Function at 0x406e13
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::npos]
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
push dword [eax]
push ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::erase_unsigned_int__unsigned_int_]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80a]
cmp dword [ebp - 4], ebx
mov word [ebp - 0x80c], bx
mov dword [ebp - 8], 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
je 0x406f27
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.TEMP
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406f1d
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x80c]
push eax
call esi
pop ecx
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::assign_unsigned_short_int_const___unsigned_int_]
mov edi, dword [0x420da8]
push edi
call esi
pop ecx
mov ecx, dword [ebp + 8]
push eax
push ebx
push edi
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::find_unsigned_short_int_const___unsigned_int__unsigned_int_const]
mov edi, eax
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::npos]
cmp edi, dword [eax]
je 0x406f1d
lea eax, [ebp - 0x80c]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jbe 0x406f1d
push dword [0x420da8]
call esi
mov ebx, eax
lea eax, [ebp - 0x80c]
push eax
call esi
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x80c]
push eax
push ebx
push edi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::replace_unsigned_int__unsigned_int__unsigned_short_int_const___unsigned_int_]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret