Function at 0x403ed0
Capabilities:
Delete file
Enumerate gui resources
Get common file path
Get hostname

Disassembly:
mov eax, 0x117c
call fcn.00404290
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor esi, esi
cmp esi, 0x13b4
jne 0x403ef7
mov eax, 0x38d6
add dword [0x57ce64], eax
cmp dword [0x57ce64], 0xdcc
jne 0x403f07
push 0
call edi
inc esi
cmp esi, 0x31aa3a
jl 0x403ee4
mov eax, dword [0x57ce64]
push ebx
push ebp
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebp, dword [sym.imp.KERNEL32.dll_FoldStringW]
mov dword [0x57c948], eax
mov eax, dword [0x57ce64]
mov dword [esp + 0x10], 0x962aca
lea ebx, [ebx]
cmp eax, 3
jne 0x403f67
lea ecx, [esp + 0x4c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [0x57ce64]
cmp eax, 0xd
jne 0x403fa8
push 0
push 0
push 0
push 0
call esi
lea edx, [esp + 0x18]
push edx
push 0
call edi
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [esp + 0x190]
push eax
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
call ebp
mov eax, dword [0x57ce64]
dec dword [esp + 0x10]
jne 0x403f50
xor ebp, ebp
test eax, eax
je 0x404001
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edi, dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
mov ebx, dword [sym.imp.KERNEL32.dll_FatalAppExitW]
cmp eax, 0xfe
jne 0x403ff1
push 0x401308
push 0x401378
push 0x4012c4
push 0x4013ec
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push ebp
call fcn.00403920
mov eax, dword [0x57ce64]
inc ebp
cmp ebp, eax
jb 0x403fc6
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, 0x19c
jne 0x40406d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
push 0
lea ecx, [esp + 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
push 0x40124c
push 0x4012ec
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesA]
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0x43d868
call esi
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x24]
mov edi, dword [sym.imp.GDI32.dll_GetBoundsRect]
mov dword [0x57ce60], eax
xor esi, esi
lea esp, [esp]
cmp esi, 0x1b9f1
jge 0x4040a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
call edi
cmp esi, 0x1ea07c8d
jle 0x4040be
cmp ebx, 0xacc888
je 0x4040be
cmp ebp, 0xad669fc
jne 0x4040c7
inc esi
cmp esi, 0x8df004e8
jb 0x404090
mov byte [0x43d868], 0
call fcn.00403a60
mov eax, dword [0x57ce64]
mov ecx, dword [0x57c948]
push 0x43c6b8
push eax
push ecx
call fcn.004038f0
call fcn.00403a40
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov dword [esp + 0x10], 0xdd7b3
nop
cmp dword [0x57ce64], 0x21
jne 0x404159
push 0
push 0
call esi
push 0
push 0
lea edx, [esp + 0x194]
push edx
push 0
call edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x990]
push ecx
push 0
call ebx
push 0x40140c
push 0x40141c
push 0x401428
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
dec dword [esp + 0x10]
jne 0x404110
call fcn.00402ea0
pop ebp
mov byte [0x43d869], 0x73
mov esi, 0x1ef75
pop ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec esi
jne 0x404172
cmp dword [0x57ce64], 0x58c
pop edi
pop esi
jne 0x4041b5
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0x401468
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.00403a30
xor eax, eax
add esp, 0x117c
ret