Function at 0x403885
Capabilities:
Contain obfuscated stackstrings
Create directory
Create thread
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov dword [ebp - 0x48], 0x6e6e6143
mov dword [ebp - 0x44], 0x6f20746f
mov dword [ebp - 0x40], 0x206e6570
mov dword [ebp - 0x3c], 0x656c6966
mov dword [ebp - 0x38], 0x726f6620
mov dword [ebp - 0x34], 0x61657220
mov dword [ebp - 0x30], 0x676e6964
mov byte [ebp - 0x2c], 0x2e
mov byte [ebp - 0x2b], 0
mov dword [ebp - 0x2a], 0x65726944
mov dword [ebp - 0x26], 0x726f7463
mov dword [ebp - 0x22], 0x6c612079
mov dword [ebp - 0x1e], 0x64616572
mov dword [ebp - 0x1a], 0x78652079
mov dword [ebp - 0x16], 0x73747369
mov dword [ebp - 0x12], 0x764f2021
mov dword [ebp - 0xe], 0x72777265
mov dword [ebp - 0xa], 0x6e697469
mov dword [ebp - 6], 0x2e2e2e67
mov byte [ebp - 2], 0
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [0x401743]
push 0
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 1
push 0x404
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
push 0x80000000
push 0x401747
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x84c], 0
je 0x403acc
push 0x401747
lea edx, [ebp - 0x848]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea edx, [ebp - 0x848]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov byte [ebp + eax - 0x84c], 0
call 0x403a12
pop edi
jne 0x403a7d
jo 0x403a12
lea edx, [ebp - 0x848]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
lea edx, [ebp - 0x848]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
cmp eax, 0
jne 0x403a53
lea eax, [ebp - 0x2a]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
lea edx, [ebp - 0x848]
push edx
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea edx, [ebp - 0x848]
push edx
call 0x403a7e
inc ebp
js 0x403ae3
jb 0x403ad2
arpl word [ecx + ebp*2 + 0x6e], si
and byte [si + 0x6f], dh
cmp ah, byte [eax]
and eax, 0x958d0073
mov eax, 0x52fffffb
call dword [sym.imp.USER32.DLL_wsprintfA]
add byte [ebp - 0x4476b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x448]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0
push 0
push dword [ebp - 0x84c]
push 0x403aee
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x403aec
lea eax, [ebp - 0x48]
mov dword [0x4016b7], eax
push 0x40169f
push 0
inc eax
add byte [eax - 0x61], ch
push ss
inc eax
add byte [edx], ch
push 0x1100
push dword [0x401062]
adc byte [eax], al
call dword [sym.imp.USER32.DLL_SendMessageA]
leave
ret