Function at 0x406b82
Capabilities:
Allocate or change rwx memory
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe54
push edi
and dword [ebp - 0x420], 0
and dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 1
mov al, byte [0x410f90]
mov byte [ebp - 0x30c], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x410f90]
mov byte [ebp - 0x524], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x523]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x410f90]
mov byte [ebp - 0x208], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x410f90]
mov byte [ebp - 0x104], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x410f90]
mov byte [ebp - 0x410], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 4
push 0x1000
push 0x105
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0x41c], eax
push 1
push dword [ebp + 8]
call fcn.004064da
pop ecx
pop ecx
cmp eax, 0x40d27c
jne 0x406c64
mov dword [ebp - 0x414], 1
jmp 0x406c79
and dword [ebp - 0x414], 0
push 0x40d27c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x40d40c
push dword [ebp + 8]
push 0
call fcn.00406584
add esp, 0xc
test eax, eax
je 0x406cab
push 0x104
push 0x40d408
push 0x40d40c
push dword [ebp + 8]
call fcn.00406718
add esp, 0x10
jmp 0x406c79
push 0x104
lea eax, [ebp - 0x30c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
push 1
pop eax
test eax, eax
je 0x4070ac
push dword [ebp - 0x420]
push 0x40d27c
lea eax, [ebp - 0x30c]
push eax
call fcn.004068aa
add esp, 0xc
push eax
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push 0x410f90
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
je 0x407098
push str._startmenu_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406d6b
mov al, byte [0x410f90]
mov byte [ebp - 0x628], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x628]
push eax
push str.Programs
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0x628]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._desktop_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406dad
lea eax, [ebp - 0x72c]
push eax
push str.Desktop
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0x72c]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._sendto_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406def
lea eax, [ebp - 0x830]
push eax
push str.SendTo
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0x830]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._favorites_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406e31
lea eax, [ebp - 0x934]
push eax
push str.Favorites
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0x934]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._startup_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406e73
lea eax, [ebp - 0xa38]
push eax
push str.Startup
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0xa38]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._targetdir_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406ea0
push 0x411a00
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push 0x40d384
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406ee1
lea eax, [ebp - 0xb3c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea eax, [ebp - 0xb3c]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._quicklaunch_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x406f88
mov al, byte [0x410f90]
mov byte [ebp - 0xc40], al
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0xc3f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc40]
push eax
push str.AppData
call fcn.00406aaf
pop ecx
pop ecx
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jle 0x406f4d
push str.MicrosoftInternet_ExplorerQuick_Launch
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0xc40]
push eax
call fcn.00406a0f
pop ecx
test eax, eax
jne 0x406f70
lea eax, [ebp - 0xc40]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0xc40]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._programfiles_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x407034
push str.C:Program_Files
lea eax, [ebp - 0xd44]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0xd48]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40701f
mov dword [ebp - 0xd50], 0x104
mov dword [ebp - 0xd4c], 1
lea eax, [ebp - 0xd50]
push eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0xd4c]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xd48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xd44]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
push str._sysdir_
lea eax, [ebp - 0x524]
push eax
call fcn.0040680b
pop ecx
pop ecx
test eax, eax
jne 0x407072
push 0x104
lea eax, [ebp - 0xe54]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea eax, [ebp - 0xe54]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
jmp 0x407085
lea eax, [ebp - 0x524]
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x40d27c
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
jmp 0x40709a
jmp 0x4070ac
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
jmp 0x406cc0
cmp dword [ebp - 0x414], 0
jne 0x4070dd
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
dec eax
push eax
push dword [ebp - 0x41c]
call fcn.004064da
pop ecx
pop ecx
push eax
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, dword [ebp - 0x41c]
pop edi
leave
ret