Function at 0x401d20
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x41f228
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x429978]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, ecx
push str.CIniFile::GetVariableFromIni
lea ecx, [esp + 0x30]
call fcn.00401120
xor esi, esi
push 0x104
mov dword [esp + 0x40], esi
call fcn.00403b7b
push 0x104
mov dword [esp + 0x24], eax
call fcn.00403b7b
mov edi, eax
push 0x104
mov dword [esp + 0x24], edi
call fcn.00403b7b
push 0x104
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], esi
call fcn.00403b7b
add esp, 0x10
test edi, edi
mov ebp, eax
mov dword [esp + 0x28], ebp
je 0x40220c
cmp dword [esp + 0x1c], esi
je 0x40220c
mov edi, dword [esp + 0x44]
push str.SourcePath
push edi
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x401e54
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
push 0x104
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40220c
mov edi, ebp
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x401e00
mov al, byte [0x421780]
push 0x5c
push ebp
mov byte [edi], al
call fcn.0040dc0c
add esp, 8
test eax, eax
je 0x40220c
mov edx, esi
mov byte [eax], 0
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401e30
push esi
lea ecx, [esp + 0x30]
push str.SourcePath:__s
push ecx
call fcn.004013f0
add esp, 0xc
jmp 0x40220c
push str.SystemDir
push edi
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x401e8e
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40220c
push str.ProgramFilesDir
push edi
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x401f1a
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
lea edx, [esp + 0x14]
push edx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40220c
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push esi
push 0
push 0
push str.ProgramFilesDir
push ecx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40220c
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x40221f
push str.PrinterDriverDir
push edi
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x401f5e
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
lea eax, [esp + 0x44]
push eax
push 0x104
push esi
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
jmp 0x40220c
push str.WindowsDir
push edi
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x401f98
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40220c
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push str.Variables:__s
push ecx
mov dword [eax], 0x524156
call fcn.004013f0
mov ebp, dword [esp + 0x54]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
add esp, 0xc
push ebp
push 0x104
push edx
push 0x4218b6
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401ff1
push edi
lea ecx, [esp + 0x30]
push str.Unable_to_read__s_in_section:_VAR
push ecx
call fcn.004013f0
add esp, 0xc
jmp 0x40220c
mov edx, dword [esp + 0x24]
push ebp
push edx
push edi
mov ecx, ebx
call fcn.00402290
test eax, eax
je 0x4021df
mov ebx, dword [esp + 0x18]
push 0x421890
push ebx
call fcn.0040c91b
add esp, 8
test eax, eax
jne 0x402035
push ebx
lea eax, [esp + 0x30]
push str.Invalid_Registry_Key_format:__s
push eax
call fcn.004013f0
add esp, 0xc
jmp 0x40220c
push eax
mov byte [eax], 0
call fcn.0040e025
mov ebp, eax
push 0x421890
push ebp
mov edi, ebp
call fcn.0040c91b
add esp, 0xc
test eax, eax
je 0x402079
push 0x421890
push edi
call fcn.0040c91b
push eax
call fcn.0040e025
mov edi, eax
push 0x421890
push edi
call fcn.0040c91b
add esp, 0x14
test eax, eax
jne 0x402054
push edi
push ebx
call fcn.0040e012
push eax
mov byte [eax], 0
call fcn.0040e025
push str.HKLM
push ebx
mov dword [esp + 0x58], eax
call fcn.0040df68
add esp, 0x14
test eax, eax
jne 0x4020a9
mov edi, 0x80000002
jmp 0x402128
push str.HKEY_LOCAL_MACHINE
push ebx
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x4020c2
mov edi, 0x80000002
jmp 0x402128
push str.HKEY_CLASSES_ROOT
push ebx
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x4020db
mov edi, 0x80000000
jmp 0x402128
push str.HKEY_CURRENT_USER
push ebx
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x4020f4
mov edi, 0x80000001
jmp 0x402128
push str.HKEY_USERS
push ebx
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x40210d
mov edi, 0x80000003
jmp 0x402128
push str.HKEY_CURRENT_CONFIG
push ebx
call fcn.0040df68
add esp, 8
test eax, eax
jne 0x4021ca
mov edi, VariantCopy
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402183
push ebp
mov edx, ebx
push edx
lea eax, [esp + 0x34]
push str.Error_opening_registry_key:__s_s
push eax
call fcn.004013f0
mov eax, dword [esp + 0x34]
mov edx, esi
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402172
jmp 0x40220c
mov edi, dword [esp + 0x44]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push esi
push 0
push 0
push edi
push edx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40220c
push edi
push ebp
mov eax, ebx
push eax
lea ecx, [esp + 0x38]
push str.Error_reading_registry_value:__s_s_s
push ecx
call fcn.004013f0
push esi
call fcn.00403b76
add esp, 0x18
xor esi, esi
jmp 0x40220c
push ebx
lea edx, [esp + 0x30]
push str.Unknown_registry_key:__s
push edx
call fcn.004013f0
add esp, 0xc
jmp 0x40220c
push 0x104
call fcn.00403b7b
mov esi, eax
add esp, 4
test esi, esi
je 0x40220c
mov eax, dword [esp + 0x18]
mov edx, esi
sub edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402200
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40221b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x402230
push eax
call fcn.00403b76
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402241
push eax
call fcn.00403b76
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402252
push eax
call fcn.00403b76
add esp, 4
test ebp, ebp
je 0x40225f
push ebp
call fcn.00403b76
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004012c0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8