Function at 0x41d2e8
Capabilities:
Get common file path
Get cpu information
Get file version info
Get memory capacity
Get system information on windows
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a1c
call fcn.004f20c8
push edi
push esi
push ebx
lea edi, [ebp - 0xa0]
xor ebx, ebx
mov eax, ebx
cld
mov ecx, 0x27
rep stosd dword es:[edi], eax
mov dword [ebp - 0xa0], 0x9c
add esp, 0xfffffff4
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.dll_GetVersionExA
lea eax, [ebp - 0xf0]
push eax
call sub.KERNEL32.dll_GetSystemInfo
lea edi, [ebp - 0xc0]
mov eax, ebx
cld
mov ecx, 8
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc0], 0x20
lea eax, [ebp - 0xc0]
push eax
call sub.KERNEL32.dll_GlobalMemoryStatus
push 0
call sub.USER32.dll_GetSystemMetrics
mov dword [ebp - 0x19c0], eax
push 1
call sub.USER32.dll_GetSystemMetrics
mov dword [ebp - 0x19c4], eax
push 0x41ccaf
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xfffffff4
push 0x41ccba
push eax
call sub.KERNEL32.dll_GetProcAddress
mov edx, eax
lea edi, [ebp - 0x2a0]
mov eax, ebx
cld
mov ecx, 0x6a
rep stosd dword es:[edi], eax
mov dword [ebp - 0x2a0], 0x1a8
add esp, 0x18
test edx, edx
je 0x41d3b9
push 0
lea eax, [ebp - 0x2a0]
push eax
push 0
push 0
call edx
add esp, 0xfffffff8
push 0x100
lea ebx, [ebp - 0xca0]
push ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x41ccce
push ebx
call fcn.004f1ea8
add esp, 0xfffffff8
push ebx
push 0x100
lea esi, [ebp - 0xda0]
push esi
push 0x41ccdb
push 0x41cce3
push 0x41ccf0
call sub.KERNEL32.dll_GetPrivateProfileStringA
push ebx
push 0x100
lea ebx, [ebp - 0xea0]
push ebx
push 0x41ccdb
push 0x41ccf8
push 0x41ccf0
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0
push dword [ebp - 0xbc]
mov eax, dword [ebp - 0xa4]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xa8]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xac]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb0]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb4]
shr eax, 0xa
push eax
mov eax, dword [ebp - 0xb8]
shr eax, 0xa
push eax
push dword [ebp - 0xec]
push dword [ebp - 0xdc]
push ebx
push esi
push 0x41cd00
lea ebx, [ebp - 0xaa0]
push ebx
call fcn.004f1ea0
mov dword [ebp - 0x1a04], 0
add esp, 0x50
lea eax, [ebp - 0xba0]
mov dword [ebp - 0x19e0], eax
lea edx, [ebp - 0x19a4]
mov dword [ebp - 0x19e4], edx
lea ecx, [ebp - 0xfa0]
mov dword [ebp - 0x19e8], ecx
lea eax, [ebp - 0x10a0]
mov dword [ebp - 0x19f4], eax
lea edx, [ebp - 0x11a0]
mov dword [ebp - 0x19d8], edx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x19dc], ecx
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x19f0], eax
mov edx, dword [ebp - 0x1a04]
cmp edx, dword [ebp - 0xdc]
jae 0x41d68a
mov ecx, dword [ebp - 0x19e0]
mov dword [ebp - 0x19cc], ecx
nop
lea edi, [ebp - 0xaa0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ebp + ecx - 0xaa1]
mov dword [ebp - 0x19c8], ecx
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41ce60
cld
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x19cc]
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov al, byte [ebp - 0x1a04]
add al, 0x30
mov edx, dword [ebp - 0x19cc]
mov byte [edx + ecx - 2], al
add esp, 0xfffffffc
mov ecx, dword [ebp - 0x19e4]
push ecx
push edx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41d672
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea ebx, [ebp - 0x19a8]
push ebx
mov eax, dword [ebp - 0x19e8]
push eax
push 0
push 0
push 0x41ce8f
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov esi, ebx
test eax, eax
je 0x41d5ba
mov eax, dword [0x41cea3]
mov dword [ebp - 0xfa0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov edx, dword [ebp - 0x19f4]
push edx
push 0
push 0
push 0x41cea7
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41d5f5
mov eax, dword [0x41cea3]
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x19a8], 4
add esp, 0xfffffff8
push esi
lea eax, [ebp - 0x19ac]
push eax
push 0
push 0
push 0x41ceb2
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41d62f
mov dword [ebp - 0x19ac], 0xffffffff
add esp, 0xfffffff8
push dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x19f4]
push ecx
mov eax, dword [ebp - 0x19e8]
push eax
mov edx, dword [ebp - 0x1a04]
push edx
push 0x41cec0
mov ecx, dword [ebp - 0x19c8]
push ecx
call fcn.004f1ea0
add esp, 0x20
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
inc dword [ebp - 0x1a04]
mov eax, dword [ebp - 0x1a04]
cmp eax, dword [ebp - 0xdc]
jb 0x41d500
add esp, 0xfffffff4
lea edx, [ebp - 0xaa0]
push edx
call fcn.004f2100
mov dword [0x4f5e8c], eax
add esp, 0x10
cmp dword [ebp - 0x90], 2
jne 0x41d6c0
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41cf00
cld
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x41d6d5
mov edi, dword [ebp - 0x19e0]
mov esi, 0x41cf40
cld
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
add esp, 0xfffffffc
mov eax, dword [ebp - 0x19e4]
push eax
mov edx, dword [ebp - 0x19e0]
push edx
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41d7c5
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea ebx, [ebp - 0x19a8]
push ebx
mov ecx, dword [ebp - 0x19f4]
push ecx
push 0
push 0
push 0x41cf6a
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov esi, ebx
test eax, eax
je 0x41d73e
mov eax, dword [0x41cea3]
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov eax, dword [ebp - 0x19e8]
push eax
push 0
push 0
push 0x41cf7a
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41d779
mov eax, dword [0x41cea3]
mov dword [ebp - 0xfa0], eax
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
push esi
mov edx, dword [ebp - 0x19d8]
push edx
push 0
push 0
push 0x41cf91
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41d7b4
mov eax, dword [0x41cea3]
mov dword [ebp - 0x11a0], eax
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffffc
movzx eax, byte [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x19e8]
push ecx
mov eax, dword [ebp - 0x19f4]
push eax
mov edx, dword [ebp - 0x19dc]
push edx
push dword [ebp - 0x94]
mov ecx, dword [ebp - 0x19d8]
push ecx
push 0x41cfa0
lea eax, [ebp - 0xaa0]
push eax
call fcn.004f1ea0
add esp, 0x30
add esp, 0xfffffff4
lea edx, [ebp - 0xaa0]
push edx
call fcn.004f2100
mov dword [0x4f5e88], eax
add esp, 0xfffffff4
mov ecx, dword [ebp - 0x19c4]
push ecx
mov eax, dword [ebp - 0x19c0]
push eax
mov edx, dword [ebp - 0x19f0]
push edx
push 0x41d060
lea ecx, [ebp - 0xaa0]
push ecx
call fcn.004f1ea0
mov byte [ebp - 0xba0], 0
add esp, 0x30
add esp, 0xfffffffc
mov eax, dword [ebp - 0x19e4]
push eax
push 0x41d0b7
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
jne 0x41d8b9
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea eax, [ebp - 0x19a8]
push eax
mov edx, dword [ebp - 0x19e0]
push edx
push 0
push 0
push 0x41d0d0
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0xfffffffc
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
cmp byte [ebp - 0xba0], 0
je 0x41ddaa
lea edi, [ebp - 0xaa0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ecx, [ebp + ecx - 0xaa1]
mov dword [ebp - 0x19d0], ecx
add esp, 0xfffffffc
push 0x12
push 0x41d0df
mov edx, dword [ebp - 0x19e0]
push edx
call fcn.004f20f8
add esp, 0x10
test eax, eax
jne 0x41d931
mov edi, dword [ebp - 0x19e0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 0x12]
lea edx, [ebp - 0xb8e]
add esp, 0xfffffffc
push eax
push edx
mov edx, dword [ebp - 0x19e0]
push edx
call fcn.004f1e98
add esp, 0x10
add esp, 0xfffffffc
mov ecx, dword [ebp - 0x19e4]
push ecx
mov eax, dword [ebp - 0x19e0]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
add esp, 4
test eax, eax
je 0x41d970
push 0
push 0x41d0f2
mov edx, dword [ebp - 0x19e0]
push edx
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x41ddaa
mov dword [ebp - 0x19a8], 0x100
add esp, 0xfffffff8
lea esi, [ebp - 0x19a8]
push esi
lea ebx, [ebp - 0x12a0]
push ebx
push 0
push 0
push 0x41d0ff
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41d9b1
mov eax, dword [0x41cea3]
mov dword [ebp - 0x12a0], eax
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
lea ebx, [ebp - 0x19a0]
push ebx
push 0
push 0
push 0x41d120
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov edi, ebx
test eax, eax
jne 0x41da10
push 0
push 0
push 0x100
lea ebx, [ebp - 0x13a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x19ec], ebx
jmp 0x41da27
mov eax, dword [0x41cea3]
mov dword [ebp - 0x13a0], eax
lea ecx, [ebp - 0x13a0]
mov dword [ebp - 0x19ec], ecx
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41d160
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41da78
push 0
push 0
push 0x100
lea ebx, [ebp - 0x14a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x19f8], ebx
jmp 0x41da8f
mov eax, dword [0x41cea3]
mov dword [ebp - 0x14a0], eax
lea eax, [ebp - 0x14a0]
mov dword [ebp - 0x19f8], eax
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41d17f
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41dae0
push 0
push 0
push 0x100
lea ebx, [ebp - 0x15a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
mov dword [ebp - 0x1a04], ebx
jmp 0x41daf7
mov eax, dword [0x41cea3]
mov dword [ebp - 0x15a0], eax
lea edx, [ebp - 0x15a0]
mov dword [ebp - 0x1a04], edx
mov dword [ebp - 0x19a8], 0x200
add esp, 0xfffffff8
push esi
push edi
push 0
push 0
push 0x41d19c
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41db42
push 0
push 0
push 0x100
lea ebx, [ebp - 0x16a0]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0xfde9
call sub.KERNEL32.dll_WideCharToMultiByte
jmp 0x41db53
mov eax, dword [0x41cea3]
mov dword [ebp - 0x16a0], eax
lea ebx, [ebp - 0x16a0]
mov dword [ebp - 0x19a8], 4
add esp, 0xfffffff8
push esi
lea eax, [ebp - 0x19b0]
push eax
push 0
push 0
push 0x41d1c0
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
je 0x41db8d
mov dword [ebp - 0x19b0], 0xffffffff
push dword [ebp - 0x19b0]
push ebx
mov ecx, dword [ebp - 0x1a04]
push ecx
mov eax, dword [ebp - 0x19f8]
push eax
mov edx, dword [ebp - 0x19ec]
push edx
lea ecx, [ebp - 0x12a0]
push ecx
push 0x41d1e0
mov eax, dword [ebp - 0x19d0]
push eax
call fcn.004f1ea0
add esp, 0x20
add esp, 0xfffffff8
push esi
push 0
push 0
push 0
push 0x41d244
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x41dd99
add esp, 0xfffffff4
push dword [ebp - 0x19a8]
call fcn.004f1e90
mov ebx, eax
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x41d244
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 0x18
test eax, eax
jne 0x41dd99
add esp, 0xfffffff8
push 0x41d25c
lea edx, [ebp - 0xaa0]
push edx
call fcn.004f1ea8
mov dword [ebp - 0x1a04], ebx
add esp, 0x10
cmp byte [ebx], 0
je 0x41dd82
lea ecx, [ebp - 0xaa0]
mov dword [ebp - 0x19d4], ecx
nop
xor edi, edi
add esp, 0xfffffff8
push 0x41d26e
mov eax, dword [ebp - 0x19d4]
push eax
call fcn.004f1ea8
add esp, 0xfffffff8
mov edx, dword [ebp - 0x1a04]
push edx
mov ecx, dword [ebp - 0x19d4]
push ecx
call fcn.004f1ea8
add esp, 0x20
add esp, 0xfffffff8
push 0x41d271
mov eax, dword [ebp - 0x19d4]
push eax
call fcn.004f1ea8
add esp, 0xfffffff8
lea eax, [ebp - 0x19b4]
push eax
mov edx, dword [ebp - 0x1a04]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x41dd47
add esp, 0xfffffff4
push ebx
call fcn.004f1e90
mov edi, eax
push edi
push ebx
push 0
mov ecx, dword [ebp - 0x1a04]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
add esp, 0x10
test eax, eax
je 0x41dd47
lea esi, [ebp - 0x19b8]
push esi
lea ebx, [ebp - 0x19bc]
push ebx
push 0x41d280
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41dd07
add esp, 0xfffffff8
push dword [ebp - 0x19bc]
lea eax, [ebp - 0xaa0]
push eax
jmp 0x41dd3f
push esi
push ebx
push 0x41d2c0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41dd30
add esp, 0xfffffff8
push dword [ebp - 0x19bc]
lea edx, [ebp - 0xaa0]
push edx
jmp 0x41dd3f
add esp, 0xfffffff8
push 0x41cea3
lea ecx, [ebp - 0xaa0]
push ecx
call fcn.004f1ea8
add esp, 0x10
test edi, edi
je 0x41dd57
add esp, 0xfffffff4
push edi
call fcn.004f1e88
add esp, 0x10
mov edi, dword [ebp - 0x1a04]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov edx, dword [ebp - 0x1a04]
lea ecx, [edx + ecx - 1]
mov dword [ebp - 0x1a04], ecx
cmp byte [ecx], 0
jne 0x41dc50
add esp, 0xfffffff8
push 0x41d2e5
lea ecx, [ebp - 0xaa0]
push ecx
call fcn.004f1ea8
add esp, 0x10
add esp, 0xfffffff4
push dword [ebp - 0x19a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff4
lea eax, [ebp - 0xaa0]
push eax
call fcn.004f2100
mov dword [0x4f5e90], eax
add esp, 0x10
lea esp, [ebp - 0x1a28]
pop ebx
pop esi
pop edi
leave
ret