Function at 0x402780
Capabilities:
Create directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4409c1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x6334
call fcn.00438720
mov eax, dword [0x45504c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x6304], ecx
mov dword [ebp - 0x6344], ecx
mov esi, 1
call fcn.0040f6bc
cmp dword [eax], esi
jle 0x4027f9
call fcn.0040f6c2
push str._nodel
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0040f744
add esp, 8
test eax, eax
je 0x402a7b
inc esi
call fcn.0040f6bc
cmp esi, dword [eax]
jl 0x4027d0
mov byte [ebp - 0x6340], 0
mov esi, 1
call fcn.0040f6bc
cmp dword [eax], esi
jle 0x402839
nop
call fcn.0040f6c2
push str._app
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0040f744
add esp, 8
test eax, eax
je 0x402a87
inc esi
call fcn.0040f6bc
cmp esi, dword [eax]
jl 0x402810
mov byte [ebp - 0x633d], 0
mov esi, 1
call fcn.0040f6bc
cmp dword [eax], esi
jle 0x402879
nop
call fcn.0040f6c2
push str._params
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0040f744
add esp, 8
test eax, eax
je 0x402a93
inc esi
call fcn.0040f6bc
cmp esi, dword [eax]
jl 0x402850
xor al, al
mov byte [ebp - 0x633e], al
mov esi, 1
call fcn.0040f6bc
cmp dword [eax], esi
jle 0x4028b9
nop
call fcn.0040f6c2
push str._skipParams
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0040f744
add esp, 8
test eax, eax
je 0x402a9f
inc esi
call fcn.0040f6bc
cmp esi, dword [eax]
jl 0x402890
mov byte [ebp - 0x633f], 0
cmp byte [ebp - 0x633d], 0
je 0x4028ce
call fcn.00402470
mov al, byte [ebp - 0x633e]
test al, al
je 0x4028e3
call fcn.00402620
mov al, byte [ebp - 0x633e]
cmp byte [ebp - 0x633d], 0
jne 0x403076
test al, al
jne 0x403076
xor eax, eax
mov dword [ebp - 0x62a4], 0
mov dword [ebp - 0x62a0], 7
mov word [ebp - 0x62b4], ax
lea edx, [ebp - 0x62b4]
mov dword [ebp - 4], eax
mov ecx, str._destination
call fcn.004023d0
test al, al
jne 0x402b84
lea edx, [ebp - 0x62b4]
mov ecx, 0x450048
call fcn.004023d0
test al, al
jne 0x402b84
push 0x1ffe
lea eax, [ebp - 0x629a]
push 0
push eax
call fcn.0040b420
push 0x1ffe
lea eax, [ebp - 0x221a]
push 0
push eax
call fcn.0040b420
xor eax, eax
lea edx, [ebp - 0x629c]
add esp, 0x10
mov word [ebp - 0x629c], ax
mov word [ebp - 0x221c], ax
call fcn.004014c0
add esp, 8
test eax, eax
je 0x402b24
cmp eax, 0x103
ja 0x402b24
lea eax, [ebp - 0x629c]
push eax
lea eax, [ebp - 0x221c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea esi, [ebp - 0x221c]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4029c0
sub esi, ecx
sar esi, 1
cmp word [ebp + esi*2 - 0x221e], 0x5c
je 0x4029f2
mov eax, 0x5c
mov word [ebp + esi*2 - 0x221c], ax
inc esi
xor eax, eax
mov word [ebp + esi*2 - 0x221c], ax
push 0x44fd20
lea eax, [ebp - 0x221c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x2216]
mov edi, 1
lea eax, [eax + esi*2]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [eax - 6]
mov dword [ebp - 0x62fc], eax
mov dword [ebp - 0x6300], ecx
push edi
push str._04X.tmp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x6300]
add esp, 0xc
inc edi
call fcn.004012a0
test al, al
jne 0x402a67
push 0
lea eax, [ebp - 0x221c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402aab
call esi
cmp eax, 0xb7
jne 0x402b2a
cmp edi, 0xffff
jge 0x402b2a
mov eax, dword [ebp - 0x62fc]
jmp 0x402a27
mov byte [ebp - 0x6340], 1
jmp 0x402800
mov byte [ebp - 0x633d], 1
jmp 0x402840
mov byte [ebp - 0x633e], 1
jmp 0x402881
mov byte [ebp - 0x633f], 1
jmp 0x4028c0
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x221c]
push eax
call edi
test eax, eax
jne 0x402af7
lea eax, [ebp - 0x629c]
push eax
call edi
push 0x104
lea eax, [ebp - 0x221c]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x21c]
push eax
call fcn.00401560
add esp, 8
jmp 0x402b2a
lea ecx, [ebp - 0x221c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402b00
sub ecx, edx
lea eax, [ebp - 0x221c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x62b4]
call fcn.00401ec0
jmp 0x402b8a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push str.Failed_to_create_applet_folder.
call esi
push eax
call fcn.00402280
mov edx, dword [ebp - 0x62a0]
add esp, 8
cmp edx, 8
jb 0x402b7a
mov ecx, dword [ebp - 0x62b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402b70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403129
push edx
push ecx
call fcn.00408f7a
add esp, 8
mov eax, 1
jmp 0x403078
mov edi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x62b4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x631c]
call fcn.00401a80
push 0
lea eax, [ebp - 0x631c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x632c]
push eax
call fcn.00405fe0
mov eax, dword [ebp - 0x632c]
add esp, 0xc
test eax, eax
je 0x402bd2
mov byte [ebp - 0x633d], 0
cmp eax, 1
jne 0x402bd9
mov byte [ebp - 0x633d], 1
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x6308]
cmp edx, 8
jb 0x402c1d
mov ecx, dword [ebp - 0x631c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402c13
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40312e
push edx
push ecx
call fcn.00408f7a
add esp, 8
cmp byte [ebp - 0x633d], 0
je 0x402c91
lea eax, [ebp - 0x62b4]
push eax
lea ecx, [ebp - 0x631c]
call fcn.00401a80
lea eax, [ebp - 0x631c]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.00405900
mov byte [ebp - 4], 1
add esp, 8
mov edx, dword [ebp - 0x6308]
cmp edx, 8
jb 0x402c91
mov ecx, dword [ebp - 0x631c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402c87
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403133
push edx
push ecx
call fcn.00408f7a
add esp, 8
mov dword [ebp - 4], 0
jmp 0x402cb9
cmp dword [ebp - 0x62a0], 8
lea eax, [ebp - 0x62b4]
cmovae eax, dword [ebp - 0x62b4]
push eax
call edi
cmp dword [ebp - 0x62a0], 8
lea eax, [ebp - 0x62b4]
cmovae eax, dword [ebp - 0x62b4]
push eax
call fcn.004126d2
add esp, 4
mov edi, eax
lea eax, [ebp - 0x6328]
push eax
push 0
lea eax, [ebp - 0x6304]
push eax
push 0
push 0
push 4
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
lea eax, [ebp - 0x6300]
push eax
push str.S_1_1_0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
mov eax, dword [ebp - 0x6300]
mov dword [ebp - 0x6308], eax
lea eax, [ebp - 0x62fc]
push eax
push dword [ebp - 0x6304]
lea eax, [ebp - 0x6324]
mov dword [ebp - 0x6320], 2
push eax
push 1
mov dword [ebp - 0x6324], 0x1200a9
mov dword [ebp - 0x631c], 3
mov dword [ebp - 0x6314], 0
mov dword [ebp - 0x6318], 0
mov dword [ebp - 0x6310], 0
mov dword [ebp - 0x630c], 0
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
push 0
push dword [ebp - 0x62fc]
push 0
push 0
push 4
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push dword [ebp - 0x62fc]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x6300]
call esi
push edi
call fcn.0040cf54
add esp, 4
call fcn.00402470
cmp byte [ebp - 0x633f], 0
jne 0x402dd7
call fcn.00402620
push 0x2080
lea eax, [ebp - 0x429c]
push 0
push eax
call fcn.0040b420
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x62b4]
add esp, 0xc
xorps xmm0, xmm0
cmp dword [ebp - 0x62a0], 8
movlpd qword [ebp - 0x62f4], xmm0
cmovae eax, dword [ebp - 0x62b4]
push eax
lea eax, [ebp - 0x429c]
movlpd qword [ebp - 0x62ec], xmm0
push eax
movlpd qword [ebp - 0x62e4], xmm0
movlpd qword [ebp - 0x62dc], xmm0
movlpd qword [ebp - 0x62d4], xmm0
movlpd qword [ebp - 0x62cc], xmm0
movlpd qword [ebp - 0x62c4], xmm0
movlpd qword [ebp - 0x62bc], xmm0
movups xmmword [ebp - 0x633c], xmm0
call esi
push str.GoToAssistService.exe
lea eax, [ebp - 0x429c]
push eax
call esi
xor eax, eax
mov dword [ebp - 0x62f8], 0x44
mov dword [ebp - 0x630c], 0
mov dword [ebp - 0x6308], 7
mov word [ebp - 0x631c], ax
lea edx, [ebp - 0x631c]
mov byte [ebp - 4], 5
mov ecx, str._pin
call fcn.004023d0
test al, al
je 0x402ee7
push str.__WebsiteUrl_https:__weblens.logmeinrescue.com___PinCode
lea eax, [ebp - 0x429c]
push 0x1040
push eax
call fcn.0040cedf
cmp dword [ebp - 0x6308], 8
lea eax, [ebp - 0x631c]
cmovae eax, dword [ebp - 0x631c]
push eax
lea eax, [ebp - 0x429c]
push 0x1040
push eax
call fcn.0040cedf
add esp, 0x18
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x6308]
cmp edx, 8
jb 0x402f2b
mov ecx, dword [ebp - 0x631c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402f21
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403138
push edx
push ecx
call fcn.00408f7a
add esp, 8
push 0x45014c
lea eax, [ebp - 0x429c]
push 0x1040
push eax
call fcn.0040cedf
push dword [ebp - 0x6344]
lea eax, [ebp - 0x429c]
push 0x1040
push eax
call fcn.0040cedf
add esp, 0x18
lea ecx, [ebp - 0x633c]
cmp dword [ebp - 0x62a0], 8
lea eax, [ebp - 0x62b4]
cmovae eax, dword [ebp - 0x62b4]
push ecx
lea ecx, [ebp - 0x62f8]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x429c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402ff9
push 0x450150
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00402280
mov edx, dword [ebp - 0x62a0]
add esp, 8
cmp edx, 8
jb 0x402fef
mov ecx, dword [ebp - 0x62b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402fe5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403124
push edx
push ecx
call fcn.00408f7a
add esp, 8
mov eax, 2
jmp 0x403078
mov eax, dword [ebp - 0x6338]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x403016
push eax
call esi
mov dword [ebp - 0x6338], 0
mov eax, dword [ebp - 0x633c]
test eax, eax
je 0x40302d
push eax
call esi
mov dword [ebp - 0x633c], 0
cmp byte [ebp - 0x6340], 0
je 0x403094
mov edx, dword [ebp - 0x62a0]
cmp edx, 8
jb 0x403076
mov ecx, dword [ebp - 0x62b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40306c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403124
push edx
push ecx
call fcn.00408f7a
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00408f46
mov esp, ebp
pop ebp
ret
mov esi, 1
call fcn.0040f6bc
cmp dword [eax], esi
jle 0x4030c7
call fcn.0040f6c2
push str._destination
mov eax, dword [eax]
push dword [eax + esi*4]
call fcn.0040f744
add esp, 8
test eax, eax
je 0x4030ea
inc esi
call fcn.0040f6bc
cmp esi, dword [eax]
jl 0x4030a2
push 0x1040
lea eax, [ebp - 0x429c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4030ea
lea ecx, [ebp - 0x429c]
call fcn.00401700
mov edx, dword [ebp - 0x62a0]
cmp edx, 8
jb 0x403076
mov ecx, dword [ebp - 0x62b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40306c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40306c
call fcn.0040ce2a
call fcn.0040ce2a
call fcn.0040ce2a
call fcn.0040ce2a
call fcn.0040ce2a
int3