Function at 0x468250
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x580
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x560], eax
mov eax, 0x5521d0
push edi
lea edi, [eax + 1]
xor ebx, ebx
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x468280
sub eax, edi
mov esi, 0xf
jne 0x468423
push 0xff
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
mov dword [ebp - 0x540], esi
mov dword [ebp - 0x544], ebx
mov byte [ebp - 0x554], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4682c1
sub eax, edx
push eax
lea edx, [ebp - 0x104]
push edx
lea ecx, [ebp - 0x558]
call fcn.0040b8b0
push 2
push ebx
lea eax, [ebp - 0x558]
push eax
lea ecx, [ebp - 0x53c]
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x528], ebx
mov byte [ebp - 0x538], bl
call fcn.00410c40
push 0xc
push str.DosDevices_
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x55c], 3
mov dword [ebp - 0x564], 0x3ff
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x50c], ebx
mov byte [ebp - 0x51c], bl
call fcn.0040b8b0
lea ecx, [ebp - 0x53c]
push ecx
lea eax, [ebp - 0x520]
lea edi, [ebp - 0x580]
call fcn.0040e300
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x520]
call fcn.00410c40
mov edi, 0x10
cmp dword [ebp - 0x568], edi
jb 0x468382
mov edx, dword [ebp - 0x57c]
push edx
call fcn.004c097a
add esp, 4
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x508], edi
jae 0x468396
lea eax, [ebp - 0x51c]
lea ecx, [ebp - 0x564]
push ecx
push 0x5521d0
lea edx, [ebp - 0x55c]
push edx
push eax
push str.SYSTEMMountedDevices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp dword [ebp - 0x508], edi
jb 0x4683d1
mov eax, dword [ebp - 0x51c]
push eax
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x50c], ebx
mov byte [ebp - 0x51c], bl
cmp dword [ebp - 0x524], edi
jb 0x4683fa
mov ecx, dword [ebp - 0x538]
push ecx
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x528], ebx
mov byte [ebp - 0x538], bl
cmp dword [ebp - 0x540], edi
jb 0x468423
mov edx, dword [ebp - 0x554]
push edx
call fcn.004c097a
add esp, 4
mov edx, dword [ebp - 0x560]
mov eax, edx
mov dword [ebp - 0x540], esi
mov dword [ebp - 0x544], ebx
mov byte [ebp - 0x554], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x468440
sub eax, edi
push eax
push edx
lea ecx, [ebp - 0x558]
call fcn.0040b8b0
push 2
push ebx
lea eax, [ebp - 0x558]
push eax
lea ecx, [ebp - 0x520]
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x50c], ebx
mov byte [ebp - 0x51c], bl
call fcn.00410c40
lea ecx, [ebp - 0x520]
push ecx
mov eax, str.DosDevices_
lea edi, [ebp - 0x53c]
call fcn.00458e10
push 0x3ff
lea edx, [ebp - 0x503]
push ebx
push edx
mov dword [ebp - 0x55c], 3
mov dword [ebp - 0x560], 0x3ff
mov byte [ebp - 0x504], bl
call fcn.004c5470
mov eax, dword [ebp - 0x538]
mov edi, 0x10
add esp, 0x10
cmp dword [ebp - 0x524], edi
jae 0x4684dc
lea eax, [ebp - 0x538]
lea ecx, [ebp - 0x560]
push ecx
lea edx, [ebp - 0x504]
push edx
lea ecx, [ebp - 0x55c]
push ecx
push eax
push str.SYSTEMMountedDevices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
xor eax, eax
jmp 0x468510
mov dl, byte [eax + 0x5521d0]
cmp dl, byte [ebp + eax - 0x504]
jne 0x4685aa
inc eax
cmp eax, 4
jl 0x468510
cmp dword [ebp - 0x524], edi
jb 0x468540
mov eax, dword [ebp - 0x538]
push eax
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x528], ebx
mov byte [ebp - 0x538], bl
cmp dword [ebp - 0x508], edi
jb 0x468569
mov ecx, dword [ebp - 0x51c]
push ecx
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x50c], ebx
mov byte [ebp - 0x51c], bl
cmp dword [ebp - 0x540], edi
jb 0x468592
mov edx, dword [ebp - 0x554]
push edx
call fcn.004c097a
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x524], edi
jb 0x4685c1
mov eax, dword [ebp - 0x538]
push eax
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x524], esi
mov dword [ebp - 0x528], ebx
mov byte [ebp - 0x538], bl
cmp dword [ebp - 0x508], edi
jb 0x4685ea
mov ecx, dword [ebp - 0x51c]
push ecx
call fcn.004c097a
add esp, 4
mov dword [ebp - 0x508], esi
mov dword [ebp - 0x50c], ebx
mov byte [ebp - 0x51c], bl
cmp dword [ebp - 0x540], edi
jb 0x468613
mov edx, dword [ebp - 0x554]
push edx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4