Function at 0x42e790
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cced9
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x528f34]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x448], ecx
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::Empty_void_
xor ebx, ebx
cmp esi, ebx
je 0x42edb5
mov esi, dword [edi]
cmp esi, ebx
je 0x42edb5
mov dword [ebp - 0x424], ebx
lea eax, [ebp - 0x434]
push str.DirInfo
push eax
mov dword [ebp - 4], ebx
call fcn.0042ced0
add esp, 8
mov edi, dword [esi]
lea ecx, [ebp - 0x424]
push ecx
mov ecx, eax
mov byte [ebp - 4], 1
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
mov edx, dword [edi + 0x120]
push eax
push esi
call edx
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], bl
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov eax, dword [ebp - 0x424]
cmp eax, ebx
je 0x42edb5
lea edx, [ebp - 0x458]
mov dword [ebp - 0x458], ebx
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x60]
call eax
cmp dword [ebp - 0x458], 1
jb 0x42ed9c
mov dword [ebp - 0x42c], ebx
mov eax, dword [ebp - 0x424]
mov ecx, dword [eax]
lea edx, [ebp - 0x42c]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x1ac]
mov byte [ebp - 4], 2
call eax
mov eax, dword [ebp - 0x42c]
cmp eax, ebx
je 0x42ed9c
mov dword [ebp - 0x430], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x430]
push edx
mov edx, dword [ebp - 0x444]
push edx
push eax
mov eax, dword [ecx + 0x120]
mov byte [ebp - 4], 3
call eax
mov eax, dword [ebp - 0x430]
cmp eax, ebx
je 0x42ed87
mov dword [ebp - 0x428], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x428]
push edx
push ebx
push eax
mov eax, dword [ecx + 0x1ac]
mov byte [ebp - 4], 4
call eax
mov esi, dword [ebp - 0x428]
cmp esi, ebx
je 0x42ed71
lea eax, [ebp - 0x434]
push str.DirType
push eax
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x44c], ebx
call fcn.0042ced0
add esp, 8
mov edi, dword [esi]
lea ecx, [ebp - 0x44c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
mov edx, dword [edi + 0x40]
push eax
push esi
call edx
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov eax, dword [ebp - 0x44c]
cmp eax, ebx
je 0x42ed5b
lea ecx, [ebp - 0x454]
push ecx
push eax
call sym.QQProtectUpd.exe_bool___cdecl_Util::Convert::StringToIntW_wchar_t_const___int__
mov eax, dword [ebp - 0x454]
add esp, 8
cmp eax, 1
je 0x42e999
cmp eax, 2
je 0x42eac3
cmp eax, 3
je 0x42ecdc
mov eax, dword [ebp - 0x428]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x42ed71
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
jmp 0x42ed71
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov word [ebp - 0x218], bx
call sub.MSVCR80.dll_memset
mov esi, dword [ebp - 0x428]
lea ecx, [ebp - 0x434]
push str.CSIDL
push ecx
call fcn.0042ced0
add esp, 0x14
mov edi, dword [esi]
lea edx, [ebp - 0x43c]
push edx
mov ecx, eax
mov byte [ebp - 4], 6
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
push eax
mov eax, dword [edi + 0x40]
push esi
call eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov eax, dword [ebp - 0x43c]
cmp eax, ebx
je 0x42ed5b
lea ecx, [ebp - 0x440]
push ecx
push eax
call sym.QQProtectUpd.exe_bool___cdecl_Util::Convert::StringToIntW_wchar_t_const___int__
mov edx, dword [ebp - 0x440]
add esp, 8
push 1
push edx
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42ed5b
mov esi, dword [ebp - 0x448]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, esi
call sym.QQProtectUpd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
push 0x4fed54
mov ecx, esi
call sym.QQProtectUpd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
mov eax, dword [ebp - 0x428]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x42ea75
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [ebp - 0x430]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x42ea8b
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x42c]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x42eaa0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x424]
cmp eax, ebx
mov dword [ebp - 4], 0xffffffff
je 0x42eab9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 1
jmp 0x42edb7
push 0x206
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x450], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x440], ebx
mov word [ebp - 0x218], bx
call sub.MSVCR80.dll_memset
mov esi, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
push str.Root
push ecx
mov dword [ebp - 0x460], 0x208
mov dword [ebp - 0x45c], ebx
call fcn.0042ced0
add esp, 0x14
mov edi, dword [esi]
lea edx, [ebp - 0x450]
push edx
mov ecx, eax
mov byte [ebp - 4], 7
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
push eax
mov eax, dword [edi + 0x40]
push esi
call eax
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov esi, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
push str.SubKey
push ecx
call fcn.0042ced0
add esp, 8
mov edi, dword [esi]
lea edx, [ebp - 0x434]
push edx
mov ecx, eax
mov byte [ebp - 4], 8
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
push eax
mov eax, dword [edi + 0x40]
push esi
call eax
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov esi, dword [ebp - 0x428]
lea ecx, [ebp - 0x438]
push str.KeyName
push ecx
call fcn.0042ced0
add esp, 8
mov edi, dword [esi]
lea edx, [ebp - 0x440]
push edx
mov ecx, eax
mov byte [ebp - 4], 9
call sym.QQProtectUpd.exe_public:_wchar_t____thiscall_CTXBSTR::operator_wchar_t__void_const
push eax
mov eax, dword [edi + 0x40]
push esi
call eax
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXBSTR::destructor_void_
mov eax, dword [ebp - 0x450]
cmp eax, ebx
je 0x42ed5b
cmp dword [ebp - 0x440], ebx
je 0x42ed5b
lea ecx, [ebp - 0x444]
push ecx
push eax
call sym.QQProtectUpd.exe_bool___cdecl_Util::Convert::StringToIntW_wchar_t_const___int__
mov eax, dword [ebp - 0x444]
add esp, 8
cmp eax, 1
jne 0x42ec12
mov eax, reloc.WS2_32.dll_accept
jmp 0x42ec2c
cmp eax, 2
jne 0x42ec1e
mov eax, reloc.WS2_32.dll_bind
jmp 0x42ec2c
cmp eax, 3
jne 0x42ed5b
mov eax, reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x434]
lea edx, [ebp - 0x43c]
push edx
push 1
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x42e97a
lea eax, [ebp - 0x460]
push eax
mov eax, dword [ebp - 0x440]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x43c]
lea edx, [ebp - 0x45c]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x43c]
cmp eax, ebx
je 0x42ec89
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x42ed5b
push 0x206
lea edx, [ebp - 0x41e]
push ebx
push edx
mov word [ebp - 0x420], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [ebp - 0x448]
lea edx, [ebp - 0x420]
push edx
mov ecx, esi
call sym.QQProtectUpd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t__
jmp 0x42ed0d
lea eax, [ebp - 0x438]
push ebx
push eax
call fcn.0043c100
add esp, 8
mov esi, dword [ebp - 0x448]
push eax
mov ecx, esi
mov byte [ebp - 4], 0xa
call fcn.0044d92a
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 4
call sym.QQProtectUpd.exe_public:_void___thiscall_CTXStringW::destructor_void_
push 0x5c
push 0x2f
mov ecx, esi
call sym.QQProtectUpd.exe_public:_int___thiscall_CTXStringW::Replace_wchar_t__wchar_t_
mov ecx, esi
call sym.QQProtectUpd.exe_public:_int___thiscall_CTXStringW::GetLength_void_const
sub eax, 1
push eax
mov ecx, esi
call sym.QQProtectUpd.exe_public:_wchar_t___thiscall_CTXStringW::operator___int_const
cmp ax, 0x5c
je 0x42ed3c
push 0x4fed54
mov ecx, esi
call sym.QQProtectUpd.exe_public:_class_CTXStringW____thiscall_CTXStringW::operator_wchar_t_const__
mov eax, dword [ebp - 0x428]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x42ea75
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x42ea75
mov eax, dword [ebp - 0x428]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x42ed71
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x430]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x42ed87
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x42c]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x42ed9c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp - 0x424]
cmp eax, ebx
mov dword [ebp - 4], 0xffffffff
je 0x42edb5
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cb642
mov esp, ebp
pop ebp
ret 8