Function at 0x403080
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push str.Windows
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4030ad
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4032f5
push str.System
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4030d0
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x4032f5
push str.TempDir
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4030f3
push ebp
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4032f5
push str.CommonFiles
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4031b9
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push 0x40e050
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032f5
lea ecx, [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
mov dword [esp + 0x1c], eax
push eax
mov eax, dword [esp + 0x28]
push str.CommonFilesDir
push eax
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
je 0x4031a9
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push ebp
push edx
push 0
push str.ProgramFilesDir
push eax
call esi
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x40e430]
mov dword [edi + 4], edx
mov eax, dword [0x40e434]
mov dword [edi + 8], eax
mov cl, byte [0x40e438]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4032f5
push str.Program_Files
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x403227
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push 0x40e050
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032f5
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
push ebp
push edx
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x28]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4032f5
push str.MyDocuments
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x403249
push 5
push ebp
call section..text
add esp, 8
jmp 0x4032f5
push str.Desktop
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x40326b
push 0x10
push ebp
call section..text
add esp, 8
jmp 0x4032f5
push str.AppData
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x40330b
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov eax, dword [0x410c94]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x4032e4
xor eax, eax
mov edx, dword [str.Application_Data]
repne scasb al, byte es:[edi]
dec edi
mov dword [edi], edx
mov eax, dword [0x40e3e4]
mov dword [edi + 4], eax
mov ecx, dword [0x40e3e8]
mov dword [edi + 8], ecx
mov edx, dword [0x40e3ec]
mov dword [edi + 0xc], edx
mov al, byte [0x40e3f0]
mov byte [edi + 0x10], al
jmp 0x4032f5
xor eax, eax
mov esi, str.ProfilesAdministratorApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp], 0
je 0x403304
push ebp
call fcn.00401840
add esp, 4
pop edi
pop esi
pop ebp
add esp, 8
ret
push str.LocalAppData
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4033dd
push 0x1c
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
je 0x40336c
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
je 0x40336c
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
je 0x40336c
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x403360
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov eax, dword [0x410c94]
add esp, 4
or ecx, 0xffffffff
mov edi, ebp
test eax, eax
jne 0x4033c4
xor eax, eax
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x40e3e4]
mov dword [edi + 4], edx
mov eax, dword [0x40e3e8]
mov dword [edi + 8], eax
mov ecx, dword [0x40e3ec]
mov dword [edi + 0xc], ecx
mov dl, byte [0x40e3f0]
mov byte [edi + 0x10], dl
jmp 0x4032f5
xor eax, eax
mov esi, str.ProfilesAdministratorLocal_SettingsApplication_Data
repne scasb al, byte es:[edi]
dec edi
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4032f5
push str.AllUsersAppData
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4034b8
push 0x23
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
jne 0x403442
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
mov esi, str.All_UsersApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4032f5
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
je 0x40348a
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
je 0x40348a
push 0x5c
push ebp
mov byte [eax], 0
call fcn.004055a0
add esp, 8
test eax, eax
je 0x40348a
mov ecx, 0x40e300
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40347b
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 9
mov esi, str.ProfilesAll_UsersApplication_Data
jmp 0x4032f3
push str.AllUsersDocuments
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x403591
push 0x2e
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
jne 0x403518
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 5
mov esi, str.All_UsersDocuments
jmp 0x4032f3
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
je 0x403560
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
je 0x403560
push 0x5c
push ebp
mov byte [eax], 0
call fcn.004055a0
add esp, 8
test eax, eax
je 0x403560
mov ecx, 0x40e29c
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x403551
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 7
mov esi, str.ProfilesAll_UsersDocuments
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4032f5
push str.AllUsersDesktop
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x40368e
push 0x19
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
jne 0x403613
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [str.All_UsersDesktop]
dec edi
mov dword [edi], eax
mov ecx, dword [0x40e258]
mov dword [edi + 4], ecx
mov edx, dword [0x40e25c]
mov dword [edi + 8], edx
mov eax, dword [0x40e260]
mov dword [edi + 0xc], eax
mov cx, word [0x40e264]
mov word [edi + 0x10], cx
jmp 0x4032f5
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
je 0x40365b
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
je 0x40365b
push 0x5c
push ebp
mov byte [eax], 0
call fcn.004055a0
add esp, 8
test eax, eax
je 0x40365b
mov ecx, 0x40e240
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40364c
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
mov esi, str.ProfilesAll_UsersDesktop
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x4032f5
push str.UserDir
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x4036ef
push 0x28
push ebp
call section..text
add esp, 8
test eax, eax
jne 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
je 0x40309c
push 0x1a
push ebp
call section..text
push 0x5c
push ebp
call fcn.004055a0
add esp, 0x10
test eax, eax
jne 0x40374e
mov eax, 0x40e214
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4036e0
jmp 0x4032f5
push str.AllUsersDir
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x403843
push 0x2e
push ebp
call section..text
add esp, 8
test eax, eax
je 0x403756
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
jne 0x40373b
mov eax, 0x40e214
mov edx, ebp
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40372c
jmp 0x4032f5
cmp eax, ebp
jbe 0x40374e
cmp byte [eax - 1], 0x3a
jne 0x40374e
mov byte [eax + 1], 0
jmp 0x4032f5
mov byte [eax], 0
jmp 0x4032f5
mov eax, dword [0x410c94]
test eax, eax
je 0x403804
push 0x1a
push ebp
call section..text
add esp, 8
test eax, eax
je 0x4037ab
push 0x5c
push ebp
call fcn.004055a0
add esp, 8
test eax, eax
je 0x4037ab
push 0x5c
push ebp
mov byte [eax], 0
call fcn.004055a0
add esp, 8
test eax, eax
je 0x4037ab
mov ecx, str.All_Users
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40379c
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [str.ProfilesAll_Users]
dec edi
mov dword [edi], edx
mov eax, dword [0x40e1e8]
mov dword [edi + 4], eax
mov ecx, dword [0x40e1ec]
mov dword [edi + 8], ecx
mov edx, dword [0x40e1f0]
mov dword [edi + 0xc], edx
mov ax, word [0x40e1f4]
mov word [edi + 0x10], ax
mov cl, byte [0x40e1f6]
mov byte [edi + 0x12], cl
jmp 0x4032f5
push 0x104
push ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebp
call fcn.00401800
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [0x40e1d8]
dec edi
mov dword [edi], edx
mov eax, dword [0x40e1dc]
mov dword [edi + 4], eax
mov cx, word [0x40e1e0]
mov word [edi + 8], cx
jmp 0x4032f5
push str.InstallDir
push ebp
call fcn.004052b0
add esp, 8
test eax, eax
jne 0x40386c
mov ecx, dword [0x410c50]
mov edx, ebp
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40385d
jmp 0x4032f5
pop edi
mov byte [ebp], 0
pop esi
pop ebp
add esp, 8
ret