Function at 0x405647
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x968
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov al, byte [eax]
push edi
test al, al
je 0x405afa
cmp al, 0x24
je 0x40566f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0xc]
jmp 0x405687
lea eax, [ebp + 0xc]
push 0x408bec
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405695
mov byte [ebx], 0x24
inc ebx
mov eax, dword [ebp + 0xc]
mov al, byte [eax]
test al, al
jne 0x405663
jmp 0x405afa
lea eax, [ebp + 0xc]
push str._PROGRAMFILES
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405727
mov esi, str.C:Program_Files
lea edi, [ebp - 0x620]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x3c
lea edi, [ebp - 0x60f]
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40571c
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 4]
push eax
push 0
push str.ProgramFilesDir
mov dword [ebp - 4], 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
jmp 0x405ac5
lea eax, [ebp + 0xc]
push str._DESKTOP
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405781
mov al, byte [0x409070]
push 0x40
mov byte [ebp - 0x314], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x314]
push eax
push str.Desktop
call fcn.00405b2e
cmp byte [ebp - 0x314], 0
pop ecx
pop ecx
je 0x405af1
lea eax, [ebp - 0x314]
jmp 0x405ac5
lea eax, [ebp + 0xc]
push str._INSTDIR
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x4057a6
cmp dword [ebp + 0x10], eax
je 0x405af1
push dword [ebp + 0x10]
jmp 0x405ac6
lea eax, [ebp + 0xc]
push str._WAVISDIR
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x40581b
cmp dword [ebp + 0x10], eax
je 0x405af1
push dword [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x828]
push str._swinamp.ini
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
push 0x104
push ebx
push 0x409070
push str.VISDir
push str.Winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebx], 0
jne 0x405ad3
push dword [ebp + 0x10]
push str._sPlugins
push ebx
call esi
add esp, 0xc
jmp 0x405ace
lea eax, [ebp + 0xc]
push str._WADSPDIR
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x40588c
cmp dword [ebp + 0x10], eax
je 0x405af1
push dword [ebp + 0x10]
lea eax, [ebp - 0x724]
push str._swinamp.ini
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x724]
push eax
push 0x104
push ebx
push 0x409070
push str.DSPDir
push str.Winamp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebx], 0
jne 0x405ad3
push dword [ebp + 0x10]
push str._sPlugins
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x405813
lea eax, [ebp + 0xc]
push str._WINDIR
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x4058b1
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x405ace
lea eax, [ebp + 0xc]
push str._SYSDIR
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x4058d6
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405ace
lea eax, [ebp + 0xc]
push str._TEMP
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x4058fb
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x405ace
lea eax, [ebp + 0xc]
push str._STARTMENU
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405955
mov al, byte [0x409070]
push 0x40
mov byte [ebp - 0x418], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x418]
push eax
push str.Start_Menu
call fcn.00405b2e
cmp byte [ebp - 0x418], 0
pop ecx
pop ecx
je 0x405af1
lea eax, [ebp - 0x418]
jmp 0x405ac5
lea eax, [ebp + 0xc]
push str._SMPROGRAMS
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x4059af
mov al, byte [0x409070]
push 0x40
mov byte [ebp - 0x210], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
push eax
push str.Programs
call fcn.00405b2e
cmp byte [ebp - 0x210], 0
pop ecx
pop ecx
je 0x405af1
lea eax, [ebp - 0x210]
jmp 0x405ac5
lea eax, [ebp + 0xc]
push str._SMSTARTUP
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405a09
mov al, byte [0x409070]
push 0x40
mov byte [ebp - 0x51c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x51b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x51c]
push eax
push str.Startup
call fcn.00405b2e
cmp byte [ebp - 0x51c], 0
pop ecx
pop ecx
je 0x405af1
lea eax, [ebp - 0x51c]
jmp 0x405ac5
lea eax, [ebp + 0xc]
push str._QUICKLAUNCH
push eax
call fcn.00405b04
pop ecx
test eax, eax
pop ecx
jne 0x405af5
mov al, byte [0x409070]
push 0x40
mov byte [ebp - 0x10c], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
push str.AppData
call fcn.00405b2e
cmp byte [ebp - 0x10c], 0
pop ecx
pop ecx
je 0x405aad
lea eax, [ebp - 0x10c]
push str.MicrosoftInternet_ExplorerQuick_Launch
push eax
call fcn.00403f95
pop ecx
lea eax, [ebp - 0x968]
pop ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x405a9d
test byte [ebp - 0x968], 0x10
jne 0x405a94
and byte [ebp - 0x10c], 0
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x405aa4
and byte [ebp - 0x10c], 0
cmp byte [ebp - 0x10c], 0
jne 0x405abf
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.00403f50
pop ecx
pop ecx
cmp byte [ebx], 0
je 0x405ae0
cmp byte [ebx + 1], 0
lea eax, [ebx + 1]
je 0x405ae0
mov ebx, eax
jmp 0x405ace
cmp byte [ebx], 0x5c
jne 0x405686
and byte [ebx], 0
jmp 0x405687
push 3
jmp 0x405af7
push 2
pop eax
jmp 0x405aff
and byte [ebx], 0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret