Function at 0x40fde0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4506c0
push eax
mov dword fs:[0], esp
mov edx, dword [0x46a018]
sub esp, 0xc10
mov al, byte [edx + 2]
push ebx
push esi
push edi
mov edi, ecx
test al, al
je 0x40fe37
cmp dword [edi], 0
jne 0x40fe37
lea eax, [ebp - 0xd]
push eax
mov byte [ebp - 0xd], 0
call fcn.00410520
cmp byte [ebp - 0xd], 0
je 0x40fe31
cmp eax, 1
jl 0x410361
mov edx, dword [0x46a018]
mov ecx, dword [edx + 0x10]
test ecx, ecx
je 0x410361
call fcn.0040d870
push eax
lea ecx, [ebp - 0x18]
call fcn.00401c50
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
or esi, 0xffffffff
cmp dword [eax - 0xc], 0
je 0x410340
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x3f8], ax
lea eax, [ebp - 0x3f6]
push eax
call fcn.0043da70
add esp, 0xc
lea eax, [ebp - 0x3f8]
push 1
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.bfAppStoreprofilesconfig.ini
lea eax, [ebp - 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x74]
call fcn.00401000
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.00401220
push ecx
push 0x458b48
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x74]
call fcn.004010c0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00401270
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ff17
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 4], 4
push dword [ebp - 0x18]
call fcn.00410710
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push ecx
mov byte [ebp - 4], 5
call fcn.00410380
mov eax, dword [0x46a018]
xor ecx, ecx
mov al, byte [eax + 2]
test al, al
setne cl
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xc18], ax
lea eax, [ebp - 0xc16]
push eax
lea ecx, [ecx*2 + 9]
mov dword [ebp - 0x3c], ecx
call fcn.0043da70
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc18]
push eax
lea eax, [ebp - 0x1c]
push eax
push str.InstallDate
push str.Software_bfAppstore
push SysReAllocStringLen
mov dword [ebp - 0x14], 0x206
mov dword [ebp - 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0xd]
push eax
mov ecx, edi
call fcn.00410520
mov edx, dword [section..data]
mov ecx, section..data
mov dword [ebp - 0x38], eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 6
push dword [ebp - 0x18]
call fcn.00410620
push 0x110
lea eax, [ebp - 0x18c]
push 0
push eax
mov dword [ebp - 0x190], 0x114
call fcn.0043da70
add esp, 0xc
lea eax, [ebp - 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x184]
lea eax, [ebp - 0x2c]
push dword [ebp - 0x188]
push dword [ebp - 0x18c]
push str._u._u._u
push eax
call fcn.0040a530
mov eax, dword [section..data]
add esp, 0x14
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 8
call fcn.00412d20
test eax, eax
mov edx, str.32bit
mov ecx, str.64bit
cmove ecx, edx
push ecx
lea eax, [ebp - 0x28]
push 0x458e6c
push eax
call fcn.0040a530
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x808], ax
lea eax, [ebp - 0x806]
push eax
call fcn.0043da70
add esp, 0xc
lea ecx, [ebp - 0x808]
call fcn.00413270
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x600], ax
lea eax, [ebp - 0x5fe]
push eax
call fcn.0043da70
add esp, 0xc
lea ecx, [ebp - 0x600]
call fcn.00413390
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa10], ax
lea eax, [ebp - 0xa0e]
push eax
call fcn.0043da70
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
add esp, 0xc
push 0
call esi
push 1
mov edi, eax
call esi
push eax
push edi
lea eax, [ebp - 0xa10]
push str._dX_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [section..data]
add esp, 0x10
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x808]
mov byte [ebp - 4], 9
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x2c]
push str._OS_:__s___bit_:__s___iever_:__s___FlashVer_:__s___Display_:__s_
push eax
call fcn.0040a530
mov eax, dword [section..data]
add esp, 0x1c
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
mov ebx, dword [ebp - 0x1c]
cmp byte [ebp + 8], 0
push ebx
push dword [ebp - 0x34]
mov ecx, 0x458f0c
push dword [ebp - 0x38]
mov eax, 0x458f08
push dword [ebp + 0xc]
cmove eax, ecx
push eax
lea eax, [ebp - 0xc18]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
push 0x458f10
push eax
call fcn.0040a530
mov eax, dword [section..data]
add esp, 0x24
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0xb
mov edi, dword [ebp - 0x14]
push edi
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push str.http:__jdatalog.jiamarket.com_logger.php_ltypejactivesid_suid_sver_smsg_s
push eax
call fcn.0040a530
mov esi, dword [ebp + 8]
add esp, 0x10
lea eax, [ebp + 0xc]
push eax
sub esp, 0x10
lea eax, [ebp - 0x1f0]
push eax
xor dl, dl
mov ecx, esi
mov dword [ebp + 0xc], 0xbb8
call fcn.00413c60
lea edx, [esi - 0x10]
or esi, 0xffffffff
add esp, 0x20
mov byte [ebp - 4], 0xa
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41023e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41025b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410278
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410298
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4102b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4102d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4102f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410318
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x74]
call fcn.00401070
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x410340
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x410361
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8