Function at 0x401015
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x37794
call fcn.00405470
push edi
mov al, byte [0xf0c6a4]
mov byte [ebp - 0x668c], al
xor ecx, ecx
mov dword [ebp - 0x668b], ecx
mov dword [ebp - 0x6687], ecx
mov dword [ebp - 0x6683], ecx
mov byte [ebp - 0x667f], cl
mov dl, byte [0xf0c6a8]
mov byte [ebp - 0x3762c], dl
mov ecx, 0xc34f
xor eax, eax
lea edi, [ebp - 0x3762b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0c6ac]
mov byte [ebp - 0x667c], al
mov ecx, 0x1869
xor eax, eax
lea edi, [ebp - 0x667b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0c6b0]
mov byte [ebp - 0x104], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0c6b4]
mov byte [ebp - 0x37794], dl
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x37793]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x6798], 0
mov dword [ebp - 0x68a0], 0
mov dword [ebp - 0x68b8], 0
mov dword [ebp - 0x6794], 0
mov al, byte [0xf0c6b8]
mov byte [ebp - 0x490], al
mov ecx, 0x59
xor eax, eax
lea edi, [ebp - 0x48f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0c6bc]
mov byte [ebp - 0x208], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0c6c0]
mov byte [ebp - 0x689c], dl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x689b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0c6c4]
mov byte [ebp - 0x6790], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x678f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov cl, byte [0xf0c6c8]
mov byte [ebp - 0x314], cl
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dl, byte [0xf0c6cc]
mov byte [ebp - 0x68e8], dl
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x68e7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0xf0c6d0]
mov byte [ebp - 0x68b4], al
xor ecx, ecx
mov dword [ebp - 0x68b3], ecx
mov dword [ebp - 0x68af], ecx
mov dword [ebp - 0x68ab], ecx
mov dword [ebp - 0x68a7], ecx
mov word [ebp - 0x68a3], cx
mov byte [ebp - 0x68a1], cl
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x68c0], 0
mov dword [ebp - 0x68ec], 0
mov dword [ebp - 0x68bc], 0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 0
push 1
call fcn.00404a03
add esp, 4
mov dword [ebp - 0x498], eax
push 0x104
push 0xf097b0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x6798], eax
mov edx, dword [ebp + 8]
push edx
push 0xf06e98
call fcn.00405300
add esp, 8
push 0xf097b0
call fcn.004053f0
add esp, 4
mov dword [ebp - 0x6798], eax
jmp 0x4012a0
mov eax, dword [ebp - 0x6798]
sub eax, 1
mov dword [ebp - 0x6798], eax
cmp dword [ebp - 0x6798], 1
jle 0x4012f3
push 1
mov ecx, dword [ebp - 0x6798]
push ecx
push 0xf097b0
call fcn.00403df1
add esp, 0xc
push eax
call fcn.00403d8d
add esp, 4
cmp eax, 0x5c
jne 0x4012f1
mov edx, dword [ebp - 0x6798]
push edx
push 0xf097b0
call fcn.00403f1e
add esp, 8
push eax
push 0xf0ab38
call fcn.00405300
add esp, 8
jmp 0x4012f3
jmp 0x401291
push 0x53
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405300
add esp, 8
push 0x61
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x69
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x76
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x61
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x53
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x6d
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x6f
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push 0x6b
call fcn.00403d31
add esp, 4
push eax
push 0xf0c238
call fcn.00405310
add esp, 8
push str._____70205
push 0xf0c244
call fcn.00405300
add esp, 8
mov dword [ebp - 0x6798], 1
jmp 0x401410
mov eax, dword [ebp - 0x6798]
add eax, 1
mov dword [ebp - 0x6798], eax
cmp dword [ebp - 0x6798], 0xb
jge 0x401447
push 1
mov ecx, dword [ebp - 0x6798]
push ecx
push 0xf0c238
call fcn.00403df1
add esp, 0xc
push eax
call fcn.00403d8d
add esp, 4
mov edx, dword [ebp - 0x6798]
mov dword [edx*4 + 0x40dddc], eax
jmp 0x401401
mov dword [ebp - 0x6798], 0
push 0xf0c6d4
push 0xf057f4
call fcn.00405300
add esp, 8
push 0xf0c6d8
lea eax, [ebp - 0x208]
push eax
call fcn.00405300
add esp, 8
push 0xf057f4
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x494], eax
mov ecx, dword [ebp - 0x494]
push ecx
push 0xf057f4
call fcn.00403f1e
add esp, 8
push eax
push 0xf057f4
call fcn.00405300
add esp, 8
push 0x72
call fcn.00403d31
add esp, 4
push eax
push 0x65
call fcn.00403d31
add esp, 4
push eax
push 0x64
call fcn.00403d31
add esp, 4
push eax
push 0x6c
call fcn.00403d31
add esp, 4
push eax
push 0x6f
call fcn.00403d31
add esp, 4
push eax
push 0x66
call fcn.00403d31
add esp, 4
push eax
push 0x61
call fcn.00403d31
add esp, 4
push eax
push 0xf057f4
push 0x40d03c
push 0xf059fc
call fcn.0040529f
add esp, 0x28
push 0
push 0xf059fc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6798], eax
push 0x70
call fcn.00403d31
add esp, 4
push eax
push 0x6d
call fcn.00403d31
add esp, 4
push eax
push 0x74
call fcn.00403d31
add esp, 4
push eax
push 0x79
call fcn.00403d31
add esp, 4
push eax
push 0xf057f4
push 0x40d050
push 0xf058f8
call fcn.0040529f
add esp, 0x1c
push 0
push 0xf058f8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x6798], eax
mov dword [ebp - 0x6798], 0
push 0x40d05c
push 4
call fcn.004039d3
add esp, 4
push eax
push 0x40d064
push 0xf058f8
push 0x40d068
push 0xf0c02c
call fcn.0040529f
add esp, 0x18
push 0x40d074
push 5
call fcn.004039d3
add esp, 4
push eax
push 0x40d07c
push 0xf058f8
push 0x40d080
push 0xf0c130
call fcn.0040529f
add esp, 0x18
push str..bat
push 1
call fcn.004039d3
add esp, 4
push eax
push 0x40d094
push 0xf058f8
push str._s_s_s_s
push 0xf05b10
call fcn.0040529f
add esp, 0x18
push 0xf05b10
push 0xf08220
call fcn.00405300
add esp, 8
push 0xf0c6dc
lea edx, [ebp - 0x104]
push edx
call fcn.00405300
add esp, 8
push str..exe
push 2
call fcn.004039d3
add esp, 4
push eax
push 0x40d0ac
lea eax, [ebp - 0x104]
push eax
call fcn.0040529f
add esp, 0x10
lea ecx, [ebp - 0x104]
push ecx
push 0x40d0b4
push 0xf058f8
push str._s_s_s
push 0xf08324
call fcn.0040529f
add esp, 0x14
mov edx, dword [ebp + 8]
push edx
push 0x20
call fcn.00403d31
add esp, 4
push eax
push 0x22
call fcn.00403d31
add esp, 4
push eax
push 0xf097b0
push 0x22
call fcn.00403d31
add esp, 4
push eax
push str._s_s_s_s_s
push 0xf05b10
call fcn.0040529f
add esp, 0x1c
push 0x73
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405300
add esp, 8
push 0x65
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x20
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405310
add esp, 8
push 0x7a
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x6d
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405310
add esp, 8
push 0x70
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x3d
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x73
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00405300
add esp, 8
push 0x65
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00405310
add esp, 8
push 0x20
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00405310
add esp, 8
push 0x4d
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00405310
add esp, 8
push 0x59
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00405310
add esp, 8
push 0x46
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00405310
add esp, 8
push 0x49
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00405310
add esp, 8
push 0x4c
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00405310
add esp, 8
push 0x45
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00405310
add esp, 8
push 0x53
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x314]
push ecx
call fcn.00405310
add esp, 8
push 0x3d
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x314]
push edx
call fcn.00405310
add esp, 8
push 0xf058f8
lea eax, [ebp - 0x6790]
push eax
push 0x40d0cc
lea ecx, [ebp - 0x208]
push ecx
call fcn.0040529f
add esp, 0x10
push 0xf059fc
lea edx, [ebp - 0x314]
push edx
push 0x40d0d4
lea eax, [ebp - 0x689c]
push eax
call fcn.0040529f
add esp, 0x10
push 0x73
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405300
add esp, 8
push 0x65
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405310
add esp, 8
push 0x20
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x62
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x66
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405310
add esp, 8
push 0x63
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x65
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x6790]
push edx
call fcn.00405310
add esp, 8
push 0x63
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x6790]
push eax
call fcn.00405310
add esp, 8
push 0x3d
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x6790]
push ecx
call fcn.00405310
add esp, 8
push 0x61
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x68e8]
push edx
call fcn.00405300
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x68e8]
push eax
call fcn.00405310
add esp, 8
push 0x74
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x68e8]
push ecx
call fcn.00405310
add esp, 8
push 0x72
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x68e8]
push edx
call fcn.00405310
add esp, 8
push 0x69
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x68e8]
push eax
call fcn.00405310
add esp, 8
push 0x62
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x68e8]
push ecx
call fcn.00405310
add esp, 8
push 0x20
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x68e8]
push edx
call fcn.00405310
add esp, 8
push 0x2b
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x68e8]
push eax
call fcn.00405310
add esp, 8
push 0x68
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x68e8]
push ecx
call fcn.00405310
add esp, 8
push 0x20
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x68e8]
push edx
call fcn.00405310
add esp, 8
push 0xf058f8
lea eax, [ebp - 0x68e8]
push eax
push 0x40d0dc
lea ecx, [ebp - 0x37794]
push ecx
call fcn.0040529f
add esp, 0x10
push 0xd
call fcn.00403d31
add esp, 4
push eax
push 0xf0bec4
call fcn.00405300
add esp, 8
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xf0bec4
call fcn.00405310
add esp, 8
lea edx, [ebp - 0x37794]
push edx
push 0xf0bec4
call fcn.00405310
add esp, 8
push 0xd
call fcn.00403d31
add esp, 4
push eax
push 0xf0bec4
call fcn.00405310
add esp, 8
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xf0bec4
call fcn.00405310
add esp, 8
push 0xf0c6e0
push 0xf08428
call fcn.00405300
add esp, 8
push 0x30
call fcn.00403d31
add esp, 4
push eax
push 0x2f
call fcn.00403d31
add esp, 4
push eax
push 0x20
call fcn.00403d31
add esp, 4
push eax
push 0x54
call fcn.00403d31
add esp, 4
push eax
push 0x46
call fcn.00403d31
add esp, 4
push eax
push 0x49
call fcn.00403d31
add esp, 4
push eax
push 0x48
call fcn.00403d31
add esp, 4
push eax
push 0x53
call fcn.00403d31
add esp, 4
push eax
push str._s_s_s_s_s_s_s_s
lea eax, [ebp - 0x68b4]
push eax
call fcn.0040529f
add esp, 0x28
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
lea ecx, [ebp - 0x68b4]
push ecx
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
mov edx, dword [ebp + 8]
push edx
push str.set_cmdline
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x6790]
push ecx
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
lea edx, [ebp - 0x689c]
push edx
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
lea eax, [ebp - 0x208]
push eax
push 0xa
call fcn.00403d31
add esp, 4
push eax
push 0xd
call fcn.00403d31
add esp, 4
push eax
push str._echo_off
push str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
push 0xf08428
call fcn.0040529f
add esp, 0x58
call fcn.00401e32
mov dword [ebp - 0x4d4], 0x3c
mov dword [ebp - 0x4c4], 0xf08220
mov dword [ebp - 0x4d0], 0x40
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4c8], str.open
mov dword [ebp - 0x4c0], 0xf05b10
mov dword [ebp - 0x4bc], 0
mov dword [ebp - 0x4b8], 0
mov dword [ebp - 0x4b4], 0x1d
lea ecx, [ebp - 0x4d4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [ebp - 0x49c], 0
je 0x401d8f
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x49c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0xf05b08], 1
jne 0x401de0
mov dword [ebp - 0x6798], 0
jmp 0x401db3
mov ecx, dword [ebp - 0x6798]
add ecx, 1
mov dword [ebp - 0x6798], ecx
mov edx, dword [0xf05b0c]
sub edx, 2
cmp dword [ebp - 0x6798], edx
jge 0x401de0
mov eax, dword [ebp - 0x6798]
imul eax, eax, 0x3e8
add eax, 0x40de0c
push eax
call fcn.00405275
add esp, 4
jmp 0x401da4
mov ecx, dword [0xf05b0c]
sub ecx, 2
mov dword [ebp - 0x6798], ecx
jmp 0x401e00
mov edx, dword [ebp - 0x6798]
add edx, 1
mov dword [ebp - 0x6798], edx
mov eax, dword [ebp - 0x6798]
cmp eax, dword [0xf05b0c]
jge 0x401e2b
mov ecx, dword [ebp - 0x6798]
imul ecx, ecx, 0x3e8
add ecx, 0x40de0c
push ecx
call fcn.00405275
add esp, 4
jmp 0x401df1
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret