Function at 0x41ba08
Capabilities:
Get common file path
Get cpu information
Get file version info
Get memory capacity
Get system information on windows
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a1c
call fcn.004dbfa4
push edi
push esi
push ebx
lea edi, [ebp - 0xa0]
xor ebx, ebx
mov eax, ebx
cld
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa0], 0x9c
add esp, 0xfffffff4
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.dll_GetVersionExA
lea eax, [ebp - 0xf0]
push eax
call sub.KERNEL32.dll_GetSystemInfo
lea edi, [ebp - 0xc0]
mov eax, ebx
cld
mov ecx, 8
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc0], 0x20
lea eax, [ebp - 0xc0]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
push 0
call sub.USER32.dll_GetSystemMetrics
mov dword [ebp - 0x19c0], eax
push 1
call sub.USER32.dll_GetSystemMetrics
mov dword [ebp - 0x19c4], eax
push 0x41b3cf
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xfffffff4
push 0x41b3da
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edx, eax
lea edi, [ebp - 0x2a0]
mov eax, ebx
cld
mov ecx, 0x6a
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2a0], 0x1a8
add esp, 0x18
test edx, edx
je 0x41bad9
push 0
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
call edx
add esp, 0xfffffff8
push 0x100
lea ebx, [ebp - 0xca0]
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x41b3ee
push ebx
call sub.crtdll.dll_strcat
add esp, 0xfffffff8
push ebx
push 0x100
lea esi, [ebp - 0xda0]
push esi
push 0x41b3fb
push 0x41b403
push 0x41b410
call sub.KERNEL32.dll_GetPrivateProfileStringA
push ebx
push 0x100
lea ebx, [ebp - 0xea0]
push ebx
push 0x41b3fb
push 0x41b418
push 0x41b410
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0
push dword [ebp - 0xbc]
mov eax, dword [ebp - 0xa4]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xa8]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xac]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb0]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb4]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb8]
shr eax, 0xa
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xdc]
push ebx
push esi
push 0x41b420
lea ebx, [ebp - 0xaa0]
push ebx
call sub.crtdll.dll_sprintf
mov dword [ebp - 0x1a04], 0
add esp, 0x50
lea eax, [ebp - 0xba0]
mov dword [ebp - 0x19e0], eax
lea edx, [ebp - 0x19a4]
mov dword [ebp - 0x19e4], edx
lea ecx, [ebp - 0xfa0]
mov dword [ebp - 0x19e8], ecx
lea eax, [ebp - 0x10a0]
mov dword [ebp - 0x19f4], eax
lea edx, [ebp - 0x11a0]
mov dword [ebp - 0x19d8], edx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x19dc], ecx
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x19f0], eax
mov edx, dword [ebp - 0x1a04]
cmp edx, dword [ebp - 0xdc]
jae 0x41bdaa
mov ecx, dword [ebp - 0x19e0]
mov dword [ebp - 0x19cc], ecx
nop
lea edi, [ebp - 0xaa0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ebp + ecx - 0xaa1]
mov dword [ebp - 0x19c8], ecx
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41b580
cld
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x19cc]
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [ebp - 0x1a04]
add al, 0x30
mov edx, dword [ebp - 0x19cc]
mov byte [edx + ecx - 2], al
add esp, 0xfffffffc
mov ecx, dword [ebp - 0x19e4]
push ecx
push edx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41bd92
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea ebx, [ebp - 0x19a8]
push ebx
mov eax, dword [ebp - 0x19e8]
push eax
push 0
push 0
push 0x41b5af
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov esi, ebx
test eax, eax
je 0x41bcda
mov eax, dword [0x41b5c3]
mov dword [ebp - 0xfa0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov edx, dword [ebp - 0x19f4]
push edx
push 0
push 0
push 0x41b5c7
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41bd15
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x19a8], 4
add esp, 0xfffffff8
push esi
lea eax, [ebp - 0x19ac]
push eax
push 0
push 0
push 0x41b5d2
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41bd4f
mov dword [ebp - 0x19ac], 0xffffffff
add esp, 0xfffffff8
push dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x19f4]
push ecx
mov eax, dword [ebp - 0x19e8]
push eax
mov edx, dword [ebp - 0x1a04]
push edx
push 0x41b5e0
mov ecx, dword [ebp - 0x19c8]
push ecx
call sub.crtdll.dll_sprintf
add esp, 0x20
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
inc dword [ebp - 0x1a04]
mov eax, dword [ebp - 0x1a04]
cmp eax, dword [ebp - 0xdc]
jb 0x41bc20
add esp, 0xfffffff4
lea edx, [ebp - 0xaa0]
push edx
call sub.crtdll.dll__strdup
mov dword [0x4dfe84], eax
add esp, 0x10
cmp dword [ebp - 0x90], 2
jne 0x41bde0
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41b620
cld
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41bdf5
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41b660
cld
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add esp, 0xfffffffc
mov eax, dword [ebp - 0x19e4]
push eax
mov edx, dword [ebp - 0x19e0]
push edx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41bee5
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea ebx, [ebp - 0x19a8]
push ebx
mov ecx, dword [ebp - 0x19f4]
push ecx
push 0
push 0
push 0x41b68a
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov esi, ebx
test eax, eax
je 0x41be5e
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov eax, dword [ebp - 0x19e8]
push eax
push 0
push 0
push 0x41b69a
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41be99
mov eax, dword [0x41b5c3]
mov dword [ebp - 0xfa0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov edx, dword [ebp - 0x19d8]
push edx
push 0
push 0
push 0x41b6b1
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41bed4
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x11a0], eax
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffffc
movzx eax, byte [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x19e8]
push ecx
mov eax, dword [ebp - 0x19f4]
push eax
mov edx, dword [ebp - 0x19dc]
push edx
push dword [ebp - 0x94]
mov ecx, dword [ebp - 0x19d8]
push ecx
push 0x41b6c0
lea eax, [ebp - 0xaa0]
push eax
call sub.crtdll.dll_sprintf
add esp, 0x30
add esp, 0xfffffff4
lea edx, [ebp - 0xaa0]
push edx
call sub.crtdll.dll__strdup
mov dword [0x4dfe80], eax
add esp, 0xfffffff4
mov ecx, dword [ebp - 0x19c4]
push ecx
mov eax, dword [ebp - 0x19c0]
push eax
mov edx, dword [ebp - 0x19f0]
push edx
push 0x41b780
lea ecx, [ebp - 0xaa0]
push ecx
call sub.crtdll.dll_sprintf
mov byte [ebp - 0xba0], 0
add esp, 0x30
add esp, 0xfffffffc
mov eax, dword [ebp - 0x19e4]
push eax
push 0x41b7d7
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41bfd9
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea eax, [ebp - 0x19a8]
push eax
mov edx, dword [ebp - 0x19e0]
push edx
push 0
push 0
push 0x41b7f0
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0xfffffffc
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp byte [ebp - 0xba0], 0
je 0x41c4ca
lea edi, [ebp - 0xaa0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ebp + ecx - 0xaa1]
mov dword [ebp - 0x19d0], ecx
add esp, 0xfffffffc
push 0x12
push 0x41b7ff
mov edx, dword [ebp - 0x19e0]
push edx
call sub.crtdll.dll__strnicmp
add esp, 0x10
test eax, eax
jne 0x41c051
mov edi, dword [ebp - 0x19e0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 0x12]
lea edx, [ebp - 0xb8e]
add esp, 0xfffffffc
push eax
push edx
mov edx, dword [ebp - 0x19e0]
push edx
call sub.crtdll.dll_memcpy
add esp, 0x10
add esp, 0xfffffffc
mov ecx, dword [ebp - 0x19e4]
push ecx
mov eax, dword [ebp - 0x19e0]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
je 0x41c090
push 0
push 0x41b812
mov edx, dword [ebp - 0x19e0]
push edx
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x41c4ca
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea esi, [ebp - 0x19a8]
push esi
lea ebx, [ebp - 0x12a0]
push ebx
push 0
push 0
push 0x41b81f
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41c0d1
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x12a0], eax
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
lea ebx, [ebp - 0x19a0]
push ebx
push 0
push 0
push 0x41b840
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov edi, ebx
test eax, eax
jne 0x41c130
push 0
push 0
push 0x100
lea ebx, [ebp - 0x13a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x19ec], ebx
jmp 0x41c147
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x13a0], eax
lea ecx, [ebp - 0x13a0]
mov dword [ebp - 0x19ec], ecx
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41b880
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41c198
push 0
push 0
push 0x100
lea ebx, [ebp - 0x14a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x19f8], ebx
jmp 0x41c1af
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x14a0], eax
lea eax, [ebp - 0x14a0]
mov dword [ebp - 0x19f8], eax
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41b89f
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41c200
push 0
push 0
push 0x100
lea ebx, [ebp - 0x15a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x1a04], ebx
jmp 0x41c217
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x15a0], eax
lea edx, [ebp - 0x15a0]
mov dword [ebp - 0x1a04], edx
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41b8bc
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41c262
push 0
push 0
push 0x100
lea ebx, [ebp - 0x16a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
jmp 0x41c273
mov eax, dword [0x41b5c3]
mov dword [ebp - 0x16a0], eax
lea ebx, [ebp - 0x16a0]
mov dword [ebp - 0x19a8], 4
add esp, 0xfffffff8
push esi
lea eax, [ebp - 0x19b0]
push eax
push 0
push 0
push 0x41b8e0
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41c2ad
mov dword [ebp - 0x19b0], 0xffffffff
push dword [ebp - 0x19b0]
push ebx
mov ecx, dword [ebp - 0x1a04]
push ecx
mov eax, dword [ebp - 0x19f8]
push eax
mov edx, dword [ebp - 0x19ec]
push edx
lea ecx, [ebp - 0x12a0]
push ecx
push 0x41b900
mov eax, dword [ebp - 0x19d0]
push eax
call sub.crtdll.dll_sprintf
add esp, 0x20
add esp, 0xfffffff8
push esi
push 0
push 0
push 0
push 0x41b964
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41c4b9
add esp, 0xfffffff4
push dword [ebp - 0x19a8]
call sub.crtdll.dll_malloc
mov ebx, eax
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x41b964
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0x18
test eax, eax
jne 0x41c4b9
add esp, 0xfffffff8
push 0x41b97c
lea edx, [ebp - 0xaa0]
push edx
call sub.crtdll.dll_strcat
mov dword [ebp - 0x1a04], ebx
add esp, 0x10
cmp byte [ebx], 0
je 0x41c4a2
lea ecx, [ebp - 0xaa0]
mov dword [ebp - 0x19d4], ecx
nop
xor edi, edi
add esp, 0xfffffff8
push 0x41b98e
mov eax, dword [ebp - 0x19d4]
push eax
call sub.crtdll.dll_strcat
add esp, 0xfffffff8
mov edx, dword [ebp - 0x1a04]
push edx
mov ecx, dword [ebp - 0x19d4]
push ecx
call sub.crtdll.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
push 0x41b991
mov eax, dword [ebp - 0x19d4]
push eax
call sub.crtdll.dll_strcat
add esp, 0xfffffff8
lea eax, [ebp - 0x19b4]
push eax
mov edx, dword [ebp - 0x1a04]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x41c467
add esp, 0xfffffff4
push ebx
call sub.crtdll.dll_malloc
mov edi, eax
push edi
push ebx
push 0
mov ecx, dword [ebp - 0x1a04]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
add esp, 0x10
test eax, eax
je 0x41c467
lea esi, [ebp - 0x19b8]
push esi
lea ebx, [ebp - 0x19bc]
push ebx
push 0x41b9a0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41c427
add esp, 0xfffffff8
push dword [ebp - 0x19bc]
lea eax, [ebp - 0xaa0]
push eax
jmp 0x41c45f
push esi
push ebx
push 0x41b9e0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41c450
add esp, 0xfffffff8
push dword [ebp - 0x19bc]
lea edx, [ebp - 0xaa0]
push edx
jmp 0x41c45f
add esp, 0xfffffff8
push 0x41b5c3
lea ecx, [ebp - 0xaa0]
push ecx
call sub.crtdll.dll_strcat
add esp, 0x10
test edi, edi
je 0x41c477
add esp, 0xfffffff4
push edi
call sub.crtdll.dll_free
add esp, 0x10
mov edi, dword [ebp - 0x1a04]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0x1a04]
lea ecx, [edx + ecx - 1]
mov dword [ebp - 0x1a04], ecx
cmp byte [ecx], 0
jne 0x41c370
add esp, 0xfffffff8
push 0x41ba05
lea ecx, [ebp - 0xaa0]
push ecx
call sub.crtdll.dll_strcat
add esp, 0x10
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff4
lea eax, [ebp - 0xaa0]
push eax
call sub.crtdll.dll__strdup
mov dword [0x4dfe88], eax
add esp, 0x10
lea esp, [ebp - 0x1a28]
pop ebx
pop esi
pop edi
leave
ret