Function at 0x40c53c
Capabilities:
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x16]
lea esi, str._TEMP_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x19]
lea esi, [0x42159f]
mov ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x27]
lea esi, str._TEMP_UNIQUE_
mov ecx, 7
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x2d]
lea esi, str._WIN_
mov ecx, 3
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x4f]
lea esi, str._WINSYS_
mov ecx, 9
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x46]
lea esi, str._DOCS_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xf]
lea esi, str._PROG_
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x35]
lea esi, str._FONTS_
mov ecx, 2
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x3f]
lea esi, str._DESKTOP_
mov ecx, 5
rep movsw word es:[edi], word [esi]
lea edi, [ebp - 0x52]
lea esi, [0x4215df]
mov ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x100
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 8], eax
push 0x100
call sub.CRTDLL.DLL_malloc
mov dword [ebp - 4], eax
mov dword [ebp - 0x58], 0x100
push ebx
push dword [ebp - 8]
call fcn.00411ab4
push ebx
call sub.CRTDLL.DLL__strupr
add esp, 0xc
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c626
cmp eax, 0
jne 0x40c642
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40ce95
lea eax, [ebp - 0xf]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c6e6
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.00411ab4
push dword [ebp - 4]
call sub.CRTDLL.DLL__strupr
add esp, 4
push 0x421631
push ebx
call fcn.00411ab4
lea eax, [ebp - 0xf]
push eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_strstr
add esp, 8
push 0x5c
mov edi, eax
inc edi
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
or eax, eax
je 0x40c6da
push 0x42162f
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
lea eax, [ebp - 0xf]
push eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_strstr
add esp, 8
push 0x5c
mov edi, eax
sub edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea edi, [edi + esi + 1]
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
mov edi, eax
inc edi
push edi
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push ebx
call fcn.0040c53c
pop ecx
jmp 0x40ce95
lea eax, [ebp - 0x16]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c763
push dword [ebp - 4]
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c70c
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c72d
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x16]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40c755
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
lea eax, [ebp - 0x19]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c7e0
push dword [ebp - 4]
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c789
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c7aa
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x19]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40c7d2
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
lea eax, [ebp - 0x27]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c886
lea eax, [ebp - 0x15c]
push eax
push 0x100
call sub.KERNEL32.DLL_GetTempPathA
push dword [ebp - 4]
push 0
push 0x421629
lea eax, [ebp - 0x15c]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
push dword [ebp - 4]
call sub.CRTDLL.DLL_remove
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c82f
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c850
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x27]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40c878
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
push 0x421627
push ebx
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40c8a8
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40ce95
lea eax, [ebp - 0x2d]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c925
push 0x100
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c8ce
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c8ef
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x2d]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40c917
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
lea eax, [ebp - 0x35]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40c9cb
lea eax, [ebp - 0x160]
push eax
push 0x14
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40c9bb
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40c964
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40c985
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x35]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40c9ad
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40ce95
lea eax, [ebp - 0x3f]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40ca71
lea eax, [ebp - 0x160]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40ca61
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ca0a
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40ca2b
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x3f]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40ca53
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40ce95
lea eax, [ebp - 0x46]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cb17
lea eax, [ebp - 0x160]
push eax
push 5
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
or eax, eax
jne 0x40cb07
push dword [ebp - 4]
push dword [ebp - 0x160]
call sub.SHELL32.DLL_SHGetPathFromIDListA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cab0
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cad1
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x46]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40caf9
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
jmp 0x40ce95
lea eax, [ebp - 0x4f]
push eax
push ebx
call sub.CRTDLL.DLL_strstr
add esp, 8
or eax, eax
je 0x40cb94
push 0x100
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetSystemDirectoryA
mov eax, dword [ebp - 4]
mov ecx, eax
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cb3d
mov edx, dword [ebp - 4]
cmp byte [eax + edx - 1], 0x5c
je 0x40cb5e
push 0x42162d
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 1
push 0x100
push dword [ebp - 4]
lea eax, [ebp - 0x4f]
push eax
push dword [ebp - 8]
call fcn.00410af4
add esp, 0x14
or eax, eax
jle 0x40cb86
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00411ab4
push dword [ebp - 8]
push ebx
call fcn.00411ab4
jmp 0x40ce95
push 2
lea eax, [ebp - 0x52]
push eax
push ebx
call sub.CRTDLL.DLL_memcmp
add esp, 0xc
or eax, eax
jne 0x40ce8c
push 0x7c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
or eax, eax
je 0x40cbd4
mov dword [ebp - 0x168], 1
push 0x7c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov byte [eax], 0
jmp 0x40cbde
mov dword [ebp - 0x168], 0
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
add esp, 8
or eax, eax
jne 0x40cc13
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
jmp 0x40cea8
push ebx
push dword [ebp - 4]
call fcn.00411ab4
push 0x5c
push dword [ebp - 4]
call sub.CRTDLL.DLL_strchr
mov byte [eax], 0
push str.HKCU
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 0x10
or eax, eax
je 0x40cc51
push str.HKEY_CURRENT_USER
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40cc5d
mov dword [ebp - 0x164], 0x80000001
jmp 0x40cccf
push str.HKLM
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
je 0x40cc85
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40cc91
mov dword [ebp - 0x164], 0x80000002
jmp 0x40cccf
push 0x4215f4
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
je 0x40ccb9
push str.HKEY_USERS
push dword [ebp - 4]
call sub.CRTDLL.DLL_strcmp
add esp, 8
or eax, eax
jne 0x40ccc5
mov dword [ebp - 0x164], 0x80000003
jmp 0x40cccf
mov dword [ebp - 0x164], 0x80000003
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
push 0x5c
mov edi, eax
inc edi
push edi
call sub.CRTDLL.DLL_strchr
add esp, 0x10
or eax, eax
jne 0x40cd0f
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
jmp 0x40cea8
push 0x5c
push ebx
call sub.CRTDLL.DLL_strchr
mov edi, eax
inc edi
push edi
push dword [ebp - 4]
call fcn.00411ab4
push 0x5c
push dword [ebp - 4]
call sub.CRTDLL.DLL_strrchr
add esp, 0x10
mov byte [eax], 0
lea eax, [ebp - 0x164]
push eax
push 0x20019
push 0
push dword [ebp - 4]
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegOpenKeyExA
or eax, eax
jne 0x40cdb8
push 0x5c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
lea edi, [ebp - 0x58]
push edi
push ebx
push 0
push 0
mov edi, eax
inc edi
push edi
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegQueryValueExA
or eax, eax
je 0x40cdab
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 4
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40cea8
push dword [ebp - 0x164]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40cddb
push ebx
push 0x100
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
jmp 0x40cea8
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40cde0
push str..exe
lea eax, [eax + ebx - 4]
push eax
call sub.CRTDLL.DLL__stricmp
add esp, 8
cmp eax, 0
jne 0x40ce2b
push ebx
call fcn.00411088
add esp, 4
cmp eax, 0
je 0x40ce2b
push 0x5c
push ebx
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x16c], eax
cmp eax, 0
je 0x40ce2b
mov eax, dword [ebp - 0x16c]
mov byte [eax], 0
cmp dword [ebp - 0x168], 0
je 0x40ce77
mov ecx, ebx
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x40ce39
cmp byte [eax + ebx - 1], 0x5c
je 0x40ce55
push 0x42162d
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x7c
push dword [ebp - 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x16c], eax
or eax, eax
je 0x40ce77
inc eax
push eax
push ebx
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
jmp 0x40cea8
push dword [ebp - 8]
push ebx
call fcn.00411ab4
push dword [ebp - 8]
call sub.CRTDLL.DLL_free
push dword [ebp - 4]
call sub.CRTDLL.DLL_free
add esp, 8
pop edi
pop esi
pop ebx
leave
ret