi
push 0x4063c8
push 2
call fcn.0041e83a
add esp, 0xc
xor esi, esi
jmp 0x427455
mov eax, dword [ebx + 0x84]
mov dword [0x443fb0], esi
mov eax, dword [eax + 0x40]
add eax, dword [0x442538]
mov dword [0x443fac], eax
cmp dword [ebp - 0x1060], 0
je 0x42787b
push dword [ebp - 0x1060]
call fcn.00440db7
pop ecx
jmp 0x42787b
mov esi, 0x80004005
jmp 0x42787b
mov dword [ebp - 0x1050], ecx
mov edx, 0x207
push edi
lea ecx, [ebp - 0x82c]
call fcn.0040c040
push ecx
lea eax, [ebp - 0x1054]
mov edi, 0x208
push eax
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c15d
test eax, eax
js 0x4274d1
mov eax, dword [ebp - 0x1054]
mov edx, edi
push ecx
push 0x40608c
push ecx
lea ecx, [ebp - 0x82c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
cmp dword [ebx + 0x14], 0
je 0x4274e7
push dword [ebx + 0x14]
mov edx, edi
lea ecx, [ebp - 0x82c]
call fcn.0040c075
mov ecx, dword [ebx + 0x84]
xor edi, edi
push edi
call fcn.0042c00d
mov ecx, 0x186a0
cmp edx, edi
ja 0x427509
jb 0x427504
cmp eax, ecx
jae 0x427509
mov ecx, 0x2710
xor edx, edx
div ecx
mov dword [0x443fbc], eax
cmp eax, 0x64
jbe 0x427525
push 0xa
xor edx, edx
pop ecx
div ecx
mov dword [0x443fbc], eax
jmp 0x427532
push 0x14
pop ecx
cmp eax, ecx
jae 0x427532
mov dword [0x443fbc], ecx
mov edi, dword [ebp - 0x1058]
push 0x4050b4
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x427573
push 0x64
pop ecx
mov dword [0x443fc0], 1
mov dword [ebp - 0x1054], 0x1f4
call fcn.0041dc25
mov eax, dword [0x442548]
mov dword [ebp - 0x1050], eax
jmp 0x4275de
mov ecx, dword [0x443fbc]
and dword [0x443fc0], 0
mov dword [ebp - 0x1054], 0x1388
call fcn.0041dc25
mov eax, dword [0x443f94]
test eax, eax
je 0x4275de
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4275de
push 0x100
lea eax, [ebp - 0xa2c]
push eax
push 0x26ec
push dword [0x442af0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4275de
lea eax, [ebp - 0xa2c]
push eax
push 0
push 0x5c5
push dword [0x443f94]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x422f20
push dword [ebp - 0x1054]
push 0x2f00
push dword [0x443f94]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp - 0x1050], 0
je 0x427648
push 0xffff
push dword [ebx + 0x3c]
lea edx, [ebp - 0x82c]
mov ecx, edi
call fcn.00421540
test eax, eax
je 0x427623
xor esi, esi
jmp 0x42774d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x427634
push 0x57
pop esi
test esi, esi
jle 0x42774d
movzx esi, si
or esi, 0x80070000
jmp 0x42774d
push 0x4050b4
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x42773d
xor ecx, ecx
lea eax, [ebp - 0x1054]
push ecx
push eax
push ecx
push 3
push ecx
push ecx
push ecx
push 0x401858
push SysReAllocStringLen
mov dword [ebp - 0x1054], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42772d
mov edi, 0x104
lea ecx, [ebp - 0xc3c]
mov edx, edi
call fcn.0041fb21
test eax, eax
je 0x42771b
push ecx
lea eax, [ebp - 0x1050]
mov edx, edi
push eax
lea ecx, [ebp - 0xc3c]
call fcn.0040c15d
test eax, eax
js 0x42771b
mov eax, dword [ebp - 0x1050]
sub edi, eax
push ecx
push 0x406090
push ecx
lea ecx, [ebp - 0xc3c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c1c3
test eax, eax
js 0x42771b
lea ecx, [ebp - 0xc3c]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4276e9
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc3c]
push eax
push 1
push edi
push 0x4060b0
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1058]
push 0x4060d0
push 4
call fcn.0041e83a
pop ecx
pop ecx
jmp 0x42774d
push edi
push 0x406110
push 2
call fcn.0041e83a
add esp, 0xc
cmp dword [0x443fc0], 0
je 0x42775b
push 0x64
pop ecx
jmp 0x427761
mov ecx, dword [0x443fbc]
call fcn.0041dd92
push 0x2f00
push dword [0x443f94]
call dword [sym.imp.USER32.dll_KillTimer]
test esi, esi
jns 0x42779e
cmp byte [ebx + 0x60], 0
je 0x42779e
or dword [0x443fa8], 1
push edi
push 0x406180
push 2
call fcn.0041e83a
add esp, 0xc
xor eax, eax
mov esi, eax
jmp 0x4277a0
xor eax, eax
cmp dword [ebx + 0x5c], eax
je 0x4277fe
cmp esi, 0x80070bc2
je 0x42780f
cmp esi, 0x8007f901
jne 0x4277b9
mov esi, eax
jmp 0x427821
cmp esi, 0x8007f02a
jne 0x4277c8
mov esi, 0xc00d2afb
jmp 0x427821
test esi, esi
js 0x4277e2
call fcn.0041f8bf
mov dword [0x442674], eax
mov dword [0x44267c], 1
jmp 0x427821
mov eax, dword [ebx + 0x84]
mov dword [0x443fb0], esi
mov eax, dword [eax + 0x40]
add eax, dword [0x442538]
mov dword [0x443fac], eax
jmp 0x427821
test esi, esi
js 0x427821
call fcn.0041f8bf
cmp dword [0x442674], eax
jae 0x427821
push ecx
push 0x4061cc
push 8
call fcn.0041f954
mov esi, 0xd2af9
mov edx, esi
mov ecx, edi
call fcn.00422de4
test eax, eax
jne 0x427843
or dword [0x443fa8], 2
push 0x4061e8
push 2
call fcn.0041e83a
pop ecx
pop ecx
push 0x40623c
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x427867
push 0x406250
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x42787b
xor eax, eax
test esi, esi
js 0x427876
cmp esi, 0xd2af9
setne al
mov dword [0x442548], eax
push esi
push 0x406490
push 4
call fcn.0041e83a
add esp, 0xc
xor eax, eax
mov ecx, ebx
push eax
call fcn.00425abc
mov eax, esi
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret 0xc