Function at 0x46a261
Capabilities:
Get common file path
Persist via run registry key
Query environment variable

Disassembly:
push 0x314
mov eax, 0x570b3c
call fcn.0054d478
mov eax, dword [ebp + 8]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x26c], eax
call fcn.00462c28
mov al, byte [eax]
test al, al
jne 0x46a34a
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
and dword [ebp - 4], 0
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv____bool____start
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x320]
call fcn.00407660
push dword [ebp - 0x26c]
mov eax, 0x59672c
mov ebx, 0x2710
call fcn.00406690
cmp dword [ebp - 0x264], 0
je 0x46addd
mov eax, dword [ebp - 0x264]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46a319
sub eax, edx
je 0x46addd
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x46a480
xor eax, eax
jmp 0x46a49c
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 4], 2
call fcn.004068d0
mov byte [ebp - 4], 3
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x46a380
mov esi, dword [eax + 4]
jmp 0x46a383
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv____bool____start
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 3
call fcn.00409c40
lea eax, [ebp - 0x274]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 5
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46a425
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x50a
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 3
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 2
call fcn.004067e0
or dword [ebp - 4], 0xffffffff
jmp 0x46a2ee
lea eax, [edi + edi]
call fcn.00552130
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x10], esp
mov esi, esp
push 3
mov edx, edi
call fcn.0045c1d0
lea ecx, [ebp - 0x258]
call fcn.004066c0
push 0x12
pop edi
mov dword [ebp - 4], edi
call fcn.00462c28
cmp byte [eax], 0
jne 0x46a56d
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
lea eax, [ebp - 0x258]
push eax
push ecx
push 0x5967ac
push ecx
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__varName
push eax
mov byte [ebp - 4], 0x13
call fcn.00407390
add esp, 0xc
push eax
call fcn.00407390
add esp, 0xc
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x14
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.00407660
mov esi, 0x104
push esi
call fcn.00545b75
mov ebx, eax
pop ecx
mov dword [ebp - 0x278], ebx
test ebx, ebx
jne 0x46a6b9
lea ecx, [ebp - 0x258]
call fcn.00409c40
xor al, al
lea esp, [ebp - 0x330]
call fcn.0054d4d4
ret
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x15
call fcn.004068d0
mov byte [ebp - 4], 0x16
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 0x17
cmp dword [eax + 0x18], 8
jb 0x46a5a0
mov esi, dword [eax + 4]
jmp 0x46a5a3
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__varName
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5967ac
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x258]
push ecx
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x16
call fcn.00409c40
lea eax, [ebp - 0x274]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x18
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46a65c
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x516
push str..SystemCommands.cpp
push eax
push ebx
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x19
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 0x16
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x15
call fcn.004067e0
mov dword [ebp - 4], edi
jmp 0x46a538
push esi
push ebx
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
mov dword [ebp - 0x270], edi
cmp edi, esi
jbe 0x46a8e9
call fcn.00462c28
cmp byte [eax], 0
jne 0x46a75b
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
push edi
push ecx
push 0x5967ac
push ecx
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__need_to_re_allocate_string_to
push eax
mov byte [ebp - 4], 0x1c
call fcn.00407390
add esp, 0xc
push eax
call fcn.00407390
add esp, 0xc
push eax
call fcn.004155d0
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x1d
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.00407660
jmp 0x46a8b1
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x1e
call fcn.004068d0
mov byte [ebp - 4], 0x1f
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 8
jb 0x46a78e
mov esi, dword [eax + 4]
jmp 0x46a791
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__need_to_re_allocate_string_to
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5967ac
push eax
call fcn.00407390
pop ecx
pop ecx
push edi
push eax
call fcn.004155d0
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x1f
call fcn.00409c40
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x21
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46a847
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x51e
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x22
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x1f
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x1e
call fcn.004067e0
mov dword [ebp - 4], 0x12
jmp 0x46a8b1
push ebx
call fcn.00547866
pop ecx
push edi
call fcn.00545b75
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x46a8d9
xor bl, bl
lea ecx, [ebp - 0x258]
call fcn.00409c40
mov al, bl
jmp 0x46a561
push edi
push ebx
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
push ebx
test edi, edi
je 0x46a931
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
cmp edi, 0x3fffffff
jle 0x46a903
xor eax, eax
jmp 0x46a91b
lea eax, [edi + edi]
call fcn.00552130
mov dword [ebp - 0x10], esp
mov esi, esp
push 3
mov edx, edi
mov eax, ebx
call fcn.0045c1d0
push dword [ebp - 0x26c]
call fcn.00406690
push ebx
call fcn.00547866
pop ecx
mov bl, 1
jmp 0x46a8c7
call fcn.00547866
pop ecx
call fcn.00462c28
cmp byte [eax], 0
jne 0x46a9db
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv__GetEnvironmentVariableA_fails
push eax
mov byte [ebp - 4], 0x25
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x26
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x12
call fcn.00407660
push dword [ebp - 0x264]
lea eax, [ebp - 0x268]
push eax
xor edi, edi
call fcn.0046cbb0
push str.APPDATA
lea eax, [ebp - 0x268]
push eax
mov byte [ebp - 4], 0x2e
call fcn.0046cbff
test eax, eax
jne 0x46ab14
push edi
push 0x1c
jmp 0x46ab46
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x27
call fcn.004068d0
mov byte [ebp - 4], 0x28
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 0x29
cmp dword [eax + 0x18], 8
jb 0x46aa0e
mov esi, dword [eax + 4]
jmp 0x46aa11
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__GetEnvironmentVariableA_fails
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x28
call fcn.00409c40
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x2a
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46aab3
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x532
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x2b
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x28
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x27
call fcn.004067e0
mov dword [ebp - 4], 0x12
jmp 0x46a9a2
push str.COMMONAPPDATA
lea eax, [ebp - 0x268]
push eax
call fcn.0046cbff
test eax, eax
jne 0x46ab2e
push edi
push 0x23
jmp 0x46ab46
push str.ProgramFiles
lea eax, [ebp - 0x268]
push eax
call fcn.0046cbff
test eax, eax
jne 0x46ab58
push edi
push 0x26
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, eax
jmp 0x46abcd
push str.LOCALAPPDATA
lea eax, [ebp - 0x268]
push eax
call fcn.0046cbff
test eax, eax
jne 0x46adca
push SysReAllocString
mov eax, 0x20019
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x27c]
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x278], edi
call fcn.00415df0
cmp eax, edi
jne 0x46abc2
mov eax, esi
push str.Local_AppData
push eax
lea edi, [ebp - 0x270]
lea esi, [ebp - 0x220]
call fcn.00415d40
lea esi, [ebp - 0x27c]
call fcn.00415e50
xor edi, edi
inc edi
lea esi, [ebp - 0x27c]
call fcn.00415e80
cmp edi, 1
jne 0x46adca
push dword [ebp - 0x26c]
lea eax, [ebp - 0x220]
call fcn.00406690
call fcn.00462c28
cmp byte [eax], 0
jne 0x46ac84
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
push dword [ebp - 0x26c]
lea eax, [ebp - 0x318]
push ecx
push 0x5967ac
push ecx
push str.CSystemCommands::GetSafeEnv__using_SHGetSpecialFolderPath__returns:
push eax
mov byte [ebp - 4], 0x2f
call fcn.00407390
add esp, 0xc
push eax
call fcn.00407390
add esp, 0xc
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0x30
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 0x2e
call fcn.00407660
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00409c70
jmp 0x46a92d
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 0x31
call fcn.004068d0
mov byte [ebp - 4], 0x32
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 0x33
cmp dword [eax + 0x18], 8
jb 0x46acb7
mov esi, dword [eax + 4]
jmp 0x46acba
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv__using_SHGetSpecialFolderPath__returns:
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5967ac
push eax
call fcn.00407390
pop ecx
pop ecx
push dword [ebp - 0x26c]
push eax
call fcn.00411b20
pop ecx
pop ecx
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0x32
call fcn.00409c40
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x34
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46ad77
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x55c
push str..SystemCommands.cpp
push eax
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x35
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0x32
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0x31
call fcn.004067e0
jmp 0x46ac71
mov eax, dword [ebp - 0x268]
add eax, 0xfffffff0
call fcn.00409c70
jmp 0x46a554
call fcn.00462c28
cmp byte [eax], 0
jne 0x46ae4c
lea eax, [ebp - 0x320]
push eax
call fcn.00409b60
lea eax, [ebp - 0x318]
push str.CSystemCommands::GetSafeEnv____varName__NULL__quits
push eax
mov dword [ebp - 4], 9
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x320]
call fcn.00407170
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0xa
call fcn.00406a80
lea ecx, [ebp - 0x23c]
call fcn.00409c40
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x320]
call fcn.00407660
jmp 0x46a55f
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 4], 0xb
call fcn.004068d0
mov byte [ebp - 4], 0xc
call fcn.00462c28
lea esi, [ebp - 0x298]
call fcn.00406720
mov byte [ebp - 4], 0xd
cmp dword [eax + 0x18], 8
jb 0x46ae82
mov esi, dword [eax + 4]
jmp 0x46ae85
lea esi, [eax + 4]
lea eax, [ebp - 0x318]
push 0x5950f8
push eax
call fcn.00407390
pop ecx
pop ecx
push esi
push eax
call fcn.00407390
pop ecx
pop ecx
push 0x5950f0
push eax
call fcn.00407390
pop ecx
pop ecx
push str.CSystemCommands::GetSafeEnv____varName__NULL__quits
push eax
call fcn.00407390
pop ecx
pop ecx
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0xc
call fcn.00409c40
lea eax, [ebp - 0x260]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push ebx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xe
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x46af22
lea ecx, [ebp - 0x298]
lea eax, [ebp - 0x318]
call fcn.00406700
push 0x50f
push str..SystemCommands.cpp
push eax
push ebx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
lea ecx, [ebp - 0x298]
call fcn.00409c40
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xc
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 0xb
call fcn.004067e0
jmp 0x46a55f