Function at 0x41cee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474dac
mov eax, dword fs:[0]
push eax
sub esp, 0x948
mov eax, dword [0x4a86cc]
xor eax, ebp
mov dword [ebp - 0x70], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.00410d40
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
call fcn.00410d40
mov byte [ebp - 4], 1
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x10], 0
push fcn.0041e320
push fcn.00410d40
push 0x12
push 4
lea eax, [ebp - 0x64]
push eax
call fcn.004264d4
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x6a8], esp
push str.bKqKpJfLbKtJbK
call fcn.0041e220
mov dword [ebp - 0x7bc], eax
lea ecx, [ebp - 0x6ac]
push ecx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7c0], eax
mov edx, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c4], edx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x7c4]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x64]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6ac]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6b0], esp
push str.6KoBsAqEoLcJrD0MXIvMdIuMaEIK8JsIcN5JHJeLeIaLuLnLoM0MTJpLeLaM8NuMfKiMaJeLvM
call fcn.0041e220
mov dword [ebp - 0x7c8], eax
lea eax, [ebp - 0x6b4]
push eax
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7cc], eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d0], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x7d0]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x60]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6b4]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6b8], esp
push str.9D8C6A9BqJcJqJrIlMnIlLcEAM7ByJ
call fcn.0041e220
mov dword [ebp - 0x7d4], eax
lea edx, [ebp - 0x6bc]
push edx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x7dc], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x7dc]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x5c]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6bc]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6c0], esp
push str.9D8CaE7BbF9D6CoK9MpKuKkLuMcJ4LmJmI4LuNpNbKrJuKsJpJcExB8CsCeE
call fcn.0041e220
mov dword [ebp - 0x7e0], eax
lea ecx, [ebp - 0x6c4]
push ecx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7e4], eax
mov edx, dword [ebp - 0x7e4]
mov dword [ebp - 0x7e8], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x7e8]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x58]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6c4]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6c8], esp
push str.9DbF8CaE9D9DcEsJoKgMoL3MtJmJ3MuMfKvMoMnIuMfK4LkLlL4LqJtJbKvNtJsJrL7DvD9D6N7B9B
call fcn.0041e220
mov dword [ebp - 0x7ec], eax
lea eax, [ebp - 0x6cc]
push eax
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7f0], eax
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp - 0x7f4], ecx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x7f4]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x54]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6cc]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6d0], esp
push str.7D7B4J
call fcn.0041e220
mov dword [ebp - 0x7f8], eax
lea edx, [ebp - 0x6d4]
push edx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x800], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x800]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x50]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6d4]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6d8], esp
push str.ZMlKdLoMrMbKpLcJ5JmDoEmA
call fcn.0041e220
mov dword [ebp - 0x804], eax
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x808], eax
mov edx, dword [ebp - 0x808]
mov dword [ebp - 0x80c], edx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x80c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x4c]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6dc]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6e0], esp
push str.oBrDmAqJdIZKSKRL4IGIcJcKbKoNlJvLON9KmJmI
call fcn.0041e220
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x6e4]
push eax
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
mov dword [ebp - 0x818], ecx
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x818]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x48]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6e4]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6e8], esp
push str.FKrLrLnLlM9KbKuKhImJnJ7LmDoEpDrIfKlB9MzLeL
call fcn.0041e220
mov dword [ebp - 0x81c], eax
lea edx, [ebp - 0x6ec]
push edx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x824], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x824]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x44]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6ec]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6f0], esp
push str.ZKuNdIrJ8CCM8JpNaL5JJLeLfJdMtIgMpN6KXNrJdIcKcJuMcJlL9KfKoL
call fcn.0041e220
mov dword [ebp - 0x828], eax
lea ecx, [ebp - 0x6f4]
push ecx
call fcn.0041f3c0
add esp, 8
mov dword [ebp - 0x82c], eax
mov edx, dword [ebp - 0x82c]
mov dword [ebp - 0x830], edx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x830]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x40]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6f4]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x6f8], esp
push str.U29mdHdhcmVcMzYwXDM2MHNlNVxzZTY
call fcn.0041e220
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x6fc]
push eax
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x838], eax
mov ecx, dword [ebp - 0x838]
mov dword [ebp - 0x83c], ecx
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x83c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6fc]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x700], esp
push str.aG9tZXBhZ2U
call fcn.0041e220
mov dword [ebp - 0x840], eax
lea edx, [ebp - 0x704]
push edx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x848], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x848]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x38]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x704]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x708], esp
push str.aGFvc291LmNvbQ
call fcn.0041e220
mov dword [ebp - 0x84c], eax
lea ecx, [ebp - 0x70c]
push ecx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x850], eax
mov edx, dword [ebp - 0x850]
mov dword [ebp - 0x854], edx
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x854]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x34]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70c]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x710], esp
push str.c28uY29t
call fcn.0041e220
mov dword [ebp - 0x858], eax
lea eax, [ebp - 0x714]
push eax
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x85c], eax
mov ecx, dword [ebp - 0x85c]
mov dword [ebp - 0x860], ecx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x860]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x30]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x714]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x718], esp
push str.MzYwMC5jb20
call fcn.0041e220
mov dword [ebp - 0x864], eax
lea edx, [ebp - 0x71c]
push edx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x86c], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x86c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x71c]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x720], esp
push str.aGFvLjM2MC5jbg
call fcn.0041e220
mov dword [ebp - 0x870], eax
lea ecx, [ebp - 0x724]
push ecx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x874], eax
mov edx, dword [ebp - 0x874]
mov dword [ebp - 0x878], edx
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x878]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x28]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x724]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x728], esp
push str.U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXDM2MHNlNg
call fcn.0041e220
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0x72c]
push eax
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x880], eax
mov ecx, dword [ebp - 0x880]
mov dword [ebp - 0x884], ecx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x884]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x24]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x72c]
call fcn.0041e320
push ecx
mov ecx, esp
mov dword [ebp - 0x730], esp
push str.RGlzcGxheUljb24
call fcn.0041e220
mov dword [ebp - 0x888], eax
lea edx, [ebp - 0x734]
push edx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x890], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x890]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x20]
call fcn.0041a570
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x734]
call fcn.0041e320
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00403bc0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41d866
push 0x400
push 0
lea ecx, [ebp - 0x738]
call fcn.0041e340
mov dword [ebp - 0x894], eax
mov edx, dword [ebp - 0x894]
mov dword [ebp - 0x898], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x898]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x738]
call fcn.0041e320
mov dword [ebp - 0x6c], 0x400
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0041ffe0
add esp, 0x18
test eax, eax
jne 0x41d85c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x73c]
push ecx
call fcn.00420020
add esp, 8
mov dword [ebp - 0x89c], eax
mov edx, dword [ebp - 0x89c]
mov dword [ebp - 0x8a0], edx
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x73c]
call fcn.0041e320
lea ecx, [ebp - 0x1c]
call fcn.0041e750
push ecx
mov ecx, esp
mov dword [ebp - 0x744], esp
push eax
call fcn.0041e2a0
mov dword [ebp - 0x8a4], eax
lea ecx, [ebp - 0x748]
push ecx
call fcn.0041f7c0
add esp, 8
mov dword [ebp - 0x8a8], eax
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8ac], edx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x8ac]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x740]
call fcn.0041a4f0
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x8b4]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041e3e0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x740]
call fcn.0041e320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x748]
call fcn.0041e320
push 0
lea ecx, [ebp - 0x34]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e5e0
cmp eax, 0xffffffff
jne 0x41d80c
push 0
lea ecx, [ebp - 0x30]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e5e0
cmp eax, 0xffffffff
jne 0x41d80c
push 0
lea ecx, [ebp - 0x2c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e5e0
cmp eax, 0xffffffff
jne 0x41d80c
push 0
lea ecx, [ebp - 0x28]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041e5e0
cmp eax, 0xffffffff
je 0x41d85c
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x74c], 0
mov byte [ebp - 4], 1
push fcn.0041e320
push 0x12
push 4
lea eax, [ebp - 0x64]
push eax
call fcn.00426471
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0041e320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.0041e320
mov eax, dword [ebp - 0x74c]
jmp 0x41e1ff
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x48]
call fcn.00403bc0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41db9c
push 0xff
push 0
lea ecx, [ebp - 0x750]
call fcn.0041e340
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8bc], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x8bc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x750]
call fcn.0041e320
mov dword [ebp - 0x6c], 0xff
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0x479fdf
lea ecx, [ebp - 0x758]
call fcn.0041a4f0
mov dword [ebp - 0x8c0], eax
mov edx, dword [ebp - 0x8c0]
mov dword [ebp - 0x8c4], edx
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x8c4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0041ffe0
add esp, 0x18
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x751], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x758]
call fcn.0041e320
movzx edx, byte [ebp - 0x751]
test edx, edx
je 0x41db92
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x75c]
push ecx
call fcn.00420020
add esp, 8
mov dword [ebp - 0x8c8], eax
mov edx, dword [ebp - 0x8c8]
mov dword [ebp - 0x8cc], edx
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x8cc]
push eax
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x75c]
call fcn.0041e320
push 0
push 0x47a278
lea ecx, [ebp - 0x68]
call fcn.0041e5e0
add eax, 1
je 0x41db92
push 0
push 0x47a280
lea ecx, [ebp - 0x68]
call fcn.0041e5e0
add eax, 1
je 0x41db92
push 0x47a284
lea ecx, [ebp - 0x760]
call fcn.0041a4f0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x760]
push ecx
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x764]
push eax
call fcn.00420220
add esp, 0xc
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x8d4], ecx
mov byte [ebp - 4], 0x1d
mov edx, dword [ebp - 0x8d4]
push edx
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x764]
call fcn.0041e320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x760]
call fcn.0041e320
push 0x47a288
push 0x47a28c
lea ecx, [ebp - 0x68]
call fcn.0041e400
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x768]
push ecx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x8d8], eax
mov edx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8dc], edx
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x8dc]
push eax
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x768]
call fcn.0041e320
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x76c]
push edx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x8e4], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x8e4]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x770]
push edx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x8ec]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x68]
call fcn.0041e400
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x770]
call fcn.0041e320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x76c]
call fcn.0041e320
push 0x47a02b
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x778]
push edx
call fcn.00420130
add esp, 8
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x8f4], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x8f4]
push ecx
call fcn.0041e710
add esp, 8
mov byte [ebp - 0x771], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x778]
call fcn.0041e320
movzx edx, byte [ebp - 0x771]
test edx, edx
je 0x41db92
lea eax, [ebp - 0x68]
push eax
call fcn.004201d0
add esp, 4
cmp eax, 0x64
jbe 0x41db92
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x41de07
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x24]
call fcn.00403bc0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41de07
push 0xff
push 0
lea ecx, [ebp - 0x77c]
call fcn.0041e340
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x8fc], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x8fc]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x77c]
call fcn.0041e320
mov dword [ebp - 0x6c], 0xff
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041ffe0
add esp, 0x18
test eax, eax
jne 0x41ddfd
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x780]
push edx
call fcn.00420020
add esp, 8
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x904], eax
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x904]
push ecx
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x780]
call fcn.0041e320
push 0
push 0x47a290
lea ecx, [ebp - 0x68]
call fcn.0041e5e0
add eax, 1
je 0x41ddfd
push 0x47a298
push 0x47a29c
lea ecx, [ebp - 0x68]
call fcn.0041e400
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x784]
push eax
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x908], eax
mov ecx, dword [ebp - 0x908]
mov dword [ebp - 0x90c], ecx
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x90c]
push edx
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x784]
call fcn.0041e320
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x788]
push ecx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x910], eax
mov edx, dword [ebp - 0x910]
mov dword [ebp - 0x914], edx
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x914]
call fcn.00403bc0
push eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x78c]
push ecx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x918], eax
mov edx, dword [ebp - 0x918]
mov dword [ebp - 0x91c], edx
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x91c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x68]
call fcn.0041e400
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x78c]
call fcn.0041e320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x788]
call fcn.0041e320
push 0x47a04b
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x794]
push ecx
call fcn.00420130
add esp, 8
mov dword [ebp - 0x920], eax
mov edx, dword [ebp - 0x920]
mov dword [ebp - 0x924], edx
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x924]
push eax
call fcn.0041e710
add esp, 8
mov byte [ebp - 0x78d], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x794]
call fcn.0041e320
movzx ecx, byte [ebp - 0x78d]
test ecx, ecx
je 0x41ddfd
lea edx, [ebp - 0x68]
push edx
call fcn.004201d0
add esp, 4
cmp eax, 0x64
jbe 0x41ddfd
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x41df06
xor ecx, ecx
mov word [ebp - 0x27c], cx
push 0x206
push 0
lea edx, [ebp - 0x27a]
push edx
call fcn.00421750
add esp, 0xc
push 0
push 0x1a
lea eax, [ebp - 0x27c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x798]
push eax
call fcn.0041e660
add esp, 0xc
mov dword [ebp - 0x928], eax
mov ecx, dword [ebp - 0x928]
mov dword [ebp - 0x92c], ecx
mov byte [ebp - 4], 0x28
mov edx, dword [ebp - 0x92c]
push edx
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x798]
call fcn.0041e320
push 0x47a089
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x7a0]
push ecx
call fcn.00420130
add esp, 8
mov dword [ebp - 0x930], eax
mov edx, dword [ebp - 0x930]
mov dword [ebp - 0x934], edx
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0x934]
push eax
call fcn.0041e710
add esp, 8
mov byte [ebp - 0x799], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7a0]
call fcn.0041e320
movzx ecx, byte [ebp - 0x799]
test ecx, ecx
je 0x41df06
lea edx, [ebp - 0x68]
push edx
call fcn.004201d0
add esp, 4
cmp eax, 0x64
jbe 0x41df06
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0x14], 0
jne 0x41e1bf
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x41dfbb
lea ecx, [ebp - 0x390]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x41dfa7
xor edx, edx
mov word [ebp - 0x59c], dx
push 0x206
push 0
lea eax, [ebp - 0x59a]
push eax
call fcn.00421750
add esp, 0xc
lea ecx, [ebp - 0x59c]
push ecx
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x59c]
push eax
call fcn.0041cd30
add esp, 4
push eax
lea ecx, [ebp - 0x38c]
push ecx
call fcn.00424b90
add esp, 8
mov edx, dword [ebp - 0x390]
push edx
mov eax, dword [ebp - 0x280]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x280]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 0x280]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x280]
push eax
mov ecx, dword [edx + 8]
call ecx
push str.360
lea edx, [ebp - 0x38c]
push edx
call fcn.00424b90
add esp, 8
push 0
lea eax, [ebp - 0x38c]
push eax
call fcn.004263fb
add esp, 8
cmp eax, 0xffffffff
je 0x41e1bf
lea ecx, [ebp - 0x6a4]
push ecx
lea edx, [ebp - 0x38c]
push edx
call fcn.0041ccb0
add esp, 4
push eax
call fcn.0041cd90
add esp, 8
push 0
lea eax, [ebp - 0x6a4]
push eax
call fcn.004263fb
add esp, 8
cmp eax, 0xffffffff
je 0x41e1bf
lea ecx, [ebp - 0x6a4]
push ecx
lea ecx, [ebp - 0x68]
call fcn.0041a570
lea edx, [ebp - 0x6a4]
push edx
push 0x47a2b4
lea eax, [ebp - 0x68]
push eax
call fcn.004159a0
add esp, 0xc
push 0
push 0x47a2bc
lea ecx, [ebp - 0x68]
call fcn.0041e5e0
add eax, 1
je 0x41e1bf
push 0x47a2c4
push 0x47a2c8
lea ecx, [ebp - 0x68]
call fcn.0041e400
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x7a4]
push edx
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x93c], eax
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x93c]
push ecx
lea ecx, [ebp - 0x68]
call fcn.0041e3e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7a4]
call fcn.0041e320
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x7a8]
push eax
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x940], eax
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x944], ecx
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x944]
call fcn.00403bc0
push eax
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x7ac]
push eax
call fcn.004200b0
add esp, 8
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
mov dword [ebp - 0x94c], ecx
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x94c]
call fcn.00403bc0
push eax
lea ecx, [ebp - 0x68]
call fcn.0041e400
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x7ac]
call fcn.0041e320
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7a8]
call fcn.0041e320
push 0x47a08a
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x7b4]
push eax
call fcn.00420130
add esp, 8
mov dword [ebp - 0x950], eax
mov ecx, dword [ebp - 0x950]
mov dword [ebp - 0x954], ecx
mov byte [ebp - 4], 0x2d
mov edx, dword [ebp - 0x954]
push edx
call fcn.0041e710
add esp, 8
mov byte [ebp - 0x7ad], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7b4]
call fcn.0041e320
movzx eax, byte [ebp - 0x7ad]
test eax, eax
je 0x41e1bf
lea ecx, [ebp - 0x68]
push ecx
call fcn.004201d0
add esp, 4
cmp eax, 0x64
jbe 0x41e1bf
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x7b8], edx
mov byte [ebp - 4], 1
push fcn.0041e320
push 0x12
push 4
lea eax, [ebp - 0x64]
push eax
call fcn.00426471
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0041e320
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.0041e320
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x70]
xor ecx, ebp
call fcn.00421737
mov esp, ebp
pop ebp
ret