Function at 0x401600
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
cmp esi, 0x19
jg 0x401963
je 0x401934
lea eax, [esi + 0x7fffffff]
cmp eax, 7
ja case.0x401976.27
jmp dword [eax*4 + 0x401be4]
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
mov ecx, 0x1a
mov eax, 0x23
cmp esi, 0x80000005
cmove eax, ecx
push eax
push edi
call fcn.00401590
add esp, 8
test eax, eax
je 0x401bd9
push edi
call fcn.00401000
mov edx, dword [section..data]
add esp, 4
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4016c0
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4016d0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401bd9
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
mov ecx, str.CommonFilesDir
push 0
mov eax, str.ProgramFilesDir
cmp esi, 0x80000006
cmovne eax, ecx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp + 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4017aa
cmp esi, 0x80000007
jne 0x4017af
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
mov dword [ebp + 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4017af
push edi
call fcn.00401000
add esp, 4
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401790
mov ecx, 6
mov esi, str.Common_Files
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ebx, 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push 0x2e
push esi
call fcn.00401590
add esp, 8
test eax, eax
je 0x40183f
push 0x5c
push esi
call fcn.0040614b
add esp, 8
test eax, eax
jne 0x40180d
mov ecx, 0x410390
sub esi, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4017f0
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, esi
jbe 0x40182c
cmp word [eax - 2], 0x3a
jne 0x40182c
pop edi
xor ecx, ecx
mov ebx, 1
mov word [eax + 2], cx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor ecx, ecx
mov ebx, 1
mov word [eax], cx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x417fac], bl
je 0x4018db
push 0x1a
push esi
call fcn.00401590
add esp, 8
test eax, eax
je 0x40189e
push 0x5c
push esi
call fcn.0040614b
add esp, 8
test eax, eax
je 0x40189e
xor ecx, ecx
push 0x5c
push esi
mov word [eax], cx
call fcn.0040614b
mov edx, eax
add esp, 8
test edx, edx
je 0x40189e
mov ecx, 0x410398
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401886
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call fcn.00401000
add esp, 4
add esi, 0xfffffffe
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x4018b6
mov edi, esi
mov ecx, 9
mov esi, str.ProfilesAll_Users
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call fcn.00401000
add esp, 4
add esi, 0xfffffffe
mov ax, word [esi + 2]
lea esi, [esi + 2]
test ax, ax
jne 0x4018f3
mov eax, dword [str.All_Users]
mov dword [esi], eax
mov eax, dword [0x4103dc]
mov dword [esi + 4], eax
mov eax, dword [0x4103e0]
mov dword [esi + 8], eax
mov eax, dword [0x4103e4]
mov dword [esi + 0xc], eax
mov eax, dword [0x4103e8]
pop edi
mov dword [esi + 0x10], eax
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
push 0x19
push esi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
push str.All_UsersDesktop
push esi
call fcn.004013f0
add esp, 8
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x1a]
cmp eax, 0x14
ja case.0x401976.27
movzx eax, byte [eax + 0x401c1c]
jmp dword [eax*4 + 0x401c04]
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push edi
call fcn.00401000
add esp, 4
add edi, 0xfffffffe
cmp byte [0x417fac], bl
jne 0x4019e0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4019b4
mov ecx, 8
mov esi, str.Application_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4019e0
mov ecx, 0x14
mov esi, str.ProfilesAdministratorApplication_Data
rep movsd dword es:[edi], dword [esi]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
push esi
push edi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
cmp byte [0x417fac], al
je 0x401a6d
push 0x1a
push edi
call fcn.00401590
add esp, 8
test eax, eax
je 0x401a6d
push 0x5c
push edi
call fcn.0040614b
mov edx, eax
add esp, 8
test edx, edx
je 0x401a6d
mov ecx, str.Local_SettingsApplication_Data
sub edx, ecx
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401a50
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push edi
call fcn.00401000
add esp, 4
add edi, 0xfffffffe
cmp byte [0x417fac], 0
jne 0x401ac0
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401a90
mov ecx, 8
mov esi, str.Application_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x401ac0
mov ecx, 0x1b
mov esi, str.ProfilesAdministratorLocal_SettingsApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
push str.All_UsersApplication_Data
push esi
call fcn.004013f0
add esp, 8
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
push str.All_UsersDocuments
push esi
call fcn.004013f0
add esp, 8
mov ebx, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00401590
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x401bd9
cmp byte [0x417fac], al
je 0x401bb1
push 0x1a
push esi
call fcn.00401590
push 0x5c
push esi
call fcn.0040614b
add esp, 0x10
test eax, eax
jne 0x401b9e
mov ecx, 0x410390
sub esi, ecx
movzx eax, word [ecx]
mov word [esi + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x401b81
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
xor ecx, ecx
mov ebx, 1
mov word [eax], cx
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 8]
call fcn.00401590
mov ebx, eax
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret