Function at 0x407ce0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push str.Windows
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407d0d
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40826b
push str.System
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
je 0x40825f
push str.System64
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
je 0x40825f
push str.CommonFiles
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407dff
lea eax, [esp + 0x28]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40826b
lea ecx, [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0x38]
push str.CommonFilesDir
push eax
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
je 0x407def
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
push 0
push str.ProgramFilesDir
push eax
call esi
push ebp
call fcn.00402110
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x41a888]
mov dword [edi + 4], edx
mov eax, dword [0x41a88c]
mov dword [edi + 8], eax
mov cl, byte [0x41a890]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40826b
push str.Program_Files
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407e6d
lea eax, [esp + 0x28]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40826b
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push ebp
push edx
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x38]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40826b
push str.Program_Files__x64_
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407edb
lea edx, [esp + 0x28]
push edx
push 0x20119
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40826b
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push ebp
push ecx
push 0
push str.ProgramFilesDir
push edx
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40826b
push str.MyDocuments
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407efd
push 5
push ebp
call fcn.00401090
add esp, 8
jmp 0x40826b
push str.Desktop
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407f1f
push 0x10
push ebp
call fcn.00401090
add esp, 8
jmp 0x40826b
push str.AppData
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x407fb6
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40826b
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00402110
mov eax, dword [0x41f2ec]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x407fa0
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x41a830]
mov dword [edi + 4], edx
mov eax, dword [0x41a834]
mov dword [edi + 8], eax
mov ecx, dword [0x41a838]
mov dword [edi + 0xc], ecx
mov dl, byte [0x41a83c]
mov byte [edi + 0x10], dl
jmp 0x40826b
xor eax, eax
mov esi, str.ProfilesAdministratorApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
jmp 0x40826b
push str.LocalAppData
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x40808e
push 0x1c
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40826b
mov eax, dword [0x41f2ec]
test eax, eax
je 0x40801e
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40801e
push 0x5c
push ebp
call fcn.004131d0
add esp, 8
test eax, eax
je 0x40801e
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40800f
jmp 0x40826b
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00402110
mov eax, dword [0x41f2ec]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x408075
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.Application_Data]
dec edi
mov dword [edi], eax
mov ecx, dword [0x41a830]
mov dword [edi + 4], ecx
mov edx, dword [0x41a834]
mov dword [edi + 8], edx
mov eax, dword [0x41a838]
mov dword [edi + 0xc], eax
mov cl, byte [0x41a83c]
mov byte [edi + 0x10], cl
jmp 0x40826b
xor eax, eax
mov esi, str.ProfilesAdministratorLocal_SettingsApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40826b
push str.UserDir
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x4080ef
push 0x28
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40826b
mov eax, dword [0x41f2ec]
test eax, eax
je 0x407cfc
push 0x1a
push ebp
call fcn.00401090
push 0x5c
push ebp
call fcn.004131d0
add esp, 0x10
test eax, eax
jne 0x40814f
mov eax, 0x41a788
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4080e0
jmp 0x40826b
push str.InstallDir
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x408118
mov ecx, dword [0x41f350]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x408109
jmp 0x40826b
push str.SourceDir
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x408157
mov ecx, dword [0x41f36c]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x408132
push 0x5c
push ebp
call fcn.004131d0
add esp, 8
test eax, eax
je 0x40826b
mov byte [eax], 0
jmp 0x40826b
push str.Date
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x4081b7
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x16]
and eax, 0xffff
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
lea ecx, [eax + edx*4]
push ecx
push 0x41a760
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40826b
push str.Year
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x4081ef
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x14]
and eax, 0xffff
push eax
push 0x41a760
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40826b
push str.Month
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x408228
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x16]
and edx, 0xffff
push edx
push 0x41a760
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40826b
push str.Day
push ebp
call fcn.00412fb0
add esp, 8
test eax, eax
jne 0x408254
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1a]
and ecx, 0xffff
jmp 0x4081a2
pop edi
mov byte [ebp], 0
pop esi
pop ebp
add esp, 0x18
ret
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp], 0
je 0x40827a
push ebp
call fcn.00402150
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x18
ret