Function at 0x436100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e17d2
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x268], esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004830b0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x436170
mov eax, dword [0x5e8aa0]
mov dword [edi], eax
cmp word [ebp - 0x218], 0
jne 0x436191
xor ecx, ecx
jmp 0x4361af
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4361a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00402650
mov eax, dword [0x67b31c]
test eax, eax
jne 0x4361fc
push 0x15c
call fcn.0046cb58
add esp, 4
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4361ee
mov ecx, eax
call fcn.004453a0
jmp 0x4361f0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x67b31c], eax
mov ecx, eax
call fcn.004710c9
mov edx, eax
mov dword [ebp - 0x24c], 7
xor eax, eax
mov dword [ebp - 0x250], 0
mov word [ebp - 0x260], ax
cmp word [edx], ax
jne 0x43622b
xor ecx, ecx
jmp 0x43623f
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436230
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x260]
call fcn.00402650
mov dword [ebp - 4], 1
call fcn.004737cc
test al, al
je 0x436272
mov byte [0xfa7bd105], al
adc cl, byte [eax + ecx*4 - 0x56]
popfd
and bl, byte [edi + edi*4 - 0x7477958c]
mov ch, 0x98
std
invalid
mov byte [edx - 0x4063dd63], ch
je 0x4362d5
mov byte [ebx - 0x2674b], cl
invalid
call fcn.004735e9
test al, al
je 0x436292
adc dword [edi], edi
add al, 0xe
mov al, byte [0x30ddc5bc]
mov esp, 0x9722287a
xor dword [ebx*4 - 0xfe8c7f6], esp
arpl word [ebp + ecx*4 - 0x29773], bp
invalid
lea ecx, [ebp - 0x298]
call fcn.00464ae4
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 2
call fcn.00464bb1
test eax, eax
je 0x436454
inc esi
inc ebp
cld
add ch, al
add eax, 0x850002e9
ror byte [edi], 0x84
mov al, byte [0x8d000001]
test dword [ebp + edi*8 - 0x7a380001], ebx
pushfd
std
invalid
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 0
push eax
lea ecx, [ebp - 0x298]
call fcn.00464dca
call fcn.004732ad
test al, al
je 0x4362e9
xor dword [ebx + ebp*8 + 0x23], esp
jmp 0x436263
call fcn.004735e9
test al, al
je 0x436302
arpl word [ebx], cx
push edx
and byte [edx + 0x42], 0x47
sbb eax, 0xe04b7bed
push 0xe81a6450
cmpsb byte [esi], byte es:[edi]
iretd
call fcn.004732ad
test al, al
je 0x436323
cmp al, 0x83
sub bl, byte [0xdecc7209]
lodsd eax, dword [esi]
ror byte [eax], 0x76
fbstp tbyte [ebp + 0x1368c55d]
sub byte [eax], bh
jmp 0x4362a2
push 0xb
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.NOvic32.dll
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402650
mov esi, dword [ebp - 0x268]
lea eax, [ebp - 0x230]
push eax
push esi
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 3
push eax
mov ecx, esi
call fcn.00432710
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x436394
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
push 0xb
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.NOvic64.dll
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402650
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 4
push eax
push esi
lea eax, [ebp - 0x260]
mov ecx, esi
into
push eax
call fcn.00432710
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x4363ff
cld
add al, byte [ebx + 0x137208f8]
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
call fcn.00473787
test al, al
je 0x436423
rcl dword [ebp + 9], 0x17
out dx, al
stosb byte es:[edi], al
mov byte [eax], bh
sbb dh, byte [esi + ebx + 0x38]
pushal
in eax, 0xe3
std
fld dword [ecx]
xor ecx, dword [esi - 0x52dda5f]
or al, byte [ecx - 0x30211772]
add eax, dword [eax]
call fcn.00473406
test al, al
je 0x43643e
mov ebp, 0x491619b5
loop 0x4363d6
nop
jo 0x4363e5
stc
cmp cl, byte [eax + 0x36]
push ebp
cmp byte [edi - 0x13], ah
push dword [ebp - 0x264]
lea ecx, [ebp - 0x298]
call fcn.00464de8
jmp 0x43652a
push 0xb
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.NOvic32.dll
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402650
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 5
push eax
push esi
lea eax, [ebp - 0x260]
mov ecx, esi
push eax
call fcn.00432710
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x4364bf
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
push 0xb
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.NOvic64.dll
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402650
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 6
push eax
push esi
lea eax, [ebp - 0x260]
mov ecx, esi
push eax
call fcn.00432710
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 2
cmp eax, 8
jb 0x43652a
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
call fcn.0047337c
test al, al
je 0x43654d
mov dl, 0xd0
mov ebx, 0xe8fc5244
sbb al, 0x1f
mov byte [0x61a276fe], al
retf
call fcn.004736b8
test al, al
je 0x436567
in al, 0x31
je 0x43651f
inc esi
add al, 0x52
in al, 0x50
sbb eax, 0x7580e687
jmp 0xd72bf5c0
call fcn.00473742
test al, al
je 0x436587
invalid
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
mov byte [ebp - 4], 7
inc esi
inc ebp
cld
pop es
call fcn.00473856
test al, al
je 0x4365e1
lock add byte [eax - 0x4e0b5e2e], bh
jl 0x4365c1
sti
mov esp, 0xf41e6e71
nop
fcmovne st(0), st(5)
push 6
push str.CLSID_
lea ecx, [ebp - 0x248]
call fcn.00402650
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x26c]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x264], eax
call fcn.00473337
test al, al
je 0x43664d
push cs
pop esi
out 0x53, al
or ecx, esi
mov dword [0x3c8b3b07], eax
lds eax, fs:[ebx + 0xe]
pop es
cmp ecx, dword [ebx + 0x43c5643c]
push cs
sub cl, cl
in eax, 0x82
and byte [eax + 0x18], bh
jl 0x43668f
push eax
or bh, cl
dec ebx
enter 0x21e8, 0xffffffffffffffd0
add eax, dword [eax]
call fcn.00473673
test al, al
je 0x43666f
movsb byte es:[edi], byte [esi]
jo 0x436681
test dword [esi], ecx
int 0x44
clc
sub byte [ebx - 0x28], ch
lodsd eax, dword [esi]
adc edx, eax
jmp 0x436637
call fcn.00473490
test al, al
je 0x436690
sub esp, eax
sub dword [esi - 0x7e], 0x6be1ae26
add byte [edx], bh
xchg edx, eax
jno 0x43669b
invalid
or al, byte [ebx - 0x26343]
inc dword [eax]
cmp dword [ebp - 0x264], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x268]
jne 0x4366bf
pop esi
add byte [ebx - 0x26763], cl
push dword [ebp + 0x1a]
push dword [ebp - 0x26c]
mov ecx, ebx
call fcn.00432df0
mov eax, dword [ebp - 0x26c]
test eax, eax
je 0x4366bf
push eax
call esi
push 0x17
push str.SOFTWAREClassesCLSID_
lea ecx, [ebp - 0x248]
call fcn.00402650
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x270]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push ecx
push 0xf013f
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov dword [ebp - 0x264], eax
call fcn.0047344b
test al, al
je 0x43672c
enter 0xffffffffffffe372, 0x6d
mov al, 0xad
inc ebp
mov esi, 0xdeeb853f
cmp al, 0x47
inc eax
push es
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x264], 0
jne 0x43674f
push dword [ebp - 0x270]
mov ecx, ebx
call fcn.00432df0
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x43674f
push eax
call esi
push 8
push str.TypeLib_
lea ecx, [ebp - 0x248]
call fcn.00402650
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x274]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push SysReAllocString
call edi
mov dword [ebp - 0x264], eax
call fcn.00473925
test al, al
je 0x4367b5
fstp dword [edi - 0x6d]
out dx, al
or byte [esi + 0x2e281895], bl
mov ah, 0x29
adc eax, 0x517ce52
push esp
invalid
add eax, 0xdefef254
mov ah, byte [ecx + 0x61]
pop esp
sub ebp, eax
cmp bl, cl
add eax, dword [eax]
call fcn.004732f2
test al, al
je 0x4367d6
sbb byte [ebp + ebp + 0x68a0efb6], al
cmp al, 0x22
loope 0x436813
and ah, cl
dec edx
pushal
add eax, 0x208b8ee5
pop esp
iretd
call fcn.004739af
test al, al
je 0x4367f3
pop edx
sal esp, 6
mov cl, 0x30
pop ds
adc al, 0xe
dec ebx
inc ebp
jns 0x436818
je 0x4367ab
add byte [ecx + 0x42], bh
mov ch, 0x4c
cmp dword [ebp - 0x264], 0
jne 0x43681e
push dword [ebp - 0x274]
mov ecx, dword [ebp - 0x268]
call fcn.004337d0
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x43681e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473856
test al, al
je 0x436846
pop es
jle 0x4368a2
aad 0xfd
mov ebp, 0xc4ae4c4b
jg 0x4367c6
or bh, al
and eax, 0x2b2b7714
jmp 0x436849
push es
imul eax, dword [ebx + ebp - 0x4c], 0x4b
xor dword [eax - 0x1317e9cd], edx
retf 3
call fcn.00473337
add eax, dword [eax]
test al, al
je 0x43686b
in al, dx
xchg edi, eax
outsb dx, byte [esi]
and byte [ebp - 0x2cb6d4a7], al
sub ecx, dword [ecx - 0x2d]
mov byte [esi + 0x51], cl
jp 0x43683c
dec esp
pushal
and byte [ebp + 0x43ce1727], cl
pop ecx
lcall 0x51e8, 0xf2f565ba
retf
call fcn.004733c1
test al, al
je 0x43688a
add ecx, dword [ebp - 0x30]
das
dec ebp
je 0x43687f
xchg ecx, eax
lahf
fnstsw word [esi + 0x46]
inc esi
push cs
std
rol byte [esp + ebx*4 + 0x5b426606], 0x93
mov ecx, dword [ebp - 0x268]
call fcn.004340b0
call fcn.0047337c
test al, al
je 0x4368b5
dec edi
pop ds
mov dh, 0xee
jmp 0x436855
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x4368d3
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x234], 7
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00464af7
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x436919
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret