Function at 0x412f00
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a995
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x92c
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x764]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.004192f0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jbe 0x412ff9
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x770]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
push str._WINDIR_
lea ecx, [ebp - 0x774]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
lea eax, [ebp - 0x770]
push eax
lea ecx, [ebp - 0x774]
push ecx
lea ecx, [ebp - 0x76c]
call fcn.00413e60
mov dword [ebp - 0x86c], eax
mov edx, dword [ebp - 0x86c]
mov dword [ebp - 0x870], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x870]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x76c]
call fcn.00413b10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x774]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x770]
call sub.MFC42.DLL_CString::CString
jmp 0x41308c
push str.c:windows
lea ecx, [ebp - 0x780]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 4
push str._WINDIR_
lea ecx, [ebp - 0x784]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x780]
push ecx
lea edx, [ebp - 0x784]
push edx
lea ecx, [ebp - 0x77c]
call fcn.00413e60
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x878], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x878]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x77c]
call fcn.00413b10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x784]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x780]
call sub.MFC42.DLL_CString::CString
push 0x104
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
jbe 0x41314b
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x790]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 7
push str._SYSDIR_
lea ecx, [ebp - 0x794]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x790]
push ecx
lea edx, [ebp - 0x794]
push edx
lea ecx, [ebp - 0x78c]
call fcn.00413e60
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x880], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x880]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x78c]
call fcn.00413b10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x794]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x790]
call sub.MFC42.DLL_CString::CString
jmp 0x4131de
push str.c:windows_system32
lea ecx, [ebp - 0x7a0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xa
push str._SYSDIR_
lea ecx, [ebp - 0x7a4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x7a0]
push edx
lea eax, [ebp - 0x7a4]
push eax
lea ecx, [ebp - 0x79c]
call fcn.00413e60
mov dword [ebp - 0x884], eax
mov ecx, dword [ebp - 0x884]
mov dword [ebp - 0x888], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x888]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x79c]
call fcn.00413b10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7a4]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7a0]
call sub.MFC42.DLL_CString::CString
push 0
push 0x26
lea eax, [ebp - 0x324]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
je 0x41329e
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x7b0]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xd
push str._PROGRAMFILES_
lea ecx, [ebp - 0x7b4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x7b0]
push edx
lea eax, [ebp - 0x7b4]
push eax
lea ecx, [ebp - 0x7ac]
call fcn.00413e60
mov dword [ebp - 0x88c], eax
mov ecx, dword [ebp - 0x88c]
mov dword [ebp - 0x890], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x890]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x7ac]
call fcn.00413b10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7b4]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7b0]
call sub.MFC42.DLL_CString::CString
jmp 0x41338d
push str._PROGRAMFILES_
lea ecx, [ebp - 0x7c8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x10
push str.Program_Files
push 2
lea eax, [ebp - 0x7c0]
push eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.00413e00
mov ecx, eax
add ecx, 4
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x894]
mov dword [ebp - 0x898], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x898]
push edx
lea eax, [ebp - 0x7c4]
push eax
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x89c], eax
mov ecx, dword [ebp - 0x89c]
mov dword [ebp - 0x8a0], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x8a0]
push edx
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0x7bc]
call fcn.00413e60
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a8], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x8a8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x7bc]
call fcn.00413b10
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x7c4]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x7c0]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c8]
call sub.MFC42.DLL_CString::CString
push 0
push 2
lea eax, [ebp - 0x42c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
jl 0x41344d
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x7d4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x14
push str._PROGRAMS_
lea ecx, [ebp - 0x7d8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x15
lea edx, [ebp - 0x7d4]
push edx
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0x7d0]
call fcn.00413e60
mov dword [ebp - 0x8ac], eax
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp - 0x8b0], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x8b0]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x7d0]
call fcn.00413b10
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7d8]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7d4]
call sub.MFC42.DLL_CString::CString
jmp 0x4134e0
push str.C:Documents_and_SettingsAll_Users_
lea ecx, [ebp - 0x7e4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x17
push str._PROGRAMS_
lea ecx, [ebp - 0x7e8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x7e8]
push ecx
lea ecx, [ebp - 0x7e0]
call fcn.00413e60
mov dword [ebp - 0x8b4], eax
mov edx, dword [ebp - 0x8b4]
mov dword [ebp - 0x8b8], edx
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x8b8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x7e0]
call fcn.00413b10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x7e8]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7e4]
call sub.MFC42.DLL_CString::CString
push 0
push 0x10
lea ecx, [ebp - 0x534]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [ebp - 0x538], eax
cmp dword [ebp - 0x538], 0
jl 0x4135a0
lea edx, [ebp - 0x534]
push edx
lea ecx, [ebp - 0x7f4]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1a
push str._DESKTOP_
lea ecx, [ebp - 0x7f8]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x7f4]
push eax
lea ecx, [ebp - 0x7f8]
push ecx
lea ecx, [ebp - 0x7f0]
call fcn.00413e60
mov dword [ebp - 0x8bc], eax
mov edx, dword [ebp - 0x8bc]
mov dword [ebp - 0x8c0], edx
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x8c0]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x7f0]
call fcn.00413b10
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x7f8]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7f4]
call sub.MFC42.DLL_CString::CString
jmp 0x413633
push 0x43e6b4
lea ecx, [ebp - 0x804]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1d
push str._DESKTOP_
lea ecx, [ebp - 0x808]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x808]
push edx
lea ecx, [ebp - 0x800]
call fcn.00413e60
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x8c8], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x8c8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x800]
call fcn.00413b10
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x808]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x804]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x53c], 0
lea edx, [ebp - 0x540]
push edx
push 0x20019
push 0
push 0x43e694
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jne 0x413892
mov dword [ebp - 0x548], 0x104
mov dword [ebp - 0x754], 1
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp - 0x64c]
push ecx
lea edx, [ebp - 0x754]
push edx
push 0
push 0x43e68c
mov eax, dword [ebp - 0x540]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jne 0x413892
mov ecx, dword [ebp - 0x540]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x64c]
push edx
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 4
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x758]
push eax
lea ecx, [ebp - 0x814]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x20
push 0x43e67c
lea ecx, [ebp - 0x818]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x814]
push ecx
lea edx, [ebp - 0x818]
push edx
lea ecx, [ebp - 0x810]
call fcn.00413e60
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x8d0], eax
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x8d0]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x810]
call fcn.00413b10
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x818]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x814]
call sub.MFC42.DLL_CString::CString
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x750]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0x750]
mov dword [ebp - 0x758], ecx
lea edx, [ebp - 0x750]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x75c], eax
push str.game_share
mov eax, dword [ebp - 0x758]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x760], 0
je 0x4137f3
mov ecx, dword [ebp - 0x760]
add ecx, 0xb
mov edx, dword [ebp - 0x758]
add edx, dword [ebp - 0x75c]
cmp ecx, edx
jne 0x4137f3
mov eax, dword [ebp - 0x760]
mov byte [eax], 0
mov ecx, dword [ebp - 0x758]
push ecx
lea ecx, [ebp - 0x824]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x23
push 0x43e668
lea ecx, [ebp - 0x828]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x24
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x820]
call fcn.00413e60
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8d8], ecx
mov byte [ebp - 4], 0x25
mov edx, dword [ebp - 0x8d8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x820]
call fcn.00413b10
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x828]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x824]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x53c], 1
cmp dword [ebp - 0x53c], 0
jne 0x4139c5
push str._PROGRAMFILES_GlobalLinkGameShare
lea ecx, [ebp - 0x834]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x26
push 0x43e67c
lea ecx, [ebp - 0x838]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x838]
push ecx
lea ecx, [ebp - 0x830]
call fcn.00413e60
mov dword [ebp - 0x8dc], eax
mov edx, dword [ebp - 0x8dc]
mov dword [ebp - 0x8e0], edx
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x8e0]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x830]
call fcn.00413b10
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x838]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x834]
call sub.MFC42.DLL_CString::CString
push str._PROGRAMFILES_GlobalLink
lea ecx, [ebp - 0x844]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x29
push 0x43e668
lea ecx, [ebp - 0x848]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x844]
push ecx
lea edx, [ebp - 0x848]
push edx
lea ecx, [ebp - 0x840]
call fcn.00413e60
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x8e8]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x840]
call fcn.00413b10
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x848]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x844]
call sub.MFC42.DLL_CString::CString
push str._PROGRAMFILES_GlobalLink
lea ecx, [ebp - 0x854]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2c
push str._TARGETDIR_
lea ecx, [ebp - 0x858]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2d
lea edx, [ebp - 0x854]
push edx
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0x850]
call fcn.00413e60
mov dword [ebp - 0x8ec], eax
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp - 0x8f0], ecx
mov byte [ebp - 4], 0x2e
mov edx, dword [ebp - 0x8f0]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x850]
call fcn.00413b10
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x858]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x854]
call sub.MFC42.DLL_CString::CString
push str._TARGETDIR_Restore
lea ecx, [ebp - 0x864]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x2f
push str._GLRESTOREDIR_
lea ecx, [ebp - 0x868]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x868]
push ecx
lea ecx, [ebp - 0x860]
call fcn.00413e60
mov dword [ebp - 0x8f4], eax
mov edx, dword [ebp - 0x8f4]
mov dword [ebp - 0x8f8], edx
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x8f8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00413e30
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x860]
call fcn.00413b10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x868]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x864]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret