Function at 0x401170
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0x4e3
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
push eax
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
add esp, 8
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x401212
push 0x401cb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.GetLastError:
push eax
call fcn.00401a90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
or eax, 0xffffffff
jmp 0x4016dc
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x144]
call fcn.00401760
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x130]
mov eax, edx
mov ecx, dword [ebp - 0x134]
sub eax, ecx
cmp eax, 1
jb 0x401261
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x144]
cmova eax, dword [ebp - 0x144]
mov word [eax + ecx], 0x5c
jmp 0x401282
push 1
push 0x403220
mov byte [ebp - 0x17c], 0
lea ecx, [ebp - 0x144]
push dword [ebp - 0x17c]
push 1
call fcn.00401ce0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 0x403224
call fcn.00401a90
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___unsigned_int__]
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, 5
idiv ecx
cmp dword [ebp - 0x148], edx
jne 0x401681
xor esi, esi
mov dword [ebp - 0x17c], esi
nop word [eax + eax]
push str.virus
lea ecx, [ebp - 0x178]
call fcn.00401760
mov edx, esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x160]
call fcn.00401930
mov byte [ebp - 4], 2
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x134]
sub eax, ecx
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x180], ecx
cmp eax, edx
jb 0x4016fc
cmp dword [ebp - 0x130], 0xf
lea eax, [ebp - 0x144]
lea esi, [ebp - 0x178]
mov dword [ebp - 0x190], 0
cmova eax, dword [ebp - 0x144]
lea edi, [ebp - 0x1a0]
cmp dword [ebp - 0x164], 0xf
xorps xmm0, xmm0
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x178]
cmova esi, eax
mov dword [ebp - 0x1a8], esi
add edx, ecx
mov esi, 0xf
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x184], edx
movups xmmword [ebp - 0x1a0], xmm0
cmp edx, esi
jbe 0x401414
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4013a7
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x4013c7
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4013ef
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4016f7
push ecx
call fcn.00401e4a
add esp, 4
test eax, eax
je 0x4016ca
mov ecx, dword [ebp - 0x180]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x184]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x40140e
test eax, eax
je 0x40140c
push eax
call fcn.00401e4a
mov ecx, dword [ebp - 0x180]
add esp, 4
mov edx, dword [ebp - 0x184]
mov edi, eax
jmp 0x40140e
xor edi, edi
mov dword [ebp - 0x1a0], edi
push ecx
push dword [ebp - 0x1a4]
mov dword [ebp - 0x190], edx
push edi
mov dword [ebp - 0x18c], esi
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x168]
mov eax, dword [ebp - 0x180]
push dword [ebp - 0x1a8]
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x184]
add esp, 0x18
mov byte [edi + eax], 0
mov byte [ebp - 4], 3
lea edx, [ebp - 0x160]
cmp dword [ebp - 0x14c], 0xf
mov edi, dword [ebp - 0x160]
mov eax, dword [ebp - 0x18c]
cmova edx, edi
mov esi, dword [ebp - 0x190]
sub eax, esi
mov ecx, dword [ebp - 0x150]
push ecx
push edx
cmp ecx, eax
ja 0x4014c2
cmp dword [ebp - 0x18c], 0xf
lea eax, [esi + ecx]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x1a0]
cmova eax, dword [ebp - 0x1a0]
add esi, eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x150]
add esp, 0xc
mov byte [eax + esi], 0
lea eax, [ebp - 0x1a0]
jmp 0x4014e1
mov byte [ebp - 0x1ac], 0
push dword [ebp - 0x1ac]
push ecx
lea ecx, [ebp - 0x1a0]
call fcn.00401ce0
mov edi, dword [ebp - 0x160]
mov dword [ebp - 0x11c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x118], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x12c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x11c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18c]
cmp ecx, 0xf
jbe 0x401565
mov edx, dword [ebp - 0x1a0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40155b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ca
push ecx
push edx
call fcn.00401e7a
add esp, 8
cmp dword [ebp - 0x118], 0xf
lea eax, [ebp - 0x12c]
push 0
cmova eax, dword [ebp - 0x12c]
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x118]
cmp ecx, 0xf
jbe 0x4015d3
mov edx, dword [ebp - 0x12c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4015c9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ca
push ecx
push edx
call fcn.00401e7a
add esp, 8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
cmp eax, 0xf
jbe 0x401628
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x40161e
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ca
push ecx
push edi
call fcn.00401e7a
add esp, 8
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x164]
cmp eax, 0xf
jbe 0x401664
mov edx, dword [ebp - 0x188]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x40165a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4016ca
push ecx
push edx
call fcn.00401e7a
add esp, 8
mov esi, dword [ebp - 0x17c]
inc esi
mov dword [ebp - 0x17c], esi
cmp esi, 0x32
jb 0x4012d0
mov edx, str.tebe_pizda
jmp 0x401686
mov edx, str.okay
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x401cb0
call fcn.00401a90
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [ebp - 0x130]
cmp ecx, 0xf
jbe 0x4016da
mov edx, dword [ebp - 0x144]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4016d0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4016d0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401e7a
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401e3c
mov esp, ebp
pop ebp
ret
call fcn.004010c0
call fcn.00401160
int3