Function at 0x4076e0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
push edi
push str.Windows
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x40770c
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4077e9
push str.System
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x40772f
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4077e9
push str.CommonFiles
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x4077fd
lea eax, [esp + 0x24]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4077e9
lea ecx, [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x10]
push esi
push edx
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x34]
push str.CommonFilesDir
push eax
mov dword [esp + 0x20], 0x104
call edi
test eax, eax
je 0x4077de
mov eax, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push esi
push edx
push 0
push str.ProgramFilesDir
push eax
call edi
push esi
call fcn.004020d0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x4196ec]
mov dword [edi + 4], edx
mov eax, dword [0x4196f0]
mov dword [edi + 8], eax
mov cl, byte [0x4196f4]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x4077f7
push esi
call fcn.00402110
add esp, 4
pop edi
pop esi
add esp, 0x18
ret
push str.Program_Files
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407857
lea eax, [esp + 0x24]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4077e9
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push esi
push edx
mov dword [esp + 0x14], eax
push eax
mov eax, dword [esp + 0x34]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x24]
push ecx
jmp 0x4077e3
push str.MyDocuments
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407879
push 5
push esi
call fcn.00401090
add esp, 8
jmp 0x4077e9
push str.AppData
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x4078f9
push 0x1a
push esi
call fcn.00401090
add esp, 8
test eax, eax
jne 0x4077e9
mov eax, dword [0x41e0f4]
test eax, eax
jne 0x4077e9
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004020d0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [str.Application_Data]
dec edi
mov dword [edi], edx
mov eax, dword [0x4196ac]
mov dword [edi + 4], eax
mov ecx, dword [0x4196b0]
mov dword [edi + 8], ecx
mov edx, dword [0x4196b4]
mov dword [edi + 0xc], edx
mov al, byte [0x4196b8]
mov byte [edi + 0x10], al
jmp 0x4077e9
push str.LocalAppData
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x4079d4
push 0x1c
push esi
call fcn.00401090
add esp, 8
test eax, eax
jne 0x4077e9
push 0x1a
push esi
call fcn.00401090
add esp, 8
test eax, eax
mov eax, dword [0x41e0f4]
jne 0x40798d
test eax, eax
jne 0x4077e9
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.004020d0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x4196ac]
mov dword [edi + 4], edx
mov eax, dword [0x4196b0]
mov dword [edi + 8], eax
mov ecx, dword [0x4196b4]
mov dword [edi + 0xc], ecx
mov dl, byte [0x4196b8]
mov byte [edi + 0x10], dl
jmp 0x4077e9
test eax, eax
je 0x4077e9
push 0x5c
push esi
call fcn.00412280
add esp, 8
test eax, eax
jne 0x4079bc
mov eax, 0x419694
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4079ad
jmp 0x4077e9
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4079c5
jmp 0x4077e9
push str.UserDir
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407a35
push 0x28
push esi
call fcn.00401090
add esp, 8
test eax, eax
jne 0x4077e9
mov eax, dword [0x41e0f4]
test eax, eax
je 0x4076fb
push 0x1a
push esi
call fcn.00401090
push 0x5c
push esi
call fcn.00412280
add esp, 0x10
test eax, eax
jne 0x407a95
mov eax, 0x419694
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x407a26
jmp 0x4077e9
push str.InstallDir
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407a5e
mov ecx, dword [0x41e154]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x407a4f
jmp 0x4077e9
push str.SourceDir
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407a9d
mov ecx, dword [0x41e088]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x407a78
push 0x5c
push esi
call fcn.00412280
add esp, 8
test eax, eax
je 0x4077e9
mov byte [eax], 0
jmp 0x4077e9
push str.Date
push esi
call fcn.00412060
add esp, 8
test eax, eax
jne 0x407afe
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x12]
and eax, 0xffff
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
mov ecx, dword [esp + 0x16]
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*4]
push edx
push 0x41963c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4077e9
mov byte [esi], 0
pop edi
pop esi
add esp, 0x18
ret