Function at 0x403af0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x45c75b
push eax
mov dword fs:[0], esp
sub esp, 0x520
cmp dword [0x4cb344], 0x84
jne 0x403bab
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push ebx
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
mov dword [esp + 0x120], 0xf
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
push ebx
push ebx
mov dword [esp + 0x534], ebx
call fcn.004044ab
push ebx
push ebx
call fcn.004044ab
add esp, 0x10
mov dword [esp + 0x52c], 0xffffffff
cmp dword [esp + 0x120], 0x10
jb 0x403b91
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.00404530
add esp, 4
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
mov dword [esp + 0x120], 0xf
pop ebx
mov dword [esp + 0x80], 0x59300646
mov dword [esp + 0xd4], 0x63f1982b
mov dword [esp + 0x74], 0x1a9c600
mov dword [esp + 0x34], 0x5f3401cf
mov dword [esp + 0x7c], 0x645b8ce9
mov dword [esp + 0xac], 0x316db92e
mov dword [esp + 0x60], 0x505e6785
mov dword [esp + 0xd8], 0xd206f39
mov dword [esp + 0xd0], 0x260c474e
mov dword [esp + 0x20], 0x388d20c6
mov dword [esp + 0x90], 0x788a95d6
mov dword [esp + 0xa8], 0x2f00cfdc
mov dword [esp + 0xf8], 0x4d13c02f
mov dword [esp + 0xf4], 0x17bfb6b6
mov dword [esp + 0xf0], 0x362cbc4f
mov dword [esp + 0xa0], 0x7c823358
mov dword [esp + 0x18], 0x505dd92c
mov dword [esp + 0x14], 0x63a7e197
mov dword [esp + 0x58], 0x7481fcdf
mov dword [esp + 0x78], 0x2679a887
mov dword [esp + 0x4c], 0x61d1dd97
mov dword [esp + 0x64], 0x6eec4e7a
mov dword [esp + 0xbc], 0x5759d9
mov dword [esp + 0x8c], 0x15d5b9fa
mov dword [esp + 0xfc], 0x2299ae3e
mov dword [esp + 0x24], 0x3222610d
mov dword [esp + 0xc8], 0x186cc409
mov dword [esp + 0x50], 0x6059a82d
mov dword [esp + 0xc0], 0x3acfa248
mov dword [esp + 0x10], 0x1a24f92f
mov dword [esp + 8], 0x5a37583
mov dword [esp], 0x23320b07
mov dword [esp + 0xb4], 0x564a7dd
mov dword [esp + 0x94], 0x4c42f36a
mov dword [esp + 0x1c], 0x64f6f9bc
mov dword [esp + 0xe0], 0x396bfa73
mov dword [esp + 0x44], 0x5a34f267
mov dword [esp + 0x70], 0x2b3be92e
mov dword [esp + 0xcc], 0x7a0299bd
mov dword [esp + 0x48], 0x3a8dfd70
mov dword [esp + 0x40], 0x4d8d1150
mov dword [esp + 0xb8], 0x3ff882a4
mov dword [esp + 0xb0], 0x64edfcb4
mov dword [esp + 0x84], 0x435f3476
mov dword [esp + 0x6c], 0x39781914
mov dword [esp + 0x98], 0x669d8c1f
mov dword [esp + 0xa4], 0x3fee1dd1
mov dword [esp + 0x38], 0x6e466651
mov dword [esp + 0xc], 0x1896f4ac
mov dword [esp + 0x9c], 0x2dac2e97
mov dword [esp + 0xe4], 0x2c87e50b
mov dword [esp + 0x5c], 0x169e6a51
mov dword [esp + 0x3c], 0x1a455f5f
mov dword [esp + 0x100], 0x4f630cc4
mov dword [esp + 0x30], 0x7beda82e
mov dword [esp + 0x88], 0x12411d87
mov dword [esp + 0x2c], 0x6bd12b2f
mov dword [esp + 0x28], 0x1df6547a
mov dword [esp + 0xec], 0x777cc3e4
mov dword [esp + 0xdc], 0x51b872c8
mov dword [esp + 0xc4], 0x13dc863d
mov dword [esp + 0xe8], 0x5d3a2c1
mov dword [esp + 0x54], 0x2895aa4e
mov dword [esp + 0x68], 0x371864bd
mov dword [esp + 4], 0xc1b9aba
sub dword [esp + 0xd4], 0x66984966
add dword [esp + 0x80], 0x2263113a
add dword [esp + 0x80], 0x2669ed0c
sub dword [esp + 0x74], 0x359a7617
sub dword [esp + 0x34], 0x72146d7f
sub dword [esp + 0x74], 0x28cdcfab
add dword [esp + 0xd4], 0x4ab6b217
mov eax, 0x61ac483e
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x80], 0x31a3b574
mov eax, 0x694d5df7
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x74], 0x3e09cdc0
add dword [esp + 0x60], 0x151264f3
add dword [esp + 0x90], 0x173d04bf
add dword [esp + 0xd8], 0x30eaa15a
sub dword [esp + 0x7c], 0x4bda534a
mov eax, 0x2acee18e
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
add dword [esp + 0xd8], 0x6a419477
sub dword [esp + 0x7c], 0x2ee95ddc
mov eax, 0x7b6343d0
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
add dword [esp + 0xf8], 0xc156a86
sub dword [esp + 0x34], 0x75af86ce
add dword [esp + 0x80], 0x16694fa8
sub dword [esp + 0xf8], 0x67bd1204
mov eax, 0x20ea5ce1
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x57c5494e
mul dword [esp + 0xd4]
mov eax, dword [esp + 0xd4]
add dword [esp + 0xd4], 0x72167b9c
add dword [esp + 0x74], 0x56df7455
mov eax, 0x4ef9360d
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0xa0], 0x68bdb25c
add dword [esp + 0x18], 0x228ff99b
add dword [esp + 0xf0], 0x40679bf3
add dword [esp + 0x14], 0x77cd3ec2
sub dword [esp + 0xf8], 0x4e0f002c
mov eax, 0x55a23c54
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x14], 0x167bbbe9
add dword [esp + 0xf0], 0x5ef81e7a
sub dword [esp + 0xf4], 0x11b0366
mov eax, 0x34ba6b71
mul dword [esp + 0xd8]
mov eax, dword [esp + 0xd8]
add dword [esp + 0xf8], 0x48972bcb
sub dword [esp + 0x34], 0x5652ff03
add dword [esp + 0x60], 0x40ad47cb
mov eax, 0xd718000
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
sub dword [esp + 0xac], 0x199f1db5
add dword [esp + 0x20], 0x5ea28fec
add dword [esp + 0x20], 0x3d7e360d
add dword [esp + 0x34], 0x38a8a3b3
sub dword [esp + 0x4c], 0x2c22b7a3
mov eax, 0x7d867438
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
mov eax, 0x64bddf55
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, 0x73d5799a
mul dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub dword [esp + 0xf8], 0x8f2d723
add dword [esp + 0xf8], 0x5ddc00b1
sub dword [esp + 0x18], 0x6acbc75c
mov eax, 0x24e3bac9
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
mov eax, 0x361d538d
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
sub dword [esp + 0xa8], 0x23de67cc
mov eax, 0x60381976
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
sub dword [esp + 0x4c], 0x72bc68f
mov eax, 0x10c0cb5
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x20], 0x73390418
add dword [esp + 0x7c], 0x274ac370
sub dword [esp + 0x74], 0x282d5f71
mov eax, 0x6e157581
mul dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
sub dword [esp + 0x8c], 0x36b3d24
add dword [esp + 0x18], 0x5f42cf11
add dword [esp + 0x8c], 0x50e16d07
mov eax, 0x2c38d2d8
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
add dword [esp + 0x7c], 0x6a32a0a7
sub dword [esp + 0x18], 0x7f89cf10
sub dword [esp + 0xd4], 0x6c6ec2f8
add dword [esp + 0xd8], 0x10622b8b
add dword [esp], 0x74f985e9
add dword [esp + 0xbc], 0x62df2418
mov eax, 0x7ada58f
mul dword [esp + 8]
mov eax, dword [esp + 8]
add dword [esp + 0xac], 0x5852d47b
sub dword [esp + 0xc0], 0x9d2be5f
add dword [esp + 0xb4], 0x5aa7f122
sub dword [esp + 0xf4], 0x780c75e8
mov eax, 0x14958328
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, 0x53eacf7d
mul dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
mov eax, 0x26443358
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
sub dword [esp + 0x78], 0x27ca7f51
add dword [esp + 0xa0], 0x38f0fc59
mov eax, 0x3d313543
mul dword [esp + 0xf0]
mov eax, dword [esp + 0xf0]
mov eax, 0x5953d05f
mul dword [esp + 0xfc]
mov eax, dword [esp + 0xfc]
sub dword [esp + 0x24], 0x7c2565ae
mov eax, 0x92e5c91
mul dword [esp + 0x78]
mov eax, dword [esp + 0x78]
sub dword [esp + 0x7c], 0x1e46bc2b
sub dword [esp + 0xf4], 0x20d85802
sub dword [esp + 0x7c], 0x3b40e521
add dword [esp + 0xc0], 0x3709f160
add dword [esp + 0xbc], 0x429b00ca
add dword [esp + 0x34], 0x769132a0
sub dword [esp + 0xd4], 0x1afee2c8
add dword [esp + 0x80], 0x46efc509
sub dword [esp + 0xbc], 0x72cf6251
add dword [esp + 0xa0], 0x681a0222
add dword [esp + 0xfc], 0x1c3c7764
add dword [esp + 0xd8], 0xe30f6fc
add dword [esp + 0xf0], 0x255a8183
add dword [esp], 0x10665cf
mov eax, 0x6bace33d
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
sub dword [esp + 0xc8], 0x671bb06d
sub dword [esp + 0x1c], 0x3e7957c8
add dword [esp + 0x48], 0x17952be
mov eax, 0x532e9e78
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
mov eax, 0x57a67a76
mul dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, 0x3abccab5
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
sub dword [esp + 0x78], 0x11e8f948
sub dword [esp + 0x34], 0x643d50df
sub dword [esp + 0x50], 0x79f487bd
mov eax, 0x7718514f
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x18], 0x4e1576dc
mov eax, 0x2b04b67
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], 0x4b0d705a
add dword [esp + 0x58], 0x4b6eb4d4
sub dword [esp], 0x6bd1b0a4
add dword [esp + 0x50], 0x36015b76
mov eax, 0x5032a9b4
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
add dword [esp + 0xd4], 0x69ab5cd
sub dword [esp + 0xd0], 0xd113a1a
add dword [esp + 0x34], 0x6fd092ce
mov eax, 0x793da674
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
sub dword [esp + 0x7c], 0x57c7601f
add dword [esp + 0x80], 0x43c20fd1
sub dword [esp + 0x74], 0x7e86388
sub dword [esp + 0xe0], 0x47a51f5b
add dword [esp + 0xcc], 0x36b7cb1b
mov eax, 0x3fdf1c2
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x279d41f0
mul dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, 0x516f97bb
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0xec], 0x5a66bca
add dword [esp + 4], 0x7b0b4252
add dword [esp + 0xc8], 0x4fa432db
mov eax, 0x4e74457
mul dword [esp + 0xdc]
mov eax, dword [esp + 0xdc]
mov edx, dword [0x460504]
mov eax, dword [0x4604d8]
mov dword [0x4cb344], edx
mov dword [0x4cbce4], eax
call fcn.004032b0
mov ecx, dword [esp + 0x520]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0x52c
ret 0x10