Function at 0x40563f
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
mov eax, 0x4b4003
call fcn.004b3f28
sub esp, 0x2a4
push ebx
push esi
mov eax, 0xb2d3b
add dword [0x4f472c], eax
xor ebx, ebx
cmp dword [0x4f472c], 0x16
jne 0x4056f0
push ebx
push ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
push ebx
push 0x404808
push 0x404848
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.00404bc0
push 0x404870
lea ecx, [ebp - 0x298]
call fcn.00405eea
push ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.004072e2
push 0x929
push 0xea
call fcn.0040691f
push ebx
call fcn.00407274
add esp, 0xc
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.00404c64
fstp st(0)
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.00405f1b
xor eax, eax
cmp eax, 0x16789e8
jge 0x405cb7
mov dword [ebp - 0x21c], 0x5a9f9939
mov dword [ebp - 0x210], 0x2005737f
mov dword [ebp - 0x88], 0x54ed839a
mov dword [ebp - 0x27c], 0x28b17089
mov dword [ebp - 0x12c], 0x4e613c4e
mov dword [ebp - 0x214], 0x26b4a1ef
mov dword [ebp - 0x160], 0x5df0a90e
mov dword [ebp - 0xc4], 0x52b8e0e8
mov dword [ebp - 0x24], 0x1bc40e30
mov dword [ebp - 0x38], 0xcf4d856
mov dword [ebp - 0xb0], 0x2f67818a
mov dword [ebp - 0x80], 0x32214d84
mov dword [ebp - 0x18], 0x7c605821
mov dword [ebp - 0x1bc], 0x6a490e6a
mov dword [ebp - 0x180], 0x3091e108
mov dword [ebp - 0xd0], 0x7eb4ee47
mov dword [ebp - 0x198], 0x6ac27fda
mov dword [ebp - 0x78], 0x446298b
mov dword [ebp - 0x124], 0xb60b06c
mov dword [ebp - 0x200], 0x587a6b33
mov dword [ebp - 0x74], 0x3dded440
mov dword [ebp - 0x1a8], 0x1227652c
mov dword [ebp - 0x11c], 0x4ba5bda
mov dword [ebp - 0x70], 0x737be082
mov dword [ebp - 0x178], 0x50cbc9cb
mov dword [ebp - 0x184], 0x78c85680
mov dword [ebp - 0x68], 0x7a03dc3b
mov dword [ebp - 0x6c], 0x483b6f9c
mov dword [ebp - 0x64], 0x559b1cff
mov dword [ebp - 0xbc], 0x265fa6c8
mov dword [ebp - 0x1f0], 0x6787fd83
mov dword [ebp - 0x1c], 0x646c085c
mov dword [ebp - 0x17c], 0x2f2cb00a
mov dword [ebp - 0x258], 0x4d6d7525
mov dword [ebp - 0x240], 0x2e2db44e
mov dword [ebp - 0x174], 0x615d6e08
mov dword [ebp - 0x15c], 0x154aab74
mov dword [ebp - 0xa8], 0x75bb0d7d
mov dword [ebp - 0x114], 0x6cf45601
mov dword [ebp - 0x30], 0x547781b7
mov dword [ebp - 0x20c], 0x2e65414a
mov dword [ebp - 0xe8], 0x1d862b5d
mov dword [ebp - 0x264], 0x5b414a0b
mov dword [ebp - 0x250], 0x2027e399
mov dword [ebp - 0x248], 0x5423fcbc
mov dword [ebp - 0x10c], 0x71e42d58
mov dword [ebp - 0x1b4], 0x28e5bff7
mov dword [ebp - 0x104], 0x7d358011
mov dword [ebp - 0xb4], 0x55d66823
mov dword [ebp - 0x5c], 0x11c53f30
mov dword [ebp - 0x204], 0x6c27265a
mov dword [ebp - 0xac], 0x638fabe5
mov dword [ebp - 0x25c], 0xfa972dc
mov dword [ebp - 0x120], 0x585cef59
mov dword [ebp - 0x60], 0x5f87b0dd
mov dword [ebp - 0x1d8], 0x781f8357
mov dword [ebp - 0x238], 0x407cc191
mov dword [ebp - 0x1d0], 0x71387130
mov dword [ebp - 0x154], 0x68d96b25
mov dword [ebp - 0x14c], 0x44f72b4f
mov dword [ebp - 0x1fc], 0xed64d7a
mov dword [ebp - 0x118], 0x12cb7a2e
mov dword [ebp - 0x170], 0x6fa206a2
mov dword [ebp - 0x58], 0x6cf7f6db
mov dword [ebp - 0x16c], 0x6f82a0b5
mov dword [ebp - 0x254], 0x7c3ade2e
mov dword [ebp - 0x20], 0xaa70197
mov dword [ebp - 0xa0], 0x278caf26
mov dword [ebp - 0x190], 0x1f8218de
mov dword [ebp - 0x1f4], 0xf520107
mov dword [ebp - 0x1ac], 0x78d20988
mov dword [ebp - 0x1f8], 0x7afd1ba
mov dword [ebp - 0xe0], 0x2c4a94bf
mov dword [ebp - 0x228], 0x37265bf9
mov dword [ebp - 0xa4], 0x7f0691dc
mov dword [ebp - 0x1a4], 0x573b975
mov dword [ebp - 0x54], 0x5c72ad7c
mov dword [ebp - 0x1b0], 0x558e020
mov dword [ebp - 0x1e8], 0x6dca8d93
mov dword [ebp - 0x110], 0x3b244f69
mov dword [ebp - 0x4c], 0x1468c94e
mov dword [ebp - 0x9c], 0x5ab7c260
mov dword [ebp - 0x144], 0x20e98555
mov dword [ebp - 0x13c], 0x130f3a77
mov dword [ebp - 0x44], 0x3a5f5ee8
mov dword [ebp - 0x1ec], 0x21e60348
mov dword [ebp - 0x158], 0x40f8ba31
mov dword [ebp - 0x1c8], 0x679a298a
mov dword [ebp - 0x1e4], 0x5a7e8c2e
mov dword [ebp - 0x108], 0xc4ba0ce
mov dword [ebp - 0x28], 0x6825863d
mov dword [ebp - 0xd8], 0x1d198b17
mov dword [ebp - 0x98], 0x75c77596
mov dword [ebp - 0xfc], 0x4426cf7d
mov dword [ebp - 0x1dc], 0x31322a4c
mov dword [ebp - 0xf4], 0x4e50df79
mov dword [ebp - 0xc8], 0x3d2e523d
mov dword [ebp - 0x148], 0x636b67e1
mov dword [ebp - 0x50], 0xa4eaf4d
mov dword [ebp - 0x270], 0x47d33ede
mov dword [ebp - 0x278], 0x838c246
mov dword [ebp - 0x208], 0x475aeb05
mov dword [ebp - 0x1d4], 0x6e804802
mov dword [ebp - 0x164], 0x2356143b
mov dword [ebp - 0x100], 0x3284b288
mov dword [ebp - 0x268], 0x215ddd80
mov dword [ebp - 0x1c0], 0x43001d08
mov dword [ebp - 0x24c], 0x5dd4d372
mov dword [ebp - 0x140], 0x1f5fee15
mov dword [ebp - 0x218], 0x4aa8a2c2
mov dword [ebp - 0x274], 0x5d2b45cb
mov dword [ebp - 0x168], 0x13a26bf8
mov dword [ebp - 0x1e0], 0x729131e9
mov dword [ebp - 0x244], 0x481267f
mov dword [ebp - 0xf8], 0x283f2546
mov dword [ebp - 0x1cc], 0x20aaa540
mov dword [ebp - 0x138], 0x62aa96f3
mov dword [ebp - 0xc0], 0x49a92fd9
mov dword [ebp - 0x94], 0x22d7fb63
mov dword [ebp - 0x3c], 0x390293cf
mov dword [ebp - 0x34], 0x637c4154
mov dword [ebp - 0x48], 0x95e5a37
mov dword [ebp - 0x8c], 0x7b5a55bc
mov dword [ebp - 0x26c], 0x37b3d9f2
mov dword [ebp - 0x23c], 0x3d6779fa
mov dword [ebp - 0x2c], 0x45476ad4
mov dword [ebp - 0x19c], 0x7845e460
mov dword [ebp - 0x234], 0x38b74787
mov dword [ebp - 0xec], 0x888b796
mov dword [ebp - 0x230], 0x5d13a243
mov dword [ebp - 0x150], 0x731062d6
mov dword [ebp - 0x220], 0xabb7b5b
mov dword [ebp - 0x134], 0x4ba8a95a
mov dword [ebp - 0xe4], 0x57424970
mov dword [ebp - 0xdc], 0x691b126a
mov dword [ebp - 0x1a0], 0x3727823c
mov dword [ebp - 0xb8], 0x22a62b70
mov dword [ebp - 0x128], 0x5d7bb0f
mov dword [ebp - 0xf0], 0x3e275197
mov dword [ebp - 0x1b8], 0x467f9773
mov dword [ebp - 0xd4], 0x79e319da
mov dword [ebp - 0x22c], 0x6e53c263
mov dword [ebp - 0x130], 0xf173702
mov dword [ebp - 0x224], 0x14f532b7
mov dword [ebp - 0x14], 0x42a0674a
mov dword [ebp - 0x90], 0x421363fc
mov dword [ebp - 0x260], 0x43ffb8eb
mov dword [ebp - 0x40], 0x45639c1d
mov dword [ebp - 0x84], 0x6f23b641
mov dword [ebp - 0x188], 0x430202cb
mov dword [ebp - 0x194], 0x27a321bc
mov dword [ebp - 0xcc], 0x7255fa29
mov dword [ebp - 0x7c], 0x4ec0e849
mov dword [ebp - 0x18c], 0x21ef19b5
mov dword [ebp - 0x1c4], 0x7dd761a7
cmp eax, 0xf02794a
jg 0x405cca
inc eax
cmp eax, 0x6d6c78b2
jl 0x4056f2
push 0x4c7f20
mov byte [0x4c7f2a], 0x6c
mov byte [0x4c7f2b], 0x6c
mov byte [0x4c7f2c], bl
mov byte [0x4c7f20], 0x6b
mov byte [0x4c7f22], 0x72
mov byte [0x4c7f25], 0x6c
mov byte [0x4c7f27], 0x32
mov byte [0x4c7f28], 0x2e
mov byte [0x4c7f23], 0x6e
mov byte [0x4c7f24], 0x65
mov byte [0x4c7f29], 0x64
mov byte [0x4c7f26], 0x33
mov byte [0x4c7f21], 0x65
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x4f472c]
mov dword [0x4f469c], eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x4f4698], eax
call fcn.00405608
mov eax, dword [0x4c243c]
xor esi, esi
mov dword [0x4f4804], eax
cmp dword [0x4f472c], ebx
jbe 0x405db4
mov eax, dword [0x4f4804]
mov dword [ebp - 0x14], eax
mov eax, 0xb2d3b
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + esi]
mov ecx, dword [0x4f4698]
mov byte [esi + ecx], al
cmp dword [0x4f472c], 0x44
jne 0x405dab
lea eax, [ebp - 0x18]
push eax
push 0x404878
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
inc esi
cmp esi, dword [0x4f472c]
jb 0x405d5f
call fcn.0040554e
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetAtomNameA]
cmp esi, 0x770e
jne 0x405dd8
call fcn.004055ee
inc esi
cmp esi, 0x286c535
jl 0x405dbb
push 0x7b
pop esi
cmp dword [0x4f472c], 0xd
jne 0x405e02
push ebx
lea eax, [ebp - 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec esi
jne 0x405de4
call fcn.00405633
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret