Function at 0x40844d
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value
Set current directory

Disassembly:
mov eax, 0x41a4ce
call fcn.0040e0b0
sub esp, 0xcd0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
call dword [0x428030]
and word [ebp - 0x4bc], 0
mov ebx, 0x81
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x4ba]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4bc]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
and word [ebp - 0x6c4], 0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x6c2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x6c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea eax, [ebp - 0x6c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi]
test eax, eax
je 0x408511
lea ecx, [ebp - 0x4bc]
push ecx
call eax
mov edi, dword [edi + 0x10]
test edi, edi
je 0x40851c
push 1
call edi
push 0x1f
xor eax, eax
mov byte [ebp - 0xac], 0x30
mov byte [ebp - 0xab], 0x30
pop ecx
lea edi, [ebp - 0xaa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edx, edx
mov word [ebp - 0x2b4], dx
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x2b2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor edi, edi
inc edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edx
push 0x2001f
push str.SoftwareThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edx
call fcn.00401492
test eax, eax
jne 0x408716
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.InstDir
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408716
lea eax, [ebp - 0x2b4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x408716
and word [ebp - 0x8cc], 0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0x8ca]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.MSVCR71.dll_wcscpy]
pop ecx
pop ecx
push str.Programdl_peer_id.dll
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x40865b
and word [ebp - 0xcdc], 0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0xcda]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xcdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x2b4]
push eax
call edi
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xcdc]
push eax
call edi
jmp 0x408669
push str.dl_peer_id.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x408716
push str.DllGetClassObject
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edi, edi
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x18]
push ecx
push 0x41d9c0
push 0x41d16c
mov byte [ebp - 4], 1
call eax
mov dword [ebp - 0x10], edi
cmp eax, edi
mov byte [ebp - 4], 2
jl 0x4086f4
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x4086f4
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x41d15c
push edi
push eax
call dword [ecx + 0xc]
cmp eax, edi
jl 0x4086f4
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x4086f4
lea edx, [ebp - 0x24]
push edx
lea edx, [ebp - 0xac]
push edx
push 0x800
mov dword [ebp - 0x24], 0x80
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x4086f4
mov dword [ebp - 0x10], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
cmp eax, edi
mov byte [ebp - 4], 1
je 0x408705
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov byte [ebp - 4], 0
je 0x408716
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xac]
push eax
call fcn.00407248
and word [ebp - 0xad4], 0
xor eax, eax
mov ecx, ebx
lea edi, [ebp - 0xad2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0xad4]
push eax
call dword [sym.imp.MSVCR71.dll_wcsncpy]
add esp, 0xc
push str.ProgramXLBugReport.exe
lea eax, [ebp - 0xad4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, dword [ebp - 0x1c]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x408781
lea ecx, [ebp - 0xad4]
push ecx
call eax
push esi
lea eax, [ebp - 0x6c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0040714f
mov edi, dword [edi + 4]
test edi, edi
je 0x4087b3
push eax
push str.0x800
push 0
lea eax, [ebp - 0x6c4]
push eax
push 0x41d630
call edi
lea ecx, [ebp - 0x20]
call fcn.004013bf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret