Function at 0x432b30
Capabilities:
Get common file path
Query or enumerate registry key

Disassembly:
push ebp
mov eax, 0x2a3c
mov ebp, esp
push edi
push esi
push ebx
call fcn.0047fb50
mov dword [ebp - 0x296c], esp
mov eax, 0x473640
mov edi, 0x433488
mov dword [ebp - 0x297c], eax
xor ebx, ebx
mov esi, 0x4ced58
mov dword [ebp - 0x2970], edi
mov eax, 0x4b5558
mov dword [ebp - 0x2978], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x2974], eax
lea eax, [ebp - 0x2994]
mov dword [esp], eax
call fcn.0047f180
mov dword [ebp - 0x29a8], esi
mov eax, dword [0x4ced5c]
mov ecx, 0x4ced58
mov dword [0x4ced50], ebx
mov dword [ebp - 0x29ac], ecx
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x433247
xor ecx, ecx
mov dword [ebp - 0x29d4], ecx
mov dword [esp + 0x14], 0x432117
lea eax, [ebp - 0x2728]
mov dword [esp + 0x10], 0x432121
mov dword [esp + 0xc], 0x432128
mov dword [esp + 8], 0x4326c2
mov dword [esp + 4], 0x2710
mov dword [esp], eax
call fcn.004800e0
mov dword [esp + 0x18], 0
xor eax, eax
lea edx, [ebp - 0x2728]
cmp dword [ebp - 0x29d4], 0
mov dword [esp + 4], edx
mov edx, 0xffffffff
setne al
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x432121
sub eax, 0x7fffffff
mov dword [ebp - 0x299c], eax
lea eax, [ebp - 0x2998]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x299c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x299c]
mov dword [esp + 8], 0
mov dword [ebp - 0x2990], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCreateKeyExA
sub esp, 0x24
test eax, eax
jne 0x432ff2
xor eax, eax
mov dword [ebp - 0x29d8], eax
mov dword [esp + 0x1c], 0
mov eax, 0x104
mov edx, dword [ebp - 0x29d8]
mov dword [ebp - 0x29a0], eax
lea eax, [ebp - 0x29a0]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x2848]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x299c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [ebp - 0x2990], eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x29a4], eax
sub esp, 0x20
cmp eax, 0x103
je 0x433191
mov eax, dword [ebp - 0x29a8]
lea edx, [ebp - 0x2848]
mov edi, 0xffffffff
mov dword [esp + 4], edx
mov dword [ebp - 0x2990], edi
add eax, 4
mov dword [ebp - 0x29ec], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
call fcn.00456350
mov eax, dword [ebp - 0x2738]
mov edx, dword [ebp - 0x29a8]
inc dword [eax]
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ebp - 0x29f0], edx
dec eax
test eax, eax
mov dword [edx], eax
jne 0x432d60
mov dword [esp], edx
mov esi, 7
mov dword [ebp - 0x2990], esi
call fcn.00456230
mov eax, dword [ebp - 0x29f0]
mov dword [esp], eax
call fcn.00475b80
lea esi, [esi]
mov eax, dword [ebp - 0x2738]
mov ebx, 0xffffffff
mov edx, dword [ebp - 0x29ec]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov dword [ebp - 0x2990], ebx
call fcn.00456470
mov edx, dword [ebp - 0x29a8]
add edx, 4
mov dword [ebp - 0x29f4], edx
mov edx, dword [ebp - 0x29a8]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x432ef2
mov dword [esp], edx
call fcn.00432910
test eax, eax
jne 0x432ef2
mov edx, dword [ebp - 0x29a4]
test edx, edx
jne 0x432fc3
mov eax, dword [ebp - 0x29a8]
mov edx, dword [ebp - 0x29f4]
mov dword [ebp - 0x29f8], eax
add eax, 8
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x299c]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00431e40
mov eax, dword [ebp - 0x2738]
sub esp, 4
mov edx, dword [ebp - 0x29a8]
inc dword [eax]
mov edx, dword [edx]
mov eax, dword [edx]
mov dword [ebp - 0x29fc], edx
dec eax
test eax, eax
mov dword [edx], eax
jne 0x432e4b
mov dword [esp], edx
mov eax, 6
mov dword [ebp - 0x2990], eax
call fcn.00456230
mov eax, dword [ebp - 0x29fc]
mov dword [esp], eax
call fcn.00475b80
mov eax, dword [ebp - 0x2738]
mov edx, dword [ebp - 0x29f8]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456470
mov edx, dword [ebp - 0x29a8]
mov eax, dword [edx]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x432ef2
mov dword [esp + 4], 0x432b1f
mov eax, edx
add eax, 4
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00457d00
test al, al
je 0x432ee0
mov eax, dword [ebp - 0x29a8]
mov dword [0x4ced50], eax
mov eax, dword [eax + 8]
test eax, eax
sete al
movzx eax, al
add eax, 0x3ed
mov dword [0x4cfdcc], eax
xor eax, eax
cmp dword [ebp - 0x29d4], 0
sete al
add eax, 0x404
mov dword [0x4cfdd0], eax
nop
lea esi, [esi]
inc dword [ebp - 0x29d8]
add dword [ebp - 0x29a8], 0xc
jmp 0x432c73
mov dword [esp], 0x10
mov edx, dword [ebp - 0x29a8]
mov edi, 0xffffffff
mov dword [ebp - 0x2990], edi
mov esi, 5
add edx, 4
mov dword [ebp - 0x2a00], edx
call fcn.00475ba0
mov dword [ebp - 0x2a04], eax
mov byte [ebp - 0x2a05], 1
mov dword [esp], eax
mov dword [ebp - 0x2990], esi
call fcn.00456130
mov byte [ebp - 0x2a05], 0
mov eax, dword [ebp - 0x2a04]
mov edx, dword [ebp - 0x2a00]
mov dword [ebp - 0x2738], eax
mov edx, dword [edx]
inc dword [eax]
mov dword [ebp - 0x2a0c], edx
mov eax, dword [edx]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x432f90
mov dword [esp], edx
mov ebx, 4
mov dword [ebp - 0x2990], ebx
call fcn.00456230
mov eax, dword [ebp - 0x2a0c]
mov dword [esp], eax
call fcn.00475b80
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x2738]
mov ecx, 0xffffffff
mov edx, dword [ebp - 0x2a00]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov dword [ebp - 0x2990], ecx
call fcn.00456470
sub dword [ebp - 0x29a8], 0xc
jmp 0x432ee0
mov eax, dword [ebp - 0x299c]
mov edx, 0xffffffff
mov dword [ebp - 0x2990], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
inc dword [ebp - 0x29d4]
sub esp, 4
cmp dword [ebp - 0x29d4], 1
jle 0x432bb4
mov eax, dword [0x4ced50]
test eax, eax
jne 0x43317b
mov dword [esp + 4], 0x432b1f
mov eax, dword [ebp - 0x29a8]
lea edx, [ebp - 0x2738]
mov dword [esp], edx
mov dword [0x4ced50], eax
add eax, 4
mov dword [ebp - 0x2a10], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456350
mov eax, dword [ebp - 0x2738]
inc dword [eax]
mov eax, dword [ebp - 0x29a8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2a14], eax
mov edx, eax
mov eax, dword [eax]
dec eax
test eax, eax
mov dword [edx], eax
jne 0x433077
mov dword [esp], edx
mov eax, 3
mov dword [ebp - 0x2990], eax
call fcn.00456230
mov eax, dword [ebp - 0x2a14]
mov dword [esp], eax
call fcn.00475b80
mov edx, dword [ebp - 0x2a10]
mov edi, 2
mov eax, dword [ebp - 0x2738]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456470
mov eax, 0x3ee
mov dword [0x4cfdcc], eax
call fcn.00432970
mov dword [esp + 4], 0x104
test eax, eax
lea edx, [ebp - 0x2958]
sete al
mov dword [esp], edx
movzx eax, al
add eax, 0x404
mov dword [0x4cfdd0], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov byte [ebp - 0x2956], 0
sub esp, 8
lea eax, [ebp - 0x2958]
mov dword [esp + 4], eax
lea edx, [ebp - 0x2968]
mov dword [esp], edx
call fcn.00456350
mov dword [esp + 8], 0x432b21
lea eax, [ebp - 0x2968]
lea edx, [ebp - 0x2738]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [ebp - 0x2990], edi
call fcn.00457c10
sub esp, 4
lea eax, [ebp - 0x2738]
mov esi, 1
mov dword [esp], eax
mov dword [ebp - 0x2990], esi
call fcn.00433540
lea eax, [ebp - 0x2738]
mov ecx, 2
mov dword [esp], eax
mov dword [ebp - 0x2990], ecx
call fcn.00456470
lea eax, [ebp - 0x2968]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456470
lea eax, [ebp - 0x2994]
mov dword [esp], eax
call fcn.0047f230
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x10
mov eax, dword [ebp - 0x29a8]
add eax, 4
mov dword [ebp - 0x29dc], eax
call fcn.00475ba0
mov dword [ebp - 0x29e0], eax
mov dword [esp], eax
mov eax, 9
mov byte [ebp - 0x29e1], 1
mov dword [ebp - 0x2990], eax
call fcn.00456130
mov byte [ebp - 0x29e1], 0
mov edx, dword [ebp - 0x29e0]
mov eax, dword [ebp - 0x29dc]
mov dword [ebp - 0x2738], edx
mov eax, dword [eax]
inc dword [edx]
mov edx, eax
mov dword [ebp - 0x29e8], eax
mov eax, dword [eax]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x43321b
mov dword [esp], edx
mov eax, 8
mov dword [ebp - 0x2990], eax
call fcn.00456230
mov eax, dword [ebp - 0x29e8]
mov dword [esp], eax
call fcn.00475b80
mov eax, dword [ebp - 0x2738]
mov edx, dword [ebp - 0x29dc]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456470
jmp 0x432fc3
mov dword [esp], 0x10
mov edx, dword [ebp - 0x29ac]
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
add edx, 4
mov dword [ebp - 0x29b0], edx
call fcn.00475ba0
mov dword [ebp - 0x29b4], eax
mov dword [esp], eax
mov eax, 0xd
mov byte [ebp - 0x29b5], 1
mov dword [ebp - 0x2990], eax
call fcn.00456130
mov byte [ebp - 0x29b5], 0
mov eax, dword [ebp - 0x29b4]
mov edx, dword [ebp - 0x29b0]
mov dword [ebp - 0x2738], eax
mov edx, dword [edx]
inc dword [eax]
mov dword [ebp - 0x29c0], edx
mov eax, dword [edx]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x4332da
mov dword [esp], edx
mov eax, 0xc
mov dword [ebp - 0x2990], eax
call fcn.00456230
mov eax, dword [ebp - 0x29c0]
mov dword [esp], eax
call fcn.00475b80
mov eax, dword [ebp - 0x2738]
mov edx, dword [ebp - 0x29b0]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov eax, 0xffffffff
mov dword [ebp - 0x2990], eax
call fcn.00456470
mov dword [esp], 0x10
mov edx, dword [ebp - 0x29ac]
mov dword [ebp - 0x29c4], edx
call fcn.00475ba0
mov dword [ebp - 0x29c8], eax
mov dword [esp], eax
mov eax, 0xb
mov byte [ebp - 0x29c9], 1
mov dword [ebp - 0x2990], eax
call fcn.00456130
mov byte [ebp - 0x29c9], 0
mov eax, dword [ebp - 0x29c8]
mov edx, dword [ebp - 0x29c4]
mov dword [ebp - 0x2738], eax
mov edx, dword [edx]
inc dword [eax]
mov dword [ebp - 0x29d0], edx
mov eax, dword [edx]
dec eax
mov dword [edx], eax
test eax, eax
jne 0x433386
mov dword [esp], edx
mov edi, 0xa
mov dword [ebp - 0x2990], edi
call fcn.00456230
mov eax, dword [ebp - 0x29d0]
mov dword [esp], eax
call fcn.00475b80
mov eax, dword [ebp - 0x2738]
mov esi, 0xffffffff
mov edx, dword [ebp - 0x29c4]
mov dword [edx], eax
lea eax, [ebp - 0x2738]
mov dword [esp], eax
mov dword [ebp - 0x2990], esi
call fcn.00456470
add dword [ebp - 0x29ac], 0xc
mov edx, dword [ebp - 0x29ac]
mov eax, dword [edx + 4]
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x433247
jmp 0x432bac