Function at 0x401317
Capabilities:
Enumerate files on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x416060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x40138c
cmp byte [section..data], bl
mov ecx, str.Endicia_for_Windows
mov eax, str.Stamps.com
cmove eax, ecx
push eax
lea eax, [ebp - 0x308]
push str._s_setup_cannot_complete_due_to_incompatibilities_with_the_version_of_COM_on_this_computer.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
cmp byte [section..data], bl
mov ecx, str.Endicia_for_Windows_Installation
push 0x30
mov eax, str.Stamps.com_Installation
cmove eax, ecx
push eax
lea eax, [ebp - 0x308]
push eax
push ebx
call fcn.004012a3
xor eax, eax
add esp, 0x1c
inc eax
jmp 0x4019d5
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x108]
push esi
push eax
mov edi, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4013ac
sub ecx, edx
cmp byte [0x41693d], bl
je 0x4013f9
push str.cdo.dll
lea eax, [ebp - 0x108]
mov byte [ebp + ecx - 0x108], bl
push esi
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x4013f9
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
cmp byte [section..data], bl
lea eax, [ebp - 0x30c]
push eax
push 0x20019
mov ecx, str.SOFTWAREEndiciaIPostage
mov eax, str.SOFTWAREStamps.comIPostage
push ebx
cmove eax, ecx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019cb
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], esi
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x318]
push eax
push ebx
push str.PATH
push dword [ebp - 0x30c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x30c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4019cb
lea ebx, [ebp - 0x108]
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x401479
push 0x40f230
lea eax, [ebp - 0x108]
sub ebx, ecx
push 0x104
push eax
mov dword [ebp - 0x310], ebx
call fcn.0040517a
lea esi, [ebp - 0x108]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4014aa
xor ebx, ebx
sub esi, ecx
cmp byte [0x416938], bl
je 0x401618
push dword [ebx + 0x40f1c0]
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x4014fb
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
xor edi, edi
pop ecx
inc edi
add ebx, 4
mov byte [ebp + esi - 0x108], 0
cmp ebx, 0x18
jb 0x4014c1
mov ebx, dword [ebp - 0x310]
lea eax, [ebp - 0x108]
mov byte [ebp + ebx - 0x108], 0
cmp byte [0x416942], 0
je 0x4015e0
push 0x40f230
mov ebx, 0x104
push ebx
push eax
call fcn.0040517a
lea esi, [ebp - 0x108]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401549
push str.abp.dll
lea eax, [ebp - 0x108]
sub esi, ecx
push ebx
push eax
call fcn.0040517a
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4019c1
lea eax, [ebp - 0x21c]
mov byte [ebp + esi - 0x108], 0
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x4015c9
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
xor edi, edi
pop ecx
inc edi
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401586
jmp 0x4019c1
push str._nativeabp.dll
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x4019b9
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
jmp 0x4019b5
push dword [ebx + 0x40f1c0]
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x401652
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
add ebx, 4
mov byte [ebp + esi - 0x108], 0
cmp ebx, 0x18
jb 0x401618
mov ebx, dword [ebp - 0x310]
lea eax, [ebp - 0x108]
push 0x40f230
push 0x104
push eax
mov byte [ebp + ebx - 0x108], 0
call fcn.0040517a
lea esi, [ebp - 0x108]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401692
sub esi, ecx
cmp byte [0x41693e], al
je 0x4016e4
push str.msol2kpi.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x4016dc
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
cmp byte [0x416939], 0
je 0x40172e
push str.mswd2kpi.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x401726
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
cmp byte [0x41693a], 0
je 0x401778
push str.mswd2kpi.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x401770
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
cmp byte [0x41693b], 0
je 0x401807
push str.mswd2k3pi.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x4017be
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
push str.StampsDotCom.ocx
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x4017ff
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
cmp byte [0x41693c], 0
je 0x401896
push str.mswd2k3pi.dll
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x40184d
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
xor edi, edi
pop ecx
inc edi
push str.StampsDotCom.ocx
lea eax, [ebp - 0x108]
mov byte [ebp + esi - 0x108], 0
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.00401a98
add esp, 0x10
test al, al
jne 0x40188e
lea eax, [ebp - 0x108]
push eax
call fcn.00401072
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
mov byte [ebp + ebx - 0x108], 0
lea eax, [ebp - 0x108]
cmp byte [0x416941], 0
je 0x401986
push 0x40f230
mov ebx, 0x104
push ebx
push eax
call fcn.0040517a
lea esi, [ebp - 0x108]
add esp, 0xc
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4018ce
push str.abp.dll
lea eax, [ebp - 0x108]
sub esi, ecx
push ebx
push eax
call fcn.0040517a
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40195e
lea eax, [ebp - 0x21c]
mov byte [ebp + esi - 0x108], 0
push eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x40194a
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
lea eax, [ebp - 0x248]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401907
jmp 0x4019c1
cmp byte [section..data], 0
mov ecx, str.Endicia_for_Windows_Installation
push 0x30
mov eax, str.Stamps.com_Installation
cmove eax, ecx
push eax
push str.Stamps.com_setup_cannot_locate_contact_list_providers__your_installation_may_be_incomplete.
push 0
call fcn.004012a3
add esp, 0x10
jmp 0x4019c1
push str._nativeabp.dll
push 0x104
push eax
call fcn.0040517a
lea eax, [ebp - 0x108]
push eax
call fcn.004019e2
add esp, 0x10
test al, al
jne 0x4019b9
lea eax, [ebp - 0x108]
push eax
call fcn.00401000
xor edi, edi
pop ecx
inc edi
mov byte [ebp + esi - 0x108], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
jmp 0x4019d3
call fcn.004010e4
xor eax, eax
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401f13
leave
ret