Function at 0x40b570
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push str.Windows
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b59d
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40b7c3
push str.System
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b5c0
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40b7c3
push str.TempDir
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b5e3
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40b7c3
push str.CommonFiles
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b6a9
lea eax, [esp + 0x28]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b7c3
lea ecx, [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0x38]
push str.CommonFilesDir
push eax
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
je 0x40b699
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
push 0
push str.ProgramFilesDir
push eax
call esi
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x42495c]
mov dword [edi + 4], edx
mov eax, dword [0x424960]
mov dword [edi + 8], eax
mov cl, byte [0x424964]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b7c3
push str.Program_Files
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b717
lea eax, [esp + 0x28]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b7c3
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push ebp
push edx
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x38]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b7c3
push str.MyDocuments
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b739
push 5
push ebp
call fcn.00401090
add esp, 8
jmp 0x40b7c3
push str.AppData
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b7d9
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov eax, dword [0x429a84]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x40b7b2
xor eax, eax
mov edx, dword [str.Application_Data]
repne scasb al, byte es:[edi]
dec edi
mov dword [edi], edx
mov eax, dword [0x4246d4]
mov dword [edi + 4], eax
mov ecx, dword [0x4246d8]
mov dword [edi + 8], ecx
mov edx, dword [0x4246dc]
mov dword [edi + 0xc], edx
mov al, byte [0x4246e0]
mov byte [edi + 0x10], al
jmp 0x40b7c3
xor eax, eax
mov esi, str.ProfilesAdministratorApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp], 0
je 0x40b7d2
push ebp
call fcn.00402110
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0x18
ret
push str.LocalAppData
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b8ab
push 0x1c
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40b7c3
mov eax, dword [0x429a84]
test eax, eax
je 0x40b83a
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40b83a
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40b83a
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40b82e
jmp 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov eax, dword [0x429a84]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x40b892
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x4246d4]
mov dword [edi + 4], edx
mov eax, dword [0x4246d8]
mov dword [edi + 8], eax
mov ecx, dword [0x4246dc]
mov dword [edi + 0xc], ecx
mov dl, byte [0x4246e0]
mov byte [edi + 0x10], dl
jmp 0x40b7c3
xor eax, eax
mov esi, str.ProfilesAdministratorLocal_SettingsApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40b7c3
push str.AllUsersAppData
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40b986
push 0x23
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40b7c3
mov eax, dword [0x429a84]
test eax, eax
jne 0x40b910
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
mov esi, str.All_UsersApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40b7c3
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40b958
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40b958
push 0x5c
push ebp
mov byte [eax], 0
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40b958
mov ecx, 0x4246b0
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40b949
jmp 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 9
mov esi, str.ProfilesAll_UsersApplication_Data
jmp 0x40b7c1
push str.AllUsersDocuments
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40ba5f
push 0x2e
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40b7c3
mov eax, dword [0x429a84]
test eax, eax
jne 0x40b9e6
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
mov esi, str.All_UsersDocuments
jmp 0x40b7c1
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40ba2e
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40ba2e
push 0x5c
push ebp
mov byte [eax], 0
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40ba2e
mov ecx, 0x424804
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40ba1f
jmp 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
mov esi, str.ProfilesAll_UsersDocuments
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40b7c3
push str.UserDir
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bac4
push 0x28
push ebp
call fcn.00401090
add esp, 8
test eax, eax
jne 0x40b7c3
mov eax, dword [0x429a84]
test eax, eax
je 0x40b58c
push 0x1a
push ebp
call fcn.00401090
push 0x5c
push ebp
call fcn.00418f90
add esp, 0x10
test eax, eax
jne 0x40bc78
mov eax, 0x4246cc
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bab5
jmp 0x40b7c3
push str.AllUsersDir
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bc18
push 0x2e
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40bb2b
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40bb10
mov eax, 0x4246cc
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bb01
jmp 0x40b7c3
cmp eax, ebp
jbe 0x40bc78
cmp byte [eax - 1], 0x3a
jne 0x40bc78
mov byte [eax + 1], 0
jmp 0x40b7c3
mov eax, dword [0x429a84]
test eax, eax
je 0x40bbd9
push 0x1a
push ebp
call fcn.00401090
add esp, 8
test eax, eax
je 0x40bb80
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40bb80
push 0x5c
push ebp
mov byte [eax], 0
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40bb80
mov ecx, str.All_Users
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40bb71
jmp 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [str.ProfilesAll_Users]
dec edi
mov dword [edi], eax
mov ecx, dword [0x4247ac]
mov dword [edi + 4], ecx
mov edx, dword [0x4247b0]
mov dword [edi + 8], edx
mov eax, dword [0x4247b4]
mov dword [edi + 0xc], eax
mov cx, word [0x4247b8]
mov word [edi + 0x10], cx
mov dl, byte [0x4247ba]
mov byte [edi + 0x12], dl
jmp 0x40b7c3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020d0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [0x42479c]
dec edi
mov dword [edi], eax
mov ecx, dword [0x4247a0]
mov dword [edi + 4], ecx
mov dx, word [0x4247a4]
mov word [edi + 8], dx
jmp 0x40b7c3
push str.InstallDir
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bc41
mov ecx, dword [0x429ae8]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40bc32
jmp 0x40b7c3
push str.SourceDir
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bc80
mov ecx, dword [0x429b04]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40bc5b
push 0x5c
push ebp
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40b7c3
mov byte [eax], 0
jmp 0x40b7c3
push str.UserName
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bca6
mov eax, dword [0x4296e4]
push eax
push ebp
call fcn.0040bde0
add esp, 8
jmp 0x40b7c3
push str.UserCompany
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bccd
mov ecx, dword [0x4296e0]
push ecx
push ebp
call fcn.0040bde0
add esp, 8
jmp 0x40b7c3
push str.UserSerialNumber
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bcf4
mov edx, dword [0x4296d8]
push edx
push ebp
call fcn.0040bde0
add esp, 8
jmp 0x40b7c3
push str.UserEmail
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bd1a
mov eax, dword [0x4296dc]
push eax
push ebp
call fcn.0040bde0
add esp, 8
jmp 0x40b7c3
push str.UserInfo
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bd41
mov ecx, dword [0x4296d4]
push ecx
push ebp
call fcn.0040bde0
add esp, 8
jmp 0x40b7c3
push str.UserRegCode
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bd6a
mov ecx, dword [0x4296ec]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40bd5b
jmp 0x40b7c3
push str.Date
push ebp
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bdca
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x16]
and eax, 0xffff
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
lea ecx, [eax + edx*4]
push ecx
push 0x42471c
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40b7c3
pop edi
mov byte [ebp], 0
pop esi
pop ebp
add esp, 0x18
ret