Function at 0x4331c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a5c2
mov eax, dword fs:[0]
push eax
sub esp, 0x96c
mov eax, dword [0x5503dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x968], edi
mov dword [ebp - 0x96c], edi
mov dword [ebp - 0x964], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x900]
push 9
xor eax, eax
mov dword [ebp - 0x8ec], 7
push str._DESKTOP_
mov dword [ebp - 0x8f0], 0
mov word [ebp - 0x900], ax
call fcn.00407b90
mov dword [ebp - 0x8e8], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8e4]
push 0xa
xor eax, eax
mov dword [ebp - 0x8d0], 7
push str._INTERNET_
mov dword [ebp - 0x8d4], 0
mov word [ebp - 0x8e4], ax
call fcn.00407b90
mov dword [ebp - 0x8cc], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c8]
push 0xa
xor eax, eax
mov dword [ebp - 0x8b4], 7
push str._PROGRAMS_
mov dword [ebp - 0x8b8], 0
mov word [ebp - 0x8c8], ax
call fcn.00407b90
mov dword [ebp - 0x8b0], 2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8ac]
push 0xa
xor eax, eax
mov dword [ebp - 0x898], 7
push str._CONTROLS_
mov dword [ebp - 0x89c], 0
mov word [ebp - 0x8ac], ax
call fcn.00407b90
mov dword [ebp - 0x894], 3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x890]
push 0xa
xor eax, eax
mov dword [ebp - 0x87c], 7
push str._PRINTERS_
mov dword [ebp - 0x880], 0
mov word [ebp - 0x890], ax
call fcn.00407b90
mov dword [ebp - 0x878], 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x874]
push 0xa
xor eax, eax
mov dword [ebp - 0x860], 7
push str._PERSONAL_
mov dword [ebp - 0x864], 0
mov word [ebp - 0x874], ax
call fcn.00407b90
mov dword [ebp - 0x85c], 5
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x858]
push 0xb
xor eax, eax
mov dword [ebp - 0x844], 7
push str._FAVORITES_
mov dword [ebp - 0x848], 0
mov word [ebp - 0x858], ax
call fcn.00407b90
mov dword [ebp - 0x840], 6
mov byte [ebp - 4], 8
push 9
xor eax, eax
mov dword [ebp - 0x828], 7
push str._STARTUP_
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x82c], 0
mov word [ebp - 0x83c], ax
call fcn.00407b90
mov dword [ebp - 0x824], 7
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x820]
push 8
xor eax, eax
mov dword [ebp - 0x80c], 7
push str._RECENT_
mov dword [ebp - 0x810], 0
mov word [ebp - 0x820], ax
call fcn.00407b90
mov dword [ebp - 0x808], 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x804]
push 8
xor eax, eax
mov dword [ebp - 0x7f0], 7
push str._SENDTO_
mov dword [ebp - 0x7f4], 0
mov word [ebp - 0x804], ax
call fcn.00407b90
mov dword [ebp - 0x7ec], 9
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7e8]
push 0xb
xor eax, eax
mov dword [ebp - 0x7d4], 7
push str._BITBUCKET_
mov dword [ebp - 0x7d8], 0
mov word [ebp - 0x7e8], ax
call fcn.00407b90
mov dword [ebp - 0x7d0], 0xa
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7cc]
push 0xb
xor eax, eax
mov dword [ebp - 0x7b8], 7
push str._STARTMENU_
mov dword [ebp - 0x7bc], 0
mov word [ebp - 0x7cc], ax
call fcn.00407b90
mov dword [ebp - 0x7b4], 0xb
push str._MYDOCUMENTS_
lea ecx, [ebp - 0x7b0]
mov byte [ebp - 4], 0xd
call fcn.004077c0
mov dword [ebp - 0x798], 5
push str._MYMUSIC_
lea ecx, [ebp - 0x794]
mov byte [ebp - 4], 0xe
call fcn.004077c0
mov dword [ebp - 0x77c], 0xd
push str._MYVIDEO_
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], 0xf
call fcn.004077c0
mov dword [ebp - 0x760], 0xe
push str._DESKTOPDIRECTORY_
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x10
call fcn.004077c0
mov dword [ebp - 0x744], 0x10
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x740]
push str._DRIVES_
call fcn.004077c0
mov dword [ebp - 0x728], 0x11
push str._NETWORK_
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], 0x12
call fcn.004077c0
mov dword [ebp - 0x70c], 0x12
push str._NETHOOD_
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x13
call fcn.004077c0
mov dword [ebp - 0x6f0], 0x13
push str._FONTS_
lea ecx, [ebp - 0x6ec]
mov byte [ebp - 4], 0x14
call fcn.004077c0
mov dword [ebp - 0x6d4], 0x14
push str._TEMPLATES_
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x15
call fcn.004077c0
mov dword [ebp - 0x6b8], 0x15
push str._COMMON_STARTMENU_
lea ecx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x16
call fcn.004077c0
mov dword [ebp - 0x69c], 0x16
push str._COMMON_PROGRAMS_
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], 0x17
call fcn.004077c0
mov dword [ebp - 0x680], 0x17
push str._COMMON_STARTUP_
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 0x18
call fcn.004077c0
mov dword [ebp - 0x664], 0x18
push str._COMMON_DESKTOPDIRECTORY_
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 0x19
call fcn.004077c0
mov dword [ebp - 0x648], 0x19
push str._APPDATA_
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0x1a
call fcn.004077c0
mov dword [ebp - 0x62c], 0x1a
push str._PRINTHOOD_
lea ecx, [ebp - 0x628]
mov byte [ebp - 4], 0x1b
call fcn.004077c0
mov dword [ebp - 0x610], 0x1b
push str._LOCAL_APPDATA_
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0x1c
call fcn.004077c0
mov dword [ebp - 0x5f4], 0x1c
push str._ALTSTARTUP_
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 0x1d
call fcn.004077c0
mov dword [ebp - 0x5d8], 0x1d
push str._COMMON_ALTSTARTUP_
lea ecx, [ebp - 0x5d4]
mov byte [ebp - 4], 0x1e
call fcn.004077c0
mov dword [ebp - 0x5bc], 0x1e
push str._COMMON_FAVORITES_
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x1f
call fcn.004077c0
mov dword [ebp - 0x5a0], 0x1f
push str._INTERNET_CACHE_
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x20
call fcn.004077c0
mov dword [ebp - 0x584], 0x20
push str._COOKIES_
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x21
call fcn.004077c0
mov dword [ebp - 0x568], 0x21
push str._HISTORY_
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x22
call fcn.004077c0
mov dword [ebp - 0x54c], 0x22
push str._COMMON_APPDATA_
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x23
call fcn.004077c0
mov dword [ebp - 0x530], 0x23
push str._WINDOWS_
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x24
call fcn.004077c0
mov dword [ebp - 0x514], 0x24
push str._SYSTEM_
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 0x25
call fcn.004077c0
mov dword [ebp - 0x4f8], 0x25
push str._PROGRAM_FILES_
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x26
call fcn.004077c0
mov dword [ebp - 0x4dc], 0x26
push str._MYPICTURES_
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x27
call fcn.004077c0
mov dword [ebp - 0x4c0], 0x27
push str._PROFILE_
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x28
call fcn.004077c0
mov dword [ebp - 0x4a4], 0x28
push str._SYSTEMX86_
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x29
call fcn.004077c0
mov dword [ebp - 0x488], 0x29
push str._PROGRAM_FILESX86_
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 0x2a
call fcn.004077c0
mov dword [ebp - 0x46c], 0x2a
push str._PROGRAM_FILES_COMMON_
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x2b
call fcn.004077c0
mov dword [ebp - 0x450], 0x2b
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x44c]
push str._PROGRAM_FILES_COMMONX86_
call fcn.004077c0
mov dword [ebp - 0x434], 0x2c
push str._COMMON_TEMPLATES_
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x2d
call fcn.004077c0
mov dword [ebp - 0x418], 0x2d
push str._COMMON_DOCUMENTS_
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x2e
call fcn.004077c0
mov dword [ebp - 0x3fc], 0x2e
push str._COMMON_ADMINTOOLS_
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 4], 0x2f
call fcn.004077c0
mov dword [ebp - 0x3e0], 0x2f
push str._ADMINTOOLS_
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x30
call fcn.004077c0
mov dword [ebp - 0x3c4], 0x30
push str._CONNECTIONS_
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x31
call fcn.004077c0
mov dword [ebp - 0x3a8], 0x31
push str._COMMON_MUSIC_
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0x32
call fcn.004077c0
mov dword [ebp - 0x38c], 0x35
push str._COMMON_PICTURES_
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x33
call fcn.004077c0
mov dword [ebp - 0x370], 0x36
push str._COMMON_VIDEO_
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x34
call fcn.004077c0
mov dword [ebp - 0x354], 0x37
push str._RESOURCES_
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x35
call fcn.004077c0
mov dword [ebp - 0x338], 0x38
push str._RESOURCES_LOCALIZED_
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0x36
call fcn.004077c0
mov dword [ebp - 0x31c], 0x39
push str._COMMON_OEM_LINKS_
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x37
call fcn.004077c0
mov dword [ebp - 0x300], 0x3a
push str._CDBURN_AREA_
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x38
call fcn.004077c0
mov dword [ebp - 0x2e4], 0x3b
push str._COMPUTERSNEARME_
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x39
call fcn.004077c0
mov dword [ebp - 0x2c8], 0x3d
push str._FLAG_CREATE_
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x3a
call fcn.004077c0
mov dword [ebp - 0x2ac], 0x8000
push str._FLAG_DONT_VERIFY_
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x3b
call fcn.004077c0
mov dword [ebp - 0x290], 0x4000
push str._FLAG_DONT_UNEXPAND_
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x3c
call fcn.004077c0
mov dword [ebp - 0x274], 0x2000
push str._FLAG_NO_ALIAS_
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x3d
call fcn.004077c0
mov dword [ebp - 0x258], 0x1000
push str._FLAG_PER_USER_INIT_
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x3e
call fcn.004077c0
mov dword [ebp - 0x23c], 0x800
push str._FLAG_MASK_
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x3f
call fcn.004077c0
mov dword [ebp - 0x220], 0xff00
push 0x53f0d8
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 0x40
call fcn.004077c0
push 0x53f0e0
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], 0x41
call fcn.004077c0
push str.SHGetSpecialFolderPathW
push str.shell32.dll
mov byte [ebp - 4], 0x42
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x208
mov dword [ebp - 0x968], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004debe0
add esp, 0xc
lea esi, [ebp - 0x900]
xor ebx, ebx
cmp dword [esi + 0x14], 8
jb 0x433b50
mov eax, dword [esi]
jmp 0x433b52
mov eax, esi
push dword [esi + 0x10]
lea ecx, [ebp + 8]
push 0
push eax
call fcn.0041d59d
cmp eax, 0xffffffff
jne 0x433e82
inc ebx
add esi, 0x1c
cmp ebx, 0x3f
jb 0x433b46
push dword [ebp - 0x920]
lea eax, [ebp - 0x948]
push 0
push eax
lea ecx, [ebp + 8]
call fcn.0041d2e4
lea ecx, [ebp - 0x930]
push ecx
mov ecx, eax
call fcn.00432d50
mov esi, eax
mov eax, dword [ebp - 0x934]
cmp eax, 8
jb 0x433bb7
inc eax
lea ecx, [ebp - 0x948]
push eax
push dword [ebp - 0x948]
call fcn.00408230
lea eax, [ebp - 0x948]
lea ecx, [ebp + 8]
test esi, esi
jne 0x433d27
push 0xffffffffffffffff
push dword [ebp - 0x920]
push eax
call fcn.0041d2e4
push eax
sub esp, 0x18
mov byte [ebp - 4], 0x45
push esp
call fcn.00433010
add esp, 4
lea ecx, [ebp - 0x960]
call fcn.00432f80
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x46
mov ecx, edi
call fcn.00432f10
mov eax, dword [ebp - 0x94c]
add esp, 4
mov dword [ebp - 0x964], 1
cmp eax, 8
jb 0x433c2d
inc eax
lea ecx, [ebp - 0x960]
push eax
push dword [ebp - 0x960]
call fcn.00408230
xor eax, eax
mov dword [ebp - 0x94c], 7
mov word [ebp - 0x960], ax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x950], 0
cmp eax, 8
jb 0x433c68
inc eax
lea ecx, [ebp - 0x948]
push eax
push dword [ebp - 0x948]
call fcn.00408230
xor eax, eax
mov dword [ebp - 0x934], 7
mov word [ebp - 0x948], ax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x938], 0
cmp eax, 8
jb 0x433ca3
inc eax
lea ecx, [ebp - 0x918]
push eax
push dword [ebp - 0x918]
call fcn.00408230
xor eax, eax
mov dword [ebp - 0x904], 7
mov word [ebp - 0x918], ax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x908], 0
cmp eax, 8
jb 0x433cde
inc eax
lea ecx, [ebp - 0x930]
push eax
push dword [ebp - 0x930]
call fcn.00408230
push fcn.00407750
xor eax, eax
mov dword [ebp - 0x91c], 7
push 0x3f
mov word [ebp - 0x930], ax
lea eax, [ebp - 0x900]
push 0x1c
push eax
mov dword [ebp - 0x920], 0
mov byte [ebp - 4], 1
call fcn.004c8ef0
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x433ffc
inc ecx
push ecx
jmp 0x433ff1
push dword [ebp - 0x908]
push 0
push eax
call fcn.0041d2e4
lea ecx, [ebp - 0x918]
push ecx
mov ecx, eax
call fcn.00432d50
mov ecx, dword [ebp - 0x934]
mov esi, eax
cmp ecx, 8
jb 0x433d63
inc ecx
push ecx
push dword [ebp - 0x948]
lea ecx, [ebp - 0x948]
call fcn.00408230
test esi, esi
jne 0x433e04
push 0xffffffffffffffff
push dword [ebp - 0x908]
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp + 8]
call fcn.0041d2e4
mov esi, eax
lea eax, [ebp - 0x948]
mov byte [ebp - 4], 0x47
push eax
call fcn.00433010
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x48
mov ecx, edi
call fcn.00432f10
add esp, 4
mov dword [ebp - 0x964], 1
lea ecx, [ebp - 0x948]
call fcn.00407750
lea ecx, [ebp - 0x960]
call fcn.00407750
lea ecx, [ebp - 0x918]
call fcn.00407750
lea ecx, [ebp - 0x930]
call fcn.00407750
push fcn.00407750
push 0x3f
push 0x1c
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 1
push eax
call fcn.004c8ef0
lea ecx, [ebp + 8]
call fcn.00407750
jmp 0x433ffc
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x433e2a
mov eax, dword [edi]
jmp 0x433e2c
mov eax, edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.00407c90
lea ecx, [ebp - 0x918]
mov dword [ebp - 0x964], 1
call fcn.00407750
lea ecx, [ebp - 0x930]
call fcn.00407750
push fcn.00407750
push 0x3f
push 0x1c
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 1
push eax
call fcn.004c8ef0
lea ecx, [ebp + 8]
call fcn.00407750
jmp 0x433ffc
lea esi, [ebx*8]
sub esi, ebx
lea eax, [ebp - 0x218]
shl esi, 2
push 0
push dword [ebp + esi - 0x8e8]
push eax
push 0
call dword [ebp - 0x968]
sub esp, 0x18
lea eax, [ebp - 0x218]
mov ecx, esp
mov dword [ebp - 0x968], esp
push eax
call fcn.004077c0
sub esp, 0x18
mov byte [ebp - 4], 0x43
mov ecx, esp
mov dword [ebp - 0x970], esp
lea edx, [ebp - 0x900]
add edx, esi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x433efa
mov eax, dword [ecx]
jmp 0x433efc
mov eax, ecx
push 0xffffffffffffffff
xor esi, esi
push esi
push edx
mov word [eax], si
call fcn.004083d0
sub esp, 0x18
mov byte [ebp - 4], 0x44
mov ecx, esp
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], esi
jb 0x433f2d
mov eax, dword [ecx]
jmp 0x433f2f
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.004083d0
mov ecx, edi
mov byte [ebp - 4], 0x42
call fcn.00432c00
add esp, 0x48
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x964], 1
cmp eax, 8
jb 0x433f76
inc eax
lea ecx, [ebp - 0x918]
push eax
push dword [ebp - 0x918]
call fcn.00408230
xor eax, eax
mov dword [ebp - 0x904], 7
mov word [ebp - 0x918], ax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x908], 0
cmp eax, 8
jb 0x433fb1
inc eax
lea ecx, [ebp - 0x930]
push eax
push dword [ebp - 0x930]
call fcn.00408230
push fcn.00407750
xor eax, eax
mov dword [ebp - 0x91c], 7
push 0x3f
mov word [ebp - 0x930], ax
lea eax, [ebp - 0x900]
push 0x1c
push eax
mov dword [ebp - 0x920], 0
mov byte [ebp - 4], 1
call fcn.004c8ef0
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x433ffc
inc eax
push eax
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00408230
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c9018
mov esp, ebp
pop ebp
ret