Function at 0x4024c0
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x422fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x42ea58]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebx, ecx
push str.CIniFile::GetVariableFromIni
lea ecx, [esp + 0x30]
call fcn.00401120
xor esi, esi
push 0x104
mov dword [esp + 0x40], esi
call fcn.00407619
push 0x104
mov dword [esp + 0x20], eax
call fcn.00407619
push 0x104
mov dword [esp + 0x28], eax
call fcn.00407619
push 0x104
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esi
call fcn.00407619
mov edi, dword [esp + 0x54]
mov ebp, eax
push edi
lea eax, [esp + 0x40]
push str.varName:__s
push eax
mov dword [esp + 0x44], ebp
call fcn.00401410
add esp, 0x1c
cmp dword [esp + 0x1c], esi
je 0x402a5e
cmp dword [esp + 0x18], esi
je 0x402a5e
push str.SourcePath
push edi
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x402604
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
push 0x104
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x402a5e
mov edi, ebp
add edi, 0xffffffff
mov edi, edi
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4025b0
mov cl, byte [0x4257f8]
push 0x5c
push ebp
mov byte [edi], cl
call fcn.004116ac
add esp, 8
test eax, eax
je 0x402a5e
mov edx, esi
mov byte [eax], 0
mov eax, ebp
sub edx, ebp
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4025e0
push esi
lea edx, [esp + 0x30]
push str.SourcePath:__s
push edx
call fcn.00401410
add esp, 0xc
jmp 0x402a5e
push str.SystemDir
push edi
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x40263e
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x402a5e
push str.ProgramFilesDir
push edi
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x4026c8
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402a5e
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push ecx
push esi
push eax
push eax
push str.ProgramFilesDir
push edx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a5e
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x402a71
push str.PrinterDriverDir
push edi
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x40270c
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
lea ecx, [esp + 0x44]
push ecx
push 0x104
push esi
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
jmp 0x402a5e
push str.WindowsDir
push edi
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x402746
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x402a5e
push edi
lea edx, [esp + 0x30]
push str.Var:__s
push edx
call fcn.00401410
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
add esp, 0xc
push ebp
push 0x104
push eax
push str.NOT_FOUND
push edi
push 0x425b54
mov ecx, ebx
call fcn.00401ec0
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push str.Variables:__s
push edx
call fcn.00401410
mov eax, dword [esp + 0x24]
push str.NOT_FOUND
push eax
call fcn.004117db
add esp, 0x14
test eax, eax
jne 0x4027bb
lea ecx, [esp + 0x2c]
push str.VariablesSection_not_specified_in_ini_file
push ecx
call fcn.00401410
add esp, 8
jmp 0x402a5e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ebp
push 0x104
push edx
push 0x42589b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x4027f8
mov ecx, dword [esp + 0x18]
push edi
push ecx
lea edx, [esp + 0x34]
push str.Unable_to_read___s__s
push edx
call fcn.00401410
add esp, 0x10
jmp 0x402a5e
mov eax, dword [esp + 0x20]
push ebp
push eax
push edi
mov ecx, ebx
call fcn.00402ae0
test eax, eax
je 0x402a37
mov ebx, dword [esp + 0x1c]
push 0x425b14
push ebx
call fcn.004103ba
add esp, 8
test eax, eax
jne 0x40283c
push ebx
lea ecx, [esp + 0x30]
push str.Invalid_Registry_Key_format:__s
push ecx
call fcn.00401410
add esp, 0xc
jmp 0x402a5e
push eax
mov byte [eax], 0
call fcn.00411ac5
mov edi, eax
push 0x425b14
push edi
mov ebp, edi
call fcn.004103ba
add esp, 0xc
test eax, eax
je 0x402885
jmp 0x402860
push 0x425b14
push ebp
call fcn.004103ba
push eax
call fcn.00411ac5
mov ebp, eax
push 0x425b14
push ebp
call fcn.004103ba
add esp, 0x14
test eax, eax
jne 0x402860
push ebp
push ebx
call fcn.00411ab2
push eax
mov byte [eax], 0
call fcn.00411ac5
push str.HKLM
push ebx
mov ebp, eax
call fcn.00411a08
add esp, 0x14
test eax, eax
jne 0x4028b3
mov ebx, 0x80000002
jmp 0x402932
push str.HKEY_LOCAL_MACHINE
push ebx
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x4028cc
mov ebx, 0x80000002
jmp 0x402932
push str.HKEY_CLASSES_ROOT
push ebx
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x4028e5
mov ebx, 0x80000000
jmp 0x402932
push str.HKEY_CURRENT_USER
push ebx
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x4028fe
mov ebx, 0x80000001
jmp 0x402932
push str.HKEY_USERS
push ebx
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x402917
mov ebx, 0x80000003
jmp 0x402932
push str.HKEY_CURRENT_CONFIG
push ebx
call fcn.00411a08
add esp, 8
test eax, eax
jne 0x402a22
mov ebx, VariantCopy
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
lea edx, [esp + 0x14]
push edx
push 1
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push edi
je 0x402991
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push str.Error_opening_registry_key:__s_s
push ecx
call fcn.00401410
mov eax, dword [esp + 0x30]
mov edx, esi
add esp, 0x10
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402980
jmp 0x402a5e
mov ebx, dword [esp + 0x20]
push ebx
lea edx, [esp + 0x34]
push str.opened_regkey_key:__s_subkey:__s
push edx
call fcn.00401410
mov ecx, dword [esp + 0x24]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
push esi
push 0
push 0
push ebp
push ecx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push ebp
push edi
push ebx
je 0x402a0e
lea edx, [esp + 0x38]
push str.Error_reading_registry_value:__s_s_s
push edx
call fcn.00401410
push esi
call fcn.00407614
push 0x104
call fcn.00407619
mov esi, eax
mov eax, dword [esp + 0x3c]
mov edx, esi
add esp, 0x1c
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402a00
jmp 0x402a5e
lea eax, [esp + 0x38]
push str.got_value_key:__s_subkey:__s_value:__s
push eax
call fcn.00401410
add esp, 0x14
jmp 0x402a5e
push ebx
lea ecx, [esp + 0x30]
push str.Unknown_registry_key:__s
push ecx
call fcn.00401410
add esp, 0xc
jmp 0x402a5e
push 0x104
call fcn.00407619
mov esi, eax
add esp, 4
test esi, esi
je 0x402a5e
mov eax, dword [esp + 0x1c]
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x402a52
mov eax, dword [esp + 0x14]
test eax, eax
je 0x402a6d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x402a82
push eax
call fcn.00407614
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402a93
push eax
call fcn.00407614
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402aa4
push eax
call fcn.00407614
add esp, 4
test ebp, ebp
je 0x402ab1
push ebp
call fcn.00407614
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004012d0
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8