Function at 0x40cb60
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
push str.Windows
push ebp
call fcn.0041add0
add esp, 8
xor ebx, ebx
test eax, eax
jne 0x40cb90
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40ce66
push str.System
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cbb3
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40ce66
push str.System64
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cbd6
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40ce66
push str.TempDir
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cbf9
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40ce66
push str.CommonFiles
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40ccbd
lea eax, [esp + 0x2c]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ce66
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push ebp
push edx
push ebx
push str.CommonFilesDir
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0x104
call esi
test eax, eax
je 0x40ccad
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push ebp
push edx
push ebx
push str.ProgramFilesDir
push eax
call esi
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x426a60]
mov dword [edi + 4], edx
mov eax, dword [0x426a64]
mov dword [edi + 8], eax
mov cl, byte [0x426a68]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ce66
push str.Program_Files
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cd2a
lea eax, [esp + 0x2c]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ce66
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
push ebx
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ce66
push str.Program_Files__x64_
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cd97
lea edx, [esp + 0x2c]
push edx
push 0x20119
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ce66
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ebp
push ecx
push ebx
push str.ProgramFilesDir
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ce66
push str.MyDocuments
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cdb9
push 5
push ebp
call fcn.00401030
add esp, 8
jmp 0x40ce66
push str.Desktop
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cddb
push 0x10
push ebp
call fcn.00401030
add esp, 8
jmp 0x40ce66
push str.AppData
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40ce7c
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov eax, dword [0x42bbbc]
add esp, 4
or ecx, 0xffffffff
cmp eax, ebx
mov edi, ebp
jne 0x40ce55
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x426750]
mov dword [edi + 4], edx
mov eax, dword [0x426754]
mov dword [edi + 8], eax
mov ecx, dword [0x426758]
mov dword [edi + 0xc], ecx
mov dl, byte [0x42675c]
mov byte [edi + 0x10], dl
jmp 0x40ce66
xor eax, eax
mov esi, str.ProfilesAdministratorApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp], bl
je 0x40ce74
push ebp
call fcn.004020f0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push str.LocalAppData
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40cf4c
push 0x1c
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
cmp dword [0x42bbbc], ebx
je 0x40cedc
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40cedc
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40cedc
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
cmp al, bl
jne 0x40ced0
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov eax, dword [0x42bbbc]
add esp, 4
or ecx, 0xffffffff
cmp eax, ebx
mov edi, ebp
jne 0x40cf33
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.Application_Data]
dec edi
mov dword [edi], eax
mov ecx, dword [0x426750]
mov dword [edi + 4], ecx
mov edx, dword [0x426754]
mov dword [edi + 8], edx
mov eax, dword [0x426758]
mov dword [edi + 0xc], eax
mov cl, byte [0x42675c]
mov byte [edi + 0x10], cl
jmp 0x40ce66
xor eax, eax
mov esi, str.ProfilesAdministratorLocal_SettingsApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40ce66
push str.AllUsersAppData
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d025
push 0x23
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
cmp dword [0x42bbbc], ebx
jne 0x40cfb0
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
mov esi, str.All_UsersApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40ce66
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40cff7
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40cff7
push 0x5c
push ebp
mov byte [eax], bl
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40cff7
mov ecx, 0x42672c
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
cmp al, bl
jne 0x40cfe8
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 9
mov esi, str.ProfilesAll_UsersApplication_Data
jmp 0x40ce64
push str.AllUsersDocuments
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d0fc
push 0x2e
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
cmp dword [0x42bbbc], ebx
jne 0x40d084
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
mov esi, str.All_UsersDocuments
jmp 0x40ce64
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40d0cb
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d0cb
push 0x5c
push ebp
mov byte [eax], bl
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d0cb
mov ecx, 0x4268f0
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
cmp al, bl
jne 0x40d0bc
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
mov esi, str.ProfilesAll_UsersDocuments
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40ce66
push str.AllUsersDesktop
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d1f7
push 0x19
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
cmp dword [0x42bbbc], ebx
jne 0x40d17d
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [str.All_UsersDesktop]
dec edi
mov dword [edi], edx
mov eax, dword [0x4268ac]
mov dword [edi + 4], eax
mov ecx, dword [0x4268b0]
mov dword [edi + 8], ecx
mov edx, dword [0x4268b4]
mov dword [edi + 0xc], edx
mov ax, word [0x4268b8]
mov word [edi + 0x10], ax
jmp 0x40ce66
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40d1c4
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d1c4
push 0x5c
push ebp
mov byte [eax], bl
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d1c4
mov ecx, 0x426894
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
cmp al, bl
jne 0x40d1b5
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
mov esi, str.ProfilesAll_UsersDesktop
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x40ce66
push str.UserDir
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d25b
push 0x28
push ebp
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40ce66
cmp dword [0x42bbbc], ebx
je 0x40cb7f
push 0x1a
push ebp
call fcn.00401030
push 0x5c
push ebp
call fcn.0041aff0
add esp, 0x10
cmp eax, ebx
jne 0x40d40c
mov eax, 0x426748
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x40d24c
jmp 0x40ce66
push str.AllUsersDir
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d3ac
push 0x2e
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40d2c1
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
jne 0x40d2a7
mov eax, 0x426748
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x40d298
jmp 0x40ce66
cmp eax, ebp
jbe 0x40d40c
cmp byte [eax - 1], 0x3a
jne 0x40d40c
mov byte [eax + 1], bl
jmp 0x40ce66
cmp dword [0x42bbbc], ebx
je 0x40d36d
push 0x1a
push ebp
call fcn.00401030
add esp, 8
test eax, eax
je 0x40d314
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d314
push 0x5c
push ebp
mov byte [eax], bl
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40d314
mov ecx, str.All_Users
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [ecx + edx], al
inc ecx
cmp al, bl
jne 0x40d305
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.ProfilesAll_Users]
dec edi
mov dword [edi], ecx
mov edx, dword [0x426840]
mov dword [edi + 4], edx
mov eax, dword [0x426844]
mov dword [edi + 8], eax
mov ecx, dword [0x426848]
mov dword [edi + 0xc], ecx
mov dx, word [0x42684c]
mov word [edi + 0x10], dx
mov al, byte [0x42684e]
mov byte [edi + 0x12], al
jmp 0x40ce66
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.004020b0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [0x426830]
dec edi
mov dword [edi], ecx
mov edx, dword [0x426834]
mov dword [edi + 4], edx
mov ax, word [0x426838]
mov word [edi + 8], ax
jmp 0x40ce66
push str.InstallDir
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d3d5
mov ecx, dword [0x42bc20]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x40d3c6
jmp 0x40ce66
push str.SourceDir
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d413
mov ecx, dword [0x42bc3c]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x40d3ef
push 0x5c
push ebp
call fcn.0041aff0
add esp, 8
cmp eax, ebx
je 0x40ce66
mov byte [eax], bl
jmp 0x40ce66
push str.UserName
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d43a
mov ecx, dword [0x42b7dc]
push ecx
push ebp
call fcn.0040d610
add esp, 8
jmp 0x40ce66
push str.UserCompany
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d461
mov edx, dword [0x42b7d8]
push edx
push ebp
call fcn.0040d610
add esp, 8
jmp 0x40ce66
push str.UserSerialNumber
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d487
mov eax, dword [0x42b7d0]
push eax
push ebp
call fcn.0040d610
add esp, 8
jmp 0x40ce66
push str.UserEmail
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d4ae
mov ecx, dword [0x42b7d4]
push ecx
push ebp
call fcn.0040d610
add esp, 8
jmp 0x40ce66
push str.UserInfo
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d4d5
mov edx, dword [0x42b7cc]
push edx
push ebp
call fcn.0040d610
add esp, 8
jmp 0x40ce66
push str.UserRegCode
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d4fe
mov ecx, dword [0x42b7e4]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
cmp al, bl
jne 0x40d4ef
jmp 0x40ce66
push str.Date
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d55f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1a]
and eax, 0xffff
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
mov ecx, dword [esp + 0x1e]
and ecx, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [ecx + eax*4]
push edx
push 0x4267b0
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40ce66
push str.Year
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d59b
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x18]
and ecx, 0xffff
push ecx
push 0x4267b0
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40ce66
push str.Month
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d5d6
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0x1a]
and eax, 0xffff
push eax
push 0x4267b0
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40ce66
push str.Day
push ebp
call fcn.0041add0
add esp, 8
test eax, eax
jne 0x40d602
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x1e]
and edx, 0xffff
jmp 0x40d54a
pop edi
mov byte [ebp], 0
pop esi
pop ebp
pop ebx
add esp, 0x18
ret