Function at 0x401a00
Capabilities:
Create directory
Create process on windows
Encode data using xor
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcbc
mov eax, dword [0x419004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.00402bc0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xa30], ax
push 0x206
push eax
lea eax, [ebp - 0xa2e]
push eax
call fcn.00402bc0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x828], ax
push 0x206
push eax
lea eax, [ebp - 0x826]
push eax
call fcn.00402bc0
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja 0x401d0c
test eax, eax
je 0x401d0c
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x620]
push str._wt_
push eax
call edi
push 0
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401acd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d0c
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0xa30]
push eax
call esi
push str.installer.exe
lea eax, [ebp - 0xa30]
push eax
call edi
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x828]
push eax
call esi
push str.installer.ini
lea eax, [ebp - 0x828]
push eax
call edi
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x418]
push eax
call esi
push str.wintoolspro.exe
lea eax, [ebp - 0x418]
push eax
call edi
push 0
lea edx, [ebp - 0xa30]
mov ecx, str.http:__www.wintools.one_installer.exe
call fcn.004017b0
add esp, 4
lea edx, [ebp - 0x418]
mov ecx, str.http:__www.wintools.one_wintoolspro.exe
push 1
call fcn.004017b0
add esp, 4
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401d0c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00402bc0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0xa
push 0x64
push eax
push 0
push dword [ebp - 0xc60]
call fcn.00404e34
mov ax, word [ebp - 0x210]
add esp, 0x14
xor edx, edx
test ax, ax
je 0x401be3
lea esi, [ebp - 0x210]
movzx ecx, ax
xor ecx, 7
lea edx, [edx + 1]
mov word [esi], cx
lea esi, [ebp - 0x210]
movzx eax, word [esi + edx*2]
lea esi, [esi + edx*2]
mov ecx, eax
test ax, ax
jne 0x401bc6
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x210]
push eax
push str.Data
push str.OPTIONS
call edi
push 0x104
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.COMDLG32.dll_GetFileTitleW]
mov ax, word [ebp - 0x210]
xor edx, edx
test ax, ax
je 0x401c50
lea esi, [ebp - 0x210]
movzx ecx, ax
xor ecx, 7
lea edx, [edx + 1]
mov word [esi], cx
lea esi, [ebp - 0x210]
movzx eax, word [esi + edx*2]
lea esi, [esi + edx*2]
mov ecx, eax
test ax, ax
jne 0x401c33
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x210]
push eax
push str.String
push str.OPTIONS
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x41a3bc]
xorps xmm0, xmm0
mov dword [ebp - 0xcb4], eax
lea eax, [ebp - 0xa30]
mov dword [ebp - 0xcac], eax
lea eax, [ebp - 0xcbc]
movlpd qword [ebp - 0xc98], xmm0
movlpd qword [ebp - 0xc90], xmm0
movlpd qword [ebp - 0xc88], xmm0
movaps xmm0, xmmword [0x417370]
push eax
mov dword [ebp - 0xcbc], 0x3c
mov dword [ebp - 0xcb8], 0x4c
mov dword [ebp - 0xcb0], str.open
movups xmmword [ebp - 0xca8], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0
push dword [0x41a3bc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41a3bc]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d64
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401d64
mov esp, ebp
pop ebp
ret