Function at 0x4018b0
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4278c8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x433a70]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
push str.CIniFile::GetVariableFromIni
lea ecx, [esp + 0x2c]
call fcn.00401130
xor esi, esi
push 0x104
mov dword [esp + 0x3c], esi
call fcn.00409b95
mov ebp, eax
push 0x104
mov dword [esp + 0x2c], ebp
call fcn.00409b95
mov edi, eax
push 0x104
mov dword [esp + 0x28], edi
call fcn.00409b95
add esp, 0xc
test edi, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], esi
je 0x401d94
test ebp, ebp
je 0x401d94
mov edi, dword [esp + 0x40]
push str.SystemDir
push edi
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401979
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push eax
push eax
call edi
add eax, 1
push eax
mov dword [esp + 0x18], eax
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov eax, dword [esp + 0x14]
push eax
push esi
call edi
jmp 0x401d81
push str.ProgramFilesDir
push edi
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401a1a
lea ecx, [esp + 0x18]
push ecx
push 1
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401d81
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
push eax
push eax
push eax
mov eax, dword [esp + 0x28]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x2c], esi
call edi
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push esi
push 0
push 0
push str.ProgramFilesDir
push eax
call edi
test eax, eax
jne 0x401d81
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
jmp 0x401d94
push str.PrinterDriverDir
push edi
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401a75
lea edx, [esp + 0x40]
push edx
push eax
push eax
push 1
push eax
push eax
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov eax, dword [esp + 0x40]
add eax, 1
push eax
mov dword [esp + 0x44], eax
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
push ecx
push esi
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
jmp 0x401d81
push str.WindowsDir
push edi
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401ab8
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push eax
push eax
call edi
add eax, 1
push eax
mov dword [esp + 0x18], eax
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov edx, dword [esp + 0x14]
push edx
push esi
call edi
jmp 0x401d81
push ebp
lea eax, [esp + 0x2c]
push str.Variables:__s
push eax
mov dword [ebp], 0x524156
call fcn.00401460
mov ebp, dword [esp + 0x50]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
add esp, 0xc
push ebp
push 0x104
push ecx
push 0x42967e
push edi
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401b0e
push edi
lea eax, [esp + 0x2c]
push str.Unable_to_read__s_in_section:_VAR
push eax
call fcn.00401460
add esp, 0xc
jmp 0x401d81
mov ecx, dword [esp + 0x20]
push ebp
push ecx
push edi
mov ecx, ebx
call fcn.00401df0
test eax, eax
je 0x401d46
mov edi, dword [esp + 0x1c]
push 0x429658
push edi
call fcn.00412936
add esp, 8
test eax, eax
jne 0x401b52
push edi
lea edx, [esp + 0x2c]
push str.Invalid_Registry_Key_format:__s
push edx
call fcn.00401460
add esp, 0xc
jmp 0x401d81
push eax
mov byte [eax], 0
call fcn.00413daf
mov ebx, eax
push 0x429658
push ebx
mov edi, ebx
call fcn.00412936
add esp, 0xc
test eax, eax
je 0x401b96
push 0x429658
push edi
call fcn.00412936
push eax
call fcn.00413daf
mov edi, eax
push 0x429658
push edi
call fcn.00412936
add esp, 0x14
test eax, eax
jne 0x401b71
mov ebp, dword [esp + 0x1c]
push edi
push ebp
call fcn.00413d9c
push eax
mov byte [eax], 0
call fcn.00413daf
push str.HKLM
push ebp
mov edi, eax
call fcn.00413cf2
add esp, 0x14
test eax, eax
jne 0x401bc8
mov eax, 0x80000002
jmp 0x401c47
push str.HKEY_LOCAL_MACHINE
push ebp
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401be1
mov eax, 0x80000002
jmp 0x401c47
push str.HKEY_CLASSES_ROOT
push ebp
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401bfa
mov eax, 0x80000000
jmp 0x401c47
push str.HKEY_CURRENT_USER
push ebp
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401c13
mov eax, 0x80000001
jmp 0x401c47
push str.HKEY_USERS
push ebp
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401c2c
mov eax, 0x80000003
jmp 0x401c47
push str.HKEY_CURRENT_CONFIG
push ebp
call fcn.00413cf2
add esp, 8
test eax, eax
jne 0x401d31
mov eax, VariantClear
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401cc4
mov eax, dword [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401c63
sub eax, edx
push eax
mov dword [esp + 0x18], eax
call fcn.00409b95
mov esi, eax
push esi
lea edx, [esp + 0x30]
push str.theVar_s
push edx
call fcn.00401460
add esp, 0x10
test esi, esi
je 0x401d81
push ebx
mov eax, ebp
push eax
lea ecx, [esp + 0x30]
push str.Error_opening_registry_key:__s_s
push ecx
call fcn.00401460
mov eax, dword [esp + 0x30]
mov edx, esi
add esp, 0x10
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401cb3
jmp 0x401d81
mov eax, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x14]
push edx
push 0
push 0
push 0
push edi
push eax
mov dword [esp + 0x2c], esi
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push esi
push 0
push 0
push edi
push eax
call ebp
test eax, eax
je 0x401d81
mov ecx, dword [esp + 0x1c]
push edi
push ebx
push ecx
lea edx, [esp + 0x34]
push str.Error_reading_registry_value:__s_s_s
push edx
call fcn.00401460
push esi
call fcn.00409b90
add esp, 0x18
xor esi, esi
jmp 0x401d81
push ebp
lea eax, [esp + 0x2c]
push str.Unknown_registry_key:__s
push eax
call fcn.00401460
add esp, 0xc
jmp 0x401d81
mov eax, dword [esp + 0x1c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401d50
sub eax, edx
add eax, 1
push eax
call fcn.00409b95
mov esi, eax
add esp, 4
test esi, esi
je 0x401d81
mov eax, dword [esp + 0x1c]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401d75
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401d90
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401da5
push eax
call fcn.00409b90
add esp, 4
test ebp, ebp
je 0x401db2
push ebp
call fcn.00409b90
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401dc3
push eax
call fcn.00409b90
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0x38], 0xffffffff
call fcn.004012e0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8