Function at 0x401070
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x424
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x43c]
xor ebx, ebx
cmp eax, ebx
mov dword [edi], ebx
jne 0x401332
mov ecx, dword [0x40f4f0]
lea eax, [esp + 0x128]
push 0x104
push eax
push 2
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x128]
push edx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], 0x104
mov byte [esp + 0x38], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x4010f4
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
push str.Database
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x24]
push 0x5c
push edx
mov ebp, eax
call fcn.00402e80
add esp, 8
cmp eax, ebx
je 0x401161
mov byte [eax + 1], bl
mov edi, str.Artgal40.cag
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x43c]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
je 0x401187
mov eax, ebp
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
cmp dword [esp + 0x1c], 1
je 0x40119e
mov eax, 0x80004005
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
lea ecx, [esp + 0x24]
push 4
push ecx
call fcn.00402e30
add esp, 8
cmp eax, 0xffffffff
jne 0x401272
lea edx, [esp + 0x24]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp eax, ebx
jne 0x4011fa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
je 0x4011ed
call esi
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x23], 0x5c
je 0x40123d
mov edi, 0x40c040
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Artgal40.cag
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x43c]
cmp byte [esp + 0x24], bl
je 0x401332
lea eax, [esp + 0x24]
mov dword [esp + 0x14], ebx
push eax
mov dword [esp + 0x14], ebx
call fcn.00402db0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x22c]
push esi
push ecx
push edx
call fcn.00402c70
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x22c]
mov word [esp + esi*2 + 0x22c], bx
push eax
push ecx
call dword [sym.imp.ole32.dll_CreateFileMoniker]
mov esi, eax
cmp esi, ebx
jl 0x401314
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.ole32.dll_GetRunningObjectTable]
mov esi, eax
cmp esi, ebx
jl 0x401314
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, ebx
jl 0x401314
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edi
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
cmp esi, ebx
jl 0x401314
mov eax, dword [esp + 0x444]
mov dword [eax], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x401322
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x401336
mov edx, dword [eax]
push eax
call dword [edx + 8]
jmp 0x401336
mov esi, dword [esp + 0x1c]
cmp esi, ebx
jl 0x40133e
cmp dword [edi], ebx
jne 0x401366
mov eax, dword [esp + 0x438]
push edi
push 0x40b038
push 1
push eax
push 0x40c030
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x444]
cmp eax, ebx
mov dword [ecx], ebx
jl 0x40137a
mov eax, dword [edi]
mov ecx, dword [esp + 0x440]
push ecx
push 0x40b028
mov edx, dword [eax]
push eax
call dword [edx]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x424
ret