Function at 0x4a7700
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x611305
mov eax, dword fs:[0]
push eax
sub esp, 0x4f8
mov eax, dword [0x685680]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4c4], edi
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x3a8], 0xf
mov dword [ebp - 0x3ac], 0
mov byte [ebp - 0x3bc], 0
mov dword [ebp - 4], 0
push 0x103
lea eax, [ebp - 0x283]
push 0
push eax
mov dword [ebp - 0x40], 0x676f6f47
mov word [ebp - 0x28], 0x6e
mov dword [ebp - 0x2d], 0x69746163
mov dword [ebp - 0x3b], 0x68435c65
mov dword [ebp - 0x32], 0x6c707041
mov byte [ebp - 0x29], 0x6f
mov dword [ebp - 0x37], 0x656d6f72
mov byte [ebp - 0x3c], 0x6c
mov byte [ebp - 0x2e], 0x69
mov byte [ebp - 0x33], 0x5c
mov dword [ebp - 0x6a], 0x475c6572
mov dword [ebp - 0x63], 0x435c656c
mov dword [ebp - 0x55], 0x6e6f6361
mov dword [ebp - 0x6e], 0x61777466
mov dword [ebp - 0x5a], 0x424c425c
mov dword [ebp - 0x5f], 0x6d6f7268
mov word [ebp - 0x70], 0x6f53
mov byte [ebp - 0x5b], 0x65
mov word [ebp - 0x66], 0x6f6f
mov byte [ebp - 0x64], 0x67
mov byte [ebp - 0x56], 0x65
mov byte [ebp - 0x51], 0
mov byte [ebp - 0x284], 0
call fcn.005d1b40
add esp, 0xc
lea eax, [ebp - 0x284]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x103
lea eax, [ebp - 0x17b]
push 0
push eax
mov byte [ebp - 0x17c], 0
call fcn.005d1b40
add esp, 0xc
lea eax, [ebp - 0x38b]
push 0x103
push 0
push eax
mov dword [ebp - 0x3e4], 1
mov byte [ebp - 0x38c], 0
call fcn.005d1b40
add esp, 0xc
mov dword [ebp - 0x3e0], 0x104
mov dword [ebp - 0x390], 0xf
mov dword [ebp - 0x394], 0
mov byte [ebp - 0x3a4], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x38c]
push eax
mov dword [ebp - 0x23], 0x6d6f7268
mov byte [ebp - 0x24], 0x63
mov word [ebp - 0x1f], 0x2e65
mov word [ebp - 0x1c], 0x6578
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x1d], 0x65
mov dword [ebp - 0x4f], 0x756f7365
mov dword [ebp - 0x4a], 0x2e736563
mov dword [ebp - 0x46], 0x6b6170
mov byte [ebp - 0x4b], 0x72
mov byte [ebp - 0x50], 0x72
lea eax, [ebp - 0x3e4]
push eax
push str.version
lea eax, [ebp - 0x70]
push eax
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4a7903
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x3a4]
call fcn.00403950
jmp 0x4a7953
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x284]
push eax
push str._s_s_s
lea eax, [ebp - 0x17c]
push 0x104
push eax
call fcn.005ce01a
add esp, 0x18
lea edx, [ebp - 0x17c]
lea ecx, [ebp - 0x42c]
call fcn.004a6860
push eax
lea ecx, [ebp - 0x3a4]
call fcn.0040d290
lea ecx, [ebp - 0x42c]
call fcn.00401720
cmp dword [ebp - 0x394], 0
jne 0x4a7985
lea eax, [ebp - 0x3bc]
push eax
mov ecx, edi
call fcn.00416e70
lea ecx, [ebp - 0x3a4]
call fcn.00401720
lea ecx, [ebp - 0x3bc]
call fcn.00401720
jmp 0x4a7f79
cmp dword [ebp - 0x390], 0x10
lea ecx, [ebp - 0x50]
push ecx
lea eax, [ebp - 0x3a4]
cmovae eax, dword [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x284]
push eax
push str._s_s_s_s
lea eax, [ebp - 0x17c]
push 0x104
push eax
call fcn.005ce01a
add esp, 0x1c
lea eax, [ebp - 0x17c]
push eax
call dword [0x6905e0]
test eax, eax
je 0x4a795c
mov dword [ebp - 0x44c], 0xf
mov dword [ebp - 0x450], 0
mov byte [ebp - 0x460], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
sub esp, 0x18
lea eax, [ebp - 0x17c]
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.004034d0
lea ecx, [ebp - 0x460]
call fcn.004adb90
push 0
push 0
mov dword [ebp - 0x4bc], 0
call fcn.004acc60
mov dword [ebp - 0x4c0], eax
lea eax, [ebp - 0x4c0]
push eax
push ecx
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 3
call fcn.004add20
xor bh, bh
xor bl, bl
mov byte [ebp - 0x4ae], bl
mov byte [ebp - 0x4ad], bh
mov dword [ebp - 0x3c8], 0xf
mov dword [ebp - 0x3cc], 0
mov byte [ebp - 0x3dc], bh
cmp dword [ebp - 0x4bc], 1
jbe 0x4a7c83
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0
call fcn.0042b1e0
lea eax, [ebp - 0x4b8]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004a74e0
test al, al
jne 0x4a7b1d
lea eax, [ebp - 0x3bc]
push eax
mov ecx, edi
call fcn.00416e70
lea ecx, [ebp - 0x4b8]
call fcn.0042efd0
push dword [ebp - 0x4b8]
call fcn.004b9997
add esp, 4
lea ecx, [ebp - 0x3dc]
call fcn.00401720
lea ecx, [ebp - 0x4c0]
call fcn.004acc10
push dword [ebp - 0x4c0]
call fcn.004b9997
add esp, 4
lea ecx, [ebp - 0x460]
call fcn.004adb10
jmp 0x4a796a
push 0x6879e4
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x4b8]
call fcn.00427370
mov eax, dword [eax]
cmp dword [ebp - 0x4b8], eax
je 0x4a7bc3
lea ecx, [eax + 0x20]
call fcn.0044a350
push eax
lea ecx, [ebp - 0x3c4]
call fcn.0042ffa0
push 0x687dd4
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 7
call fcn.00427370
mov eax, dword [eax]
cmp dword [ebp - 0x3c4], eax
je 0x4a7ba6
lea ecx, [eax + 0x20]
call fcn.0044a410
mov al, byte [eax]
lea ecx, [ebp - 0x4af]
mov byte [ebp - 0x4af], al
call fcn.00403c60
mov bl, byte [eax]
mov bh, 1
mov byte [ebp - 0x4ae], bl
mov byte [ebp - 0x4ad], bh
lea ecx, [ebp - 0x3c4]
mov byte [ebp - 4], 6
call fcn.0042efd0
push dword [ebp - 0x3c4]
call fcn.004b9997
add esp, 4
push 0x687abc
lea ecx, [ebp - 0x4b8]
call fcn.004274e0
mov ecx, eax
call fcn.004335a0
push 0x6879fc
mov ecx, eax
call fcn.004274e0
mov ecx, eax
call fcn.004335a0
push 0x6879e4
mov ecx, eax
call fcn.004274e0
mov ecx, eax
call fcn.004335a0
push 0x687dd4
mov ecx, eax
call fcn.004274e0
mov ecx, eax
call fcn.004339b0
push eax
lea ecx, [ebp - 0x42c]
call fcn.00403450
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00403c60
lea ecx, [ebp - 0x3dc]
cmp ecx, eax
je 0x4a7c3e
push 0xffffffffffffffff
push 0
push eax
call fcn.00403720
lea ecx, [ebp - 0x42c]
call fcn.00401720
lea ecx, [ebp - 0x4b8]
call fcn.0042efd0
push dword [ebp - 0x4b8]
call fcn.004b9997
add esp, 4
jmp 0x4a7c7c
mov dword [ebp - 4], 4
mov dword [ebp - 0x438], 1
mov dword [ebp - method.base::Value.virtual_0], vtable.base::FundamentalValue.0
mov byte [ebp - 0x434], bl
xor ecx, ecx
lea eax, [ebp - 0x43c]
test bh, bh
cmove eax, ecx
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x400], 0xf
mov dword [ebp - 0x404], ecx
mov byte [ebp - 0x414], cl
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0xb
call fcn.004b0f30
mov dword [ebp - 0x3e8], 0xf
mov dword [ebp - 0x3ec], 0
mov byte [ebp - 0x3fc], 0
mov byte [ebp - 4], 0xc
mov ebx, dword [ebp - 0x4c0]
mov esi, dword [ebx]
cmp esi, ebx
je 0x4a7e5e
push dword [esi + 0x10]
lea ecx, [ebp - 0x4e0]
push dword [esi + 0xc]
mov dword [ebp - 0x4cc], 0xf
mov dword [ebp - 0x4d0], 0
mov byte [ebp - 0x4e0], 0
call fcn.00403850
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x3bc]
call fcn.0040d290
lea ecx, [ebp - 0x4e0]
call fcn.00401720
cmp dword [ebp - 0x3cc], 0
je 0x4a7e48
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.004b17c0
push 0x650fe0
mov edx, 0x6879e4
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0xd
call fcn.0041b8e0
add esp, 4
push 0x687dd4
mov edx, eax
lea ecx, [ebp - 0x4e0]
mov byte [ebp - 4], 0xe
call fcn.00433c50
add esp, 4
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x42c]
push eax
mov byte [ebp - 4], 0xf
call fcn.004b18c0
lea ecx, [ebp - 0x4e0]
call fcn.00401720
lea ecx, [ebp - 0x4fc]
mov byte [ebp - 4], 0x12
call fcn.00401720
lea edx, [ebp - 0x3dc]
lea ecx, [ebp - 0x42c]
call fcn.00433ba0
test al, al
jne 0x4a7e1a
lea ecx, [ebp - 0x42c]
call fcn.00401720
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0xc
call fcn.004b1850
mov esi, dword [esi]
cmp esi, ebx
jne 0x4a7d04
jmp 0x4a7e5e
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x3fc]
call fcn.00403720
lea ecx, [ebp - 0x42c]
call fcn.00401720
lea ecx, [ebp - 0x4ac]
call fcn.004b1850
jmp 0x4a7e5e
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x3fc]
call fcn.00403720
lea eax, [ebp - 0x3fc]
push eax
mov ecx, edi
call fcn.00416e70
cmp dword [ebp - 0x3e8], 0x10
jb 0x4a7e83
push dword [ebp - 0x3fc]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x400], 0x10
mov dword [ebp - 0x3e8], 0xf
mov dword [ebp - 0x3ec], 0
mov byte [ebp - 0x3fc], 0
jb 0x4a7eb5
push dword [ebp - 0x414]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x3c8], 0x10
mov dword [ebp - 0x400], 0xf
mov dword [ebp - 0x404], 0
mov byte [ebp - 0x414], 0
mov dword [ebp - method.base::Value.virtual_0], vtable.base::Value.0
jb 0x4a7ef1
push dword [ebp - 0x3dc]
call fcn.004b9997
add esp, 4
lea ecx, [ebp - 0x4c0]
mov dword [ebp - 0x3c8], 0xf
mov dword [ebp - 0x3cc], 0
mov byte [ebp - 0x3dc], 0
call fcn.004acc10
push dword [ebp - 0x4c0]
call fcn.004b9997
add esp, 4
lea ecx, [ebp - 0x460]
call fcn.004adb10
cmp dword [ebp - 0x390], 0x10
jb 0x4a7f47
push dword [ebp - 0x3a4]
call fcn.004b9997
add esp, 4
cmp dword [ebp - 0x3a8], 0x10
mov dword [ebp - 0x390], 0xf
mov dword [ebp - 0x394], 0
mov byte [ebp - 0x3a4], 0
jb 0x4a7f79
push dword [ebp - 0x3bc]
call fcn.004b9997
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005cd355
mov esp, ebp
pop ebp
ret 4