Function at 0x4233b0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1008
call fcn.0044ced0
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x1004], eax
push ebx
push ebp
mov ebp, dword [esp + 0x1014]
push esi
push edi
mov edi, dword [esp + 0x1024]
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x419]
push ebx
push eax
mov esi, ecx
mov dword [esp + 0x1c], edi
mov byte [esp + 0x420], bl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0xc25]
push ebx
push ecx
mov byte [esp + 0xc2c], bl
call fcn.0044cf00
push 0x3ff
lea edx, [esp + 0x831]
push ebx
push edx
mov byte [esp + 0x838], bl
call fcn.0044cf00
push 0x3ff
lea eax, [esp + 0x3d]
push ebx
push eax
mov byte [esp + 0x44], bl
call fcn.0044cf00
add esp, 0x30
test ebp, ebp
je 0x4237e3
push 0x400
lea ecx, [esp + 0x18]
push ecx
push ebp
mov ecx, esi
call fcn.00423330
test eax, eax
je 0x4237e3
lea edx, [esp + 0x14]
push str.ntsd
push edx
call fcn.0044d0b0
add esp, 8
test eax, eax
jne 0x4237e3
lea eax, [esp + 0x14]
push str.rundll32.exe
push eax
call fcn.0044d0b0
add esp, 8
test eax, eax
jne 0x4237e3
lea ecx, [esp + 0x14]
push str.regsvr32.exe
push ecx
call fcn.0044d0b0
add esp, 8
test eax, eax
jne 0x4237e3
push 0x400
lea edx, [esp + 0x818]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4237e3
push 0x400
lea eax, [esp + 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4237e3
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4234f2
sub eax, edx
cmp eax, 2
jl 0x4237e3
cmp byte [ebp + 1], 0x3a
jne 0x423534
mov ecx, dword [esp + 0x1028]
push ecx
push 0
push edi
call fcn.0044cf00
mov edx, dword [str.NULL]
mov dword [edi], edx
mov al, byte [0x46a474]
add esp, 0xc
mov byte [edi + 4], al
jmp 0x4237de
cmp byte [ebp], 0x25
jne 0x423626
push 0x400
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.0044cf00
push 0x25
lea edx, [esp + 0x24]
push edx
push ebp
call fcn.0041b970
add esp, 0x18
test eax, eax
je 0x4237e3
mov edi, ebp
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x423570
mov ax, word [0x46a46c]
push str._windir_
push ebp
mov word [edi], ax
call fcn.0044e806
add esp, 8
test eax, eax
jne 0x4237e3
mov ecx, dword [esp + 0x1020]
push ecx
push eax
push ebp
call fcn.0044cf00
lea eax, [esp + 0x820]
mov edx, ebp
mov ecx, eax
add esp, 0xc
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4235b8
lea eax, [esp + 0x14]
mov ecx, eax
lea ebx, [ebx]
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x4235d0
sub eax, ecx
add ebp, 0xffffffff
mov esi, ecx
mov edi, ebp
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4235e2
mov edx, dword [esp + 0x1028]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
push 0
push esi
call fcn.0044cf00
mov eax, dword [str.NULL]
mov dword [esi], eax
mov cl, byte [0x46a474]
add esp, 0xc
mov byte [esi + 4], cl
jmp 0x4237de
push 0x469140
push ebp
call fcn.0044d0b0
add esp, 8
test eax, eax
jne 0x4237e3
push 0x46a45c
push ebp
call fcn.0044d0b0
add esp, 8
test eax, eax
jne 0x4237e3
push 0x400
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0044cf00
lea edx, [esp + 0x20]
add esp, 0xc
mov eax, ebp
sub edx, ebp
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x423670
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x814]
mov byte [esp + eax + 0x414], cl
add eax, 1
test cl, cl
jne 0x423680
lea edi, [esp + 0x414]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4236a0
mov ax, word [0x469140]
mov word [edi], ax
lea eax, [esp + 0x14]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4236c0
lea edi, [esp + 0x414]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x4236d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1020]
push ecx
push 0
push ebp
call fcn.0044cf00
lea eax, [esp + 0x420]
mov edx, eax
add esp, 0xc
sub ebp, edx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [eax + ebp], cl
add eax, 1
test cl, cl
jne 0x423710
cmp dword [esp + 0x10], ebx
jne 0x4237de
push 0x400
lea eax, [esp + 0x418]
push 0
push eax
call fcn.0044cf00
add esp, 0xc
xor eax, eax
nop
mov cl, byte [esp + eax + 0xc14]
mov byte [esp + eax + 0x414], cl
add eax, 1
test cl, cl
jne 0x423740
lea edi, [esp + 0x414]
add edi, 0xffffffff
nop
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x423760
mov cx, word [0x469140]
lea eax, [esp + 0x14]
mov word [edi], cx
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x423780
lea edi, [esp + 0x414]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x423795
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [esp + 0x1028]
rep movsd dword es:[edi], dword [esi]
push edx
mov ecx, eax
and ecx, 3
push 0
push 0
rep movsb byte es:[edi], byte [esi]
call fcn.0044cf00
add esp, 0xc
lea ecx, [esp + 0x414]
xor edx, edx
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x4237d0
mov ebx, 1
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0044ce74
add esp, 0x1008
ret 0x10