Function at 0x403977
Capabilities:
Clear file content
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
push esi
push edi
mov dword [ebp - 0xc], 0x2a910c94
mov dword [ebp - 0x54], 0x293b2732
mov dword [ebp - 0x50], 0x605345a1
mov dword [ebp - 0x48], 0x18456859
mov dword [ebp - 0x88], 0x636d73e1
mov dword [ebp - 0x24], 0x40f76551
mov dword [ebp - 0x20], 0x3247ccc3
mov dword [ebp - 0x78], 0x2da732a6
mov dword [ebp - 0x6c], 0x33088929
mov dword [ebp - 0x8c], 0x5b9cb0ab
mov dword [ebp - 0x5c], 0x298f4677
mov dword [ebp - 0x74], 0xeef299e
mov dword [ebp - 0x34], 0x1970c6e2
mov dword [ebp - 0x40], 0x5b31dd8c
mov dword [ebp - 0x14], 0x14b0e1b4
mov dword [ebp - 0x18], 0x53c7a5a9
mov dword [ebp - 0x84], 0x40b04e7e
mov dword [ebp - 0x70], 0x210a5324
mov dword [ebp - 0x2c], 0x6afb72a7
mov dword [ebp - 0x98], 0x5f6d8690
mov dword [ebp - 0x7c], 0x322501f0
mov dword [ebp - 0x9c], 0x553eeaf9
mov dword [ebp - 0x38], 0x31308862
mov dword [ebp - 0x1c], 0x544c4eaa
mov dword [ebp - 0x4c], 0x18127817
mov dword [ebp - 0x60], 0x5538e12d
mov dword [ebp - 0x94], 0xcfb094a
mov dword [ebp - 0x3c], 0x3306f3ac
mov dword [ebp - 0x90], 0x12c07ff7
mov dword [ebp - 0x58], 0xcb821ef
mov dword [ebp - 0x30], 0x7dc6c0af
mov dword [ebp - 0x28], 0x9a59c63
mov dword [ebp - 8], 0x6e4e3921
mov dword [ebp - 0x64], 0x18efdb37
mov dword [ebp - 0x80], 0x6e280459
mov dword [ebp - 0x68], 0x3e0d43a9
mov dword [ebp - 0x44], 0x4d5eb029
mov dword [ebp - 4], 0x5da0115b
mov dword [ebp - 0x10], 0x6a0c2613
sub dword [ebp - 0xc], 0x56b921e3
add dword [ebp - 0x54], 0x76e39cbf
mov eax, 0x5e44f10d
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x54], 0x1ae1d137
sub dword [ebp - 0xc], 0x7ad011e4
sub dword [ebp - 0x54], 0x5f16b3e2
add dword [ebp - 0xc], 0x6be52f53
add dword [ebp - 0x50], 0x5fefd9bf
mov eax, 0x5ee745fb
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, 0x49ba3655
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0x50], 0x42d7cf73
sub dword [ebp - 0xc], 0x26eda2d4
sub dword [ebp - 0xc], 0x249e1ea6
add dword [ebp - 0x48], 0x16794d5c
mov eax, 0x3b832a8c
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, 0x3622d4cf
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, 0x79ff6806
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x50], 0x19fbda38
mov eax, 0x1dfbf281
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
add dword [ebp - 0x50], 0x5f3d9fd2
add dword [ebp - 0x50], 0x270e4b50
sub dword [ebp - 0x54], 0x4f852a99
sub dword [ebp - 0x54], 0x2a6ca089
mov eax, 0x49685cc7
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
add dword [ebp - 0x50], 0x3e39c1dd
sub dword [ebp - 0x54], 0x3a898f00
mov eax, 0x21216d48
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0xc], 0x5b09b346
add dword [ebp - 0x50], 0x1e6bacd2
add dword [ebp - 0x50], 0x5bf9edc6
sub dword [ebp - 0x6c], 0x42d4675f
mov eax, 0x6201543d
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
add dword [ebp - 0x20], 0x3d1c4d7b
mov eax, 0x23c0c873
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, 0x59c3230
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x78], 0x32ea7071
mov eax, 0x5326085d
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
sub dword [ebp - 0x88], 0x6c3429d8
sub dword [ebp - 0xc], 0x2556d97b
mov eax, 0x7d6909a3
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x54], 0x41ed8aaa
mov eax, 0x31ef07bf
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, 0x18ac2530
mul dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x20], 0x3ef58440
sub dword [ebp - 0x8c], 0x7df0e78b
mov eax, 0x361aed1a
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, 0x76e09e96
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, 0x16c0ec6a
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
sub dword [ebp - 0xc], 0x5c9eb658
mov eax, 0x40314070
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x54], 0x1bca7635
add dword [ebp - 0x74], 0xbeb1609
sub dword [ebp - 0x48], 0x21ec1fb2
mov eax, 0x39ed073b
mul dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x34], 0x7933e992
sub dword [ebp - 0x24], 0x3d15c993
add dword [ebp - 0x48], 0x7d527d00
mov eax, 0x53b877ce
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
add dword [ebp - 0x8c], 0x6d1bb7a5
add dword [ebp - 0x20], 0x2e3b9b31
mov eax, 0x120439a3
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, 0x27aa103a
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, 0x37667081
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x54], 0x2f837c7
mov eax, 0x631e0e30
mul dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
sub dword [ebp - 0x2c], 0x45c35935
sub dword [ebp - 0x40], 0x79b854a4
sub dword [ebp - 0x70], 0x45354cfc
mov eax, 0x6650a53d
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, 0x795bbe59
mul dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, 0x60796a7
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
sub dword [ebp - 0x18], 0x3c0eba2b
mov eax, 0x3376b521
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x78], 0x48a4bea0
add dword [ebp - 0x9c], 0xbe44a4
mov eax, 0xe32d68
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
sub dword [ebp - 0x2c], 0x7661b30a
sub dword [ebp - 0x84], 0x3af14032
add dword [ebp - 0x50], 0x221e145
mov eax, 0x4daf00b8
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, 0x563b3ca0
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], 0x6ca7dda4
mov eax, 0xe4b3c27
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, 0x55c64947
mul dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x5c], 0x16d349d8
sub dword [ebp - 0x54], 0x50ade929
sub dword [ebp - 0x6c], 0x6f96b073
sub dword [ebp - 0x20], 0x24d82330
add dword [ebp - 0x98], 0x5dd58669
mov eax, 0x493cd7b
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x48], 0x5b499cc4
mov eax, 0x338e38ef
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x20], 0x23162441
add dword [ebp - 0x7c], 0x3991152a
mov eax, 0x1d488e19
mul dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
sub dword [ebp - 0x60], 0x1ecf0174
mov eax, 0x3804b20e
mul dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub dword [ebp - 0x4c], 0x7e6fa950
add dword [ebp - 0x94], 0x14a5ee16
mov eax, 0x4a9e0b84
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, 0x16d72ec2
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add dword [ebp - 0x3c], 0x9d42b9d
sub dword [ebp - 0x18], 0x5d80202c
mov eax, 0x6843ea4d
mul dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x24], 0x125f41ed
add dword [ebp - 0x50], 0x4f89b13
add dword [ebp - 0x18], 0xc07a00e
mov eax, 0x4cb4cf31
mul dword [ebp - 0x90]
mov eax, dword [ebp - 0x90]
sub dword [ebp - 0x60], 0x5938dc04
sub dword [ebp - 0x14], 0x46d4063f
sub dword [ebp - 0x6c], 0x52db8bfe
xor esi, esi
xor edi, edi
cmp edi, 0x911
jge 0x403ec7
push esi
call dword [sym.imp.USER32.dll_GetSysColor]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp edi, 0x166f93c
jg 0x403ed8
inc edi
cmp edi, 0x379d171
jl 0x403eac
cmp dword [0x24619ec], 0x400
jne 0x403f26
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalShrink]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call fcn.0040422a
push esi
call fcn.004041b0
push esi
push esi
call fcn.004041ea
push esi
push esi
push esi
call fcn.004047ea
add esp, 0x1c
xor edi, edi
cmp edi, 0x16d22
jge 0x403f37
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edi, 0x12e8a06
jg 0x403f55
inc edi
cmp edi, 0x30375
jl 0x403f28
mov eax, dword [0x43a724]
mov dword [0x24619ec], eax
call fcn.004036ba
mov edi, 0x2ec37
cmp dword [0x24619ec], 0x51f
jne 0x403f83
lea eax, [ebp - 0x89c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec edi
jne 0x403f69
pop edi
xor eax, eax
pop esi
leave
ret 0x10