Function at 0x4214f0
Capabilities:
Create thread
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4500bc
mov eax, dword fs:[0]
push eax
sub esp, 0x4b0
mov eax, dword [0x463184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x45c], edi
push 0x800
call dword [0x463044]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x436]
push eax
call fcn.0042d630
add esp, 0xc
lea eax, [ebp - 0x438]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421604
push 0x45a9cc
lea eax, [ebp - 0x438]
push 0x104
push eax
call fcn.0043b1eb
lea ecx, [ebp - 0x438]
add esp, 0xc
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421590
sub ecx, edx
mov dword [ebp - 0x464], str.version.dll
sar ecx, 1
lea eax, [ebp - 0x438]
mov edi, 0x104
mov dword [ebp - 0x460], str.cabinet.dll
xor esi, esi
sub edi, ecx
lea eax, [eax + ecx*2]
mov dword [ebp - 0x468], eax
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x464]
push edi
push eax
call fcn.0043b25a
add esp, 0xc
test eax, eax
jne 0x4215f2
lea eax, [ebp - 0x438]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp - 0x468]
inc esi
cmp esi, 2
jb 0x4215d0
mov edi, dword [ebp - 0x45c]
push 0
push 0x4ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.00422320
push eax
mov dword [0x465c40], eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
movzx eax, word [0x465c40]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push 0x34
lea eax, [ebp - 0x4b8]
mov dword [ebp - method.eset::CFileVersionInfo.virtual_0], vtable.eset::CFileVersionInfo.0
push 0
push eax
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
call fcn.0042d630
push dword [ebp - 0x484]
call fcn.0043056f
add esp, 0x10
mov dword [ebp - 0x484], 0
mov dword [ebp - 4], 1
call fcn.0041c4a0
mov dword [ebp - 0x468], eax
test eax, eax
je 0x422116
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x451380]
mov ecx, dword [ebp - 0x468]
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x478], esi
mov byte [ebp - 4], 2
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4216f2
push 0x104
lea ecx, [ebp - 0x478]
call fcn.0041e190
mov esi, dword [ebp - 0x478]
mov dword [ebp - 0x468], esi
cmp dword [esi - 8], 0x104
jl 0x42210c
push 0x104
xor eax, eax
mov dword [esi - 0xc], 0x104
push esi
push eax
mov word [esi + 0x208], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x421805
push esi
lea ecx, [ebp - 0x4bc]
call fcn.0041e7c0
test eax, eax
je 0x4217c9
mov eax, dword [edi + 0x2c]
lea ecx, [edi + 0x2c]
mov edx, 1
sub edx, dword [eax - 4]
mov eax, dword [eax - 8]
add eax, 0xffffff80
or eax, edx
jge 0x42175d
push 0x80
call fcn.0041e190
lea ecx, [edi + 0x2c]
mov edx, dword [ecx]
cmp dword [edx - 8], 0x80
jl 0x42210c
mov dword [edx - 0xc], 0x80
mov eax, dword [ecx]
xor ecx, ecx
push 0x80
push edx
push ecx
mov word [eax + 0x100], cx
lea ecx, [ebp - 0x4bc]
call fcn.0041e910
mov eax, dword [edi + 0x2c]
test eax, eax
jne 0x42179b
xor ecx, ecx
jmp 0x4217b1
push dword [eax - 8]
push eax
call fcn.0043c160
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x42210c
mov eax, dword [edi + 0x2c]
cmp ecx, dword [eax - 8]
jg 0x42210c
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi + 0x2c]
mov word [eax + ecx*2], dx
push 0x34
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x47c], 0
push 0
push eax
mov dword [ebp - 0x480], 0
call fcn.0042d630
push dword [ebp - 0x484]
call fcn.0043056f
add esp, 0x10
mov dword [ebp - 0x484], 0
push dword [esi - 8]
push esi
call fcn.0043c160
add esp, 8
test eax, eax
js 0x42210c
cmp eax, dword [esi - 8]
jg 0x42210c
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
push str._EsetBootstrapperWnd
push ecx
push ecx
mov word [esi + eax*2], cx
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x42199f
lea ecx, [ebp - 0x20]
call fcn.004242f0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x454], eax
test eax, eax
je 0x422140
cmp byte [ebp - 0x1c], 0
je 0x42186e
cmp byte [eax + 0x6c], 0
jne 0x422140
cmp byte [ebp - 0x18], 0
jne 0x422120
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x464], eax
mov byte [ebp - 0x460], 1
lock inc dword [eax + 4]
lea eax, [ebp - 0x464]
push eax
lea ecx, [edi + 0xc8]
call fcn.00422170
mov ecx, dword [ebp - 0x464]
test ecx, ecx
je 0x4218eb
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x4218eb
mov eax, dword [ecx + 0x78]
mov dword [ebp - 0x468], eax
test eax, eax
je 0x4218d5
mov eax, dword [eax]
push ecx
mov edi, dword [eax]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x468]
jmp 0x4218e9
mov eax, dword [ecx]
push 1
mov edi, dword [eax]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x464]
call edi
mov edi, dword [0x465668]
push 0x18
call fcn.0042b0e4
mov ecx, dword [ebp - 0x454]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x468], eax
mov dword [eax], ecx
mov byte [eax + 4], 0
mov byte [eax + 8], 1
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], 0x422c60
lea ecx, [ebp - 0x460]
mov byte [ebp - 4], 4
push ecx
push 0
push eax
push 0x424db0
push 0
push 0
call fcn.0043c4ac
mov edx, eax
add esp, 0x1c
mov dword [ebp - 0x464], edx
test edx, edx
je 0x42212f
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x468], 0
cmp dword [ecx + 0xc4], 0
jne 0x42212a
mov eax, dword [ebp - 0x460]
xorps xmm0, xmm0
movlpd qword [ebp - 0x464], xmm0
mov dword [ecx + 0xc0], edx
mov dword [ecx + 0xc4], eax
mov edi, 1
mov dword [ebp - 0x454], edi
jmp 0x4220a4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea edi, [ebp - 0x13]
mov dword [ebp - 0x458], ecx
mov eax, 0xcccccccd
dec edi
mul ecx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
mov eax, dword [ebp - 0x458]
add cl, cl
sub al, cl
mov ecx, edx
add al, 0x30
mov byte [edi], al
mov eax, edx
mov dword [ebp - 0x458], eax
test eax, eax
jne 0x4219b0
push ecx
lea eax, [ebp - 0x13]
push eax
push edi
lea ecx, [ebp - 0x450]
call fcn.0040a890
mov edi, dword [ebp - 0x45c]
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x43c], 0x10
cmovae eax, dword [ebp - 0x450]
cmp byte [edi + 0x110], 0
mov dword [ebp - 0x454], eax
je 0x421a8f
sub esp, 8
lea ecx, [edi + 0xe0]
call fcn.00424770
mov ecx, eax
cmp dword [edi + 0xf0], ecx
jb 0x42214a
lfence
cmp dword [edi + 0xf4], 0x10
lea edx, [edi + 0xe0]
jb 0x421a52
mov edx, dword [edi + 0xe0]
mov dword [edi + 0xf0], ecx
sub esp, 8
mov byte [edx + ecx], 0
lea ecx, [edi + 0xf8]
call fcn.00424770
mov ecx, eax
lea eax, [edi + 0xf8]
cmp dword [eax + 0x10], ecx
lea edx, [eax + 0x10]
jb 0x42214a
cmp dword [eax + 0x14], 0x10
jb 0x421a89
lfence
mov eax, dword [eax]
mov dword [edx], ecx
mov byte [eax + ecx], 0
lea eax, [edi + 0xe0]
push 1
push 0x45bac4
mov ecx, eax
call fcn.004154b0
mov edx, dword [ebp - 0x454]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x458], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x421ab4
sub ecx, dword [ebp - 0x458]
push ecx
push edx
lea ecx, [edi + 0xe0]
call fcn.004154b0
push 1
lea ecx, [edi + 0xf8]
push 0x45bac4
call fcn.004154b0
mov ecx, dword [ebp - 0x454]
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0x454], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x421af1
sub edx, dword [ebp - 0x454]
push edx
push ecx
lea ecx, [edi + 0xf8]
call fcn.004154b0
lea ecx, [ebp - 0x450]
mov byte [edi + 0x110], 1
mov byte [ebp - 4], 2
call fcn.0040a9c0
lea ecx, [edi + 0xd0]
call fcn.00420070
mov eax, dword [0x465c40]
and eax, 0x3ff
mov ecx, eax
cmp ax, 1
je 0x421b47
cmp ecx, 0xd
je 0x421b47
xor al, al
jmp 0x421b49
mov al, 1
mov ecx, edi
mov edx, 0x19
mov byte [edx + ecx], al
lea eax, [edi + 0x40]
mov dword [ebp - 0x458], eax
mov eax, dword [eax]
mov edi, dword [eax]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x458]
call edi
mov eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x45c]
movaps xmm0, xmmword [0x45c6f0]
sub ecx, 0xffffff80
push ecx
mov eax, dword [eax]
movups xmmword [ecx], xmm0
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x458]
call edi
mov edi, dword [ebp - 0x45c]
mov edx, dword [edi + 0x74]
lea ecx, [edi + 0x70]
mov eax, edx
mov dword [ebp - 0x470], edx
sub eax, dword [ecx]
sar eax, 6
mov dword [ebp - 0x454], eax
cmp eax, 7
jbe 0x421bcf
mov eax, dword [ecx]
add eax, 0x1c0
mov dword [ecx + 4], eax
jmp 0x421c1f
jae 0x421c1f
mov eax, dword [ecx + 8]
sub eax, dword [ecx]
sar eax, 6
cmp eax, 7
jae 0x421beb
sub esp, 8
call fcn.00424b30
lea ecx, [edi + 0x70]
jmp 0x421c1f
mov eax, 7
sub eax, dword [ebp - 0x454]
je 0x421c1c
shl eax, 6
push eax
push 0
push edx
mov dword [ebp - 0x454], eax
call fcn.0042d630
mov edx, dword [ebp - 0x470]
lea ecx, [edi + 0x70]
add esp, 0xc
add edx, dword [ebp - 0x454]
mov dword [ecx + 4], edx
mov eax, dword [ecx + 4]
xorps xmm2, xmm2
mov edx, dword [ecx]
mov dword [ebp - 0x470], eax
cmp edx, eax
je 0x421cee
movsd xmm3, qword [0x45c680]
lea ecx, [edx + 0x38]
movaps xmm4, xmmword [0x45c720]
mov esi, eax
movss xmm5, dword [0x45c760]
movsd xmm6, qword [0x45c690]
movss xmm7, dword [0x45c6a0]
movsd qword [ebp - 0x464], xmm3
nop dword [eax]
mov eax, dword [edi + 0x88]
sub eax, dword [edi + 0x80]
lea edi, [ebp - 0x474]
mov dword [edx], 0x420b70
movsd qword [ecx - 0x28], xmm6
mov byte [ecx - 8], 0
movd xmm0, eax
lea eax, [ebp - 0x464]
cvtdq2pd xmm0, xmm0
comisd xmm3, xmm0
movsd qword [ebp - 0x474], xmm0
cmovbe eax, edi
mov edi, dword [ebp - 0x45c]
add edx, 0x40
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
movaps xmm1, xmm0
movhpd xmm1, qword [ecx]
movaps xmm0, xmm2
mulpd xmm1, xmm4
xorps xmm0, xmm5
addss xmm2, xmm7
cvtss2sd xmm0, xmm0
movups xmmword [ecx - 0x20], xmm1
movsd qword [ecx - 0x30], xmm0
add ecx, 0x40
cmp edx, esi
jne 0x421c70
mov esi, dword [ebp - 0x468]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x454], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x22e]
push eax
call fcn.0042d630
mov ecx, dword [ebp - 0x454]
lea eax, [ebp - 0x230]
push 0x104
push eax
mov edx, 0x82
call fcn.00424ee0
lea edx, [ebp - 0x230]
add esp, 0x14
lea eax, [edx + 2]
lea ecx, [edi + 0x20]
mov dword [ebp - 0x470], eax
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x421d50
sub edx, dword [ebp - 0x470]
lea eax, [ebp - 0x230]
sar edx, 1
push edx
push eax
call fcn.0041e200
mov ecx, dword [ebp - 0x454]
lea eax, [ebp - 0x230]
push 0x104
push eax
mov edx, 0x83
call fcn.00424ee0
lea edx, [ebp - 0x230]
add esp, 8
lea eax, [edx + 2]
lea ecx, [edi + 0x28]
mov dword [ebp - 0x470], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x421da1
sub edx, dword [ebp - 0x470]
lea eax, [ebp - 0x230]
sar edx, 1
push edx
push eax
call fcn.0041e200
mov eax, dword [edi + 0x40]
lea ecx, [edi + 0x90]
movaps xmm0, xmmword [0x45c710]
movups xmmword [ecx], xmm0
push ecx
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x458]
call edi
mov eax, dword [ebp - 0x45c]
add eax, 0x30
mov dword [ebp - 0x458], eax
push str._EsetBootstrapperWnd
mov eax, dword [eax]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x458]
call edi
mov eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x45c]
push 0
push 0
mov eax, dword [eax]
push 0
mov edi, dword [eax + 0x24]
lea eax, [ecx + 0x90]
push eax
push 0x80000000
push dword [ecx + 0x2c]
mov ecx, edi
push str._EsetBootstrapperWnd
push 8
call dword [0x451380]
mov ecx, dword [ebp - 0x458]
call edi
mov edi, dword [ebp - 0x45c]
mov eax, dword [edi + 0x34]
mov dword [ebp - 0x468], eax
call fcn.0041d640
test al, al
jne 0x421ea6
mov eax, dword [0x465678]
mov dword [ebp - 0x470], 2
mov dword [ebp - 0x460], eax
test eax, eax
je 0x421ea6
push 4
lea ecx, [ebp - 0x470]
push ecx
push 0x21
push dword [ebp - 0x468]
mov ecx, eax
call dword [0x451380]
call dword [ebp - 0x460]
test eax, eax
js 0x421ea6
mov al, 1
jmp 0x421ea8
xor al, al
push 0
push 0x20
push 1
push dword [edi + 0x9c]
mov byte [edi + 0x1c], al
push dword [edi + 0x98]
call dword [sym.imp.GDI32.dll_CreateBitmap]
push 0x65
push dword [ebp - 0x454]
mov dword [edi + 0xb4], eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edi, eax
mov eax, dword [ebp - 0x458]
push edi
push 1
push 0x80
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov edi, dword [ebp - 0x458]
push 0
push 0x80
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x45c]
cmp dword [eax + 0x34], 0
jne 0x421f20
xor edi, edi
mov dword [ebp - 0x454], edi
jmp 0x4220a4
push ecx
mov ecx, edi
mov dword [eax + 4], edi
call fcn.0041cda0
lea ecx, [ebp - 0x20]
call fcn.004242f0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x470], eax
test eax, eax
je 0x422140
cmp byte [ebp - 0x1c], 0
je 0x421f58
cmp byte [eax + 0x6c], 0
jne 0x422140
cmp byte [ebp - 0x18], 0
jne 0x42214f
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x46c], eax
mov byte [ebp - 0x468], 1
lock inc dword [eax + 4]
mov ecx, dword [ebp - 0x45c]
lea eax, [ebp - 0x46c]
push eax
add ecx, 0xc8
call fcn.00422170
mov ecx, dword [ebp - 0x46c]
test ecx, ecx
je 0x421fdb
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x421fdb
mov eax, dword [ecx + 0x78]
mov dword [ebp - 0x460], eax
test eax, eax
je 0x421fc5
mov eax, dword [eax]
push ecx
mov edi, dword [eax]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x460]
jmp 0x421fd9
mov eax, dword [ecx]
push 1
mov edi, dword [eax]
mov ecx, edi
call dword [0x451380]
mov ecx, dword [ebp - 0x46c]
call edi
mov eax, dword [ebp - 0x45c]
push 0x18
mov edi, dword [eax + 0x34]
mov eax, dword [0x465668]
mov dword [ebp - 0x460], eax
call fcn.0042b0e4
mov ecx, eax
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x470]
mov dword [ecx], eax
mov eax, dword [ebp - 0x460]
mov byte [ecx + 4], 0
mov byte [ecx + 8], 1
mov dword [ecx + 0xc], edi
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0x422c60
mov dword [ebp - 0x460], ecx
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 8
push eax
push 0
push ecx
push 0x424db0
push 0
push 0
call fcn.0043c4ac
mov edx, eax
add esp, 0x1c
mov dword [ebp - 0x46c], edx
test edx, edx
je 0x42215e
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x460], 0
cmp dword [ecx + 0xc4], 0
jne 0x422159
mov eax, dword [ebp - 0x468]
xorps xmm0, xmm0
mov dword [ecx + 0xc0], edx
mov edi, 1
mov dword [ecx + 0xc4], eax
lea ecx, [ebp - 0x20]
movlpd qword [ebp - 0x46c], xmm0
mov dword [ebp - 0x454], edi
call fcn.004240a0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4220d1
lfence
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x451380]
mov ecx, edi
call esi
mov edi, dword [ebp - 0x454]
push 0x34
lea eax, [ebp - 0x4b8]
push 0
push eax
call fcn.0042d630
push dword [ebp - 0x484]
call fcn.0043056f
add esp, 0x10
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b03b
mov esp, ebp
pop ebp
push 0x80070057
call fcn.0041c230
push 0x80004005
call fcn.0041c230
mov ecx, 2
call fcn.00420460
call fcn.0043c310
push 6
mov dword [ebp - 0x460], 0
call fcn.00429d97
mov ecx, 4
call fcn.00420460
call fcn.00402a80
mov ecx, 2
call fcn.00420460
call fcn.0043c310
push 6
mov dword [ebp - 0x468], 0
call fcn.00429d97
int3