Function at 0x47ed50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x5d7008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push edi
mov dword [ebp - 0x10c], ebx
call fcn.004864f0
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x108]
push eax
push 0x104
mov dword [ebp - 0x110], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x47edfb
push 0x104
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x47edc9
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0053eb80
add esp, 8
test eax, eax
je 0x47f032
mov byte [eax], bl
push 0x584fd8
lea edi, [esi + 0x168]
push 0x104
push edi
call fcn.005417f5
lea eax, [ebp - 0x108]
push eax
push 0x104
push edi
call fcn.0054184f
add esp, 0x18
mov eax, 0x5b92c8
jmp 0x47ee1a
push 0x584fd8
lea edi, [esi + 0x168]
push 0x104
push edi
call fcn.005417f5
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
push edi
call fcn.0054184f
push str.UltraVNC.ini
push 0x104
push edi
call fcn.0054184f
mov eax, dword [ebp - 0x114]
add esp, 0x18
test eax, eax
je 0x47eec0
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
push 0x201eb
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x47eec0
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x110], eax
test eax, eax
jne 0x47eec0
push 0x104
push edi
push str._TEMP_
push dword [ebp - 0x10c]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
push 0x5b92c8
push 0x104
push edi
call fcn.0054184f
push str.UltraVNC.ini
push 0x104
push edi
call fcn.0054184f
add esp, 0x18
cmp dword [esi], 0
je 0x47ef41
lea ecx, [ebp - 0x108]
call fcn.00486920
test eax, eax
jne 0x47eef7
cmp dword [ebp - 0x110], 0
jne 0x47eee3
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push dword [ebp - 0x10c]
jmp 0x47f030
mov ecx, 0x584fd8
lea eax, [ebp - 0x108]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47ef22
test dl, dl
je 0x47ef1e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47ef22
add eax, 2
add ecx, 2
test dl, dl
jne 0x47ef02
xor eax, eax
jmp 0x47ef27
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47ef41
push 0x30
push 0x5e7808
mov edx, 0x5e7748
call fcn.004254b0
add esp, 8
jmp 0x47eed4
cmp dword [esi + 0x114], 0
jne 0x47f009
cmp dword [esi], 0
je 0x47ef7c
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncpropertiesPoll.cpp_:_show_per_user_Properties_n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0xc
mov dword [esi + 0x10c], 1
mov ecx, esi
push 1
call fcn.0047fc10
jmp 0x47ef83
mov ecx, esi
call fcn.00480890
push esi
push 0x47f050
push 0
push 0x66
push dword [0x5e6634]
mov dword [esi + 0x110], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [esi + 0x110], 0
mov edi, eax
jne 0x47efdd
push 2
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncpropertiesPoll.cpp_:_dialog_result___d_n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0x10
cmp dword [0x5e65ec], 0
jne 0x47f009
cmp dword [esi], 0
mov ecx, esi
je 0x47f004
push 1
call fcn.0047fc10
jmp 0x47f009
push edi
push str.C:Users_rudiDesktopgit_ultravncwinvncwinvnc_vncpropertiesPoll.cpp_:_dialog_result___d_n
push 9
push 0x5d7d48
call fcn.0041c960
add esp, 0x10
cmp edi, 0xffffffff
jne 0x47efc4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x47eed4
call fcn.00480890
cmp dword [ebp - 0x110], 0
jne 0x47f018
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x47f025
push ebx
call esi
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x47f032
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053d630
mov esp, ebp
pop ebp
ret 8