Function at 0x402db0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
lea edi, [ebp - 0x110]
xor eax, eax
mov byte [edi], al
movsx esi, al
mov ebx, dword [ebp + 8]
jmp 0x403046
cmp byte [ebx], 0x25
jne 0x40303f
cmp byte [ebx + 1], 0x25
jne 0x40303f
cmp byte [ebx + 2], 0x44
jne 0x402e54
add ebx, 2
cmp byte [0x410bf0], 0
je 0x402e08
push 0x410bf0
add esi, edi
push esi
call fcn.00404710
add esp, 8
jmp 0x402e1b
mov eax, 0x104
sub eax, esi
push eax
add esi, edi
push esi
call fcn.0040966c
add esp, 8
push edi
call fcn.00406968
pop ecx
mov esi, eax
test esi, esi
jle 0x403045
mov al, byte [edi + esi - 1]
cmp al, 0x5c
je 0x403045
cmp al, 0x3a
je 0x403045
push 0x40e4e5
push edi
call fcn.004068d8
add esp, 8
inc esi
jmp 0x403045
cmp byte [ebx + 2], 0x41
jne 0x402e93
add esi, edi
add ebx, 2
push esi
push edi
xor eax, eax
or ecx, 0xffffffff
mov edi, 0x410d14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.00406968
pop ecx
mov esi, eax
jmp 0x403045
cmp byte [ebx + 2], 0x46
jne 0x402ed2
add esi, edi
add ebx, 2
push esi
push edi
xor eax, eax
or ecx, 0xffffffff
mov edi, 0x410ad8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.00406968
pop ecx
mov esi, eax
jmp 0x403045
cmp byte [ebx + 2], 0x50
jne 0x402f96
mov byte [ebp - 0x214], 0
add ebx, 2
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40e4e7
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402f30
mov dword [ebp - 0xc], 0x104
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebp - 0x214]
push ecx
lea eax, [ebp - 8]
push eax
push 0
push 0x40e511
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [ebp - 0x214]
push eax
call fcn.00406968
pop ecx
test eax, eax
je 0x402f4b
cmp byte [ebp + eax - 0x215], 0x5c
je 0x402f5f
push 0x40e521
lea edx, [ebp - 0x214]
push edx
call fcn.004068d8
add esp, 8
add esi, edi
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.00406968
pop ecx
mov esi, eax
jmp 0x403045
cmp byte [ebx + 2], 0x54
jne 0x40301a
mov byte [ebp - 0x318], 0
lea eax, [ebp - 0x318]
add ebx, 2
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
lea edx, [ebp - 0x318]
push edx
call fcn.00406968
pop ecx
test eax, eax
je 0x402fd2
cmp byte [ebp + eax - 0x319], 0x5c
je 0x402fe6
push 0x40e523
lea ecx, [ebp - 0x318]
push ecx
call fcn.004068d8
add esp, 8
add esi, edi
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x318]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push edi
call fcn.00406968
pop ecx
mov esi, eax
jmp 0x403045
cmp byte [ebx + 2], 0x22
jne 0x40303f
add ebx, 2
add esi, edi
push esi
push edi
mov edi, esi
mov esi, 0x40e525
mov eax, edi
movsw word es:[edi], word [esi]
pop edi
pop esi
push edi
call fcn.00406968
pop ecx
mov esi, eax
jmp 0x403045
mov al, byte [ebx]
mov byte [edi + esi], al
inc esi
inc ebx
cmp byte [ebx], 0
jne 0x402dd1
mov byte [edi + esi], 0
xor eax, eax
mov edx, dword [ebp + 8]
push edi
or ecx, 0xffffffff
mov esi, edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret