Function at 0x401070
Capabilities:
Get common file path

Disassembly:
push 0x401824
call sub.KERNEL32.dll_SetUnhandledExceptionFilter
push edi
xor eax, eax
mov ecx, 0xa
mov edi, 0x403538
rep stosd dword es:[edi], eax
mov byte [0x403560], al
pop edi
call sub.KERNEL32.dll_GetCommandLineA
mov edx, eax
xor ecx, ecx
mov ah, byte [edx]
cmp ah, 0x22
je 0x401031
mov ah, 0x20
inc edx
mov al, byte [edx]
cmp al, ah
jne 0x401031
inc edx
cmp ah, 0x22
sete cl
add edx, ecx
cmp dword [edx], 0x74706f2f
setne byte [0x403561]
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x403540], eax
push eax
push 0x401070
push 0
push 0x64
push eax
call sub.USER32.dll_DialogBoxParamA
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x110
jne 0x4010e6
mov eax, dword [ebp + 8]
mov dword [0x40353c], eax
push 0
push eax
call sub.USER32.dll_GetSystemMenu
push str.About_Registry_Setup...
push 0xa
push 0
push eax
push 0
push 0
push 0x800
push eax
call sub.USER32.dll_AppendMenuA
call sub.USER32.dll_AppendMenuA
push 2
push dword [ebp + 0x14]
call sub.USER32.dll_LoadIconA
mov dword [section..data], eax
push eax
push 1
push 0x80
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
push 0x65
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
mov dword [0x403004], eax
cmp byte [0x403561], 1
je 0x401118
jmp 0x40176a
cmp dword [ebp + 0xc], 0x112
jne 0x4010fe
cmp dword [ebp + 0x10], 0xa
je 0x4016e2
jmp 0x40176a
cmp dword [ebp + 0xc], 0x111
jne 0x401736
mov eax, dword [ebp + 0x10]
cmp ax, 0x68
jne 0x40137a
push 0x401770
push dword fs:[0]
mov dword [0x403520], esp
mov dword [0x403524], ebp
mov dword [0x403528], ebx
mov dword [0x40352c], esi
mov dword [0x403530], edi
mov dword [0x403534], 0x401327
mov dword fs:[0], esp
push str.___Setting_up_registry...
push 0xffffffffffffffff
push 0x181
push dword [0x403004]
call sub.USER32.dll_SendMessageA
mov ecx, 0x403008
push ecx
push ecx
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
pop ecx
mov dword [0x403314], eax
add eax, ecx
cmp byte [eax], 0x5c
jne 0x40118b
mov byte [eax], 0
mov ecx, 0x40310c
push ecx
push 0x104
push ecx
call sub.KERNEL32.dll_GetSystemDirectoryA
pop ecx
mov dword [0x403318], eax
add eax, ecx
cmp byte [eax], 0x5c
jne 0x4011ac
mov byte [eax], 0
mov ecx, 0x403210
push ecx
push 0x104
push ecx
call sub.KERNEL32.dll_GetWindowsDirectoryA
pop ecx
mov dword [0x40331c], eax
add eax, ecx
cmp byte [eax], 0x5c
jne 0x4011cd
mov byte [eax], 0
mov eax, dword [0x402204]
mov ecx, dword [0x4021fc]
mov dword [0x403320], ecx
test ecx, ecx
je 0x401327
mov dword [0x40332c], eax
mov edx, dword [eax]
cmp byte [eax], 0
je 0x4011f5
inc eax
jmp 0x4011ed
inc eax
cmp edx, 0x52434b48
jne 0x401205
mov ecx, 0x80000000
jmp 0x40125d
cmp edx, 0x55434b48
jne 0x401214
mov ecx, 0x80000001
jmp 0x40125d
cmp edx, 0x4d4c4b48
jne 0x401223
mov ecx, 0x80000002
jmp 0x40125d
cmp edx, 0x53554b48
jne 0x401232
mov ecx, 0x80000003
jmp 0x40125d
cmp edx, 0x44504b48
jne 0x401241
mov ecx, 0x80000004
jmp 0x40125d
cmp edx, 0x43434b48
jne 0x401250
mov ecx, 0x80000005
jmp 0x40125d
cmp edx, 0x44444b48
jne 0x40125d
mov ecx, 0x80000006
mov dword [0x403324], ecx
mov dword [0x403330], eax
add dword [0x40332c], 5
cmp byte [eax], 0
je 0x401277
inc eax
jmp 0x40126f
inc eax
movzx ecx, byte [eax]
mov dword [0x403328], ecx
inc eax
mov dword [0x403334], eax
push eax
push eax
cmp ecx, 1
je 0x401298
cmp ecx, 2
je 0x401298
cmp ecx, 7
jne 0x4012b5
mov edx, 0x40333c
mov dword [0x403334], edx
push eax
push edx
call fcn.00401942
mov dword [esp], edx
mov dword [0x403338], ecx
jmp 0x4012ee
cmp ecx, 3
jne 0x4012d3
lea edx, [eax + 4]
mov ecx, dword [eax]
mov dword [0x403334], edx
mov dword [0x403338], ecx
add ecx, 4
mov dword [esp], ecx
jmp 0x4012ee
cmp ecx, 4
je 0x4012dd
cmp ecx, 5
jne 0x4012ee
mov dword [0x403338], 4
mov dword [esp], 4
push dword [0x403338]
push dword [0x403334]
push dword [0x403330]
push dword [0x40332c]
push dword [0x403328]
push dword [0x403324]
call fcn.0040187b
pop eax
pop ecx
add eax, ecx
dec dword [0x403320]
jne 0x4011e6
push str.___Done
push 0xffffffffffffffff
push 0x181
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push 0
push eax
push 0x197
push dword [0x403004]
call sub.USER32.dll_SendMessageA
cmp byte [0x403561], 0
je 0x40136b
push 0
push 0x7d0
push 1
push dword [ebp + 8]
call sub.USER32.dll_SetTimer
pop dword fs:[0]
add esp, 4
jmp 0x40176a
cmp ax, 0x69
jne 0x4016dc
cmp byte [0x403560], 0
je 0x40161d
push 0x401770
push dword fs:[0]
mov dword [0x403520], esp
mov dword [0x403524], ebp
mov dword [0x403528], ebx
mov dword [0x40352c], esi
mov dword [0x403530], edi
mov dword [0x403534], 0x4015cb
mov dword fs:[0], esp
push str.___Setting_up_registry...
push 0xffffffffffffffff
push 0x181
push dword [0x403004]
call sub.USER32.dll_SendMessageA
mov eax, dword [0x402204]
mov ecx, dword [0x4021fc]
mov dword [0x403320], ecx
test ecx, ecx
je 0x401501
mov dword [0x40332c], eax
mov edx, dword [eax]
cmp byte [eax], 0
je 0x40140b
inc eax
jmp 0x401403
inc eax
cmp edx, 0x52434b48
jne 0x40141b
mov ecx, 0x80000000
jmp 0x401473
cmp edx, 0x55434b48
jne 0x40142a
mov ecx, 0x80000001
jmp 0x401473
cmp edx, 0x4d4c4b48
jne 0x401439
mov ecx, 0x80000002
jmp 0x401473
cmp edx, 0x53554b48
jne 0x401448
mov ecx, 0x80000003
jmp 0x401473
cmp edx, 0x44504b48
jne 0x401457
mov ecx, 0x80000004
jmp 0x401473
cmp edx, 0x43434b48
jne 0x401466
mov ecx, 0x80000005
jmp 0x401473
cmp edx, 0x44444b48
jne 0x401473
mov ecx, 0x80000006
mov dword [0x403324], ecx
mov dword [0x403330], eax
add dword [0x40332c], 5
cmp byte [eax], 0
je 0x40148d
inc eax
jmp 0x401485
inc eax
movzx ecx, byte [eax]
mov dword [0x403328], ecx
inc eax
mov dword [0x403334], eax
push eax
push eax
cmp ecx, 1
je 0x4014ae
cmp ecx, 2
je 0x4014ae
cmp ecx, 7
jne 0x4014ba
push eax
call sub.KERNEL32.dll_lstrlenA
inc eax
mov dword [esp], eax
jmp 0x4014da
cmp ecx, 3
jne 0x4014c9
mov ecx, dword [eax]
add ecx, 4
mov dword [esp], ecx
jmp 0x4014da
cmp ecx, 4
je 0x4014d3
cmp ecx, 5
jne 0x4014da
mov dword [esp], 4
push dword [0x403330]
push dword [0x40332c]
push dword [0x403324]
call fcn.004018c8
pop eax
pop ecx
add eax, ecx
dec dword [0x403320]
jne 0x4013fc
push 0
push 0
push 0x18b
push dword [0x403004]
call sub.USER32.dll_SendMessageA
sub eax, 2
push eax
push 0
push eax
push 0x187
push dword [0x403004]
call sub.USER32.dll_SendMessageA
test eax, eax
je 0x4015c3
push 0
push dword [esp + 4]
push 0x199
push dword [0x403004]
call sub.USER32.dll_SendMessageA
test eax, eax
je 0x4015c3
mov edx, dword [eax]
cmp edx, 0x52434b48
jne 0x40155f
mov edx, 0x80000000
jmp 0x4015b7
cmp edx, 0x55434b48
jne 0x40156e
mov edx, 0x80000001
jmp 0x4015b7
cmp edx, 0x4d4c4b48
jne 0x40157d
mov edx, 0x80000002
jmp 0x4015b7
cmp edx, 0x53554b48
jne 0x40158c
mov edx, 0x80000003
jmp 0x4015b7
cmp edx, 0x44504b48
jne 0x40159b
mov edx, 0x80000004
jmp 0x4015b7
cmp edx, 0x43434b48
jne 0x4015aa
mov edx, 0x80000005
jmp 0x4015b7
cmp edx, 0x44444b48
jne 0x4015b7
mov edx, 0x80000006
add eax, 5
push 0
push eax
push edx
call fcn.00401905
pop eax
dec eax
jne 0x401518
push str.___Done
push 0xffffffffffffffff
push 0x181
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push 0
push eax
push 0x197
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push 1
push 0x68
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
mov byte [0x403560], 0
pop dword fs:[0]
add esp, 4
jmp 0x40176a
cmp dword [0x402200], 0
je 0x401391
xor eax, eax
mov ecx, dword [0x403004]
push eax
push eax
push 0x184
push ecx
push eax
push 0x68
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_EnableWindow
call sub.USER32.dll_SendMessageA
mov ecx, dword [0x402200]
mov eax, dword [0x402208]
test ecx, ecx
je 0x4016d0
push ecx
push eax
push eax
push eax
push 0
push 0x180
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push eax
push eax
push 1
push 0x185
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push 0x19a
push dword [0x403004]
call sub.USER32.dll_SendMessageA
pop eax
pop ecx
cmp byte [eax], 0
je 0x4016a3
inc eax
jmp 0x40169b
inc eax
dec ecx
jne 0x40165f
push str.___Please_select_which_keys_to_remove:
push ecx
push 0x181
push dword [0x403004]
call sub.USER32.dll_SendMessageA
push 0
push eax
push 0x197
push dword [0x403004]
call sub.USER32.dll_SendMessageA
mov byte [0x403560], 1
jmp 0x40176a
cmp ax, 0x6a
jne 0x401720
mov dword [0x403538], 0x28
mov dword [0x403544], 0x402096
mov dword [0x403548], 0x402078
mov dword [0x40354c], 0x80
mov dword [0x403550], 2
push 0x403538
call sub.USER32.dll_MessageBoxIndirectA
jmp 0x40176a
cmp ax, 0x6b
jne 0x40176a
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.USER32.dll_SendMessageA
jmp 0x40176a
cmp dword [ebp + 0xc], 0x113
jne 0x40174f
push 0
push 0
push 0x10
push dword [ebp + 8]
call sub.USER32.dll_PostMessageA
jmp 0x40176a
cmp dword [ebp + 0xc], 0x10
jne 0x40176a
push 0
push dword [ebp + 8]
call sub.USER32.dll_EndDialog
push dword [section..data]
call sub.USER32.dll_DestroyIcon
xor eax, eax
leave
ret 0x10