Function at 0x468750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4f5568]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x114], 0
push edi
mov dword [ebp - 0x120], ebx
call fcn.0046fbd0
mov dword [ebp - 0x118], eax
xor eax, eax
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x468842
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4687d9
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004ad400
add esp, 8
test eax, eax
je 0x468ad9
mov byte [eax], 0
add ebx, 0x164
lea edx, [ebp - 0x110]
mov esi, edx
mov byte [ebx], 0
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4687f0
sub edx, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x468800
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x468820
mov ax, word [0x4dfc28]
lea ecx, [ebx - 1]
mov word [edi], ax
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x468836
jmp 0x46888a
add ebx, 0x164
lea edx, [ebp - 0x110]
mov esi, edx
mov byte [ebx], 0
mov al, byte [edx]
inc edx
test al, al
jne 0x468853
sub edx, esi
lea edi, [ebx - 1]
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x468860
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx - 1]
lea esp, [esp]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x468880
mov eax, dword [str.UltraVNC.ini]
mov dword [ecx], eax
mov eax, dword [0x4e13f4]
mov dword [ecx + 4], eax
mov eax, dword [0x4e13f8]
mov dword [ecx + 8], eax
mov al, byte [0x4e13fc]
mov byte [ecx + 0xc], al
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x468965
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x114]
push eax
push 0x201eb
push edi
mov dword [ebp - 0x118], edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x468967
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0x11c], esi
test esi, esi
jne 0x468969
push 0x104
push ebx
push str._TEMP_
push dword [ebp - 0x114]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x468920
mov ax, word [0x4dfc28]
dec ebx
mov word [edi], ax
mov al, byte [ebx + 1]
lea ebx, [ebx + 1]
test al, al
jne 0x468934
mov eax, dword [str.UltraVNC.ini]
mov edi, dword [ebp - 0x118]
mov dword [ebx], eax
mov eax, dword [0x4e13f4]
mov dword [ebx + 4], eax
mov eax, dword [0x4e13f8]
mov dword [ebx + 8], eax
mov al, byte [0x4e13fc]
mov byte [ebx + 0xc], al
jmp 0x468969
xor edi, edi
xor esi, esi
mov ebx, dword [ebp - 0x120]
cmp dword [ebx], 0
je 0x4689ef
lea ecx, [ebp - 0x110]
call fcn.0046fff0
test eax, eax
jne 0x4689a1
test esi, esi
jne 0x46898d
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x114]
jmp 0x468ad7
mov ecx, 0x4d9f42
lea eax, [ebp - 0x110]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4689d0
test dl, dl
je 0x4689cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4689d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4689b0
xor eax, eax
jmp 0x4689d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4689ef
push 0x30
push 0x502668
mov edx, 0x502978
call fcn.0041b520
add esp, 8
jmp 0x468983
cmp dword [ebx + 0x114], 0
jne 0x468aaf
cmp dword [ebx], 0
je 0x468a2a
push str.vncpropertiesPoll.cpp_:_show_per_user_Properties_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0xc
mov dword [ebx + 0x10c], 1
mov ecx, ebx
push 1
call fcn.00469460
jmp 0x468a31
mov ecx, ebx
call fcn.00469fb0
push ebx
push 0x468af0
push 0
push 0x66
push dword [0x502044]
mov dword [ebx + 0x110], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [ebx + 0x110], 0
mov esi, eax
mov eax, 2
cmove esi, eax
push esi
push str.vncpropertiesPoll.cpp_:_dialog_result___d_n
push 9
push 0x4f6c50
call fcn.00414f90
add esp, 0x10
cmp esi, 0xffffffff
jne 0x468a91
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0x11c]
test eax, eax
jmp 0x468985
cmp dword [0x501498], 0
jne 0x468aaf
cmp dword [ebx], 0
mov ecx, ebx
je 0x468aaa
push 1
call fcn.00469460
jmp 0x468aaf
call fcn.00469fb0
mov eax, dword [ebp - 0x11c]
test eax, eax
jne 0x468abf
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x468acc
push edi
call esi
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x468ad9
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aca59
mov esp, ebp
pop ebp
ret 8