Function at 0x41e146
Capabilities:
Get common file path

Disassembly:
mov eax, 0x43358a
call fcn.004269c8
push ecx
mov eax, 0xc284
call fcn.00425e20
mov eax, dword [0x44de90]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x41
pop ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
xor eax, eax
push 0x41
mov byte [ebp - 0x128], bl
lea edi, [ebp - 0x127]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x27c], bl
lea edi, [ebp - 0x27b]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x128]
push eax
call fcn.00425700
pop ecx
lea ecx, [ebp - 0x128]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x41e1d1
lea eax, [ebp - 0x128]
push 0x43462c
push eax
call fcn.00425610
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.00425600
lea eax, [ebp - 0x27c]
push str.dllcache_
push eax
call fcn.00425610
push dword [ebp + 8]
lea eax, [ebp - 0x128]
push eax
call fcn.00425610
push dword [ebp + 8]
lea eax, [ebp - 0x27c]
push eax
call fcn.00425610
add esp, 0x20
push 0x12
pop ecx
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea edi, [ebp - 0x174]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.Debugger
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc280]
push eax
push 0x2001f
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x174]
push eax
push 0x80000002
mov dword [ebp - 0xc280], ebx
movsb byte es:[edi], byte [esi]
call dword [0x451e18]
cmp eax, ebx
jne 0x41e45a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc28c]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc280]
mov dword [ebp - 0xc28c], ebx
call dword [0x451e30]
cmp eax, ebx
jne 0x41e44e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [ebp - 0xc27c], bl
xor eax, eax
mov ecx, 0xfff
lea edi, [ebp - 0xc27b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xc284], ebx
mov eax, dword [ebp - 0xc284]
cmp eax, dword [ebp - 0xc28c]
jae 0x41e44e
push 0x4000
lea eax, [ebp - 0xc27c]
push eax
push dword [ebp - 0xc284]
mov byte [ebp - 0xc27c], bl
push dword [ebp - 0xc280]
call dword [0x451e38]
cmp eax, ebx
jne 0x41e443
xor eax, eax
mov byte [ebp - 0x427c], bl
mov ecx, 0xfff
lea edi, [ebp - 0x427b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x427c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x43462c
lea eax, [ebp - 0x427c]
push eax
call esi
lea eax, [ebp - 0xc27c]
push eax
lea eax, [ebp - 0x427c]
push eax
call esi
lea eax, [ebp - 0xc288]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x427c]
push eax
push 0x80000002
mov dword [ebp - 0xc288], ebx
call dword [0x451e18]
cmp eax, ebx
jne 0x41e443
xor eax, eax
mov byte [ebp - 0x827c], bl
mov ecx, 0xfff
lea edi, [ebp - 0x827b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xc290]
push eax
lea eax, [ebp - 0x827c]
push eax
lea eax, [ebp - 0xc294]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc288]
mov dword [ebp - 0xc290], 0x4000
call dword [0x451e28]
cmp eax, ebx
jne 0x41e437
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x827c]
push eax
call fcn.00425100
test eax, eax
pop ecx
pop ecx
je 0x41e3e6
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x827c]
push eax
call fcn.00425100
test eax, eax
pop ecx
pop ecx
jne 0x41e437
push dword [ebp - 0xc288]
call dword [0x451e1c]
push dword [ebp - 0xc280]
call dword [0x451e1c]
push dword [ebp + 8]
lea eax, [ebp - 0x128]
push eax
call fcn.00409bfb
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x27c]
push eax
call fcn.00409bfb
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push eax
push str._s__t_t_Removed:_Worm.Win32.AutoRun.ouu.__..._n
call fcn.00425036
pop ecx
pop ecx
mov al, 1
jmp 0x41e45c
push dword [ebp - 0xc288]
call dword [0x451e1c]
inc dword [ebp - 0xc284]
jmp 0x41e2af
push dword [ebp - 0xc280]
call dword [0x451e1c]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret