Function at 0x40bca0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push esi
mov esi, dword [esp + 0x20]
push edi
push str.Windows
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bccc
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x40bdcc
push str.System
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bcef
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x40bdcc
push str.TempDir
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bd12
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
jmp 0x40bdcc
push str.CommonFiles
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bde0
lea eax, [esp + 0x24]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40bdcc
lea ecx, [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x10]
push esi
push edx
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x34]
push str.CommonFilesDir
push eax
mov dword [esp + 0x20], 0x104
call edi
test eax, eax
je 0x40bdc1
mov eax, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push esi
push edx
push 0
push str.ProgramFilesDir
push eax
call edi
push esi
call fcn.00402070
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Common_Files]
dec edi
mov dword [edi], ecx
mov edx, dword [0x4245c8]
mov dword [edi + 4], edx
mov eax, dword [0x4245cc]
mov dword [edi + 8], eax
mov cl, byte [0x4245d0]
mov byte [edi + 0xc], cl
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esi], 0
je 0x40bdda
push esi
call fcn.004020b0
add esp, 4
pop edi
pop esi
add esp, 0x18
ret
push str.Program_Files
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40be3a
lea eax, [esp + 0x24]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40bdcc
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push esi
push edx
mov dword [esp + 0x14], eax
push eax
mov eax, dword [esp + 0x34]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x24]
push ecx
jmp 0x40bdc6
push str.MyDocuments
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40be5c
push 5
push esi
call fcn.00401030
add esp, 8
jmp 0x40bdcc
push str.AppData
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bedc
push 0x1a
push esi
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40bdcc
mov eax, dword [0x4296fc]
test eax, eax
jne 0x40bdcc
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push esi
call fcn.00402070
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [str.Application_Data]
dec edi
mov dword [edi], edx
mov eax, dword [0x424588]
mov dword [edi + 4], eax
mov ecx, dword [0x42458c]
mov dword [edi + 8], ecx
mov edx, dword [0x424590]
mov dword [edi + 0xc], edx
mov al, byte [0x424594]
mov byte [edi + 0x10], al
jmp 0x40bdcc
push str.LocalAppData
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40bfb7
push 0x1c
push esi
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40bdcc
push 0x1a
push esi
call fcn.00401030
add esp, 8
test eax, eax
mov eax, dword [0x4296fc]
jne 0x40bf70
test eax, eax
jne 0x40bdcc
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push esi
call fcn.00402070
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov ecx, dword [str.Application_Data]
dec edi
mov dword [edi], ecx
mov edx, dword [0x424588]
mov dword [edi + 4], edx
mov eax, dword [0x42458c]
mov dword [edi + 8], eax
mov ecx, dword [0x424590]
mov dword [edi + 0xc], ecx
mov dl, byte [0x424594]
mov byte [edi + 0x10], dl
jmp 0x40bdcc
test eax, eax
je 0x40bdcc
push 0x5c
push esi
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40bf9f
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bf90
jmp 0x40bdcc
mov ecx, str.Local_SettingsApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40bfa8
jmp 0x40bdcc
push str.AllUsersAppData
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c0bb
push 0x23
push esi
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40bdcc
push 0x1a
push esi
call fcn.00401030
add esp, 8
test eax, eax
mov eax, dword [0x4296fc]
jne 0x40c04a
test eax, eax
jne 0x40bdcc
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push esi
call fcn.00402070
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [str.Application_Data]
dec edi
mov dword [edi], eax
mov ecx, dword [0x424588]
mov dword [edi + 4], ecx
mov edx, dword [0x42458c]
mov dword [edi + 8], edx
mov eax, dword [0x424590]
mov dword [edi + 0xc], eax
mov cl, byte [0x424594]
mov byte [edi + 0x10], cl
jmp 0x40bdcc
test eax, eax
je 0x40bdcc
push 0x5c
push esi
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40c079
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c06a
jmp 0x40bdcc
push 0x5c
push esi
mov byte [eax], 0
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40c0a3
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c094
jmp 0x40bdcc
mov ecx, str.All_UsersApplication_Data
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40c0ac
jmp 0x40bdcc
push str.UserDir
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c120
push 0x28
push esi
call fcn.00401030
add esp, 8
test eax, eax
jne 0x40bdcc
mov eax, dword [0x4296fc]
test eax, eax
je 0x40bcbb
push 0x1a
push esi
call fcn.00401030
push 0x5c
push esi
call fcn.00418f90
add esp, 0x10
test eax, eax
jne 0x40c24e
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c111
jmp 0x40bdcc
push str.AllUsersDir
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c1ee
push 0x23
push esi
call fcn.00401030
add esp, 8
test eax, eax
je 0x40c170
push 0x5c
push esi
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40c24e
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c161
jmp 0x40bdcc
mov eax, dword [0x4296fc]
test eax, eax
je 0x40bcbb
push 0x1a
push esi
call fcn.00401030
push 0x5c
push esi
call fcn.00418f90
add esp, 0x10
test eax, eax
jne 0x40c1ac
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c19d
jmp 0x40bdcc
push 0x5c
push esi
mov byte [eax], 0
call fcn.00418f90
add esp, 8
test eax, eax
jne 0x40c1d6
mov eax, 0x424570
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c1c7
jmp 0x40bdcc
mov ecx, str.All_Users
mov edx, eax
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x40c1df
jmp 0x40bdcc
push str.InstallDir
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c217
mov ecx, dword [0x42975c]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40c208
jmp 0x40bdcc
push str.SourceDir
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c256
mov ecx, dword [0x429690]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40c231
push 0x5c
push esi
call fcn.00418f90
add esp, 8
test eax, eax
je 0x40bdcc
mov byte [eax], 0
jmp 0x40bdcc
push str.UserName
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c27d
mov edx, dword [0x429320]
push edx
push esi
call fcn.0040c3b0
add esp, 8
jmp 0x40bdcc
push str.UserCompany
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c2a3
mov eax, dword [0x42931c]
push eax
push esi
call fcn.0040c3b0
add esp, 8
jmp 0x40bdcc
push str.UserSerialNumber
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c2ca
mov ecx, dword [0x429314]
push ecx
push esi
call fcn.0040c3b0
add esp, 8
jmp 0x40bdcc
push str.UserEmail
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c2f1
mov edx, dword [0x429318]
push edx
push esi
call fcn.0040c3b0
add esp, 8
jmp 0x40bdcc
push str.UserInfo
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c317
mov eax, dword [0x429310]
push eax
push esi
call fcn.0040c3b0
add esp, 8
jmp 0x40bdcc
push str.UserRegCode
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c340
mov ecx, dword [0x429328]
mov edx, esi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x40c331
jmp 0x40bdcc
push str.Date
push esi
call fcn.00418d70
add esp, 8
test eax, eax
jne 0x40c3a0
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
mov eax, dword [esp + 0x10]
and eax, 0xffff
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x12]
and eax, 0xffff
lea eax, [eax + edx*4]
mov edx, dword [esp + 0x16]
and edx, 0xffff
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*4]
push eax
push 0x424474
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x40bdcc
mov byte [esi], 0
pop edi
pop esi
add esp, 0x18
ret