Function at 0x41e106
Capabilities:
Create directory
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x14d4
call fcn.00484590
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi + 2]
cmp eax, 6
ja 0x41e943
cmp esi, 2
je 0x41e943
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x34]
call fcn.0043ac50
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x38]
call fcn.0043ac50
lea edx, [esp + 0x34]
lea ecx, [esp + 0x30]
call fcn.0041ca16
mov ebx, eax
test ebx, ebx
jne 0x41e19c
push eax
cmp esi, 0xfffffffe
jne 0x41e1a5
lea ecx, [esp + 0x38]
call fcn.0043b93f
mov eax, dword [esp + 0x34]
mov edx, str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000002
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 7
push str.Element
mov ecx, 0x80000002
call fcn.0044ce32
add esp, 0x10
mov ebx, eax
mov edi, dword [esp + 0x30]
jmp 0x41e92b
mov edi, dword [esp + 0x34]
lea edx, [esp + 0x14]
and dword [esp + 0x14], 0
mov ecx, edi
call fcn.0041cbe5
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41e92b
cmp dword [esp + 0x10], eax
jne 0x41e3d5
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
push eax
lea ecx, [esp + 0x20]
call fcn.0043b487
mov edx, str.WinREMountDir_
lea ecx, [esp + 0x1c]
call fcn.0044b36a
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.0044c9a8
test eax, eax
je 0x41e226
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x41e226
push eax
push eax
push esi
call sym.Dismx86.exe_DismUnmountImage
test eax, eax
je 0x41e226
xor edx, edx
mov ecx, esi
inc edx
call fcn.0044bfcd
mov ebx, eax
test ebx, ebx
jne 0x41e923
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push 0
push 0
push edi
call sym.Dismx86.exe_DismMountImage
mov ebx, eax
test ebx, ebx
jne 0x41e923
push 0x146c
lea eax, [esp + 0x76]
mov word [esp + 0x74], 0x4b50
push 0x488498
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push str.WindowsSystem32NativeDism.exe
call fcn.0043ab55
lea edx, [esp + 0x74]
mov ecx, dword [eax]
call fcn.0044b44d
pop ecx
mov ecx, dword [esp + 0x10]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
je 0x41e2b0
push 0x493f28
push str.NativeDism
push 4
call dword [sym.imp.CBSHost.dll_DismWriteLog]
jmp 0x41e384
push str.WindowsSystem32configSYSTEM
lea edx, [esp + 0x20]
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push dword [eax]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov ecx, dword [esp + 0x10]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
je 0x41e2ee
push 0x493f7c
jmp 0x41e29e
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push eax
push 0x20006
push dword [0x4ab220]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x41e374
push 0xc
pop ecx
mov esi, str.NativeDism_NativeDism_
lea edi, [esp + 0x3c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push 0x32
push eax
push 7
push str.BootExecute
mov edx, str.ControlSet001ControlSession_Manager
movsw word es:[edi], word [esi]
call fcn.0044ce32
mov esi, dword [esp + 0x2c]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x41e366
mov edx, dword [esp + 0x18]
mov ecx, esi
call fcn.00415d1e
lea ebx, [eax - 0x50]
neg ebx
sbb ebx, ebx
and ebx, eax
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x30]
push str.WinRE_SYSTEM
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor eax, eax
test ebx, ebx
sete al
push eax
push 1
push edi
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMUnmountImage]
test eax, eax
jne 0x41e3a6
call fcn.0044bc4b
mov ebx, eax
jmp 0x41e923
test ebx, ebx
jne 0x41e923
and dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
push 1
mov ecx, edi
call fcn.0041cbe5
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41e923
lea ecx, [esi - 0x10]
call fcn.0043c924
mov esi, dword [ebp + 8]
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x18]
call fcn.0043ac50
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x20]
call fcn.0043ac50
cmp esi, 0xffffffff
je 0x41e911
test esi, esi
je 0x41e4d0
cmp esi, 1
je 0x41e41a
cmp esi, 3
je 0x41e4d0
push 0x57
pop ebx
jmp 0x41e913
push 0x105
push 0x104
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], 0x4652daff
call fcn.0043c822
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
sub eax, esi
lea ecx, [esp + 0x1c]
sar eax, 1
dec eax
push eax
call fcn.0043c894
mov eax, 0x248
lea ecx, [esp + 0x14]
push eax
mov dword [esp + 0x14], eax
call fcn.0043aa22
xor ecx, ecx
mov dword [esp + 0x18], eax
push ecx
mov ebx, esp
mov word [eax + 0x24], cx
lea ecx, [esi - 0x10]
mov dword [eax], 4
call fcn.0043baa0
mov ecx, dword [esp + 0x1c]
add eax, 0x10
mov dword [ebx], eax
call fcn.0041df8a
mov ebx, eax
pop ecx
test ebx, ebx
je 0x41e5d4
push ebx
lea eax, [esp + 0x14]
push 0x49402c
push eax
call fcn.00449eea
add esp, 0xc
push dword [eax]
push str.NativeDism
push 1
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x41e913
mov eax, dword [ebp + 0xc]
mov ecx, 0x4652daff
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x20], eax
cmp eax, ecx
je 0x41e4e7
test eax, eax
jne 0x41e4f3
test esi, esi
jne 0x41e412
mov dword [esp + 0x20], ecx
test esi, esi
jne 0x41e520
push 0x105
push 0x104
lea ecx, [esp + 0x24]
call fcn.0043c822
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push eax
lea ecx, [esp + 0x20]
call fcn.0043c894
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov ebx, eax
mov ecx, esi
sub ebx, esi
sar ebx, 1
dec ebx
mov dword [esp + 0x28], ebx
call fcn.0044bc8f
sub eax, ebx
lea ecx, [esp + 0x14]
add eax, eax
mov dword [esp + 0x24], eax
add eax, 0x248
push eax
mov dword [esp + 0x14], eax
call fcn.0043aa22
push ecx
mov ecx, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov dword [eax], 3
call fcn.0043a92d
mov ecx, dword [esp + 0x1c]
call fcn.0041df8a
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x41e49d
mov eax, dword [esp + 0x18]
mov edx, 0x8003
add eax, 0x14
mov ecx, esi
push 0x10
push eax
call fcn.0044b192
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x41e5b3
push ebx
push esi
lea eax, [esp + 0x18]
push 0x49405c
push eax
call fcn.00449eea
add esp, 0x10
jmp 0x41e4b0
mov eax, dword [esp + 0x24]
add eax, 2
push eax
mov eax, dword [esp + 0x2c]
lea eax, [esi + eax*2]
push eax
mov eax, dword [esp + 0x20]
add eax, 0x24
push eax
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
mov esi, dword [esp + 0x14]
cmp dword [esi - 4], 1
jle 0x41e5ee
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.0043abd1
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov ebx, esi
and edi, 0xfffffff8
je 0x41e60d
mov edx, str.______8_13JMQ__79E__0xu_
mov ecx, ebx
call fcn.0041cde2
add ebx, 8
sub edi, 8
jne 0x41e5f9
push dword [esp + 0x20]
lea eax, [esp + 0x28]
push str._.8x_77a1_4391_9157_aba3f31b3629
push eax
call fcn.00449eea
add esp, 0xc
lea eax, [esp + 0x34]
xor edi, edi
lea ecx, [esp + 0x28]
mov edx, str.BCD00000000Objects_
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
push eax
call fcn.00430fb9
pop ecx
lea ecx, [esp + 0x38]
push ecx
push 0x20019
push dword [0x4ab220]
push dword [eax]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x28]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
jne 0x41e8ed
lea eax, [esp + 0x24]
mov edx, str.BCD00000000Objects_
push eax
lea ecx, [esp + 0x2c]
call fcn.00430fb9
pop ecx
push edi
lea ecx, [esp + 0x30]
push ecx
push edi
push 0x2001f
push dword [0x4ab220]
push edi
push edi
push dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0x80000002
call edi
mov ecx, dword [esp + 0x28]
mov ebx, eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
test ebx, ebx
jne 0x41e8ed
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
call fcn.0044d10d
mov ebx, eax
test ebx, ebx
jne 0x41e8ed
cmp dword [esi - 4], 1
jle 0x41e6ee
push dword [esi - 0xc]
lea ecx, [esp + 0x18]
call fcn.0043abd1
mov esi, dword [esp + 0x14]
push dword [esp + 0x10]
push esi
push 3
push 0
push str.Custom
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
jne 0x41e8ed
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x1c]
call fcn.0043ac50
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
push ebx
push str.Element
mov edx, str.Elements11000001
call fcn.0044cfa0
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41e755
push dword [eax - 0xc]
lea ecx, [esp + 0x1c]
call fcn.0043abd1
mov eax, dword [esp + 0x18]
push 0x494130
mov edx, eax
lea ecx, [esp + 0x24]
call fcn.0044a5e5
push eax
mov edx, str.BCD00000000Objects_
lea ecx, [esp + 0x18]
call fcn.00430fb9
pop ecx
mov edx, eax
lea ecx, [esp + 0x2c]
call fcn.0043ab55
pop ecx
mov ecx, 0x80000002
mov edx, dword [eax]
call fcn.0044cfe3
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x2c]
mov edx, str.Elements12000004
push 0x486104
push str.Element
call fcn.0044cefe
cmp dword [ebp + 8], 3
pop ecx
pop ecx
push ebx
je 0x41e802
lea ecx, [esp + 0x28]
call fcn.0043b93f
mov edi, dword [esp + 0x24]
mov edx, str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000002
push 0x50
push edi
push 7
push str.Element
mov ecx, 0x80000002
call fcn.0044ce32
add esp, 0x10
mov ebx, eax
jmp 0x41e8dc
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
push ebx
push 0x2001f
push dword [0x4ab220]
push ebx
push ebx
push str.BCD00000000Objects9dea862c_5cdd_4e70_acc1_f32b344d4795Elements24000001
push 0x80000002
call edi
mov ebx, eax
test ebx, ebx
jne 0x41e860
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x18]
call fcn.0043ac50
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
mov edx, str.Element
call fcn.0044cd14
mov ebx, eax
pop ecx
mov ecx, dword [esp + 0x14]
test ebx, ebx
je 0x41e87b
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x20]
call fcn.0043a910
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x41e8f1
mov edi, dword [esp + 0x24]
mov edx, edi
call fcn.00449eaf
test eax, eax
jne 0x41e8c7
push dword [edi - 0xc]
lea ecx, [esp + 0x18]
push edi
call fcn.0043b96c
push 0
lea ecx, [esp + 0x18]
call fcn.0043b93f
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 7
push 0
push str.Element
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x20]
call fcn.0043a910
test ebx, ebx
jne 0x41e86d
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
jmp 0x41e86d
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
call fcn.0043a910
lea ecx, [esp + 0x38]
call fcn.0043a910
lea ecx, [edi - 0x10]
call fcn.0043c924
mov edi, dword [esp + 0x30]
jmp 0x41e917
xor ebx, ebx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esi - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x34]
add ecx, 0xfffffff0
call fcn.0043c924
lea ecx, [edi - 0x10]
call fcn.0043c924
mov eax, ebx
jmp 0x41e948
mov eax, 0x80004002
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14