Function at 0x4028ec
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x406f78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8ec
mov dword [ebp - 0x868], ecx
lea eax, [ebp - 0x760]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.004036e0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4029e5
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x76c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
push 0x40a160
lea ecx, [ebp - 0x770]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x76c]
push eax
lea ecx, [ebp - 0x770]
push ecx
lea ecx, [ebp - 0x768]
call fcn.00403830
mov dword [ebp - 0x86c], eax
mov edx, dword [ebp - 0x86c]
mov dword [ebp - 0x870], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x870]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x768]
call fcn.00403690
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x770]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x76c]
call fcn.00405e62
jmp 0x402a7b
push str.c:windows
lea ecx, [ebp - 0x77c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 4
push str._WINDIR_
lea ecx, [ebp - 0x780]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x77c]
push ecx
lea edx, [ebp - 0x780]
push edx
lea ecx, [ebp - 0x778]
call fcn.00403830
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x878], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x878]
push ecx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x778]
call fcn.00403690
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x780]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x77c]
call fcn.00405e62
push 0x104
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jbe 0x402b3d
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x78c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 7
push 0x40a184
lea ecx, [ebp - 0x790]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x78c]
push ecx
lea edx, [ebp - 0x790]
push edx
lea ecx, [ebp - 0x788]
call fcn.00403830
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x880], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x880]
push ecx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x788]
call fcn.00403690
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x790]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x78c]
call fcn.00405e62
jmp 0x402bd3
push str.c:windows_system32
lea ecx, [ebp - 0x79c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xa
push str._SYSDIR_
lea ecx, [ebp - 0x7a0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x79c]
push edx
lea eax, [ebp - 0x7a0]
push eax
lea ecx, [ebp - 0x798]
call fcn.00403830
mov dword [ebp - 0x884], eax
mov ecx, dword [ebp - 0x884]
mov dword [ebp - 0x888], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x888]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x798]
call fcn.00403690
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7a0]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x79c]
call fcn.00405e62
push 0
push 0x26
lea eax, [ebp - 0x324]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x402c96
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x7ac]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xd
push 0x40a1b0
lea ecx, [ebp - 0x7b0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x7ac]
push edx
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0x7a8]
call fcn.00403830
mov dword [ebp - 0x88c], eax
mov ecx, dword [ebp - 0x88c]
mov dword [ebp - 0x890], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x890]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x7a8]
call fcn.00403690
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7b0]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7ac]
call fcn.00405e62
jmp 0x402d8b
push str._PROGRAMFILES_
lea ecx, [ebp - 0x7c4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x10
push str.Program_Files
push 2
lea eax, [ebp - 0x7bc]
push eax
push 0
mov ecx, dword [ebp - 0x868]
call fcn.004037e0
mov ecx, eax
add ecx, 4
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x894]
mov dword [ebp - 0x898], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x898]
push edx
lea eax, [ebp - 0x7c0]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x89c]
mov dword [ebp - 0x8a0], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x8a0]
push edx
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0x7b8]
call fcn.00403830
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a8], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x8a8]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7b8]
call fcn.00403690
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x7c0]
call fcn.00405e62
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x7bc]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c4]
call fcn.00405e62
push 0
push 2
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jl 0x402e4e
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x7d0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x14
push 0x40a1e0
lea ecx, [ebp - 0x7d4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x7d0]
push edx
lea eax, [ebp - 0x7d4]
push eax
lea ecx, [ebp - 0x7cc]
call fcn.00403830
mov dword [ebp - 0x8ac], eax
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x8b0], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x8b0]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x7cc]
call fcn.00403690
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7d4]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7d0]
call fcn.00405e62
jmp 0x402ee4
push 0x40a1ec
lea ecx, [ebp - 0x7e0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x17
push str._PROGRAMS_
lea ecx, [ebp - 0x7e4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x7e0]
push eax
lea ecx, [ebp - 0x7e4]
push ecx
lea ecx, [ebp - 0x7dc]
call fcn.00403830
mov dword [ebp - 0x8b4], eax
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x8b8], edx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x8b8]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x7dc]
call fcn.00403690
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x7e4]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7e0]
call fcn.00405e62
push 0
push 0x10
lea ecx, [ebp - 0x534]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jl 0x402fa7
lea edx, [ebp - 0x534]
push edx
lea ecx, [ebp - 0x7f0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1a
push 0x40a230
lea ecx, [ebp - 0x7f4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0x7f4]
push ecx
lea ecx, [ebp - 0x7ec]
call fcn.00403830
mov dword [ebp - 0x8bc], eax
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x8c0], edx
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x8c0]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7ec]
call fcn.00403690
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x7f4]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f0]
call fcn.00405e62
jmp 0x40303d
push str.C:Documents_and_SettingsAll_Users_
lea ecx, [ebp - 0x800]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1d
push str._DESKTOP_
lea ecx, [ebp - 0x804]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x800]
push ecx
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x7fc]
call fcn.00403830
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x8c8]
push ecx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x7fc]
call fcn.00403690
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x804]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x800]
call fcn.00405e62
mov dword [ebp - 0x53c], 0
lea edx, [ebp - 0x538]
push edx
push 0x20019
push 0
push str.SoftwareGloballinkGameShare
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
jne 0x4032a2
mov dword [ebp - 0x750], 0x104
mov dword [ebp - 0x544], 1
lea eax, [ebp - 0x750]
push eax
lea ecx, [ebp - 0x648]
push ecx
lea edx, [ebp - 0x544]
push edx
push 0
push str.Path
mov eax, dword [ebp - 0x538]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
jne 0x4032a2
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x648]
push edx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
push eax
lea ecx, [ebp - 0x810]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x20
push 0x40a29c
lea ecx, [ebp - 0x814]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x814]
push edx
lea ecx, [ebp - 0x80c]
call fcn.00403830
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x8d0], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x8d0]
push ecx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x80c]
call fcn.00403690
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x814]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x810]
call fcn.00405e62
lea edx, [ebp - 0x648]
push edx
lea eax, [ebp - 0x74c]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x74c]
mov dword [ebp - 0x754], ecx
lea edx, [ebp - 0x74c]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x75c], eax
push str.game_share
mov eax, dword [ebp - 0x754]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0
je 0x403200
mov ecx, dword [ebp - 0x758]
add ecx, 0xb
mov edx, dword [ebp - 0x754]
add edx, dword [ebp - 0x75c]
cmp ecx, edx
jne 0x403200
mov eax, dword [ebp - 0x758]
mov byte [eax], 0
mov ecx, dword [ebp - 0x754]
push ecx
lea ecx, [ebp - 0x820]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x23
push 0x40a2b8
lea ecx, [ebp - 0x824]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00403830
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8d8], ecx
mov byte [ebp - 4], 0x25
mov edx, dword [ebp - 0x8d8]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x81c]
call fcn.00403690
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x824]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x820]
call fcn.00405e62
mov dword [ebp - 0x53c], 1
cmp dword [ebp - 0x53c], 0
jne 0x4033db
push str._PROGRAMFILES_GlobalLinkGameShare
lea ecx, [ebp - 0x830]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x26
push str._GLWORLDDIR_
lea ecx, [ebp - 0x834]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x834]
push ecx
lea ecx, [ebp - 0x82c]
call fcn.00403830
mov dword [ebp - 0x8dc], eax
mov edx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e0], edx
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x8e0]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x82c]
call fcn.00403690
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x834]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x830]
call fcn.00405e62
push 0x40a2f8
lea ecx, [ebp - 0x840]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x29
push str._GLDIR_
lea ecx, [ebp - 0x844]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x840]
push ecx
lea edx, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x83c]
call fcn.00403830
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x8e8]
push ecx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x83c]
call fcn.00403690
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x844]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x840]
call fcn.00405e62
push str._PROGRAMFILES_GlobalLink
lea ecx, [ebp - 0x850]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2c
push str._TARGETDIR_
lea ecx, [ebp - 0x854]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x84c]
call fcn.00403830
mov dword [ebp - 0x8ec], eax
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp - 0x8f0], ecx
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x8f0]
push edx
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x84c]
call fcn.00403690
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x854]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x850]
call fcn.00405e62
push str._TARGETDIR_Restore
lea ecx, [ebp - 0x860]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2f
push str._GLRESTOREDIR_
lea ecx, [ebp - 0x864]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x860]
push eax
lea ecx, [ebp - 0x864]
push ecx
lea ecx, [ebp - 0x85c]
call fcn.00403830
mov dword [ebp - 0x8f4], eax
mov edx, dword [ebp - 0x8f4]
mov dword [ebp - 0x8f8], edx
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x8f8]
push eax
mov ecx, dword [ebp - 0x868]
call fcn.00403800
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x85c]
call fcn.00403690
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x864]
call fcn.00405e62
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x860]
call fcn.00405e62
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x868]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret