Function at 0x40c964
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x16]
lea esi, str._TEMP_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x19]
lea esi, [0x4215ff]
mov ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x27]
lea esi, str._TEMP_UNIQUE_
mov ecx, 7
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2d]
lea esi, str._WIN_
mov ecx, 3
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x4f]
lea esi, str._WINSYS_
mov ecx, 9
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x46]
lea esi, str._DOCS_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xf]
lea esi, str._PROG_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x35]
lea esi, str._FONTS_
mov ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x3f]
lea esi, str._DESKTOP_
mov ecx, 5
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x52]
lea esi, [0x42163f]
mov ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x100
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 8], eax
push 0x100
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], 0x100
push ebx
push dword [ebp - 8]
call fcn.00411b78
push ebx
call sub.CRTDLL.DLL__strupr
add esp, 0xc
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ca4e
cmp eax, 0
jne 0x40ca6a
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40d2bd
lea eax, [ebp - 0xf]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cb0e
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411b78
push dword [ebp - 4]
call sub.CRTDLL.DLL__strupr
add esp, 4
push 0x421691
push ebx
call fcn.00411b78
lea eax, [ebp - 0xf]
push eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_strstr
add esp, 8
push 0x5c
mov edi, eax
inc edi
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
or eax, eax
je 0x40cb02
push 0x42168f
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0xf]
push eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_strstr
add esp, 8
push 0x5c
mov edi, eax
sub edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea edi, [edi + esi + 1]
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
mov edi, eax
inc edi
push edi
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push ebx
call fcn.0040c964
pop ecx
jmp 0x40d2bd
lea eax, [ebp - 0x16]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cb8b
push dword [ebp - 4]
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cb34
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cb55
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x16]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cb7d
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
lea eax, [ebp - 0x19]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cc08
push dword [ebp - 4]
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cbb1
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cbd2
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x19]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cbfa
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
lea eax, [ebp - 0x27]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40ccae
lea eax, [ebp - 0x15c]
push eax
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp - 4]
push 0
push 0x421689
lea eax, [ebp - 0x15c]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
push dword [ebp - 4]
call sub.CRTDLL.DLL_remove
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cc57
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cc78
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x27]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cca0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
push 0x421687
push ebx
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40ccd0
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40d2bd
lea eax, [ebp - 0x2d]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cd4d
push 0x100
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ccf6
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cd17
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cd3f
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
lea eax, [ebp - 0x35]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cdf3
lea eax, [ebp - 0x160]
push eax
push 0x14
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40cde3
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cd8c
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cdad
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x35]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cdd5
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40d2bd
lea eax, [ebp - 0x3f]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40ce99
lea eax, [ebp - 0x160]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40ce89
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ce32
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40ce53
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x3f]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40ce7b
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40d2bd
lea eax, [ebp - 0x46]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cf3f
lea eax, [ebp - 0x160]
push eax
push 5
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40cf2f
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ced8
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cef9
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x46]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cf21
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40d2bd
lea eax, [ebp - 0x4f]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cfbc
push 0x100
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cf65
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cf86
push 0x42168d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x4f]
push eax
push dword [ebp - 8]
call fcn.00410f00
add esp, 0x14
or eax, eax
jle 0x40cfae
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411b78
push dword [ebp - 8]
push ebx
call fcn.00411b78
jmp 0x40d2bd
push 2
lea eax, [ebp - 0x52]
push eax
push ebx
call sub.CRTDLL.DLL_memcmp
add esp, 0xc
or eax, eax
jne 0x40d2b4
push 0x7c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
or eax, eax
je 0x40cffc
mov dword [ebp - 0x168], 1
push 0x7c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov byte [eax], 0
jmp 0x40d006
mov dword [ebp - 0x168], 0
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
add esp, 8
or eax, eax
jne 0x40d03b
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
jmp 0x40d2d0
push ebx
push dword [ebp - 4]
call fcn.00411b78
push 0x5c
push dword [ebp - 4]
call sub.CRTDLL.DLL_strchr
mov byte [eax], 0
push str.HKCU
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 0x10
or eax, eax
je 0x40d079
push str.HKEY_CURRENT_USER
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40d085
mov dword [ebp - 0x164], 0x80000001
jmp 0x40d0f7
push str.HKLM
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
je 0x40d0ad
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40d0b9
mov dword [ebp - 0x164], 0x80000002
jmp 0x40d0f7
push 0x421654
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
je 0x40d0e1
push str.HKEY_USERS
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40d0ed
mov dword [ebp - 0x164], 0x80000003
jmp 0x40d0f7
mov dword [ebp - 0x164], 0x80000003
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
push 0x5c
mov edi, eax
inc edi
push edi
call sub.CRTDLL.DLL_strchr
add esp, 0x10
or eax, eax
jne 0x40d137
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
jmp 0x40d2d0
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
mov edi, eax
inc edi
push edi
push dword [ebp - 4]
call fcn.00411b78
push 0x5c
push dword [ebp - 4]
call sub.CRTDLL.DLL_strrchr
add esp, 0x10
mov byte [eax], 0
lea eax, [ebp - 0x164]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
jne 0x40d1e0
push 0x5c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
lea edi, [ebp - 0x58]
push edi
push ebx
push 0
push 0
mov edi, eax
inc edi
push edi
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegQueryValueExA
or eax, eax
je 0x40d1d3
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40d2d0
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40d203
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
jmp 0x40d2d0
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40d208
push str..exe
lea eax, [eax + ebx - 4]
push eax
call sub.CRTDLL.DLL__stricmp
add esp, 8
cmp eax, 0
jne 0x40d253
push ebx
call fcn.00411494
add esp, 4
cmp eax, 0
je 0x40d253
push 0x5c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x16c], eax
cmp eax, 0
je 0x40d253
mov eax, dword [ebp - 0x16c]
mov byte [eax], 0
cmp dword [ebp - 0x168], 0
je 0x40d29f
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40d261
cmp byte [eax + ebx - 1], 0x5c
je 0x40d27d
push 0x42168d
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x7c
push dword [ebp - 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x16c], eax
or eax, eax
je 0x40d29f
inc eax
push eax
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
jmp 0x40d2d0
push dword [ebp - 8]
push ebx
call fcn.00411b78
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
pop edi
pop esi
pop ebx
leave
ret