Function at 0x41a952
Capabilities:
Contain obfuscated stackstrings
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4686a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f4
mov dword [ebp - 0x330], ecx
mov eax, dword [ebp - 0x330]
mov dword [eax + 0x140], 1
mov dword [ebp - 0x1b8], 1
lea ecx, [ebp - 0x2c4]
call fcn.00412d50
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x330]
call fcn.00420a90
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00449129
lea ecx, [ebp - 0x2c0]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea edx, [ebp - 0x2c0]
push edx
lea ecx, [ebp - 0x1b4]
call fcn.0044905e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x170]
push eax
push 0xf80514
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x2c8]
push edx
call fcn.00449285
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x338], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x338]
call fcn.00412d70
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c8]
call fcn.00448ff0
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41ab34
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push 0
push 0xf8051c
lea edx, [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x2cc]
push eax
call fcn.00449285
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x340], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x340]
call fcn.00412d70
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2cc]
call fcn.00448ff0
push 0
lea edx, [ebp - 0x2c4]
push edx
push 0xf80524
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x2d0]
push ecx
call fcn.00449285
mov dword [ebp - 0x344], eax
mov edx, dword [ebp - 0x344]
mov dword [ebp - 0x348], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x348]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.0044921f
mov dword [ebp - 0x34c], eax
mov edx, dword [ebp - 0x34c]
mov dword [ebp - 0x350], edx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x350]
call fcn.00412d70
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2d4]
call fcn.00448ff0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d0]
call fcn.00448ff0
jmp 0x41ac70
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x170]
push ecx
lea edx, [ebp - 0x2c4]
push edx
push 0xf80530
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00449285
mov dword [ebp - 0x354], eax
mov edx, dword [ebp - 0x354]
mov dword [ebp - 0x358], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x358]
push eax
lea ecx, [ebp - 0x2dc]
push ecx
call fcn.0044921f
mov dword [ebp - 0x35c], eax
mov edx, dword [ebp - 0x35c]
mov dword [ebp - 0x360], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x360]
call fcn.00412d70
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2dc]
call fcn.00448ff0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d8]
call fcn.00448ff0
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41ac70
push 0
lea eax, [ebp - 0x2c4]
push eax
push 0xf8053c
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x2e0]
push edx
call fcn.00449285
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x368], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x368]
push ecx
lea edx, [ebp - 0x2e4]
push edx
call fcn.0044921f
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x370], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x370]
call fcn.00412d70
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2e4]
call fcn.00448ff0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2e0]
call fcn.00448ff0
push 0x1002
push 0xf80548
lea ecx, [ebp - 0x2c4]
push ecx
push 0xf80554
lea edx, [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x2e8]
push eax
call fcn.00449285
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x378], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x378]
push edx
lea eax, [ebp - 0x2ec]
push eax
call fcn.0044921f
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x380], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x380]
push edx
lea eax, [ebp - 0x2f0]
push eax
call fcn.00449285
mov dword [ebp - 0x384], eax
mov ecx, dword [ebp - 0x384]
mov dword [ebp - 0x388], ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x388]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x20]
call fcn.0044a6ad
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2f0]
call fcn.00448ff0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2ec]
call fcn.00448ff0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2e8]
call fcn.00448ff0
lea ecx, [ebp - 0x20]
call fcn.0044aa25
push 0x1002
push 0xf80560
lea edx, [ebp - 0x2c4]
push edx
push 0xf8056c
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.00449285
mov dword [ebp - 0x38c], eax
mov edx, dword [ebp - 0x38c]
mov dword [ebp - 0x390], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x390]
push eax
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.0044921f
mov dword [ebp - 0x394], eax
mov edx, dword [ebp - 0x394]
mov dword [ebp - 0x398], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x398]
push eax
lea ecx, [ebp - 0x2fc]
push ecx
call fcn.00449285
mov dword [ebp - 0x39c], eax
mov edx, dword [ebp - 0x39c]
mov dword [ebp - 0x3a0], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x3a0]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x30]
call fcn.0044a6ad
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2fc]
call fcn.00448ff0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x2f8]
call fcn.00448ff0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x2f4]
call fcn.00448ff0
lea ecx, [ebp - 0x30]
call fcn.0044aa25
push 0x1002
push 0xf80578
lea eax, [ebp - 0x2c4]
push eax
push 0xf80584
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x300]
push edx
call fcn.00449285
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3a8], eax
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x3a8]
push ecx
lea edx, [ebp - 0x304]
push edx
call fcn.0044921f
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x308]
push edx
call fcn.00449285
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3b8], eax
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x3b8]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x180]
call fcn.0044a6ad
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x308]
call fcn.00448ff0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x304]
call fcn.00448ff0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x300]
call fcn.00448ff0
lea ecx, [ebp - 0x180]
call fcn.0044aa25
push 0x1002
push 0xf80590
lea ecx, [ebp - 0x2c4]
push ecx
push 0xf8059c
lea edx, [ebp - 0x1b4]
push edx
lea eax, [ebp - 0x30c]
push eax
call fcn.00449285
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp - 0x3c0], ecx
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x3c0]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.0044921f
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x3c8], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x314]
push eax
call fcn.00449285
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3d0], ecx
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x3d0]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x190]
call fcn.0044a6ad
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x314]
call fcn.00448ff0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x310]
call fcn.00448ff0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30c]
call fcn.00448ff0
lea ecx, [ebp - 0x190]
call fcn.0044aa25
push 0x1002
push 0xf805a8
lea edx, [ebp - 0x2c4]
push edx
push 0xf805b4
lea eax, [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x318]
push ecx
call fcn.00449285
mov dword [ebp - 0x3d4], eax
mov edx, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], edx
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x3d8]
push eax
lea ecx, [ebp - 0x31c]
push ecx
call fcn.0044921f
mov dword [ebp - 0x3dc], eax
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], edx
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x3e0]
push eax
lea ecx, [ebp - 0x320]
push ecx
call fcn.00449285
mov dword [ebp - 0x3e4], eax
mov edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], edx
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x3e8]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x1a0]
call fcn.0044a6ad
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x320]
call fcn.00448ff0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x31c]
call fcn.00448ff0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x318]
call fcn.00448ff0
lea ecx, [ebp - 0x1a0]
call fcn.0044aa25
push 0x1002
push 0xf805c0
lea eax, [ebp - 0x2c4]
push eax
push 0xf805c8
lea ecx, [ebp - 0x1b4]
push ecx
lea edx, [ebp - 0x324]
push edx
call fcn.00449285
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x3f0]
push ecx
lea edx, [ebp - 0x328]
push edx
call fcn.0044921f
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x3f8], eax
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x3f8]
push ecx
lea edx, [ebp - 0x32c]
push edx
call fcn.00449285
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x400], eax
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x400]
call fcn.00412d70
push eax
lea ecx, [ebp - 0x1b0]
call fcn.0044a6ad
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x32c]
call fcn.00448ff0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x328]
call fcn.00448ff0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x324]
call fcn.00448ff0
lea ecx, [ebp - 0x1b0]
call fcn.0044aa25
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1b0]
call fcn.0044a74d
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x1a0]
call fcn.0044a74d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x190]
call fcn.0044a74d
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x180]
call fcn.0044a74d
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x30]
call fcn.0044a74d
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0044a74d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1b4]
call fcn.00448ff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.00448ff0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret