Function at 0x438960
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444878
push 0x43e794
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4b4
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x4c4], ecx
xor ebx, ebx
mov byte [ebp - 0x124], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
lea eax, [ebp - 0x124]
mov edx, 0x47bbe8
lea ecx, [ebp - 0x124]
sub edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x4389ce
mov byte [eax], cl
inc eax
dec esi
jne 0x4389c1
cmp esi, ebx
jne 0x4389d3
dec eax
mov byte [eax], bl
mov dword [ebp - 0x128], ebx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x124]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x438a0a
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x448], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x447]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x330], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x32f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x104
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x334], esi
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x330]
push edx
lea ecx, [ebp - 0x340]
push ecx
push ebx
lea edx, [ebp - 0x344]
push edx
lea ecx, [ebp - 0x448]
push ecx
push eax
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x438ca1
cmp eax, ebx
jne 0x438ca1
mov byte [ebp - 0x22c], bl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x22b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
cmp edi, ebx
je 0x438ca1
mov ecx, esi
sub ecx, edi
cmp ecx, 0x7fffffff
ja 0x438b3e
mov edx, ecx
lea eax, [ebp - 0x22c]
xor esi, esi
cmp ecx, ebx
je 0x438aeb
cmp byte [eax], bl
je 0x438aeb
inc eax
dec edx
jne 0x438ae3
cmp edx, ebx
jne 0x438af4
mov esi, 0x80070057
cmp esi, ebx
jl 0x438b0e
lea eax, [ebp - 0x468]
test eax, eax
je 0x438b0e
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x468], eax
jmp 0x438b14
mov eax, dword [ebp - 0x468]
cmp esi, ebx
jl 0x438b3e
sub ecx, eax
lea edx, [ebp + eax - 0x22c]
je 0x438b3e
mov esi, 0x44a228
sub esi, edx
mov al, byte [esi + edx]
cmp al, bl
je 0x438b37
mov byte [edx], al
inc edx
dec ecx
jne 0x438b2a
cmp ecx, ebx
jne 0x438b3c
dec edx
mov byte [edx], bl
mov ecx, 0x103
sub ecx, edi
cmp ecx, 0x7fffffff
ja 0x438bb7
mov edx, ecx
lea eax, [ebp - 0x22c]
xor esi, esi
cmp ecx, ebx
je 0x438b63
cmp byte [eax], bl
je 0x438b63
inc eax
dec edx
jne 0x438b5b
cmp edx, ebx
jne 0x438b6c
mov esi, 0x80070057
cmp esi, ebx
jl 0x438b86
lea eax, [ebp - 0x498]
test eax, eax
je 0x438b86
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x498], eax
jmp 0x438b8c
mov eax, dword [ebp - 0x498]
cmp esi, ebx
jl 0x438bb7
sub ecx, eax
lea eax, [ebp + eax - 0x22c]
je 0x438bb7
lea esi, [ebp - 0x330]
sub esi, eax
mov dl, byte [esi + eax]
cmp dl, bl
je 0x438bb0
mov byte [eax], dl
inc eax
dec ecx
jne 0x438ba3
cmp ecx, ebx
jne 0x438bb5
dec eax
mov byte [eax], bl
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00414f90
add esp, 4
test eax, eax
je 0x438a0d
lea edx, [ebp - 0x22c]
push edx
call fcn.0041e770
mov ecx, eax
call fcn.0041eb60
test eax, eax
jne 0x438a0d
push 1
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.00415170
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x44c], esi
cmp esi, ebx
je 0x438a0d
mov dword [ebp - 4], ebx
push esi
call fcn.00414750
add esp, 4
test eax, eax
je 0x438c66
lea ecx, [ebp - 0x22c]
push ecx
mov edi, dword [ebp - 0x4c4]
mov ecx, edi
call fcn.004383f0
test eax, eax
je 0x438c66
push ebx
push ebx
push esi
lea edx, [ebp - 0x22c]
push edx
mov ecx, edi
call fcn.00438190
test eax, eax
je 0x438c66
mov eax, dword [ebp + 0xc]
push eax
push 0x6b
lea ecx, [ebp - 0x22c]
push ecx
push edi
call dword [ebp + 8]
mov dword [edi + 4], 1
inc dword [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.00415210
add esp, 4
jmp 0x438a0d
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8