Function at 0x402520
Capabilities:
Copy file
Persist via lnk shortcut

Disassembly:
mov eax, 0x32f4
call fcn.00421e40
push ebx
push ebp
push esi
mov esi, dword [esp + 0x3304]
xor ebx, ebx
push edi
cmp esi, ebx
mov dword [esp + 0x14], ecx
je 0x402a40
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x446]
mov word [esp + 0x444], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x1276]
mov word [esp + 0x1274], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x23e]
mov word [esp + 0x23c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x856]
mov word [esp + 0x854], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x444]
push 0x103
push eax
push str._name:
push esi
call fcn.0040e1d0
lea ecx, [esp + 0x1284]
push 0x823
push ecx
push str._url:
push esi
call fcn.0040e1d0
lea edx, [esp + 0x25c]
push 0x103
push edx
push str._shortcut:
push esi
call fcn.0040e1d0
add esp, 0x30
cmp word [esp + 0x1274], bx
je 0x402a40
cmp word [esp + 0x23c], bx
je 0x402a40
push ebx
lea eax, [esp + 0x1c]
push 2
lea ecx, [esp + 0x85c]
push eax
lea edx, [esp + 0x1280]
push ecx
push edx
mov dword [esp + 0x2c], 0xff
call dword [sym.imp.SHLWAPI.dll_UrlGetPartW]
cmp word [esp + 0x444], bx
jne 0x40268a
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [esp + 0x854]
push eax
call esi
add esp, 4
cmp eax, 0x103
jbe 0x402663
mov eax, 0x103
jmp 0x402670
lea ecx, [esp + 0x854]
push ecx
call esi
add esp, 4
push eax
lea edx, [esp + 0x858]
lea eax, [esp + 0x448]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_wcsncpy]
add esp, 0xc
lea ecx, [esp + 0x23c]
push 1
push ecx
call fcn.0040dc50
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3e]
mov word [esp + 0x3c], bx
rep stosd dword es:[edi], eax
mov ebp, dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x44c]
stosw word es:[edi], ax
lea eax, [esp + 0x3c]
push edx
push eax
call ebp
mov ecx, 6
mov esi, str._r_n_:____
lea edi, [esp + 0x2c]
lea edx, [esp + 0x44]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.MSVCRT.dll_wcspbrk]
lea ecx, [esp + 0x2c]
push ecx
push edx
call esi
add esp, 0x18
cmp eax, ebx
je 0x402703
mov word [eax], 0x5f
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push ecx
call esi
add esp, 8
cmp eax, ebx
jne 0x4026eb
push 1
lea edx, [esp + 0x38]
push 0x20
push edx
call fcn.00413200
lea eax, [esp + 0x40]
add esp, 0xc
test eax, eax
jne 0x402736
mov ecx, 0x82
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x34]
push str.WebApp
push ecx
call ebp
add esp, 8
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
lea edx, [esp + 0x23c]
push edx
call esi
mov edi, 0x103
sub edi, eax
lea eax, [esp + 0x448]
push eax
call esi
add esp, 8
cmp edi, eax
jae 0x402774
lea ecx, [esp + 0x23c]
push ecx
call esi
mov ecx, 0x103
add esp, 4
sub ecx, eax
jmp 0x402783
lea edx, [esp + 0x444]
push edx
call esi
add esp, 4
mov ecx, eax
push ecx
lea eax, [esp + 0x38]
lea ecx, [esp + 0x240]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcsncat]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x65a]
mov word [esp + 0x658], bx
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0xc
lea edx, [esp + 0x23c]
stosw word es:[edi], ax
push edx
push str._s.lnk
lea eax, [esp + 0x654]
push 0x103
push eax
call esi
lea ecx, [esp + 0x65c]
push ebx
push ecx
call fcn.0040dad0
add esp, 0x18
test eax, eax
je 0x40282a
mov eax, dword [0x4280c8]
lea edx, [esp + 0x23c]
mov ecx, eax
inc eax
push ecx
mov dword [0x4280c8], eax
push edx
push str._s__d_.lnk
lea eax, [esp + 0x658]
push 0x103
push eax
call esi
lea ecx, [esp + 0x660]
push ebx
push ecx
call fcn.0040dad0
add esp, 0x1c
test eax, eax
jne 0x4027eb
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa56]
mov word [esp + 0xa54], bx
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x10]
stosw word es:[edi], ax
push edx
lea eax, [esp + 0xa58]
push 0x103
push eax
mov ecx, ebp
mov dword [esp + 0x1c], ebx
call fcn.00402e40
test eax, eax
je 0x402a40
cmp dword [esp + 0x10], ebx
je 0x402a40
lea ecx, [esp + 0xa54]
push ecx
call fcn.0040de00
add esp, 4
lea edx, [esp + 0x1274]
lea eax, [esp + 0x444]
lea ecx, [esp + 0xa54]
push edx
push eax
push ecx
mov ecx, ebp
call fcn.00402ed0
test eax, eax
je 0x402a40
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xc5e]
mov word [esp + 0xc5c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe66]
mov word [esp + 0xe64], bx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x854]
mov ecx, ebp
push edx
stosw word es:[edi], ax
call fcn.004020e0
push eax
push str._sDataico_s.ico
lea eax, [esp + 0xc68]
push 0x103
push eax
call esi
lea ecx, [esp + 0xc70]
push ebx
push ecx
call fcn.0040dad0
add esp, 0x1c
test eax, eax
je 0x402956
lea edx, [esp + 0xa54]
push str.favicon.ico
push edx
push 0x428240
lea eax, [esp + 0xe70]
push 0x103
push eax
call esi
add esp, 0x14
lea ecx, [esp + 0xe64]
lea edx, [esp + 0xc5c]
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x106e]
mov word [esp + 0x106c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x106c]
push eax
push str._app:
push str._s_d
push 0x103
push ecx
call esi
lea edx, [esp + 0xe78]
lea eax, [esp + 0x1080]
push edx
lea ecx, [ebp + 0x54]
push eax
lea edx, [esp + 0x668]
push ecx
push edx
call fcn.0040e2f0
add esp, 0x24
test eax, eax
jl 0x402a40
mov edx, dword [esp + 0x3308]
lea eax, [esp + 0x1274]
lea ecx, [esp + 0xa54]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.00402b80
mov ecx, 0x411
xor eax, eax
lea edi, [esp + 0x22be]
mov word [esp + 0x22bc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x34]
push eax
push 0x7df
call fcn.00412aa0
add esp, 4
lea ecx, [esp + 0x22c0]
push eax
push 0x823
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x22bc]
push 0x40
push str.WebApp
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x32f4
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x32f4
ret 4