Function at 0x40bf39
Capabilities:
Get common file path
Persist via run registry key
Set current directory

Disassembly:
mov eax, 0x4292b2
call fcn.00410ccc
sub esp, 0x9c0
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x2c]
call fcn.00405040
lea eax, [esi + 0x2f4]
push 1
xor ebx, ebx
push str.5.2_PE
push eax
mov dword [ebp - 4], ebx
call fcn.0040cb96
push 1
push 0xa
push ebx
mov edi, 0x80000002
push str.SoftwareHighCriteriaTotalRecorder
lea eax, [esi + 0x2f4]
push edi
push eax
call fcn.0040ceee
push 1
push 0x46
push ebx
push str.SoftwareHighCriteriaTotalRecorderIncompatiListBlack
lea eax, [esi + 0x2f4]
push edi
push eax
call fcn.0040ceee
push 1
push 0x46
push ebx
push str.SoftwareHighCriteriaTotalRecorderIncompatiListGrey
lea eax, [esi + 0x2f4]
push edi
push eax
call fcn.0040ceee
add esp, 0x54
lea eax, [esi + 0x2f4]
push 1
push 0x46
push ebx
push str.SoftwareHighCriteriaTotalRecorderIncompatiListWhite
push edi
push eax
call fcn.0040ceee
push 1
push 0x46
push ebx
push str.SoftwareHighCriteriaTotalRecorderIncompatiListGreyLog
lea eax, [esi + 0x2f4]
push edi
push eax
call fcn.0040ceee
push 1
push 0xa
push ebx
push str.SoftwareHighCriteriaTotalRecorder
lea eax, [esi + 0x2f4]
push 0x80000001
push eax
call fcn.0040ceee
add esp, 0x48
lea eax, [esi + 0x2f4]
push 1
push eax
call fcn.0040d60d
push 1
push 0x20
push ebx
push str.SoftwareMicrosoftMultimediaSound_Mapper
lea eax, [esi + 0x2f4]
push 0x80000001
push eax
call fcn.0040ceee
add esp, 0x20
push ebx
push str.TotalRecorderScheduler
push 0x46
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea eax, [esi + 0x2f4]
push edi
push eax
call fcn.0040d5ee
push 1
push 0x64
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
lea eax, [esi + 0x2f4]
push 0x80000001
push eax
call fcn.0040ceee
push 0x670
call fcn.0041f286
add esp, 0x34
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x40c089
mov ecx, eax
call fcn.0040d76b
jmp 0x40c08b
xor eax, eax
push 0xe014
lea ecx, [esi + 0x354]
mov byte [ebp - 4], bl
mov dword [esi + 0x318], eax
call fcn.00422e76
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jge 0x40c0b9
push str.CoInitialize
jmp 0x40cb6f
lea eax, [ebp - 0x514]
push eax
call fcn.0040b62b
cmp dword [ebp - 0x514], ebx
pop ecx
mov dword [ebp - 0x10], eax
je 0x40c0de
lea eax, [ebp - 0x514]
push eax
call fcn.0040bd64
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x40c11a
push 0xffffffffffffffff
push 0x40000001
push 0xe012
call fcn.00424bc0
cmp eax, 1
jne 0x40cb77
lea eax, [ebp - 0x514]
push eax
call fcn.0040b79b
lea eax, [ebp - 0x514]
push eax
call fcn.0040bd64
jmp 0x40cb75
lea eax, [esi + 0x19c]
push 0x94
push ebx
push eax
call fcn.00410eb0
add esp, 0xc
lea eax, [esi + 0x19c]
push eax
mov dword [eax], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esi + 0x1ac]
cmp eax, 1
je 0x40c16b
cmp eax, 2
jne 0x40c15b
cmp dword [esi + 0x1a0], 4
jae 0x40c16b
push ebx
push 0x40000030
push 0xe005
jmp 0x40c2de
xor ecx, ecx
cmp eax, 1
lea eax, [esi + 0xc0]
push 1
setne cl
push eax
mov dword [esi + 0x2c8], ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x40c196
push str.InitializeSecurityDescriptor
jmp 0x40ca98
push ebx
push ebx
lea eax, [esi + 0xc0]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x40c1b5
push str.SetSecurityDescriptorDacl
jmp 0x40ca98
cmp dword [esi + 0x2c8], 1
lea eax, [esi + 0xc0]
mov dword [esi + 0x230], 0xc
mov dword [esi + 0x234], eax
mov dword [esi + 0x238], ebx
jne 0x40c23a
lea eax, [ebp - 0x9cc]
push eax
call fcn.0040aa89
test eax, eax
pop ecx
jne 0x40c23a
cmp dword [ebp - 0x9cc], ebx
je 0x40c205
lea eax, [ebp - 0x9cc]
push eax
call fcn.0040bd64
pop ecx
jmp 0x40cb3d
lea eax, [ebp - 0x884]
push eax
lea eax, [ebp + 8]
push 0xe006
push eax
call fcn.00406614
add esp, 0xc
mov eax, dword [eax]
push ebx
push 0x40000030
push eax
mov byte [ebp - 4], 2
call fcn.00424b88
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
jmp 0x40cb38
push ebx
lea eax, [ebp - 0x2b8]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x43c090]
push dword [eax]
call fcn.004117c1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00411110
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00411120
add esp, 0x24
lea eax, [ebp - 0x164]
push eax
push str.Dir__s_
lea eax, [esi + 0x2f4]
push 1
push eax
call fcn.00401b1d
add esp, 0x10
cmp byte [ebp - 0x164], bl
je 0x40c312
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40c2f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x7b
jne 0x40c2e8
lea eax, [ebp - 0x164]
push 0x435c04
push eax
call fcn.00410cf0
pop ecx
test eax, eax
pop ecx
jne 0x40c2e8
push ebx
push 0x40000030
push 0xe013
call fcn.00424bc0
jmp 0x40cb77
push str.SetCurrentDirectory
push esi
jmp 0x40cb70
cmp byte [ebp - 0x164], bl
je 0x40c312
lea eax, [ebp - 0x164]
push eax
call fcn.00411260
cmp byte [ebp + eax - 0x165], 0x5c
pop ecx
je 0x40c325
lea eax, [ebp - 0x164]
push 0x434124
push eax
call fcn.00411120
pop ecx
pop ecx
lea eax, [ebp - 0x164]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40c346
push str.GetModuleFileName
jmp 0x40ca98
lea eax, [ebp - 0x164]
lea ecx, [esi + 0x374]
push eax
call fcn.0041ef25
push 0x5c
lea ecx, [esi + 0x374]
call fcn.0041d702
cmp eax, ebx
jle 0x40c394
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [esi + 0x374]
call fcn.0041d68a
push eax
lea ecx, [esi + 0x374]
mov byte [ebp - 4], 3
call fcn.0041eed5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0041ede8
lea eax, [esi + 0x384]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x40c3af
push str.SHGetMalloc
jmp 0x40ca98
lea eax, [esi + 0x378]
mov ecx, esi
push eax
mov eax, dword [esi + 0x2c8]
neg eax
sbb eax, eax
and eax, 0x15
inc eax
inc eax
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0040be27
test eax, eax
je 0x40cb77
lea eax, [esi + 0x37c]
mov ecx, esi
push eax
mov eax, dword [esi + 0x2c8]
neg eax
sbb eax, eax
and eax, 0x19
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call fcn.0040be27
test eax, eax
je 0x40cb77
push str.Total_Recorder.LNK
lea ecx, [esi + 0x37c]
call fcn.0041f137
push 1
push 1
push str.SoftwareMicrosoftWindowsCurrentVersion
push edi
lea ecx, [ebp - 0x2c]
call fcn.004050b2
push 1
push 1
lea eax, [ebp + 8]
push str.ProgramFilesDir
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
push eax
lea ecx, [esi + 0x368]
mov byte [ebp - 4], 4
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
lea ecx, [ebp - 0x2c]
call fcn.004059b4
test eax, eax
jne 0x40cb77
lea eax, [ebp - 0x164]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp eax, ebx
je 0x40cb5f
cmp eax, 0x104
jae 0x40cb67
lea eax, [ebp - 0x164]
lea ecx, [esi + 0x370]
push eax
call fcn.0041ef25
lea eax, [ebp - 0x164]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
je 0x40cb4d
cmp eax, 0x104
jae 0x40cb55
cmp byte [ebp - 0x164], bl
je 0x40c4e2
lea eax, [ebp - 0x164]
push eax
call fcn.00411260
cmp byte [ebp + eax - 0x165], 0x5c
pop ecx
je 0x40c4f5
lea eax, [ebp - 0x164]
push 0x434124
push eax
call fcn.00411120
pop ecx
pop ecx
lea eax, [ebp - 0x164]
lea ecx, [esi + 0x36c]
push eax
call fcn.0041ef25
push ebx
push 1
push str.SOFTWAREHigh_CriteriaTotal_Recorder
push edi
lea ecx, [ebp - 0x2c]
call fcn.004050b2
lea ecx, [ebp - 0x2c]
call fcn.004059b4
neg eax
sbb eax, eax
push ebx
push 1
inc eax
push str.SoftwareHighCriteriaTotalRecorder
push edi
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x31c], eax
call fcn.004050b2
push ebx
push ebx
lea eax, [ebp + 8]
push str.Version
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
lea ecx, [esi + 0x358]
push eax
mov byte [ebp - 4], 5
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
mov eax, dword [esi + 0x358]
cmp dword [eax - 8], ebx
jne 0x40c58d
cmp dword [esi + 0x31c], ebx
je 0x40c58d
push 0x435b90
lea ecx, [esi + 0x358]
call fcn.0041ef25
push ebx
push str.Edition
lea ecx, [ebp - 0x2c]
call fcn.004055ce
push ebx
push str.NoDrv
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x32c], eax
call fcn.004055ce
push ebx
push str.NoDesktopShortcut
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x338], eax
mov dword [esi + 0x33c], eax
call fcn.004055ce
push ebx
push str.NoSched
lea ecx, [ebp - 0x2c]
mov dword [esi + 0x348], eax
call fcn.004055ce
mov dword [esi + 0x34c], eax
push ebx
push ebx
lea eax, [ebp + 8]
push str.Language
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
push eax
lea ecx, [esi + 0x330]
mov byte [ebp - 4], 6
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
push ebx
push ebx
lea eax, [ebp + 8]
push str.RegKeyPrefix
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
lea ecx, [esi + 0x334]
push eax
mov byte [ebp - 4], 7
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
mov eax, dword [esi + 0x334]
cmp dword [eax - 8], ebx
jne 0x40c6ab
mov ecx, dword [esi + 0x358]
cmp dword [ecx - 8], ebx
je 0x40c6ab
mov eax, dword [esi + 0x32c]
sub eax, ebx
je 0x40c68a
dec eax
je 0x40c683
dec eax
jne 0x40c6ab
push 0x435b84
push ecx
call fcn.00409894
pop ecx
test eax, eax
pop ecx
mov eax, str.TRD3
jl 0x40c680
mov eax, str.TRD4
push eax
jmp 0x40c6a0
push str.TRP4
jmp 0x40c6a0
push 0x435b70
push ecx
call fcn.00409894
pop ecx
test eax, eax
pop ecx
jl 0x40c6ab
push str.TR30
lea ecx, [esi + 0x334]
call fcn.0041ef25
mov eax, dword [esi + 0x358]
cmp dword [eax - 8], ebx
jne 0x40c6ca
mov dword [esi + 0x320], ebx
mov dword [esi + 0x324], ebx
mov dword [esi + 0x328], ebx
jmp 0x40c71d
push 0x434150
push eax
call fcn.00409894
push 0x434150
mov dword [ebp + 8], eax
push dword [esi + 0x358]
call fcn.00410cf0
add esp, 0x10
cmp eax, ebx
sete al
cmp dword [ebp + 8], ebx
movzx eax, al
mov dword [esi + 0x324], eax
jg 0x40c707
cmp eax, ebx
jne 0x40c707
push 1
pop eax
jmp 0x40c709
xor eax, eax
mov dword [esi + 0x320], eax
xor eax, eax
cmp dword [ebp + 8], ebx
setg al
mov dword [esi + 0x328], eax
push ebx
push 1
push str.SoftwareHighCriteriaTotalRecorder5.2
push edi
lea ecx, [ebp - 0x2c]
call fcn.004050b2
push ebx
push ebx
lea eax, [ebp + 8]
push str.Path
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
lea ecx, [esi + 0x364]
push eax
mov byte [ebp - 4], 8
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
push ebx
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsTotalRecorder.exe
push edi
lea ecx, [ebp - 0x2c]
call fcn.004050b2
push ebx
push ebx
lea eax, [ebp + 8]
push str.Path
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
lea ecx, [esi + 0x360]
push eax
mov byte [ebp - 4], 9
call fcn.0041eed5
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
cmp dword [0x43c08c], 2
jne 0x40c7b1
mov eax, dword [0x43c090]
mov eax, dword [eax + 4]
cmp byte [eax], 0x55
je 0x40c825
push ecx
lea eax, [esi + 0x364]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0041eb5d
push ecx
lea eax, [esi + 0x374]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 0xa
call fcn.0041eb5d
mov byte [ebp - 4], bl
call fcn.00402653
pop ecx
cmp eax, ebx
pop ecx
jne 0x40caab
push ecx
lea eax, [esi + 0x360]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0041eb5d
push ecx
lea eax, [esi + 0x374]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.0041eb5d
mov byte [ebp - 4], bl
call fcn.00402653
pop ecx
cmp eax, ebx
pop ecx
jne 0x40caab
cmp dword [esi + 0x31c], ebx
je 0x40c9bc
mov eax, dword [0x436704]
mov dword [ebp + 8], eax
push ebx
push 1
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTotal_Recorder
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xf
call fcn.004050b2
push ebx
push ebx
lea eax, [ebp - 0x10]
push str.UninstallString
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040547e
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x10
call fcn.0041eed5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call fcn.0041ede8
lea eax, [ebp - 0x5c]
push eax
push 2
push 0xffffffffffffffff
push 0x22
push 0x20
push dword [ebp + 8]
call fcn.00409724
add esp, 0x18
cmp eax, 2
jne 0x40c9b1
cmp dword [ebp - 0x48], eax
jbe 0x40c9b1
push eax
push 0x435b64
push dword [ebp - 0x4c]
call fcn.004121b0
add esp, 0xc
test eax, eax
jne 0x40c9b1
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x48]
add eax, 0xfffffffe
push 1
push eax
mov eax, dword [ebp - 0x4c]
push 0x22
add eax, 2
push ebx
push eax
call fcn.00409724
add esp, 0x18
cmp eax, 1
jne 0x40c9b1
cmp byte [ebp - 0x33], al
ja 0x40c9b1
cmp dword [ebp - 0x38], 3
jbe 0x40c9b1
mov eax, dword [ebp - 0x3c]
cmp byte [eax + 1], 0x3a
jne 0x40c9b1
cmp byte [eax + 2], 0x5c
jne 0x40c9b1
push dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004122a0
mov eax, dword [ebp - 0x38]
push ebx
push ebx
mov byte [ebp + eax - 0x164], bl
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.004117c1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00411110
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00411120
add esp, 0x30
lea eax, [ebp - 0x164]
lea edi, [esi + 0x360]
push eax
mov ecx, edi
call fcn.0041ef25
mov eax, dword [edi]
mov ecx, dword [eax - 8]
cmp ecx, 3
jle 0x40c9b1
cmp byte [ecx + eax - 1], 0x5c
jne 0x40c9b1
dec ecx
lea eax, [ebp - 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0041d68a
push eax
mov ecx, edi
mov byte [ebp - 4], 0x11
call fcn.0041eed5
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xf
call fcn.0041ede8
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.0041ede8
lea ecx, [ebp - 0x2c]
call fcn.0040523e
mov edi, str.Playback_through_TotalRecorder
push 0x42af90
push edi
push 0x502
push ebx
lea eax, [ebp - 0x770]
push ebx
push eax
call fcn.0040a824
mov dword [esi + 0x350], eax
lea eax, [ebp - 0x770]
push eax
call fcn.0040bd64
add esp, 0x1c
cmp dword [ebp - 0x770], ebx
je 0x40ca06
or dword [esi + 0x350], 4
test byte [esi + 0x350], 1
je 0x40ca68
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x770]
push eax
call fcn.0040a5ac
lea eax, [ebp - 0x770]
push eax
call fcn.0040bd64
lea eax, [ebp - 0x1a8]
push str.Record_through_TotalRecorder
push eax
call fcn.00410cf0
add esp, 0x14
test eax, eax
jne 0x40ca5e
lea eax, [ebp - 0x187]
push edi
push eax
call fcn.00410cf0
pop ecx
test eax, eax
pop ecx
jne 0x40ca5e
push 1
pop eax
jmp 0x40ca60
xor eax, eax
mov dword [esi + 0x340], eax
jmp 0x40ca72
mov dword [esi + 0x340], 1
mov eax, dword [esi + 0x340]
push str.Inst_windows_message___HighCriteria_TotalRecorder_Mrqx1FQGyj4c1kycrBxP
mov dword [esi + 0x344], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
cmp eax, ebx
mov dword [esi + 0x388], eax
jne 0x40caa3
push str.RegisterWindowMessage
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40cb6f
push 1
pop ebx
jmp 0x40cb77
mov eax, dword [0x436704]
mov dword [ebp + 8], eax
push 0xe00b
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xc
call fcn.00422e76
cmp dword [esi + 0x324], ebx
je 0x40cb24
xor eax, eax
cmp dword [esi + 0x348], ebx
setne al
add eax, 0xe016
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00406614
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xd
push str._n_n_s
push eax
call fcn.004065bb
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xe
call fcn.0041f15e
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xd
call fcn.0041ede8
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.0041ede8
push ebx
push 0x40000030
push dword [ebp + 8]
call fcn.00424b88
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.0041ede8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405079
xor eax, eax
jmp 0x40cb85
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40cb58
push 0x7a
pop eax
push str.GetSystemDirectory
jmp 0x40cb6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40cb6a
push 0x7a
pop eax
push str.GetTempPath
push eax
call fcn.0040bc53
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00405079
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4