Function at 0x403dd0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x41c4d8
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41ccd8
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov edx, 0x41d4d8
mov ecx, 0x800
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 2
push 0x4118d2
push ebx
call fcn.004028f0
add esp, 0xc
mov ecx, 0x41ccd8
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403e30
pop eax
push 3
push 0x4118d2
push ebx
call fcn.004028f0
add esp, 0xc
mov ecx, 0x41d4d8
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403e55
pop eax
push 0x411898
push 0x41ccd8
call fcn.00401260
add esp, 8
test eax, eax
je 0x404671
push 0x41ccd8
call fcn.00401650
pop ecx
push str.APPDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403eda
mov edx, 0x41300c
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
call fcn.00401850
mov ecx, 0x41300c
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403eba
pop eax
push 0x41300c
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.BROWSEFORFOLDER
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403f80
mov edx, 0x413110
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
jmp 0x403f69
push 0
push 0x40
push str.Please_select_or_create_the_folder_where_you_would_like_to_extract_the_files_packed_in_this_executable.
call fcn.004027a0
add esp, 0xc
mov ecx, 0x413110
mov edx, eax
push ecx
sub ecx, edx
mov al, byte [edx]
mov byte [ecx + edx], al
inc edx
test al, al
jne 0x403f2c
pop eax
push 0x413110
call fcn.004013c0
pop ecx
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x403f47
test eax, eax
jne 0x403f5a
push 0x1c
call fcn.00405090
pop ecx
push 0x413110
call fcn.00401a80
pop ecx
test eax, eax
jne 0x403f6b
jmp 0x403f11
push 0x413110
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.CURDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x403fd8
mov eax, 0x413214
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413214
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push 0x413214
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.DESKTOP
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404032
mov eax, 0x413318
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413318
push str.Desktop
call fcn.004047f0
add esp, 8
push 0x413318
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.DOCUMENTS
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40408c
mov eax, 0x41341c
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x41341c
push str.Personal
call fcn.004047f0
add esp, 8
push 0x41341c
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.FAVORITES
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4040e6
mov eax, 0x413520
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413520
push str.Favorites
call fcn.004047f0
add esp, 8
push 0x413520
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.FONTS
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404140
mov eax, 0x413624
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413624
push str.Fonts
call fcn.004047f0
add esp, 8
push 0x413624
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.LOCALSETTINGS
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40419a
mov eax, 0x413728
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413728
push str.Local_Settings
call fcn.004047f0
add esp, 8
push 0x413728
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.MYMUSIC
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4041f4
mov eax, 0x41382c
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x41382c
push str.My_Music
call fcn.004047f0
add esp, 8
push 0x41382c
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.MYPICTUTES
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40424e
mov eax, 0x413930
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413930
push str.My_Pictures
call fcn.004047f0
add esp, 8
push 0x413930
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.MYVIDEO
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4042a8
mov eax, 0x413a34
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413a34
push str.My_Video
call fcn.004047f0
add esp, 8
push 0x413a34
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.PROGRAMFILES
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404368
mov eax, 0x413b38
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41dcd8], 0
push str.C:Program_Files
push 0x413b38
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x41dcd8
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404353
mov dword [ebp - 4], 0x104
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
push 0x413b38
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
mov eax, dword [0x41dcd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [0x41dcd8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x413b38
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.SENDTO
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4043c2
mov eax, 0x413c3c
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413c3c
push str.SendTo
call fcn.004047f0
add esp, 8
push 0x413c3c
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.STARTMENU
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40441c
mov eax, 0x413d40
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413d40
push str.Programs
call fcn.004047f0
add esp, 8
push 0x413d40
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.STARTUP
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404476
mov eax, 0x413e44
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x413e44
push str.Startup
call fcn.004047f0
add esp, 8
push 0x413e44
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.SYSDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4044ce
mov eax, 0x413f48
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x104
push 0x413f48
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x413f48
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.TEMPDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404526
mov eax, 0x41404c
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x41404c
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x41404c
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.WINDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x40457e
mov eax, 0x414150
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x104
push 0x414150
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0x414150
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.QUICKLAUNCH
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x4045f4
mov eax, 0x414254
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x414254
push str.AppData
call fcn.004047f0
add esp, 8
push 0x414254
call fcn.0040a4d0
pop ecx
test eax, eax
je 0x4045e2
push str.MicrosoftInternet_ExplorerQuick_Launch
push 0x414254
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x414254
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x404652
push 0x41ccd8
call fcn.00401650
pop ecx
push str.ROOTDIR
push eax
call fcn.00401260
add esp, 8
test eax, eax
jne 0x404652
mov eax, 0x414358
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x104
push 0x414358
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 3
push 0x414358
call fcn.004012b0
add esp, 8
push eax
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x41c4d8
call fcn.00401a80
pop ecx
test eax, eax
jne 0x404671
push 0x41c4d8
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
push 0x41d4d8
call fcn.0040a4d0
pop ecx
test eax, eax
je 0x40473a
push 1
push 0x41c4d8
call fcn.00401300
add esp, 8
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401770
add esp, 0x28
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x40472a
push 1
push 0x41d4d8
call fcn.004012b0
add esp, 8
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401770
add esp, 0x28
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x40472a
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401770
add esp, 0x28
push eax
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x41d4d8
push 0x41c4d8
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x41c4d8
call fcn.00403d30
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret