Function at 0x47b2a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x114], ebx
call fcn.00483e70
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x110]
push eax
push 0x104
mov dword [ebp - 0x118], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x47b34b
push 0x104
lea eax, [ebp - 0x110]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x47b319
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x47b580
mov byte [eax], bl
push 0x518188
lea esi, [edi + 0x164]
push 0x104
push esi
call fcn.004d0170
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push 0x104
push esi
call fcn.004d01ca
mov eax, 0x53e1f8
jmp 0x47b367
push 0x518188
lea esi, [edi + 0x164]
push 0x104
push esi
call fcn.004d0170
lea eax, [ebp - 0x110]
add esp, 0xc
push eax
push 0x104
push esi
call fcn.004d01ca
add esp, 0xc
push str.UltraVNC.ini
push 0x104
push esi
call fcn.004d01ca
mov eax, dword [ebp - 0x11c]
add esp, 0xc
test eax, eax
je 0x47b41a
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x114]
push eax
push 0x201eb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47b41a
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x118], eax
test eax, eax
jne 0x47b41a
push 0x104
push esi
push str._TEMP_
push dword [ebp - 0x114]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
push 0x53e1f8
push 0x104
push esi
call fcn.004d01ca
add esp, 0xc
push str.UltraVNC.ini
push 0x104
push esi
call fcn.004d01ca
add esp, 0xc
cmp dword [edi], 0
je 0x47b49f
lea ecx, [ebp - 0x110]
call fcn.00484360
test eax, eax
jne 0x47b455
cmp dword [ebp - 0x118], 0
jne 0x47b441
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x114]
jmp 0x47b57e
mov ecx, 0x518188
lea eax, [ebp - 0x110]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47b480
test dl, dl
je 0x47b47c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47b480
add eax, 2
add ecx, 2
test dl, dl
jne 0x47b460
xor eax, eax
jmp 0x47b485
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47b49f
push 0x30
push 0x567828
mov edx, 0x567768
call fcn.00425e00
add esp, 8
jmp 0x47b432
cmp dword [edi + 0x114], 0
jne 0x47b557
cmp dword [edi], 0
je 0x47b4da
push str.d:_saasultravncwinvncwinvnc_vncpropertiespoll.cpp_:_show_per_user_Properties_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0xc
mov dword [edi + 0x10c], 1
mov ecx, edi
push 1
call fcn.0047c300
jmp 0x47b4e1
mov ecx, edi
call fcn.0047cfe0
push edi
push 0x47b5a0
push 0
push 0x66
push dword [0x567d1c]
mov dword [edi + 0x110], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [edi + 0x110], 0
mov esi, eax
mov eax, 2
cmove esi, eax
push esi
push str.d:_saasultravncwinvncwinvnc_vncpropertiespoll.cpp_:_dialog_result___d_n
push 9
push 0x558c50
call fcn.0041c840
add esp, 0x10
cmp esi, 0xffffffff
jne 0x47b539
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x47b432
cmp dword [0x5674b8], 0
jne 0x47b557
cmp dword [edi], 0
mov ecx, edi
je 0x47b552
push 1
call fcn.0047c300
jmp 0x47b557
call fcn.0047cfe0
cmp dword [ebp - 0x118], 0
jne 0x47b566
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x47b573
push ebx
call esi
mov eax, dword [ebp - 0x114]
test eax, eax
je 0x47b580
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret 8