Function at 0x40e841
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x492110]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor ecx, ecx
cmp dword [esi], ecx
jne 0x40e864
xor al, al
jmp 0x40eb5f
push ebx
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ebx, 0x104
push ebx
push ecx
push 0x23
push ecx
call edi
test eax, eax
jns 0x40e898
push str.C:All_UsersApplication_Data
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00436682
add esp, 0xc
push 0x4706dc
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 1
push dword [esi]
call fcn.00406210
mov bl, al
lea eax, [ebp - 0x20c]
neg bl
push str..exe
sbb bl, bl
push 0x104
push eax
and bl, 1
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 4
push dword [esi]
call fcn.00406210
mov bh, al
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0
neg bh
push 0x26
sbb bh, bh
push 0
and bh, bl
call edi
test eax, eax
jns 0x40e930
push str.C:Program_Files
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00436682
add esp, 0xc
push 0x4706dc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 1
push dword [esi]
call fcn.00406210
mov bl, al
lea eax, [ebp - 0x20c]
neg bl
push str..exe
sbb bl, bl
push 0x104
push eax
and bl, bh
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 4
push dword [esi]
call fcn.00406210
mov bh, al
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0
neg bh
push 0x25
sbb bh, bh
push 0
and bh, bl
call edi
test eax, eax
jns 0x40e9cb
push str.C:WindowsSystem32
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00436682
add esp, 0xc
push 0x4706dc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 1
push dword [esi]
call fcn.00406210
mov bl, al
lea eax, [ebp - 0x20c]
neg bl
push str..exe
sbb bl, bl
push 0x104
push eax
and bl, bh
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 4
push dword [esi]
call fcn.00406210
mov bh, al
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0
neg bh
push 0x24
sbb bh, bh
push 0
and bh, bl
call edi
mov edi, 0x104
test eax, eax
jns 0x40ea67
push str.C:Windows
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.00436682
add esp, 0xc
push 0x4706dc
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 1
push dword [esi]
call fcn.00406210
mov bl, al
lea eax, [ebp - 0x20c]
neg bl
push str..exe
sbb bl, bl
push edi
push eax
and bl, bh
call fcn.0043660d
add esp, 0xc
lea eax, [ebp - 0x20c]
push 1
push 0xffffffffffffffff
push eax
push 4
push dword [esi]
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bh, al
push str.HKLMSMcAfee
neg bh
push 2
push dword [esi]
sbb bh, bh
and bh, bl
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bl, al
mov edi, str.HKLMSINTERNET_CONTENT_FILTER
push edi
neg bl
push 2
push dword [esi]
sbb bl, bl
and bl, bh
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bh, al
push str.HKLMSMcAfee
neg bh
push 3
push dword [esi]
sbb bh, bh
and bh, bl
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bl, al
push edi
neg bl
push 3
push dword [esi]
sbb bl, bl
and bl, bh
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bh, al
mov edi, str.HKCCSServices
neg bh
push edi
sbb bh, bh
push 2
push dword [esi]
and bh, bl
call fcn.00406210
push 1
push 0xffffffffffffffff
mov bl, al
push edi
neg bl
push 3
push dword [esi]
sbb bl, bl
and bl, bh
call fcn.00406210
neg al
pop edi
sbb al, al
and al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042db8f
leave
ret