Function at 0x407f0a
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
mov ecx, 0x42faf0
jmp 0x407ef6
mov eax, 0x4214f0
call main
sub esp, 0x230
mov al, byte [ebp - 0x2d]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x34], esi
mov byte [esi], al
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov edi, 0x104
lea eax, [ebp - 0x138]
push edi
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, ebx
jbe 0x407fb3
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._WINDIR_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 2
call fcn.00417b2e
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 3
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 4
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
jmp 0x40802a
push str.c:windows
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._WINDIR_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 7
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 8
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 9
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x138]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
jbe 0x4080bc
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._SYSDIR_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xc
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xd
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0xe
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xf
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x408133
push str.c:windows_system32
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._SYSDIR_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x11
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x12
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x13
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x14
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x10
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebx
lea eax, [ebp - 0x138]
push 0x26
push eax
push ebx
call edi
cmp eax, ebx
je 0x4081cd
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._PROGRAMFILES_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x16
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x17
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x18
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x19
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x16
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x408269
push str._PROGRAMFILES_
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x2c]
push 2
push ecx
lea ecx, [eax + 4]
mov byte [ebp - 4], 0x1a
call sub.MFC42.DLL_CString::Left
push str.Program_Files
push eax
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x1c
call fcn.00417b2e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1d
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x1e
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1f
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1c
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x1b
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1a
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
push ebx
lea eax, [ebp - 0x138]
push 2
push eax
push ebx
call edi
cmp eax, ebx
jl 0x4082fa
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._PROGRAMS_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x20
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x21
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x22
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x23
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x24
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x21
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x20
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x408371
push str.C:Documents_and_SettingsAll_Users_
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._PROGRAMS_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x25
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x26
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x27
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x28
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x29
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x26
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x25
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
push ebx
lea eax, [ebp - 0x138]
push 0x10
push eax
push ebx
call edi
cmp eax, ebx
jl 0x408402
lea eax, [ebp - 0x138]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._DESKTOP_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2a
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x2b
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x2c
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x2d
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x2e
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x2b
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2a
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x408479
push 0x42c668
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._DESKTOP_
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2f
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x30
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x31
call fcn.00417b2e
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x32
call fcn.00408957
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x33
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x30
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x2f
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareGloballinkGameShare
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov edi, str._PROGRAMFILES_GlobalLink
jne 0x408634
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.Path
mov dword [ebp - 0x18], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x408634
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_1
push str._GLWORLDDIR_
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x34
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x35
call fcn.00417b2e
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x36
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x37
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x38
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x35
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x34
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x23c]
push eax
call sub.MSVCRT.dll_strlen
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x23c]
push str.game_share
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x14
cmp eax, ebx
je 0x4085b6
mov ecx, dword [ebp - 0x20]
lea edx, [eax + 0xb]
lea ecx, [ebp + ecx - 0x23c]
cmp edx, ecx
jne 0x4085b6
mov byte [eax], bl
lea eax, [ebp - 0x23c]
lea ecx, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::CString_1
push str._GLDIR_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x39
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x3a
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x3b
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x3c
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x3d
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3a
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x39
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
jmp 0x408723
push str._PROGRAMFILES_GlobalLinkGameShare
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._GLWORLDDIR_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x3e
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x3f
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x40
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x41
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x42
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x3f
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x3e
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_1
push str._GLDIR_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x43
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x44
call fcn.00417b2e
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x45
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x46
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x47
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x44
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x43
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
push edi
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
push str._TARGETDIR_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x48
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x49
call fcn.00417b2e
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x4a
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x4b
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x4c
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x49
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x48
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
push str._TARGETDIR_Restore
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_1
push str._GLRESTOREDIR_
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x4d
call sub.MFC42.DLL_CString::CString_1
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x4e
call fcn.00417b2e
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x4f
call fcn.00417b2e
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x50
call fcn.00408957
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x51
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x4e
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x4d
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret