Function at 0x4291c0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46705c
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x45c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x46c]
xor ebx, ebx
push 0x3fe
lea eax, [esp + 0x5a]
push ebx
push eax
mov esi, ecx
mov word [esp + 0x60], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x400
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x468], ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::size_void_const]
test eax, eax
je 0x42931b
cmp byte [esi + 0x6c], bl
mov word [esp + 0x38], 0x5c
mov word [esp + 0x3a], 0x77
mov word [esp + 0x3c], 0x69
mov word [esp + 0x3e], 0x6e
mov word [esp + 0x40], 0x73
mov word [esp + 0x42], 0x65
mov word [esp + 0x44], 0x76
mov word [esp + 0x46], 0x72
mov word [esp + 0x48], 0x2e
mov word [esp + 0x4a], 0x64
mov word [esp + 0x4c], 0x61
mov word [esp + 0x4e], 0x74
mov word [esp + 0x50], bx
lea ecx, [esp + 0x1c]
je 0x4292cb
add esi, 0xee
push esi
jmp 0x4292d0
lea eax, [esp + 0x38]
push eax
call dword [0x46831c]
push ebx
push 1
sub esp, 0x1c
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea edi, [esp + 0x3c]
call fcn.00432050
cmp al, bl
je 0x42931b
push ebp
mov eax, edi
push eax
mov ebx, 0x52
call fcn.004322b0
test al, al
mov eax, dword [esp + 0x18]
jne 0x429334
test eax, eax
je 0x42931b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x464], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x429356
test eax, eax
je 0x42933f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x464], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x45c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.0043ad38
add esp, 0x454
ret 4