Function at 0x401015
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3777c
call fcn.00404970
push edi
mov al, byte [0xde1444]
mov byte [ebp - 0x6688], al
xor ecx, ecx
mov dword [ebp - 0x6687], ecx
mov dword [ebp - 0x6683], ecx
mov dword [ebp - 0x667f], ecx
mov byte [ebp - 0x667b], cl
mov dl, byte [0xde1448]
mov byte [ebp - 0x37614], dl
mov ecx, 0xc34f
xor eax, eax
lea edi, [ebp - 0x37613]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xde144c]
mov byte [ebp - 0x6678], al
mov ecx, 0x1869
xor eax, eax
lea edi, [ebp - 0x6677]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xde1450]
mov byte [ebp - 0x104], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xde1454]
mov byte [ebp - 0x3777c], dl
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x3777b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x6794], 0
mov dword [ebp - 0x689c], 0
mov dword [ebp - 0x68a0], 0
mov dword [ebp - 0x6790], 0
mov al, byte [0xde1458]
mov byte [ebp - 0x490], al
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x48f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xde145c]
mov byte [ebp - 0x208], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xde1460]
mov byte [ebp - 0x6898], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x6897]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xde1464]
mov byte [ebp - 0x678c], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x678b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xde1468]
mov byte [ebp - 0x314], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xde146c]
mov byte [ebp - 0x68d0], dl
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x68cf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x68a8], 0
mov dword [ebp - 0x68d4], 0
mov dword [ebp - 0x68a4], 0
mov dword [ebp - 0x494], 0
push 0x104
push 0xde08f0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x6794], eax
push 0xde08f0
call fcn.004048f0
add esp, 4
mov dword [ebp - 0x6794], eax
jmp 0x401243
mov eax, dword [ebp - 0x6794]
sub eax, 1
mov dword [ebp - 0x6794], eax
cmp dword [ebp - 0x6794], 1
jle 0x401296
push 1
mov ecx, dword [ebp - 0x6794]
push ecx
push 0xde08f0
call fcn.004043ab
add esp, 0xc
push eax
call fcn.00404347
add esp, 4
cmp eax, 0x5c
jne 0x401294
mov edx, dword [ebp - 0x6794]
push edx
push 0xde08f0
call fcn.004044d8
add esp, 8
push eax
push 0xde09f4
call fcn.00404800
add esp, 8
jmp 0x401296
jmp 0x401234
push 0x53
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404800
add esp, 8
push 0x61
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x69
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x76
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x61
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x53
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x6d
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x6f
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
push 0x6b
call fcn.004042eb
add esp, 4
push eax
push 0xde0fec
call fcn.00404810
add esp, 8
mov dword [ebp - 0x6794], 1
jmp 0x4013a1
mov eax, dword [ebp - 0x6794]
add eax, 1
mov dword [ebp - 0x6794], eax
cmp dword [ebp - 0x6794], 0xb
jge 0x4013d8
push 1
mov ecx, dword [ebp - 0x6794]
push ecx
push 0xde0fec
call fcn.004043ab
add esp, 0xc
push eax
call fcn.00404347
add esp, 4
mov edx, dword [ebp - 0x6794]
mov dword [edx*4 + 0x40cd7c], eax
jmp 0x401392
mov dword [ebp - 0x6794], 0
push 0xde1470
push 0xddf814
call fcn.00404800
add esp, 8
push 0xde1474
lea eax, [ebp - 0x208]
push eax
call fcn.00404800
add esp, 8
push 0xddf814
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
push ecx
push 0xddf814
call fcn.004044d8
add esp, 8
push eax
push 0xddf814
call fcn.00404800
add esp, 8
push 0x72
call fcn.004042eb
add esp, 4
push eax
push 0x65
call fcn.004042eb
add esp, 4
push eax
push 0x64
call fcn.004042eb
add esp, 4
push eax
push 0x6c
call fcn.004042eb
add esp, 4
push eax
push 0x6f
call fcn.004042eb
add esp, 4
push eax
push 0x66
call fcn.004042eb
add esp, 4
push eax
push 0x61
call fcn.004042eb
add esp, 4
push eax
push 0xddf814
push str._s_s_s_s_s_s_s_s
push 0xddfa1c
call fcn.004047ad
add esp, 0x28
push 0
push 0xddfa1c
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6794], eax
push 0x70
call fcn.004042eb
add esp, 4
push eax
push 0x6d
call fcn.004042eb
add esp, 4
push eax
push 0x74
call fcn.004042eb
add esp, 4
push eax
push 0x7a
call fcn.004042eb
add esp, 4
push eax
push 0xddf814
push 0x40c044
push 0xddf918
call fcn.004047ad
add esp, 0x1c
push 0
push 0xddf918
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6794], eax
mov dword [ebp - 0x6794], 0
push 0x40c050
push 4
call fcn.00403f8d
add esp, 4
push eax
push 0x40c058
push 0xddf918
push 0x40c05c
push 0xde0de0
call fcn.004047ad
add esp, 0x18
push 0x40c068
push 5
call fcn.00403f8d
add esp, 4
push eax
push 0x40c070
push 0xddf918
push 0x40c074
push 0xde0ee4
call fcn.004047ad
add esp, 0x18
push str..bat
push 1
call fcn.00403f8d
add esp, 4
push eax
push 0x40c088
push 0xddf918
push str._s_s_s_s
push 0xddfb30
call fcn.004047ad
add esp, 0x18
push 0xddfb30
push 0xddff18
call fcn.00404800
add esp, 8
push 0xde1478
lea edx, [ebp - 0x104]
push edx
call fcn.00404800
add esp, 8
push str..exe
push 2
call fcn.00403f8d
add esp, 4
push eax
push 0x40c0a0
lea eax, [ebp - 0x104]
push eax
call fcn.004047ad
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 0x40c0a8
push 0xddf918
push str._s_s_s
push 0xde001c
call fcn.004047ad
add esp, 0x14
push 0x73
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404800
add esp, 8
push 0x65
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x20
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404810
add esp, 8
push 0x7a
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x6d
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404810
add esp, 8
push 0x70
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x3d
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x73
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00404800
add esp, 8
push 0x65
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00404810
add esp, 8
push 0x20
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00404810
add esp, 8
push 0x4d
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00404810
add esp, 8
push 0x59
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00404810
add esp, 8
push 0x46
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00404810
add esp, 8
push 0x49
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00404810
add esp, 8
push 0x4c
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00404810
add esp, 8
push 0x45
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00404810
add esp, 8
push 0x53
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00404810
add esp, 8
push 0x3d
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00404810
add esp, 8
push 0xddf918
lea edx, [ebp - 0x678c]
push edx
push 0x40c0b4
lea eax, [ebp - 0x208]
push eax
call fcn.004047ad
add esp, 0x10
push 0xddfa1c
lea ecx, [ebp - 0x314]
push ecx
push 0x40c0bc
lea edx, [ebp - 0x6898]
push edx
call fcn.004047ad
add esp, 0x10
push 0x73
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404800
add esp, 8
push 0x65
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404810
add esp, 8
push 0x20
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x62
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x66
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404810
add esp, 8
push 0x63
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x65
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x678c]
push ecx
call fcn.00404810
add esp, 8
push 0x63
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x678c]
push edx
call fcn.00404810
add esp, 8
push 0x3d
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x678c]
push eax
call fcn.00404810
add esp, 8
push 0x61
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x68d0]
push ecx
call fcn.00404800
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x68d0]
push edx
call fcn.00404810
add esp, 8
push 0x74
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x68d0]
push eax
call fcn.00404810
add esp, 8
push 0x72
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x68d0]
push ecx
call fcn.00404810
add esp, 8
push 0x69
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x68d0]
push edx
call fcn.00404810
add esp, 8
push 0x62
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x68d0]
push eax
call fcn.00404810
add esp, 8
push 0x20
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x68d0]
push ecx
call fcn.00404810
add esp, 8
push 0x2b
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x68d0]
push edx
call fcn.00404810
add esp, 8
push 0x68
call fcn.004042eb
add esp, 4
push eax
lea eax, [ebp - 0x68d0]
push eax
call fcn.00404810
add esp, 8
push 0x20
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x68d0]
push ecx
call fcn.00404810
add esp, 8
push 0xddf918
lea edx, [ebp - 0x68d0]
push edx
push 0x40c0c4
lea eax, [ebp - 0x3777c]
push eax
call fcn.004047ad
add esp, 0x10
push 0xde147c
push 0xde0120
call fcn.00404800
add esp, 8
push 0xa
call fcn.004042eb
add esp, 4
push eax
push 0xd
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x3777c]
push ecx
push 0xa
call fcn.004042eb
add esp, 4
push eax
push 0xd
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x678c]
push eax
push 0xa
call fcn.004042eb
add esp, 4
push eax
push 0xd
call fcn.004042eb
add esp, 4
push eax
lea ecx, [ebp - 0x6898]
push ecx
push 0xa
call fcn.004042eb
add esp, 4
push eax
push 0xd
call fcn.004042eb
add esp, 4
push eax
lea edx, [ebp - 0x208]
push edx
push 0xa
call fcn.004042eb
add esp, 4
push eax
push 0xd
call fcn.004042eb
add esp, 4
push eax
push str._echo_off
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push 0xde0120
call fcn.004047ad
add esp, 0x48
push 0xddfb30
push 0x20
call fcn.004042eb
add esp, 4
push eax
push 0x6c
call fcn.004042eb
add esp, 4
push eax
push 0x65
call fcn.004042eb
add esp, 4
push eax
push 0x64
call fcn.004042eb
add esp, 4
push eax
push str._s_s_s_s_s
lea eax, [ebp - 0x490]
push eax
call fcn.004047ad
add esp, 0x1c
call fcn.00401ccc
mov dword [ebp - 0x4d0], 0x3c
mov dword [ebp - 0x4c0], 0xddfb30
mov dword [ebp - 0x4cc], 0x40
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x4c4], str.open
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x4bc], ecx
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0x1d
lea edx, [ebp - 0x4d0]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x498], 0
je 0x401c29
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x498]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x498]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0xddfb28], 1
jne 0x401c7a
mov dword [ebp - 0x6794], 0
jmp 0x401c4d
mov edx, dword [ebp - 0x6794]
add edx, 1
mov dword [ebp - 0x6794], edx
mov eax, dword [0xddfb2c]
sub eax, 2
cmp dword [ebp - 0x6794], eax
jge 0x401c7a
mov ecx, dword [ebp - 0x6794]
imul ecx, ecx, 0x3e8
add ecx, str.C:_tempztmp_t30689.bat
push ecx
call fcn.00404783
add esp, 4
jmp 0x401c3e
mov edx, dword [0xddfb2c]
sub edx, 2
mov dword [ebp - 0x6794], edx
jmp 0x401c9a
mov eax, dword [ebp - 0x6794]
add eax, 1
mov dword [ebp - 0x6794], eax
mov ecx, dword [ebp - 0x6794]
cmp ecx, dword [0xddfb2c]
jge 0x401cc5
mov edx, dword [ebp - 0x6794]
imul edx, edx, 0x3e8
add edx, str.C:_tempztmp_t30689.bat
push edx
call fcn.00404783
add esp, 4
jmp 0x401c8b
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret