Function at 0x4027a9
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402873
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x41a88c]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x416128
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x41a88c]
push eax
call fcn.004023cb
add esp, 8
mov dword [0x41a8a0], eax
mov dword [ebp - 0x14], 0x104
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [0x41a88c]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.CommonFilesDir
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x41a88c]
push eax
call fcn.004023cb
add esp, 8
mov dword [0x41a8a4], eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
push 0x104
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [0x41a88c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [0x41a88c]
push ecx
call fcn.004023cb
add esp, 8
mov dword [0x41a8a8], eax
push str.SYSTEM32
mov edx, dword [0x41a88c]
push edx
call fcn.0040e3f0
add esp, 8
mov eax, dword [0x41a88c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [0x41a88c]
push ecx
call fcn.004023cb
add esp, 8
mov dword [0x41a8b0], eax
push 0x104
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x41a88c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov ecx, dword [0x41a88c]
push ecx
call fcn.004023cb
add esp, 8
mov dword [0x41a8ac], eax
mov edx, dword [0x41a88c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 4], eax
mov eax, dword [0x41a88c]
add eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
jne 0x402953
mov edx, dword [0x41a88c]
add edx, dword [ebp - 4]
mov byte [edx - 1], 0
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0x10
mov ecx, dword [0x41a88c]
push ecx
call fcn.00401328
add esp, 8
test eax, eax
je 0x40298b
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [0x41a88c]
push eax
call fcn.004023cb
add esp, 8
mov dword [0x41a8b4], eax
jmp 0x4029e0
mov ecx, dword [0x41a8a8]
push ecx
mov edx, dword [0x41a88c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.TEMP
mov eax, dword [0x41a88c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [0x41a88c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [0x41a88c]
push edx
call fcn.004023cb
add esp, 8
mov dword [0x41a8b4], eax
mov eax, dword [0x41a88c]
push eax
call fcn.004018cb
add esp, 4
mov esp, ebp
pop ebp
ret