Function at 0x4077ae
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd80
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov al, byte [eax]
test al, al
je 0x407f04
mov edi, dword [sym.imp.USER32.dll_CharNextA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [ebp + 8]
cmp al, 0x24
je 0x4077ee
push ebx
mov byte [ebx], al
call edi
push dword [ebp + 0xc]
mov ebx, eax
call edi
mov dword [ebp + 0xc], eax
jmp 0x407eec
lea eax, [ebp + 0xc]
push 0x410ef8
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x40780b
mov byte [ebx], 0x24
inc ebx
jmp 0x407eec
lea eax, [ebp + 0xc]
push str._PROGRAMFILES
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x4078b0
mov esi, str.C:Program_Files
lea edi, [ebp - 0x72c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x3c
lea edi, [ebp - 0x71b]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407896
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.ProgramFilesDir
mov dword [ebp - 0x10], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x72c]
push eax
push ebx
call fcn.004080d0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
jmp 0x407eb8
lea eax, [ebp + 0xc]
push str._STRING_
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407969
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x830]
mov al, byte [edx]
test al, al
je 0x4078e0
mov byte [ecx], al
inc ecx
inc edx
mov dword [ebp + 0xc], edx
jmp 0x4078d1
and byte [ecx], 0
lea eax, [ebp - 0x830]
push eax
call fcn.0040770a
test eax, eax
pop ecx
je 0x407938
push eax
lea eax, [ebp - 0xc40]
push eax
call fcn.004080d0
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040774e
mov al, byte [ebp - 0x218]
add esp, 0x10
lea ecx, [ebp - 0x218]
test al, al
je 0x407930
mov byte [ebx], al
mov al, byte [ecx + 1]
inc ebx
inc ecx
jmp 0x407923
and byte [ebx], 0
jmp 0x407eb8
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x218]
push str._STRING__s
push eax
call esi
mov al, byte [ebp - 0x218]
add esp, 0xc
lea ecx, [ebp - 0x218]
test al, al
je 0x407930
mov byte [ebx], al
mov al, byte [ecx + 1]
inc ebx
inc ecx
jmp 0x40795c
lea eax, [ebp + 0xc]
push str._DESKTOP
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x4079c3
mov al, byte [0x411df4]
push 0x40
mov byte [ebp - 0x420], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x41f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
push eax
push str.Desktop
call fcn.00407f56
cmp byte [ebp - 0x420], 0
pop ecx
pop ecx
je 0x407efb
lea eax, [ebp - 0x420]
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._INSTDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x4079e8
cmp dword [ebp + 0x10], eax
je 0x407efb
push dword [ebp + 0x10]
jmp 0x407eb0
lea eax, [ebp + 0xc]
push str._ALTDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407a10
mov eax, 0x412f40
mov ecx, eax
test ecx, ecx
je 0x407efb
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._WAVISDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407a7f
cmp dword [ebp + 0x10], eax
je 0x407efb
push dword [ebp + 0x10]
lea eax, [ebp - 0xa38]
push str._swinamp.ini
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xa38]
push eax
push 0x104
push ebx
push 0x411df4
push str.VISDir
push str.Winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebx], 0
jne 0x407ebd
push dword [ebp + 0x10]
push str._sPlugins
push ebx
call esi
add esp, 0xc
jmp 0x407eb8
lea eax, [ebp + 0xc]
push str._WADSPDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407ac9
cmp dword [ebp + 0x10], eax
je 0x407efb
push dword [ebp + 0x10]
lea eax, [ebp - 0xb3c]
push str._swinamp.ini
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xb3c]
push eax
push 0x104
push ebx
push 0x411df4
push str.DSPDir
jmp 0x407a58
lea eax, [ebp + 0xc]
push str._WINDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407aee
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x407eb8
lea eax, [ebp + 0xc]
push str._SYSDIR
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407b13
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x407eb8
lea eax, [ebp + 0xc]
push str._TEMP
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407b38
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x407eb8
lea eax, [ebp + 0xc]
push str._STARTMENU
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407b92
mov al, byte [0x411df4]
push 0x40
mov byte [ebp - 0x628], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x628]
push eax
push str.Start_Menu
call fcn.00407f56
cmp byte [ebp - 0x628], 0
pop ecx
pop ecx
je 0x407efb
lea eax, [ebp - 0x628]
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._SMPROGRAMS
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407bec
mov al, byte [0x411df4]
push 0x40
mov byte [ebp - 0x31c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x31b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x31c]
push eax
push str.Programs
call fcn.00407f56
cmp byte [ebp - 0x31c], 0
pop ecx
pop ecx
je 0x407efb
lea eax, [ebp - 0x31c]
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._SMSTARTUP
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407c46
mov al, byte [0x411df4]
push 0x40
mov byte [ebp - 0x524], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x523]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x524]
push eax
push str.Startup
call fcn.00407f56
cmp byte [ebp - 0x524], 0
pop ecx
pop ecx
je 0x407efb
lea eax, [ebp - 0x524]
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._USERPROFILE
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407d01
cmp dword [0x411efc], eax
jne 0x407cea
lea eax, [ebp - 4]
mov dword [0x411efc], 1
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x407cd9
lea eax, [ebp - 0x934]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x407cb9
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x934]
push 0x5c
push eax
call fcn.00408602
pop ecx
test eax, eax
pop ecx
je 0x407cd0
and byte [eax], 0
lea eax, [ebp - 0x934]
push eax
jmp 0x407cde
push 0x410d9c
push 0x411df8
call fcn.004080d0
pop ecx
pop ecx
cmp byte [0x411df8], 0
je 0x407efb
push 0x411df8
jmp 0x407eb0
lea eax, [ebp + 0xc]
push 0x410d98
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407d25
push dword [0x410ba0]
push 0x410d94
jmp 0x407a74
lea eax, [ebp + 0xc]
push 0x410d90
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407d63
mov eax, 0x412e40
test eax, eax
je 0x407f0a
mov eax, dword [0x411dbc]
test eax, eax
je 0x407f0a
cmp eax, 2
jl 0x407f0a
mov eax, dword [0x412e44]
jmp 0x407ddd
lea eax, [ebp + 0xc]
push 0x410d8c
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407da1
mov eax, 0x412e40
test eax, eax
je 0x407f0a
mov eax, dword [0x411dbc]
test eax, eax
je 0x407f0a
cmp eax, 3
jl 0x407f0a
mov eax, dword [0x412e48]
jmp 0x407ddd
lea eax, [ebp + 0xc]
push 0x410d88
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407df3
mov eax, 0x412e40
test eax, eax
je 0x407f0a
mov eax, dword [0x411dbc]
test eax, eax
je 0x407f0a
cmp eax, 4
jl 0x407f0a
mov eax, dword [0x412e4c]
test eax, eax
je 0x407f0a
cmp byte [eax], 0
je 0x407f0a
jmp 0x407eaf
lea eax, [ebp + 0xc]
push str._QUICKLAUNCH
push eax
call fcn.00407f11
pop ecx
test eax, eax
pop ecx
jne 0x407eff
mov al, byte [0x411df4]
push 0x40
mov byte [ebp - 0x114], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
push str.AppData
call fcn.00407f56
cmp byte [ebp - 0x114], 0
pop ecx
pop ecx
je 0x407e97
lea eax, [ebp - 0x114]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.004080e0
pop ecx
lea eax, [ebp - 0xd80]
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x407e87
test byte [ebp - 0xd80], 0x10
jne 0x407e7e
and byte [ebp - 0x114], 0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x407e8e
and byte [ebp - 0x114], 0
cmp byte [ebp - 0x114], 0
jne 0x407ea9
lea eax, [ebp - 0x114]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x114]
push eax
push ebx
call fcn.004080d0
pop ecx
pop ecx
cmp byte [ebx], 0
je 0x407ed7
mov edi, dword [sym.imp.USER32.dll_CharNextA]
push ebx
call edi
cmp byte [eax], 0
je 0x407edd
push ebx
call edi
mov ebx, eax
cmp byte [ebx], 0
jne 0x407ec3
jmp 0x407edd
mov edi, dword [sym.imp.USER32.dll_CharNextA]
cmp byte [ebx], 0x5c
jne 0x407ee7
and byte [ebx], 0
jmp 0x407eec
push ebx
call edi
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
test al, al
jne 0x4077d6
jmp 0x407f07
push 3
jmp 0x407f01
push 2
pop eax
jmp 0x407f0c
mov ebx, dword [ebp + 8]
and byte [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret