Function at 0x4088cf
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0x2a0
mov eax, 0x46aa0e
call fcn.0042dc79
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x11c]
mov edi, 0x105
mov dword [ebp - 0x298], esi
push edi
xor ebx, ebx
push ebx
push eax
call fcn.0042f1f0
add esp, 0xc
mov dword [ebp - 0x25c], ebx
mov byte [ebp - 0x26c], bl
push 0xf
pop eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], eax
mov byte [ebp - 0x284], bl
mov dword [ebp - 0x294], ebx
push edi
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 2
call fcn.0040bbad
push edi
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec eax
push 0xf
pop edi
cmp eax, 0x103
ja 0x408bc6
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408977
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 6
push str.WINDIR
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 3
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x290]
push esi
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
mov esi, 0x1000
cmp eax, 0x10
jb 0x408a2e
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x28c], ecx
cmp eax, esi
jb 0x408a25
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x288]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x28c]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x408a90
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408a87
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408aab
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 7
push str.WINDOWS
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x408b62
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408b59
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x408bcb
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408bbb
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
jmp 0x408bcb
mov esi, 0x1000
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootA]
cmp eax, 1
jne 0x408d22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408c09
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 9
push str.HOMEDRIVE
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 7
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x408cc0
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408cb7
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x408d22
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408d19
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
push 0x105
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x408fa8
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408d5b
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 6
push 0x46f9bc
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 9
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x408e12
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408e09
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x408e74
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408e6b
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408e8f
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 6
push str.SYSDIR
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x408f46
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408f3d
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x408fa8
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x408f9f
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea eax, [ebp - 0x11c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x409231
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408fe1
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 3
push 0x46ff1c
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409098
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x40908f
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x4090fa
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4090f1
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409115
sub ecx, edx
lea eax, [ebp - 0x11c]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 4
push str.TEMP
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], 0xf
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x4091d0
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4091c7
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 0x23c], bl
push 0xf
pop edi
mov dword [ebp - 0x228], edi
cmp eax, 0x10
jb 0x409231
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409228
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
cmp dword [ebp - 0x294], 0
mov byte [ebp - 4], 0x11
je 0x409250
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x294], ebx
lea eax, [ebp - 0x294]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040ad25
push str.SystemRoot
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xa
push str.SYSTEMROOT
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x13
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409330
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409327
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 0x11
call fcn.004043a0
push str.SystemRoot
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xb
push str.SYSTEM_ROOT
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x15
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409408
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4093ff
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.004043a0
jmp 0x409437
cmp dword [ebp - 0x294], 0
mov dword [ebp - 4], 2
mov byte [ebp - 4], 0x17
je 0x40945d
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x294], ebx
lea eax, [ebp - 0x294]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040ad25
push str.SystemRoot
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xa
push str.SYSTEMROOT
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x19
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x40953d
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409534
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 0x17
call fcn.004043a0
push str.SystemRoot
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xb
push str.SYSTEM_ROOT
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x1b
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409615
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x40960c
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.004043a0
jmp 0x409644
cmp dword [ebp - 0x294], 0
mov dword [ebp - 4], 2
mov byte [ebp - 4], 0x1d
je 0x40966a
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x294], ebx
lea eax, [ebp - 0x294]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040ad25
push str.ProgramFilesDir
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xc
push str.PROGRAMFILES
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x1f
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x40974a
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409741
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 0x1d
call fcn.004043a0
push str.ProgramFilesDir
lea eax, [ebp - 0x254]
push eax
lea ecx, [ebp - 0x294]
call fcn.0040b3f3
mov dword [ebp - 0x28c], eax
push 0xd
push str.PROGRAM_FILES
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
push dword [ebp - 0x28c]
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 0x21
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409822
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409819
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.004043a0
jmp 0x409851
push 0x105
lea eax, [ebp - 0x224]
mov dword [ebp - 4], 2
push ebx
push eax
call fcn.0042f1f0
add esp, 0xc
lea eax, [ebp - 0x224]
push 0x104
push eax
push str._ALLUSERSPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x409ead
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4098a7
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 0xf
pop eax
push eax
push str.ALLUSERSPROFILE
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], eax
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409960
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409957
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
push 0xf
pop edi
mov dword [ebp - 0x228], edi
cmp eax, 0x10
jb 0x4099c5
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x4099bc
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4099e0
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push str.ALLUSERS_PROFILE
mov byte [ebp - 0x28c], bl
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
mov byte [ebp - 4], 0x25
push 0x10
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404120
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409aa3
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409a9a
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x409b05
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409afc
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409b20
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push str.ALL_USERS_PROFILE
mov byte [ebp - 0x28c], bl
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
mov byte [ebp - 4], 0x27
push 0x11
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404120
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409be3
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409bda
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x409c45
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409c3c
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409c60
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 9
push str.ALL_USERS
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409d17
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409d0e
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x409d79
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409d70
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
lea edx, [ecx + 1]
mov byte [ebp - 0x254], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409d94
sub ecx, edx
lea eax, [ebp - 0x224]
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00404230
push 8
push str.ALLUSERS
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
call fcn.00404230
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x228]
add esp, 0x10
cmp eax, 0x10
jb 0x409e4b
mov ecx, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409e42
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x23c], bl
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x409ead
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409ea4
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
cmp dword [ebp - 0x258], 0x10
lea eax, [ebp - 0x26c]
push SysReAllocString
cmovae eax, dword [ebp - 0x26c]
push eax
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40a00c
push 0xb
push str.USERPROFILE
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
mov byte [ebp - 0x254], bl
call fcn.00404230
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x240]
add esp, 0x10
mov byte [ebp - 4], 2
cmp eax, 0x10
jb 0x409f75
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x409f6c
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
push 0xc
push str.USER_PROFILE
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
mov byte [ebp - 0x254], bl
call fcn.00404230
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x290]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x240]
add esp, 0x10
cmp eax, 0x10
jb 0x40a00c
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, esi
jb 0x40a003
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0x2f
push eax
call fcn.0040a8ad
mov eax, dword [ebp - 0x2a0]
mov esi, dword [ebp - 0x2a4]
mov dword [ebp - 0x28c], eax
pop ecx
cmp esi, eax
je 0x40a102
push 6
push str.DRIVES
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], edi
mov byte [ebp - 0x254], bl
call fcn.00404230
push esi
lea eax, [ebp - 0x254]
mov byte [ebp - 4], 0x30
push eax
push dword [ebp - 0x298]
lea eax, [ebp - 0x2ac]
push eax
call fcn.0040a6be
mov eax, dword [ebp - 0x240]
add esp, 0x10
mov byte [ebp - 4], 0x2f
cmp eax, 0x10
jb 0x40a0e1
mov ecx, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x40a0d8
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
mov eax, dword [ebp - 0x2a0]
push 0x18
pop ecx
add esi, ecx
mov dword [ebp - 0x28c], eax
cmp esi, eax
jne 0x40a049
mov esi, dword [ebp - 0x2a4]
jmp 0x40a105
push 0x18
pop ecx
test esi, esi
je 0x40a186
cmp esi, eax
je 0x40a129
mov edi, dword [ebp - 0x28c]
mov ecx, esi
call fcn.004043a0
push 0x18
pop ecx
add esi, ecx
cmp esi, edi
jne 0x40a113
mov esi, dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x29c]
sub eax, esi
mov dword [ebp - 0x288], esi
cdq
idiv ecx
imul eax, eax, 0x18
mov dword [ebp - 0x28c], eax
cmp eax, 0x1000
jb 0x40a16b
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
mov esi, dword [ebp - 0x288]
pop ecx
pop ecx
push eax
push esi
call fcn.0042d727
pop ecx
pop ecx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
cmp dword [ebp - 0x294], 0
je 0x40a1a1
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x294], ebx
mov eax, dword [ebp - 0x258]
cmp eax, 0x10
jb 0x40a1f0
mov ecx, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], ecx
cmp eax, 0x1000
jb 0x40a1e7
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x28c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x288]
push eax
push ecx
call fcn.0042d727
pop ecx
pop ecx
call fcn.0042dbc6
ret