Function at 0x4775b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56b070
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0
call fcn.004864f0
mov dword [ebp - 0x230], eax
xor eax, eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x11c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x477686
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x477654
lea eax, [ebp - 0x11c]
push 0x5c
push eax
call fcn.0053eb80
add esp, 8
test eax, eax
je 0x47793b
mov byte [eax], 0
push 0x584fd8
lea esi, [edi + 0xf8c]
push 0x104
push esi
call fcn.005417f5
lea eax, [ebp - 0x11c]
push eax
push 0x104
push esi
call fcn.0054184f
add esp, 0x18
mov eax, 0x5b92c8
jmp 0x4776a5
push 0x584fd8
lea esi, [edi + 0xf8c]
push 0x104
push esi
call fcn.005417f5
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
push 0x104
push esi
call fcn.0054184f
push str.UltraVNC.ini
push 0x104
push esi
call fcn.0054184f
mov eax, dword [ebp - 0x230]
add esp, 0x18
test eax, eax
je 0x477763
test ebx, ebx
je 0x477763
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x22c], eax
push ecx
push 0x201eb
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x477763
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x228], eax
test eax, eax
jne 0x477765
push 0x104
push esi
push str._TEMP_
push dword [ebp - 0x224]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
push 0x5b92c8
push 0x104
push esi
call fcn.0054184f
push str.UltraVNC.ini
push 0x104
push esi
call fcn.0054184f
mov eax, dword [ebp - 0x228]
add esp, 0x18
jmp 0x477765
xor eax, eax
cmp dword [edi + 0x120], 0
jne 0x477775
test eax, eax
jmp 0x477913
cmp dword [edi + 4], 0
je 0x477959
cmp dword [0x5e65ec], 0
je 0x4777e7
mov dword [edi + 0x11c], 0
xor ebx, ebx
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x234], 0
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x230], 0
push eax
push 0
push 0x20019
push 0
push 0
push 0
push 0x586a74
push reloc.WS2_32.dll_bind
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x47789b
xor esi, esi
jmp 0x4778ce
mov dword [edi + 0x11c], ebx
test ebx, ebx
je 0x477794
lea ecx, [ebp - 0x220]
call fcn.00486920
test eax, eax
jne 0x477827
cmp dword [ebp - 0x228], eax
jne 0x47780e
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
jmp 0x477939
mov ecx, 0x584fd8
lea eax, [ebp - 0x220]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x477852
test dl, dl
je 0x47784e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x477852
add eax, 2
add ecx, 2
test dl, dl
jne 0x477832
xor eax, eax
jmp 0x477857
sbb eax, eax
or eax, 1
test eax, eax
jne 0x477959
push 0x30
push 0x5e7808
mov edx, 0x5e7748
call fcn.004254b0
add esp, 8
cmp dword [ebp - 0x228], 0
jne 0x477882
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
jmp 0x477939
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.Default
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor ecx, ecx
test eax, eax
cmovne esi, ecx
mov eax, dword [ebp - 0x234]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4778e7
push eax
call ecx
mov ecx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x230]
test eax, eax
je 0x4778f4
push eax
call ecx
test esi, esi
jne 0x477959
push 0x30
push 0x5e7808
mov edx, 0x5e7950
call fcn.004254b0
add esp, 8
cmp dword [ebp - 0x228], 0
jne 0x47791b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x47792e
push eax
call esi
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x47793b
push eax
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d630
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0x540], 0
jne 0x47790c
cmp dword [edi + 4], 0
je 0x477990
mov ecx, str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_show_per_user_Properties_n
test ebx, ebx
mov eax, str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_show_default_system_Properties_n
cmovne eax, ecx
push eax
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0xc
mov dword [edi + 0x11c], ebx
nop dword [eax]
push edi
push 0x477be0
push 0
push 0x92
push dword [0x5e6634]
mov dword [edi + 0x53c], 0
mov dword [edi + 0x10c], 1
mov dword [edi + 0x109c], 0
mov dword [edi + 0x1098], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [edi + 0x53c], 0
mov ebx, eax
jne 0x4779f8
mov ebx, 2
push ebx
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_dialog_result___d_n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0x10
jmp 0x477a16
push ebx
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_dialog_result___d_n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0x10
cmp ebx, 0xffffffff
je 0x477ba9
mov ecx, dword [edi + 0x118]
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ecx]
call dword [eax + 0x128]
mov ecx, dword [edi + 0x118]
mov eax, dword [ecx]
call dword [eax + 0x24c]
push 9
mov esi, eax
call fcn.0054cef5
add esp, 4
mov dword [ebp - 0x238], eax
test esi, esi
mov eax, 0x5d7a94
mov ecx, 0x5d7ba0
mov edx, 1
cmove ecx, eax
call fcn.0041ddf0
mov esi, dword [ebp - 0x238]
lea ecx, [ebp - 0x18]
mov edx, esi
call fcn.0041e040
mov byte [esi + 8], 0
mov dword [ebp - 0x238], esi
mov ecx, esi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x477a87
sub ecx, edx
jne 0x477b57
mov ecx, dword [edi + 0x118]
mov eax, dword [ecx]
call dword [eax + 0x1a8]
test eax, eax
je 0x477b57
mov eax, esi
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x477ab8
sub eax, edx
push eax
push 0
push esi
call fcn.0053f2b0
push esi
call fcn.005417da
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_warning___empty_password_n
push 0
push 0x5d7d48
call fcn.0041c960
push 0x30
push 0x5e7848
mov edx, 0x5e7680
call fcn.004254b0
add esp, 0x24
cmp ebx, 2
je 0x477b0a
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x477990
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncproperties.cpp_:_no_password___QUITTING_n
push 0
push 0x5d7d48
call fcn.0041c960
add esp, 0xc
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [ebp - 0x228], 0
jne 0x477b35
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
call esi
mov byte [0x5d9e87], 1
jmp 0x47793b
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x477b63
sub ecx, edx
push ecx
push 0
push esi
call fcn.0053f2b0
push esi
call fcn.005417da
add esp, 0x10
cmp dword [0x5e65ec], 0
jne 0x47790c
cmp dword [edi + 4], 0
mov ecx, edi
je 0x477b9f
push 1
call fcn.0047a380
jmp 0x47790c
call fcn.0047ccc0
jmp 0x47790c
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [ebp - 0x228], 0
jne 0x477bc0
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 0x22c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x224]
jmp 0x477939