Function at 0x413830
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41e4ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esp + 0x160]
lea ecx, [esp + 0x3c]
push eax
mov dword [esp + 0x15c], 0
call fcn.0041b7f4
lea ecx, [esp + 0x28]
mov byte [esp + 0x158], 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x4c]
mov byte [esp + 0x158], 2
push ecx
mov ecx, esi
call fcn.004137e0
lea edx, [esp + 0x50]
push 0x100
push edx
mov byte [esp + 0x160], 3
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 0x50]
push 1
push eax
lea ecx, [esp + 0x50]
call sub.MFC42.DLL_CString::CString_3
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [esp + 0x34]
mov byte [esp + 0x15c], 4
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x15c], 5
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Common_Desktop
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x164], 6
call fcn.0041b7f4
lea eax, [esp + 0x48]
mov byte [esp + 0x160], 5
push eax
call fcn.00416dc0
add esp, 8
mov byte [esp + 0x15c], 7
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Common_Startup
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x164], 8
call fcn.0041b7f4
lea eax, [esp + 0x4c]
mov byte [esp + 0x160], 7
push eax
call fcn.00416dc0
add esp, 8
mov byte [esp + 0x15c], 9
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Common_Programs
call sub.MFC42.DLL_CString::CString_1
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x2c], esp
push edx
mov byte [esp + 0x164], 0xa
call fcn.0041b7f4
lea eax, [esp + 0x24]
mov byte [esp + 0x160], 9
push eax
call fcn.00416dc0
mov ecx, dword [esp + 0x48]
mov edi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push str.Desktop
push ecx
mov byte [esp + 0x16c], 0xb
call edi
add esp, 0x14
test eax, eax
jne 0x413a4d
lea edx, [esp + 0x40]
push 0x429044
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator
lea ecx, [esi + 0xc]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x164], 0xc
call sub.MFC42.DLL_operator_2
push str..lnk
push eax
lea eax, [esp + 0x18]
mov bl, 0xd
push eax
mov byte [esp + 0x164], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 0xe
call fcn.0041b82a
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0xc
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x158], 0xb
lea ecx, [esp + 0x14]
jmp 0x413f71
mov ecx, dword [esp + 0x3c]
push str.Startup
push ecx
call edi
add esp, 8
test eax, eax
jne 0x413aec
lea edx, [esp + 0x44]
push 0x429044
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator
lea ecx, [esi + 0xc]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x164], 0xf
call sub.MFC42.DLL_operator_2
push str..lnk
push eax
lea eax, [esp + 0x18]
mov bl, 0x10
push eax
mov byte [esp + 0x164], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 0x11
call fcn.0041b82a
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0xf
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x158], 0xb
lea ecx, [esp + 0x14]
jmp 0x413f71
push 0x5c
lea ecx, [esp + 0x164]
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x1c]
push 0x42a028
lea edx, [esp + 0x14]
push ecx
push edx
mov edi, eax
call sub.MFC42.DLL_operator
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push eax
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
push 0x42a014
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [esi + 0x20]
mov byte [esp + 0x158], 0x12
add edx, 0xd8
push edx
push eax
lea eax, [esp + 0x18]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
push eax
call ebp
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0xb
call sub.MFC42.DLL_CString::CString
cmp edi, 0xffffffff
jne 0x413c64
lea ecx, [esp + 0x1c]
push 0x42a014
lea edx, [esp + 0x30]
push ecx
push edx
call sub.MFC42.DLL_operator
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x38]
add ecx, 0xd8
mov byte [esp + 0x158], 0x13
push ecx
push eax
push edx
call sub.MFC42.DLL_operator_2
push 0x429044
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x160], 0x14
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x160]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x164], 0x15
call sub.MFC42.DLL_operator_2
push str..lnk
push eax
lea eax, [esp + 0x18]
mov bl, 0x16
push eax
mov byte [esp + 0x164], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 0x17
call fcn.0041b82a
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0x15
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x158], 0x14
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], 0x13
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x158], 0xb
lea ecx, [esp + 0x2c]
jmp 0x413f71
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x168]
call sub.MFC42.DLL_CString::Left
mov byte [esp + 0x158], 0x18
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
mov dword [esi + 0x20], eax
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0x19
call sub.MFC42.DLL_CString::CString_2
mov bl, 0x1a
xor edi, edi
mov byte [esp + 0x158], bl
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call fcn.0041b82a
push edi
push 0x5c
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Find
mov edi, eax
cmp edi, 0xffffffff
je 0x413dbe
lea eax, [esp + 0x2c]
push edi
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 0x1b
call fcn.0041b82a
lea ecx, [esp + 0x2c]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esi + 0x20]
push 0x429044
add ecx, 0xd8
lea edx, [esp + 0x38]
push ecx
push edx
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x18]
lea edx, [esp + 0x38]
push ecx
push eax
push edx
mov byte [esp + 0x164], 0x1c
call sub.MFC42.DLL_operator_2
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x1d
call fcn.0041b82a
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], 0x1c
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
push 0x42a014
lea ecx, [esp + 0x24]
push eax
push ecx
call sub.MFC42.DLL_operator
lea edx, [esp + 0x14]
mov byte [esp + 0x158], 0x1e
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
push eax
call ebp
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
inc edi
cmp edi, 0xffffffff
jne 0x413cae
lea ecx, [esp + 0x1c]
push 0x42a014
lea edx, [esp + 0x30]
push ecx
push edx
call sub.MFC42.DLL_operator
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x34]
add ecx, 0xd8
mov byte [esp + 0x158], 0x1f
push ecx
push eax
push edx
call sub.MFC42.DLL_operator_2
push 0x429044
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x160], 0x20
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x164], 0x21
call sub.MFC42.DLL_operator_2
mov eax, dword [eax]
push 0
push eax
call ebp
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x158], 0x20
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x158], 0x1f
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0x1c]
push 0x42a014
lea ecx, [esp + 0x3c]
push eax
push ecx
call sub.MFC42.DLL_operator
mov edx, dword [esi + 0x20]
mov byte [esp + 0x158], 0x22
add edx, 0xd8
push edx
push eax
lea eax, [esp + 0x34]
push eax
call sub.MFC42.DLL_operator_2
push 0x429044
lea ecx, [esp + 0x38]
push eax
push ecx
mov byte [esp + 0x164], 0x23
call sub.MFC42.DLL_operator
lea edx, [esp + 0x160]
mov byte [esp + 0x158], 0x24
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call sub.MFC42.DLL_operator_2
push str..lnk
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0x160], 0x25
push ecx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 0x26
call fcn.0041b82a
lea ecx, [esp + 0x20]
mov byte [esp + 0x158], 0x25
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x158], 0x24
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x158], 0x23
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x158], 0x22
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x158], 0x19
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x158], 0x18
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0x158], 0xb
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 8]
mov edx, dword [esp + 0x28]
mov ecx, dword [esi + 4]
push eax
push edx
push ecx
mov ecx, esi
call fcn.00413630
test eax, eax
mov byte [esp + 0x158], 9
lea ecx, [esp + 0x1c]
jne 0x41403b
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x158], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x158], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x158], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x158], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x158], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x158], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x4140d0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x44]
mov byte [esp + 0x158], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x158], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x158], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x158], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x158], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov byte [esp + 0x158], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14c
ret 4