Function at 0x410cc0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x48602c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x460], ecx
cmp dword [ebp + 8], 0
je 0x410ce5
cmp dword [ebp + 0xc], 0
jne 0x410cec
xor eax, eax
jmp 0x411003
mov eax, dword [ebp - 0x460]
cmp dword [eax], 0
je 0x410d40
mov ecx, dword [ebp - 0x460]
add ecx, 0x108
push ecx
call sub.MSVCR80.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x410d18
xor eax, eax
jmp 0x411003
mov edx, dword [ebp - 0x460]
add edx, 0x108
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR80.dll_strcpy_s]
add esp, 0xc
mov eax, 1
jmp 0x411003
lea edx, [ebp - 0x244]
push edx
push 1
push 0
push str.SYSTEMSetup
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x410d71
xor eax, eax
jmp 0x411003
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x250], 0x104
mov dword [ebp - 0x240], 0
xor eax, eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x21c], 0x20
mov word [ebp - 0x458], 0
push 0x206
push 0
lea ecx, [ebp - 0x456]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [ebp - 0x210]
push ecx
push str.._c:
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x20000080
push 3
push 0
push 3
push bind
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x410efc
push 0
lea ecx, [ebp - 0x248]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
lea eax, [ebp - 0x240]
push eax
push 0
push 0
push 0x560000
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x410efc
mov edx, dword [ebp - 0x238]
push edx
push 0x104
lea eax, [ebp - 0x458]
push eax
call fcn.0043c4f0
add esp, 0xc
test eax, eax
je 0x410efc
push 0x104
lea ecx, [ebp - 0x458]
push ecx
mov edx, dword [ebp - 0x460]
add edx, 4
push edx
call dword [sym.imp.MSVCR80.dll_wcstombs]
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x410efa
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x214], 0xffffffff
jmp 0x410f2e
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 0x460]
add edx, 4
push edx
lea eax, [ebp - 0x45c]
push eax
push 0
push str.SystemPartition
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
je 0x410f4b
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x411003
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 0x218]
and ecx, 0x3e8
push ecx
push str.._systmp_d
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x460]
add eax, 0x108
push eax
call dword [sym.imp.MSVCR80.dll_sprintf_s]
add esp, 0x10
mov ecx, dword [ebp - 0x460]
add ecx, 4
push ecx
mov edx, dword [ebp - 0x460]
add edx, 0x10c
push edx
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
test eax, eax
jne 0x410fb6
xor eax, eax
jmp 0x411003
mov eax, dword [ebp - 0x460]
mov dword [eax], 1
mov ecx, dword [ebp - 0x460]
add ecx, 0x108
push ecx
call sub.MSVCR80.dll_strlen
add esp, 4
cmp dword [ebp + 0xc], eax
jae 0x410fe0
xor eax, eax
jmp 0x411003
mov edx, dword [ebp - 0x460]
add edx, 0x108
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR80.dll_strcpy_s]
add esp, 0xc
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret 8