Function at 0x4490f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x120
mov eax, dword [0x4ba700]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x12c]
push esi
push edi
call fcn.00451100
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
push 0x104
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4491be
push 0x104
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x449167
lea edx, [esp + 0x20]
push 0x5c
push edx
call fcn.0047c410
add esp, 8
test eax, eax
je 0x449465
mov byte [eax], 0
lea ebx, [ebp + 0x164]
lea eax, [esp + 0x20]
mov byte [ebx], 0
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449176
mov edi, ebx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x449182
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
jmp 0x4491a0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4491a0
mov ax, word [0x4a3f08]
mov word [edi], ax
mov eax, ebx
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4491b4
jmp 0x449208
lea ebx, [ebp + 0x164]
lea eax, [esp + 0x20]
mov byte [ebx], 0
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4491d0
mov edi, ebx
sub eax, esi
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4491e0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x449200
mov ecx, dword [str.ultravnc.ini]
mov dword [eax], ecx
mov edx, dword [0x4a997c]
mov dword [eax + 4], edx
mov ecx, dword [0x4a9980]
mov dword [eax + 8], ecx
mov dl, byte [0x4a9984]
mov byte [eax + 0xc], dl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4492d0
push eax
push 0
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x201eb
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4492d4
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4492d4
mov edx, dword [esp + 0x18]
push 0x104
push ebx
push str._TEMP_
push edx
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
or edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x449292
mov ax, word [0x4a3f08]
mov word [edi], ax
dec ebx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x4492a4
mov ecx, dword [str.ultravnc.ini]
mov dword [ebx], ecx
mov edx, dword [0x4a997c]
mov dword [ebx + 4], edx
mov eax, dword [0x4a9980]
mov dword [ebx + 8], eax
mov cl, byte [0x4a9984]
mov byte [ebx + 0xc], cl
jmp 0x4492d4
mov esi, dword [esp + 0x14]
cmp dword [ebp], 0
je 0x44936f
lea eax, [esp + 0x20]
call fcn.00451550
test eax, eax
jne 0x44930a
cmp dword [esp + 0x1c], eax
jne 0x4492f7
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edx, dword [esp + 0x18]
push edx
jmp 0x449463
mov ecx, 0x4a3fbe
or eax, 0x8a202444
adc byte [edx], bh
adc dword [ebp + 0x1a], esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x449333
test dl, dl
je 0x44932f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x449333
add eax, 2
add ecx, 2
test dl, dl
jne 0x449313
xor eax, eax
jmp 0x449338
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44936f
push 0x30
push 0x4f2360
push 0x4f2c68
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
add edi, dword [esp + 0x1c]
add byte [ebp + 6], dh
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x18]
push eax
jmp 0x449463
cmp dword [ebp + 0x114], 0
jne 0x449448
cmp dword [ebp], 0
je 0x4493ae
push str.._vncpropertiesPoll.cpp_:_show_per_user_Properties_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 4
push 1
mov ecx, ebp
mov dword [ebp + 0x10c], 1
call fcn.00449e90
jmp 0x4493b5
mov esi, ebp
call fcn.0044a980
mov ecx, dword [0x4f21d8]
push ebp
push 0x449480
push 0
push 0x66
push ecx
mov dword [ebp + 0x110], 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [ebp + 0x110], 0
mov esi, eax
jne 0x4493e6
mov esi, 2
push esi
push str.._vncpropertiesPoll.cpp_:_dialog_result___d_n
mov ecx, 9
mov eax, 0x4bc990
call fcn.00401110
add esp, 8
cmp esi, 0xffffffff
jne 0x44942c
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [esp + 0x1c], 0
jne 0x449418
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
jmp 0x449463
cmp dword [ebp], 0
je 0x44943d
push 1
mov ecx, ebp
call fcn.00449e90
jmp 0x449444
mov esi, ebp
call fcn.0044a980
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x1c], 0
jne 0x449455
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047c3ff
add esp, 0x120
ret 4