Function at 0x4058ae
Capabilities:
Contain obfuscated stackstrings
Get file attributes
Get geographical location
Get thread local storage value
Resolve function by parsing pe exports
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x416de6
push eax
mov dword fs:[0], esp
sub esp, 0xb50
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x42d51c], 0x16
jne 0x405990
call dword [sym.imp.KERNEL32.dll_GetVersion]
push edi
lea eax, [esp + 0x18]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_HeapSize]
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [esp + 0x14c]
call fcn.00406526
push edi
push edi
mov dword [esp + 0xb6c], edi
call fcn.00406943
push edi
push edi
push edi
call fcn.00406e4e
add esp, 0xc
mov dword [esp + 4], edi
mov dword [esp], edi
call fcn.00405570
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040554d
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040552a
fstp st(0)
push edi
call fcn.00406c65
push ecx
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00405507
fstp st(0)
or dword [esp + 0xb64], 0xffffffff
lea esi, [esp + 0x14c]
call fcn.00406543
mov eax, dword [0x42d51c]
cmp eax, 0xc
jne 0x4059e6
push edi
call dword [sym.imp.ole32.dll_OleQueryLinkFromData]
push edi
lea eax, [esp + 0x35c]
push eax
push edi
push 0x40518c
push edi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push edi
call fcn.004065d4
pop ecx
push edi
push edi
call fcn.0040683a
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.00405507
fstp st(0)
push edi
call fcn.00406c4f
pop ecx
push edi
call fcn.00406823
pop ecx
call fcn.00406bba
xor esi, esi
cmp eax, edi
jbe 0x405a3d
mov eax, dword [0x42de8c]
mov dword [esp + 0x10], eax
mov eax, 0xb2d3b
add dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov al, byte [eax + esi]
mov ecx, dword [0x42d47c]
mov byte [ecx + esi], al
cmp dword [0x42d51c], 0x44
jne 0x405a34
push edi
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
inc esi
cmp esi, dword [0x42d51c]
jb 0x4059ec
mov esi, dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor ebx, ebx
mov eax, dword [0x42d51c]
add eax, ebx
cmp eax, 0x5e
jne 0x405a6e
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
push edi
push 0x4051cc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push edi
push edi
call esi
inc ebx
cmp ebx, 0x40c893
jl 0x405a45
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0x120723e
jge 0x4063a0
mov dword [esp + 0xec], 0x4e627021
mov dword [esp + 0x24], 0x215b6660
mov dword [esp + 0xbc], 0x6e920e9b
mov dword [esp + 0x11c], 0x87d3fa0
mov dword [esp + 0x80], 0x3a438c4f
mov dword [esp + 0x120], 0x25908a53
mov dword [esp + 0x64], 0x4f4b3cb4
mov dword [esp + 0x7c], 0x4024fb6f
mov dword [esp + 0xf8], 0x330756b8
mov dword [esp + 0xa8], 0x61da5a75
mov dword [esp + 0x48], 0x25e7b9ba
mov dword [esp + 0xa0], 0x26b6ac0f
mov dword [esp + 0x138], 0x376478e4
mov dword [esp + 0x134], 0x5a58f071
mov dword [esp + 0x44], 0x41f9f06d
mov dword [esp + 0xf0], 0x67b165ff
mov dword [esp + 0x118], 0x424ff23e
mov dword [esp + 0xe8], 0x7ff6fa55
mov dword [esp + 0xb4], 0x53a124ed
mov dword [esp + 0x78], 0x588436bd
mov dword [esp + 0x13c], 0x55cc7f95
mov dword [esp + 0x94], 0x562ba11
mov dword [esp + 0xf4], 0x43b1fae2
mov dword [esp + 0x40], 0x607a8146
mov dword [esp + 0x104], 0x3c4d15ea
mov dword [esp + 0x54], 0x1e181e91
mov dword [esp + 0x14], 0x111b4c9f
mov dword [esp + 0xe0], 0x5b050ab5
mov dword [esp + 0xd8], 0x541bbf7b
mov dword [esp + 0x130], 0x4a83859f
mov dword [esp + 0x98], 0xd1aa2e5
mov dword [esp + 0x34], 0x6cf29885
mov dword [esp + 0x1c], 0x75da6ba3
mov dword [esp + 0xc4], 0x4fb2c937
mov dword [esp + 0x110], 0x2a09940f
mov dword [esp + 0x38], 0x66a62aae
mov dword [esp + 0xd0], 0x2a8f2010
mov dword [esp + 0x90], 0x334de827
mov dword [esp + 0x70], 0x29b5f4b4
mov dword [esp + 0x68], 0x3f6a5c30
mov dword [esp + 0xc8], 0x1f3d6e02
mov dword [esp + 0x74], 0x794b22cc
mov dword [esp + 0x30], 0x3e568168
mov dword [esp + 0x60], 0x1dee1606
mov dword [esp + 0x108], 0x2c7fea58
mov dword [esp + 0x144], 0x6b81bbed
mov dword [esp + 0xe4], 0x64a41f37
mov dword [esp + 0xd4], 0x35729f65
mov dword [esp + 0x28], 0x5aadb3a8
mov dword [esp + 0xc0], 0x6ea7f473
mov dword [esp + 0x4c], 0x6921ddf8
mov dword [esp + 0x58], 0x769c5e44
mov dword [esp + 0xdc], 0x656fed79
mov dword [esp + 0x20], 0x1378c832
mov dword [esp + 0x8c], 0x5d5bd4c
mov dword [esp + 0x5c], 0x75fd95ac
mov dword [esp + 0xac], 0x1cc6260a
mov dword [esp + 0x100], 0x3f40d0c
mov dword [esp + 0x10], 0x7adaa56b
mov dword [esp + 0x12c], 0x57b008b4
mov dword [esp + 0x50], 0x2700123d
mov dword [esp + 0xb8], 0x6dbcd40c
mov dword [esp + 0xb0], 0x5a90c04a
mov dword [esp + 0x2c], 0x3953d19f
mov dword [esp + 0x128], 0x64e5d37a
mov dword [esp + 0x6c], 0x7ce1380e
mov dword [esp + 0x18], 0x524dcf5b
mov dword [esp + 0xa4], 0x5951f7eb
mov dword [esp + 0xfc], 0x6955fa03
mov dword [esp + 0x124], 0x500c476a
mov dword [esp + 0x140], 0x4b3e0419
mov dword [esp + 0x10c], 0x1db8b113
mov dword [esp + 0x9c], 0x24eb64e4
mov dword [esp + 0xcc], 0x328a92be
mov dword [esp + 0x88], 0x6a062f7d
mov dword [esp + 0x3c], 0x3ea350c2
mov dword [esp + 0x114], 0x4bb851a
mov dword [esp + 0x84], 0x4b8d9459
mov dword [esp + 0x148], 0x38e35efd
sub dword [esp + 0xec], 0x558fe6a4
mov eax, 0x30f4c84
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
mov eax, 0x47a0d527
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
add dword [esp + 0xec], 0x50ad1fda
sub dword [esp + 0xec], 0x14676606
mov eax, 0x1da6200a
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
sub dword [esp + 0xec], 0xde9941e
mov eax, 0x2c28fdba
mul dword [esp + 0x11c]
mov eax, dword [esp + 0x11c]
mov eax, 0x5cfb8ff9
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x5a261ba
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add dword [esp + 0x11c], 0x530252b3
sub dword [esp + 0x24], 0x5712fe58
sub dword [esp + 0x24], 0x67656cad
sub dword [esp + 0x11c], 0x27701414
sub dword [esp + 0xf8], 0x2d7fdc66
add dword [esp + 0x11c], 0xd927fd0
add dword [esp + 0x7c], 0x1d62bd47
sub dword [esp + 0xec], 0x413beb88
add dword [esp + 0x80], 0x4b1ba98c
mov eax, 0x40c318f6
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
add dword [esp + 0x138], 0x5714e824
add dword [esp + 0x7c], 0x5991b917
add dword [esp + 0x138], 0xe416917
add dword [esp + 0x64], 0x7989dc34
mov eax, 0x76d8ce0f
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0x48], 0x23cfc6eb
add dword [esp + 0x64], 0x2801ab16
add dword [esp + 0x11c], 0x7484b53a
add dword [esp + 0x138], 0x749e9c07
sub dword [esp + 0xa0], 0x5457031
add dword [esp + 0xf8], 0x7cef0def
mov eax, 0x6c034e7f
mul dword [esp + 0x11c]
mov eax, dword [esp + 0x11c]
mov eax, 0x198ee566
mul dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
add dword [esp + 0x11c], 0x602337d4
sub dword [esp + 0x7c], 0x4db5aaa7
mov eax, 0x464b761b
mul dword [esp + 0x13c]
mov eax, dword [esp + 0x13c]
sub dword [esp + 0xec], 0xd15d48d
mov eax, 0x6403589c
mul dword [esp + 0xf0]
mov eax, dword [esp + 0xf0]
add dword [esp + 0x24], 0x1195b0f0
add dword [esp + 0x134], 0x162f2481
mov eax, 0x15e6d844
mul dword [esp + 0x118]
mov eax, dword [esp + 0x118]
sub dword [esp + 0xe8], 0x65b9b22d
mov eax, 0x6015fd47
mul dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
mov eax, 0x48d7438f
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
sub dword [esp + 0xa0], 0x7301efd9
add dword [esp + 0x13c], 0x27c78c9c
mov eax, 0x466d3ea4
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
sub dword [esp + 0xb4], 0x59972a51
mov eax, 0x1674b68e
mul dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
sub dword [esp + 0x40], 0x19eb66c5
mov eax, 0xe3ba836
mul dword [esp + 0x134]
mov eax, dword [esp + 0x134]
add dword [esp + 0xd8], 0x4e89d140
add dword [esp + 0x138], 0x2e2119d1
mov eax, 0x2c702326
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
sub dword [esp + 0x40], 0x4e734c7a
sub dword [esp + 0x104], 0x59bb6af3
sub dword [esp + 0x13c], 0x70f4c2b3
add dword [esp + 0x120], 0x2edb0761
sub dword [esp + 0x118], 0x1923a94e
mov eax, 0x510f0893
mul dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
sub dword [esp + 0x7c], 0x2ef58b8a
add dword [esp + 0x54], 0x33dad1d
add dword [esp + 0x138], 0x5423c49b
sub dword [esp + 0x94], 0x48abee08
add dword [esp + 0xe8], 0x3d4e7d87
add dword [esp + 0x64], 0x26809a7f
sub dword [esp + 0xf0], 0x4b246d69
add dword [esp + 0x118], 0x20474bcf
sub dword [esp + 0x98], 0x21c628b
mov eax, 0xb15d2f8
mul dword [esp + 0x13c]
mov eax, dword [esp + 0x13c]
mov eax, 0x6542435a
mul dword [esp + 0x13c]
mov eax, dword [esp + 0x13c]
sub dword [esp + 0x1c], 0x17c8788f
add dword [esp + 0x110], 0x16bd0599
mov eax, 0x51e9d6de
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
sub dword [esp + 0x90], 0x15f7270a
sub dword [esp + 0xf0], 0x21060fcb
add dword [esp + 0x104], 0xebdaa01
add dword [esp + 0x64], 0x1b52ee57
add dword [esp + 0x98], 0x5b2af0c1
mov eax, 0x63dc7254
mul dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
sub dword [esp + 0xd8], 0x4db5b8c3
mov eax, 0x6c0e944c
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x1f54c69c
mul dword [esp + 0x118]
mov eax, dword [esp + 0x118]
add dword [esp + 0xc4], 0x6510af93
add dword [esp + 0xd4], 0x52e0ddbf
mov eax, 0x19fad079
mul dword [esp + 0xe0]
mov eax, dword [esp + 0xe0]
mov eax, 0x2af3b09e
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, 0x63b5fb69
mul dword [esp + 0x118]
mov eax, dword [esp + 0x118]
sub dword [esp + 0x80], 0x2bd2897c
sub dword [esp + 0x24], 0x13112fb5
mov eax, 0x54965141
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x51e0469b
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x110], 0x6a13f381
mov eax, 0x33e7e177
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
sub dword [esp + 0xf0], 0x54dc36e9
add dword [esp + 0xb4], 0x65426798
mov eax, 0x1a736307
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x34], 0x690c2f07
add dword [esp + 0xec], 0x6ad6249
mov eax, 0x270b374d
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
add dword [esp + 0x144], 0x5bec5851
sub dword [esp + 0xc4], 0x2acb6a31
sub dword [esp + 0x68], 0x3d050de4
mov eax, 0x266ee953
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub dword [esp + 0xe8], 0x3e2bbe5b
mov eax, 0x7f210c2a
mul dword [esp + 0x138]
mov eax, dword [esp + 0x138]
add dword [esp + 0x24], 0x37e10dd2
mov eax, 0x778863ed
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0xe4], 0x660439a6
mov eax, 0x268578f7
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
add dword [esp + 0x70], 0x43dcb1d8
add dword [esp + 0x2c], 0x55a9d8d1
add dword [esp + 0x144], 0x3591dc23
sub dword [esp + 0xec], 0x6ee3267
add dword [esp + 0x54], 0x191d88a6
mov eax, 0x48896798
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
mov eax, 0x63742156
mul dword [esp + 0x144]
mov eax, dword [esp + 0x144]
mov eax, 0x32391df5
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
mov eax, 0x3d48e397
mul dword [esp + 0xf0]
mov eax, dword [esp + 0xf0]
add dword [esp + 0xf8], 0x306bac8f
mov eax, 0x7873c0ad
mul dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp ebx, 0x11bb645
jg 0x4063c6
inc ebx
cmp ebx, 0x16f1a994
jl 0x405a79
call fcn.00405770
xor ecx, ecx
cmp ecx, 0x770e
jne 0x4063da
call fcn.00405880
inc ecx
cmp ecx, 0x286b97d
jl 0x4063cd
push 0x7b
pop ebx
cmp dword [0x42d51c], 0xd
jne 0x406419
lea eax, [esp + 0x358]
push eax
push edi
push 0x405218
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp dword [0x42d51c], 0xf
jne 0x406433
push edi
push edi
lea eax, [esp + 0x360]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
dec ebx
jne 0x4063e6
mov ebx, 0x184cc
cmp dword [0x42d51c], 0x1833b
jne 0x406481
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x405278
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea eax, [esp + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0x4051e4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x405298
push edi
call esi
dec ebx
jne 0x40643b
push 0x4052e4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0xb5c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret