Function at 0x40a5d9
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push esi
push edi
mov dword [ebp - 0x824], ecx
mov byte [ebp - 0x81c], 0x5c
mov byte [ebp - 0x81b], 0x54
mov byte [ebp - 0x81a], 0x58
mov byte [ebp - 0x819], 0x50
mov byte [ebp - 0x818], 0x6c
mov byte [ebp - 0x817], 0x74
mov byte [ebp - 0x816], 0x53
mov byte [ebp - 0x815], 0x61
mov byte [ebp - 0x814], 0x66
mov byte [ebp - 0x813], 0x65
mov byte [ebp - 0x812], 0x49
mov byte [ebp - 0x811], 0x6e
mov byte [ebp - 0x810], 0x66
mov byte [ebp - 0x80f], 0x2e
mov byte [ebp - 0x80e], 0x64
mov byte [ebp - 0x80d], 0x6c
mov byte [ebp - 0x80c], 0x6c
mov byte [ebp - 0x80b], 0
mov byte [ebp - 0x340], 0x5c
mov byte [ebp - 0x33f], 0x72
mov byte [ebp - 0x33e], 0x75
mov byte [ebp - 0x33d], 0x6e
mov byte [ebp - 0x33c], 0x64
mov byte [ebp - 0x33b], 0x6c
mov byte [ebp - 0x33a], 0x6c
mov byte [ebp - 0x339], 0x33
mov byte [ebp - 0x338], 0x32
mov byte [ebp - 0x337], 0x2e
mov byte [ebp - 0x336], 0x65
mov byte [ebp - 0x335], 0x78
mov byte [ebp - 0x334], 0x65
mov byte [ebp - 0x333], 0x20
mov byte [ebp - 0x332], 0
mov byte [ebp - 0x808], 0x5c
mov byte [ebp - 0x807], 0x54
mov byte [ebp - 0x806], 0x58
mov byte [ebp - 0x805], 0x50
mov byte [ebp - 0x804], 0x6c
mov byte [ebp - 0x803], 0x74
mov byte [ebp - 0x802], 0x53
mov byte [ebp - 0x801], 0x61
mov byte [ebp - 0x800], 0x66
mov byte [ebp - 0x7ff], 0x65
mov byte [ebp - 0x7fe], 0x49
mov byte [ebp - 0x7fd], 0x6e
mov byte [ebp - 0x7fc], 0x66
mov byte [ebp - 0x7fb], 0x2e
mov byte [ebp - 0x7fa], 0x64
mov byte [ebp - 0x7f9], 0x6c
mov byte [ebp - 0x7f8], 0x6c
mov byte [ebp - 0x7f7], 0x2c
mov byte [ebp - 0x7f6], 0x54
mov byte [ebp - 0x7f5], 0x58
mov byte [ebp - 0x7f4], 0x50
mov byte [ebp - 0x7f3], 0x6c
mov byte [ebp - 0x7f2], 0x74
mov byte [ebp - 0x7f1], 0x53
mov byte [ebp - 0x7f0], 0x61
mov byte [ebp - 0x7ef], 0x66
mov byte [ebp - 0x7ee], 0x65
mov byte [ebp - 0x7ed], 0x49
mov byte [ebp - 0x7ec], 0x6e
mov byte [ebp - 0x7eb], 0x66
mov byte [ebp - 0x7ea], 0x45
mov byte [ebp - 0x7e9], 0x6e
mov byte [ebp - 0x7e8], 0x74
mov byte [ebp - 0x7e7], 0x72
mov byte [ebp - 0x7e6], 0x79
mov byte [ebp - 0x7e5], 0x20
mov byte [ebp - 0x7e4], 0x2f
mov byte [ebp - 0x7e3], 0x67
mov byte [ebp - 0x7e2], 0x75
mov byte [ebp - 0x7e1], 0x69
mov byte [ebp - 0x7e0], 0x64
mov byte [ebp - 0x7df], 0x3d
mov byte [ebp - 0x7de], 0x30
mov byte [ebp - 0x7dd], 0x30
mov byte [ebp - 0x7dc], 0x30
mov byte [ebp - 0x7db], 0x30
mov byte [ebp - 0x7da], 0x30
mov byte [ebp - 0x7d9], 0x30
mov byte [ebp - 0x7d8], 0x30
mov byte [ebp - 0x7d7], 0x31
mov byte [ebp - 0x7d6], 0x2d
mov byte [ebp - 0x7d5], 0x30
mov byte [ebp - 0x7d4], 0x30
mov byte [ebp - 0x7d3], 0x30
mov byte [ebp - 0x7d2], 0x30
mov byte [ebp - 0x7d1], 0x2d
mov byte [ebp - 0x7d0], 0x30
mov byte [ebp - 0x7cf], 0x30
mov byte [ebp - 0x7ce], 0x30
mov byte [ebp - 0x7cd], 0x30
mov byte [ebp - 0x7cc], 0x2d
mov byte [ebp - 0x7cb], 0x38
mov byte [ebp - 0x7ca], 0x37
mov byte [ebp - 0x7c9], 0x45
mov byte [ebp - 0x7c8], 0x31
mov byte [ebp - 0x7c7], 0x2d
mov byte [ebp - 0x7c6], 0x35
mov byte [ebp - 0x7c5], 0x31
mov byte [ebp - 0x7c4], 0x34
mov byte [ebp - 0x7c3], 0x31
mov byte [ebp - 0x7c2], 0x32
mov byte [ebp - 0x7c1], 0x43
mov byte [ebp - 0x7c0], 0x38
mov byte [ebp - 0x7bf], 0x33
mov byte [ebp - 0x7be], 0x38
mov byte [ebp - 0x7bd], 0x38
mov byte [ebp - 0x7bc], 0x41
mov byte [ebp - 0x7bb], 0x37
mov byte [ebp - 0x7ba], 0
mov ecx, 0x14
mov esi, str.TXPltSafeInf.dll_TXPltSafeInfEntry__a__guid12A07ED9_0E84_B249_A3AB_99CE373363C1
lea edi, [ebp - 0x7b8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x328], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x327]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x120], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x11f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x764], 0
mov ecx, 0x66
xor eax, eax
lea edi, [ebp - 0x763]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x32c], 0
mov dword [ebp - 0x330], 0
mov byte [ebp - 0x5c8], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x5c7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x208
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x453530
lea edx, [ebp - 0x120]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a9ce
jmp 0x40ac7d
push str.TenProtect
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov byte [edx], 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x19a
lea eax, [ebp - 0x764]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x40aa45
cmp dword [ebp - 0x32c], 0x105
jb 0x40aa4a
jmp 0x40ac7b
lea edx, [ebp - 0x81c]
push edx
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp - 0x824]
cmp dword [ecx + 0x1d4], 5
jne 0x40ab86
push 0x104
lea edx, [ebp - 0x5c8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str.TCLSTenProtect
lea eax, [ebp - 0x5c8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jne 0x40aaad
jmp 0x40ac79
mov ecx, dword [ebp - 0x820]
mov byte [ecx], 0
lea edx, [ebp - 0x5c8]
push edx
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x820]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.StartTenProtect
lea eax, [ebp - 0x5c8]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x19a
push 0
lea ecx, [ebp - 0x764]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x19a
lea edx, [ebp - 0x764]
push edx
lea eax, [ebp - 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x40ab3f
cmp dword [ebp - 0x32c], 0x105
jb 0x40ab44
jmp 0x40ac77
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x5c8]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x105
push 0
lea eax, [ebp - 0x120]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x5c8]
push ecx
lea edx, [ebp - 0x120]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0xffffffff
jne 0x40abae
jmp 0x40ac75
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x328]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
mov ecx, dword [ebp - 0x824]
cmp dword [ecx + 0x1d4], 0x2a
jne 0x40abeb
lea edx, [ebp - 0x7b8]
push edx
lea eax, [ebp - 0x764]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
jmp 0x40ac01
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x764]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea eax, [ebp - 0x764]
push eax
lea ecx, [ebp - 0x328]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x4c4]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x4c4], 0x44
mov word [ebp - 0x494], 0
mov dword [ebp - 0x498], 1
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x4c4]
push ecx
push 0
push 0
push 0x30
push 0
push 0
push 0
lea edx, [ebp - 0x328]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x40ac7f
jmp 0x40ac70
jmp 0x40ac70
jmp 0x40ac70
jmp 0x40ac70
jmp 0x40ac70
pop edi
pop esi
mov esp, ebp
pop ebp
ret