Function at 0x428fd0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46705c
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0x440], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0x45c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x46c]
xor ebx, ebx
push 0x3fe
lea eax, [esp + 0x5a]
push ebx
push eax
mov esi, ecx
mov word [esp + 0x60], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x400
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
mov dword [esp + 0x468], ebx
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::size_void_const]
test eax, eax
je 0x429158
cmp byte [esi + 0x6c], bl
mov word [esp + 0x38], 0x5c
mov word [esp + 0x3a], 0x77
mov word [esp + 0x3c], 0x69
mov word [esp + 0x3e], 0x6e
mov word [esp + 0x40], 0x73
mov word [esp + 0x42], 0x65
mov word [esp + 0x44], 0x76
mov word [esp + 0x46], 0x72
mov word [esp + 0x48], 0x2e
mov word [esp + 0x4a], 0x64
mov word [esp + 0x4c], 0x61
mov word [esp + 0x4e], 0x74
mov word [esp + 0x50], bx
lea ecx, [esp + 0x1c]
je 0x429108
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::length_void_const]
sub eax, 1
push eax
lea ecx, [esp + 0x20]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator___unsigned_int_]
cmp word [eax], 0x5c
je 0x4290fb
push 0x47bbdc
lea ecx, [esp + 0x20]
call dword [0x46831c]
add esi, 0xee
push esi
lea ecx, [esp + 0x20]
jmp 0x42910d
lea eax, [esp + 0x38]
push eax
call dword [0x46831c]
push ebx
push 1
sub esp, 0x1c
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea edi, [esp + 0x3c]
call fcn.00432050
cmp al, bl
je 0x429158
push ebp
mov eax, edi
push eax
mov ebx, 0x1b0
call fcn.004322b0
test al, al
mov eax, dword [esp + 0x18]
jne 0x429171
test eax, eax
je 0x429158
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x464], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
xor al, al
jmp 0x429193
test eax, eax
je 0x42917c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x464], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov al, 1
mov ecx, dword [esp + 0x45c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x440]
xor ecx, esp
call fcn.0043ad38
add esp, 0x454
ret 4