Function at 0x404920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5673f0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.004fc760
add esp, 0xc
lea ecx, [ebp - 0x230]
push ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x230]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404962
mov edx, dword [str.TInjector.cfg]
mov ecx, dword [0x549b94]
mov dword [eax], edx
mov edx, dword [0x549b98]
mov dword [eax + 4], ecx
mov cx, word [0x549b9c]
mov dword [eax + 8], edx
mov dl, byte [0x549b9e]
mov word [eax + 0xc], cx
push ebx
mov byte [eax + 0xe], dl
lea eax, [ebp - 0x230]
push 0x549ba0
push eax
call fcn.004fb853
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x404e10
cmp byte [esi + 0x445], 0
lea eax, [esi + 0x445]
je 0x4049f5
push eax
push str.LastInfectedProcess_s
lea ecx, [ebp - 0x130]
push 0x12c
push ecx
call fcn.004fafe1
lea edx, [ebp - 0x130]
push ebx
push edx
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
add esp, 0x20
push edi
push 0x12c
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.004fc760
mov ecx, dword [0x549bbc]
mov al, byte [0x549bc4]
mov edx, dword [0x549bc0]
mov dword [ebp - 0x130], ecx
mov ecx, dword [esi + 0x548]
mov byte [ebp - 0x128], al
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x12c], edx
cmp dword [ecx - 0xc], eax
jle 0x404a63
lea esp, [esp]
test eax, eax
js 0x404c5a
mov edi, ecx
cmp eax, dword [edi - 0xc]
jg 0x404c5a
mov dl, byte [edi + eax]
mov byte [ebp + eax - 0x127], dl
inc eax
cmp eax, dword [ecx - 0xc]
jl 0x404a40
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea ecx, [ebp - 0x130]
push 0
push ecx
call fcn.004fc760
mov eax, dword [0x549bcc]
mov cl, byte [0x549bd0]
mov edx, dword [0x549bc8]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], cl
mov ecx, dword [esi + 0xbc]
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x130], edx
cmp dword [ecx - 0xc], eax
jle 0x404ae3
mov edi, edi
test eax, eax
js 0x404c5a
mov edi, ecx
cmp eax, dword [edi - 0xc]
jg 0x404c5a
mov dl, byte [edi + eax]
mov byte [ebp + eax - 0x127], dl
inc eax
cmp eax, dword [ecx - 0xc]
jl 0x404ac0
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea ecx, [ebp - 0x130]
push 0
push ecx
call fcn.004fc760
mov ax, word [0x549bd8]
mov cl, byte [0x549bda]
mov edx, dword [0x549bd4]
mov word [ebp - 0x12c], ax
mov byte [ebp - 0x12a], cl
mov ecx, dword [esi + 0x31c]
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x130], edx
cmp dword [ecx - 0xc], eax
jle 0x404b63
test eax, eax
js 0x404c5a
mov edi, ecx
cmp eax, dword [edi - 0xc]
jg 0x404c5a
mov dl, byte [edi + eax]
mov byte [ebp + eax - 0x129], dl
inc eax
cmp eax, dword [ecx - 0xc]
jl 0x404b40
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea ecx, [ebp - 0x130]
push 0
push ecx
call fcn.004fc760
mov ax, word [0x549be0]
mov edx, dword [0x549bdc]
mov ecx, dword [esi + 0x320]
mov word [ebp - 0x12c], ax
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x130], edx
cmp dword [ecx - 0xc], eax
jle 0x404bd7
test eax, eax
js 0x404c5a
mov edi, ecx
cmp eax, dword [edi - 0xc]
jg 0x404c5a
mov dl, byte [edi + eax]
mov byte [ebp + eax - 0x12a], dl
inc eax
cmp eax, dword [ecx - 0xc]
jl 0x404bb4
lea eax, [ebp - 0x130]
push ebx
push eax
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea ecx, [ebp - 0x130]
push 0
push ecx
call fcn.004fc760
mov edx, dword [0x549be4]
mov ax, word [0x549be8]
add esp, 0x1c
push 0x3ed
mov ecx, esi
mov dword [ebp - 0x130], edx
mov word [ebp - 0x12c], ax
call fcn.0040dfa7
mov ecx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [ebp - 0x130]
dec edi
cmp eax, 1
jne 0x404c64
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404c46
mov dx, word [0x549bec]
mov word [edi], dx
jmp 0x404c75
push 0x80070057
call fcn.00401a00
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404c64
mov ax, word [0x549bf0]
mov word [edi], ax
lea ecx, [ebp - 0x130]
push ebx
push ecx
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea edx, [ebp - 0x130]
push 0
push edx
call fcn.004fc760
mov cx, word [0x549bf8]
mov eax, dword [0x549bf4]
add esp, 0x1c
mov word [ebp - 0x12c], cx
push 0x3f0
mov ecx, esi
mov dword [ebp - 0x130], eax
call fcn.0040dfa7
mov edx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea edi, [ebp - 0x130]
dec edi
cmp eax, 1
jne 0x404cf7
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404ce4
mov ax, word [0x549bec]
mov word [edi], ax
jmp 0x404d09
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404cf7
mov cx, word [0x549bf0]
mov word [edi], cx
lea edx, [ebp - 0x130]
push ebx
push edx
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push 0x12c
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.004fc760
mov ecx, dword [0x549bfc]
mov dx, word [0x549c00]
add esp, 0x1c
mov dword [ebp - 0x130], ecx
push 0x3f2
mov ecx, esi
mov word [ebp - 0x12c], dx
call fcn.0040dfa7
mov eax, dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xf0
push eax
call edi
cmp eax, 1
jne 0x404d91
lea edi, [ebp - 0x130]
dec edi
jmp 0x404d80
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404d80
mov cx, word [0x549bec]
jmp 0x404ddf
push 0x3f3
mov ecx, esi
call fcn.0040dfa7
mov edx, dword [eax + 0x20]
push 0
push 0
push 0xf0
push edx
call edi
lea edi, [ebp - 0x130]
dec edi
cmp eax, 1
jne 0x404dd0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404db8
mov ax, word [0x549bf0]
mov word [edi], ax
jmp 0x404de2
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404dd0
mov cx, word [0x549c04]
mov word [edi], cx
lea edx, [ebp - 0x130]
push ebx
push edx
call fcn.004fb94b
push ebx
push 0xa
call fcn.004fba51
push ebx
call fcn.004fb8d7
add esp, 0x14
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fa984
mov esp, ebp
pop ebp
ret
push 0
push 0x548e34
push 0x549c08
mov ecx, esi
call fcn.00409a7b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004fa984
mov esp, ebp
pop ebp
ret