Function at 0x430870
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1b71
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x636b1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x25c], edi
mov dword [ebp - 0x264], edi
lea eax, [edi + 0x18]
mov dword [ebp - 0x260], eax
mov dword [eax], 0
add eax, 4
mov dword [ebp - 0x22c], eax
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov byte [eax + 0x18], 0
mov dword [ebp - 4], 2
lea ecx, [edi + 0x38]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 3
lea ecx, [edi + 0x40]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 4
lea ecx, [edi + 0x44]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 5
push 0xa
lea ecx, [edi + 0x60]
call sub.mfc120u.dll_Ordinal_926
mov byte [ebp - 4], 6
push 0xa
lea ecx, [edi + 0x7c]
call sub.mfc120u.dll_Ordinal_926
mov byte [ebp - 4], 7
push 0xa
lea ecx, [edi + 0x98]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 8
push 0xa
lea ecx, [edi + 0xb4]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 9
push 0xa
lea ecx, [edi + 0xe4]
call sub.mfc120u.dll_Ordinal_972
mov byte [ebp - 4], 0xa
push 0x4316a0
push 0x430810
push 4
push 0xc
lea eax, [edi + 0x100]
push eax
call fcn.0047486e
mov byte [ebp - 4], 0xb
lea ecx, [edi + 0x140]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 0xc
lea esi, [edi + 0x4a8]
mov dword [ebp - 0x260], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov ecx, esi
call fcn.00435660
mov dword [esi], eax
mov byte [ebp - 4], 0x11
lea eax, [edi + 0x4cc]
mov dword [ebp - 0x260], eax
mov dword [eax], 0x4c204c
lea esi, [eax + 4]
mov dword [ebp - 0x22c], esi
push 0xa
mov ecx, esi
call sub.mfc120u.dll_Ordinal_821
mov byte [ebp - 4], 0x12
mov dword [esi], 0x4c22d0
mov byte [ebp - 4], 0x13
mov dword [esi], 0x4c2060
mov byte [ebp - 4], 0x15
push 0xa
mov esi, edi
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_926
mov byte [ebp - 4], 0x16
push 0xa
lea ecx, [esi + 0x508]
call sub.mfc120u.dll_Ordinal_552
mov byte [ebp - 4], 0x17
lea ecx, [esi + 0x528]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 0x18
push 0xa
lea ecx, [esi + 0x540]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 0x19
push 0xa
lea ecx, [esi + 0x55c]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 0x1a
lea ecx, [esi + 0x578]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 0x1b
push 0xa
lea ecx, [esi + 0x57c]
call sub.mfc120u.dll_Ordinal_557
mov byte [ebp - 4], 0x1c
push 0xa
lea ecx, [esi + 0x598]
call sub.mfc120u.dll_Ordinal_552
mov byte [ebp - 4], 0x1d
push 0xa
lea ecx, [esi + 0x5b4]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 0x1e
push 0xa
lea ecx, [esi + 0x5d4]
call sub.mfc120u.dll_Ordinal_551
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
call fcn.004345e0
xorps xmm0, xmm0
movq qword [ebp - 0x238], xmm0
push 1
push 0x638a20
lea ecx, [ebp - 0x238]
call fcn.00405210
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x230], 0
push 0x4b542c
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 0x22
mov byte [esi + 0x50], 1
mov dword [ebp - 0x230], 0
push 0x4b542c
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc120u.dll_Ordinal_1520]
push str.IDM
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
lea eax, [ebp - 0x230]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x260], esp
push 0x4c22e4
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x224], esp
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.mfc120u.dll_Ordinal_280]
mov byte [ebp - 4], 0x24
push SysReAllocStringLen
mov byte [ebp - 4], 0x22
call fcn.00403000
add esp, 0x10
test al, al
je 0x430b62
cmp dword [ebp - 0x230], 0
jbe 0x430b62
mov byte [esi + 0x50], 0
push 0
mov edi, dword [sym.imp.MSVCR120.dll__time64]
call edi
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 8
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x250], 0
lea eax, [ebp - 0x250]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x430dd6
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x430dca
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430bd0
sub ecx, edx
sar ecx, 1
je 0x430dca
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_286]
mov byte [ebp - 4], 0x26
push 0x4bd274
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call edi
push 0x4bd28c
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call edi
push str.idm
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call edi
push 0x4b46c0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0x4b57e8
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
push 0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call edi
push 0x4b46c0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
lea ecx, [ebp - 0x224]
call dword [sym.imp.mfc120u.dll_Ordinal_296]
mov byte [ebp - 4], 0x27
call dword [sym.imp.MSVCR120.dll_rand]
push eax
push str._04X
lea eax, [ebp - 0x224]
push eax
mov esi, dword [sym.imp.mfc120u.dll_Ordinal_4772]
call esi
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2415]
push 0x4bf9c8
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2416]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str._08X
lea eax, [ebp - 0x224]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2415]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x23a]
push eax
movzx eax, word [ebp - 0x23c]
push eax
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x240]
push eax
push str.__02d_02d_02d_02d
lea eax, [ebp - 0x224]
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_2415]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc120u.dll_Ordinal_1518]
push 0
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1658]
push eax
call edi
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x224]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov esi, dword [ebp - 0x25c]
mov edi, dword [sym.imp.MSVCR120.dll__time64]
push dword [ebp - 0x250]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esi + 0x3c], 0
call fcn.00455c40
call fcn.0045eea0
push esi
lea ecx, [esi + 0x4cc]
call fcn.0042d520
call fcn.00455c50
push str.hello
lea ecx, [esi + 0x528]
call dword [sym.imp.mfc120u.dll_Ordinal_1520]
mov dword [esi + 0x52c], 0
mov dword [esi + 0x530], 0
mov dword [esi + 0x534], 0
mov dword [esi + 0x524], 0
mov byte [esi + 0x4b0], 0
mov byte [esi + 0x4bc], 0
mov dword [esi + 0x4c0], 0
mov byte [esi + 0x4c4], 0
mov dword [esi + 0x4c8], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x4b8], 1
mov dword [esi + 0x144], 0
mov dword [esi + 0x53c], 1
mov byte [esi + 0x538], 1
lea eax, [esi + 0x130]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 0
push 0x6100000
mov ecx, esi
call fcn.0043f050
push 0
push 0x6100120
mov ecx, esi
call fcn.0043f050
push 0
push 0x6100240
mov ecx, esi
call fcn.0043f050
push 0
call edi
push eax
call dword [sym.imp.MSVCR120.dll_srand]
add esp, 8
call dword [sym.imp.MSVCR120.dll_rand]
mov dword [esi + 0x58], eax
push 0x4b4618
lea ecx, [esi + 0x44]
call dword [sym.imp.mfc120u.dll_Ordinal_1520]
mov byte [esi + 0x5c], 0
mov dword [esi + 0x4c], 1
mov dword [esi + 0x5f0], 0x8040000
mov dword [esi + 0x5f4], 0x4000
mov byte [esi + 0x48], 0
push 0x4b542c
lea ecx, [esi + 0x40]
call dword [sym.imp.mfc120u.dll_Ordinal_1520]
mov ecx, esi
call fcn.00445310
mov byte [ebp - 0x252], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x268], 0
mov ecx, 0x2db
mov eax, dword [ebp - 0x268]
cmp ax, cx
jae 0x43133f
mov byte [ebp - 4], 0x28
movzx eax, ax
movzx ecx, byte [eax*4 + 0x4d96cb]
mov eax, dword [0x636384]
movzx eax, byte [ecx + eax]
mov edi, dword [eax*8 + 0x4da244]
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x26c], edi
mov cl, byte [edi + 0x24]
mov byte [ebp - 0x251], cl
mov byte [ebp - 0x255], cl
xor dh, dh
mov byte [ebp - 0x253], dh
cmp dh, cl
jae 0x431309
mov byte [ebp - 4], 0x29
movzx eax, dh
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov dword [ebp - 0x278], eax
xor dl, dl
mov byte [ebp - 0x254], dl
mov cl, byte [ebp - 0x251]
jmp 0x430fc0
cmp dl, byte [eax + 8]
jae 0x4312bd
mov byte [ebp - 4], 0x2a
movzx eax, word [ebp - 0x268]
movzx ecx, word [eax*4 + 0x4d96ca]
shl ecx, 8
movzx eax, dh
add ecx, eax
shl ecx, 8
movzx eax, dl
add ecx, eax
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x260], ecx
push dword [esi + 0x4c]
push ecx
call fcn.00437e30
add esp, 8
test al, al
je 0x43103b
movzx eax, byte [ebp - 0x252]
mov ecx, dword [ebp - 0x220]
test cl, cl
mov edx, 1
cmove eax, edx
mov byte [ebp - 0x252], al
push ecx
call fcn.00438990
add esp, 4
cmp al, 7
jne 0x431058
mov byte [ebp - 0x252], 1
jmp 0x431058
cmp byte [ebp - 0x252], 1
jne 0x431051
push dword [ebp - 0x220]
mov ecx, esi
call fcn.00431c60
mov byte [ebp - 0x252], 0
mov esi, dword [ebp - 0x220]
push esi
mov edi, dword [ebp - 0x25c]
lea ecx, [edi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
push esi
call fcn.00460030
add esp, 4
cmp al, 0x80
je 0x4310ae
push dword [ebp - 0x24c]
lea ecx, [edi + 0x57c]
call sub.mfc120u.dll_Ordinal_1656
mov ecx, esi
mov dword [eax], ecx
push ecx
lea ecx, [edi + 0x598]
call sub.mfc120u.dll_Ordinal_1651
mov cx, word [ebp - 0x24c]
mov word [eax], cx
inc dword [ebp - 0x24c]
push esi
mov esi, dword [ebp - 0x25c]
mov ecx, esi
call fcn.00436990
movzx ecx, ax
mov eax, dword [ebp - 0x220]
cmp eax, 0xc6000303
je 0x4310f6
cmp eax, 0xc6000304
je 0x4310e8
cmp eax, 0xc6000318
jne 0x431102
lea eax, [ecx + 0x30000]
mov dword [esi + 0x52c], eax
jmp 0x431102
lea eax, [ecx + 0x30000]
mov dword [esi + 0x530], eax
jmp 0x431102
lea eax, [ecx + 0x30000]
mov dword [esi + 0x524], eax
mov byte [ebp - 4], 0x2b
xor cl, cl
mov byte [ebp - 0x256], cl
xor edx, edx
mov dword [ebp - 0x270], edx
mov al, byte [ebp - 0x251]
movzx eax, al
cmp dx, ax
jae 0x4311dd
test cl, cl
jne 0x4311dd
movzx ecx, dx
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 0x20]
lea eax, [eax + ecx*8]
mov dword [ebp - 0x260], eax
mov cl, byte [ebp - 0x253]
cmp byte [eax], cl
jne 0x4311bf
xor edi, edi
mov dword [ebp - 0x284], edi
mov ecx, dword [ebp - 0x278]
movzx ecx, byte [ecx + 8]
cmp di, cx
jae 0x4311cb
movzx edx, di
mov ecx, dword [eax + 4]
mov al, byte [ebp - 0x254]
cmp byte [edx + ecx], al
mov eax, dword [ebp - 0x260]
jne 0x4311bc
push dword [ebp - 0x220]
lea ecx, [esi + 0x508]
call sub.mfc120u.dll_Ordinal_1651
mov esi, eax
push edi
push dword [ebp - 0x220]
call fcn.00435d90
add esp, 8
mov word [esi], ax
mov cl, 1
mov byte [ebp - 0x256], cl
mov esi, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x270]
inc edx
jmp 0x431110
inc edi
jmp 0x431151
mov cl, byte [ebp - 0x256]
inc edx
jmp 0x431110
mov cl, byte [ebp - 0x256]
mov edx, dword [ebp - 0x270]
inc edx
jmp 0x431110
mov dword [ebp - 4], 0x2a
mov cl, byte [ebp - 0x251]
mov edi, dword [ebp - 0x224]
mov dword [ebp - 4], 0x29
mov dl, byte [ebp - 0x254]
inc dl
mov byte [ebp - 0x254], dl
mov eax, dword [ebp - 0x278]
mov dh, byte [ebp - 0x253]
jmp 0x430fc0
mov dword [ebp - 4], 0x28
inc dh
jmp 0x430f85
mov dword [ebp - 4], 0x25
inc dword [ebp - 0x268]
jmp 0x430f35
lea eax, [esi + 0x4ec]
lea ecx, [ebp - 0x24c]
push ecx
push eax
lea ecx, [esi + 0x4cc]
call fcn.0042c0b0
xor edi, edi
mov dword [ebp - 0x280], edi
cmp edi, 3
jae 0x43137c
inc edi
push edi
mov ecx, esi
call fcn.004416a0
push eax
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
jmp 0x43135a
mov edi, 0x16005001
mov dword [ebp - 0x27c], edi
cmp edi, 0x16005006
jae 0x43139e
push edi
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
inc edi
jmp 0x431381
mov edi, 0x16005007
mov dword [ebp - 0x28c], edi
cmp edi, 0x1600502f
jae 0x4313c0
push edi
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
inc edi
jmp 0x4313a3
mov edi, 0x16005030
mov dword [ebp - 0x288], edi
cmp edi, 0x160050fd
jae 0x431411
push edi
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
push dword [ebp - 0x24c]
lea ecx, [esi + 0x57c]
call sub.mfc120u.dll_Ordinal_1656
mov dword [eax], edi
push edi
lea ecx, [esi + 0x598]
call sub.mfc120u.dll_Ordinal_1651
mov cx, word [ebp - 0x24c]
mov word [eax], cx
inc dword [ebp - 0x24c]
inc edi
jmp 0x4313c5
mov dword [ebp - 0x274], 0
xor edi, edi
mov dword [ebp - 0x274], edi
cmp edi, 4
jae 0x431440
lea eax, [edi + edi*2]
push dword [esi + eax*4 + 0x100]
lea ecx, [esi + 0x4ec]
call sub.mfc120u.dll_Ordinal_1966
inc edi
jmp 0x43141d
lea ecx, [esi + 0x540]
call sub.mfc120u.dll_Ordinal_12466
lea ecx, [esi + 0x55c]
call sub.mfc120u.dll_Ordinal_12466
lea ecx, [esi + 0x98]
call sub.mfc120u.dll_Ordinal_12466
lea ecx, [esi + 0xb4]
call sub.mfc120u.dll_Ordinal_12466
mov dword [esi + 0xd8], 0
mov byte [esi + 0xdc], 0
mov ecx, esi
call fcn.0043a250
mov dword [esi + 0xe0], 0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x22c]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x228]
call dword [sym.imp.mfc120u.dll_Ordinal_1042]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x238]
call fcn.004052b0
mov dword [ebp - 4], 0x1f
mov dword [ebp - 4], 0xffffffff
mov eax, esi
jmp 0x4314e9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004743e6
mov esp, ebp
pop ebp
ret