Function at 0x456410
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4ea5e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
call fcn.0045d8f0
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
mov dword [ebp - 0x114], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4564fe
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x45649a
lea edx, [ebp - 0x108]
push 0x5c
push edx
call fcn.004a9130
add esp, 8
cmp eax, esi
je 0x4567d5
mov byte [eax], 0
add ebx, 0x164
lea eax, [ebp - 0x108]
mov byte [ebx], 0
mov esi, eax
jmp 0x4564b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4564b0
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4564c0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4564e0
mov ax, word [0x4ce6f4]
mov word [edi], ax
lea eax, [ebx - 1]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4564f4
jmp 0x456548
add ebx, 0x164
lea eax, [ebp - 0x108]
mov byte [ebx], 0
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x456510
sub eax, esi
lea edi, [ebx - 1]
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x456520
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebx - 1]
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x456540
mov ecx, dword [str.UltraVNC.ini]
mov dword [eax], ecx
mov edx, dword [0x4d65dc]
mov dword [eax + 4], edx
mov ecx, dword [0x4d65e0]
mov dword [eax + 8], ecx
mov dl, byte [0x4d65e4]
mov byte [eax + 0xc], dl
mov eax, dword [ebp - 0x11c]
test eax, eax
je 0x45661d
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea ecx, [ebp - 0x10c]
push ecx
push 0x201eb
push eax
mov dword [ebp - 0x110], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x45661d
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0x114], edi
test edi, edi
jne 0x456623
mov eax, dword [ebp - 0x10c]
push 0x104
push ebx
push str._TEMP_
push eax
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
lea edi, [ebx - 1]
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4565e0
mov cx, word [0x4ce6f4]
mov word [edi], cx
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4565f3
mov edx, dword [str.UltraVNC.ini]
mov dword [ebx], edx
mov eax, dword [0x4d65dc]
mov dword [ebx + 4], eax
mov ecx, dword [0x4d65e0]
mov dword [ebx + 8], ecx
mov dl, byte [0x4d65e4]
mov byte [ebx + 0xc], dl
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp - 0x118]
cmp dword [esi], 0
je 0x4566f3
lea eax, [ebp - 0x108]
call fcn.0045dd00
test eax, eax
jne 0x456674
test edi, edi
jne 0x45664b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0x10c]
push ecx
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
mov ecx, 0x4ce44c
lea eax, [ebp - 0x108]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4566a0
test dl, dl
je 0x45669c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4566a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x456680
xor eax, eax
jmp 0x4566a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4566f3
push 0x517b58
push 0x518468
mov eax, 0x30
call fcn.00409310
add esp, 8
test edi, edi
jne 0x4566ca
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x10c]
push eax
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x114], 0
jne 0x4567ab
cmp dword [esi], 0
je 0x45672f
push str.vncpropertiesPoll.cpp_:_show_per_user_Properties_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 4
push 1
mov dword [esi + 0x10c], 1
call fcn.004571b0
jmp 0x456734
call fcn.00457cc0
mov ecx, dword [0x513794]
push esi
push 0x4567f0
push 0
push 0x66
push ecx
mov dword [esi + 0x110], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [esi + 0x110], 0
mov ebx, eax
jne 0x456765
mov ebx, 2
push ebx
push str.vncpropertiesPoll.cpp_:_dialog_result___d_n
mov eax, 9
mov ecx, 0x4ecb00
call fcn.00403230
add esp, 8
cmp ebx, 0xffffffff
jne 0x45678f
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4566c0
cmp dword [0x544798], 0
jne 0x4567ab
cmp dword [esi], 0
je 0x4567a6
push 1
call fcn.004571b0
jmp 0x4567ab
call fcn.00457cc0
test edi, edi
jne 0x4567b5
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x110]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4567c8
push eax
call esi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x4567d5
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a8a2f
mov esp, ebp
pop ebp
ret