Function at 0x411280
Capabilities:
Contain obfuscated stackstrings
Create directory
Decrypt data using tea
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], ecx
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx]
mov dword [ebp - 0xc], eax
cmp dword [0x427b1c], 0x54a
jne 0x4112eb
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x10], eax
mov dword [0x427b38], 0
mov dword [ebp - 0x18], 0xc6ef3720
cmp dword [0x427b1c], 0x1261
jne 0x411321
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov dword [ebp - 0x38], 0x9e3779b9
cmp dword [0x427b1c], 0x1239
jne 0x411352
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x30], ecx
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x34], ecx
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x28], ecx
cmp dword [0x427b1c], 0xf85
jne 0x41139a
mov dword [0x427b28], 0
mov edx, 4
imul eax, edx, 3
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + eax]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], 0
jmp 0x4113bd
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x20
jae 0x41190a
mov ecx, dword [ebp - 0xc]
shl ecx, 4
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov dword [0x444928], 0xff6c6fe6
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 0x24]
mov dword [ebp - 4], edx
mov dword [0x427b2c], 0xf7e06ef4
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 0x3c], 0x6b23e17f
mov dword [ebp - 0x40], 0x39a26ec0
mov dword [ebp - 0x44], 0x57fa30c9
mov dword [ebp - 0x48], 0x3a7c983b
mov dword [ebp - 0x4c], 0x537975c2
mov dword [ebp - 0x50], 0x460bfa4d
mov dword [ebp - 0x54], 0x6dcaf1e0
mov dword [ebp - 0x58], 0x5d290cbd
mov dword [ebp - 0x5c], 0x1bb3496a
mov dword [ebp - 0x60], 0x635b1c75
mov dword [ebp - 0x64], 0x34cd0ced
mov dword [ebp - 0x68], 0x497be7c2
mov dword [ebp - 0x6c], 0x47761bf9
mov dword [ebp - 0x70], 0x5d1d0f74
mov dword [ebp - 0x74], 0x72edf427
mov dword [ebp - 0x78], 0x1891130c
mov dword [ebp - 0x7c], 0x65a09127
mov dword [ebp - 0x80], 0x71ba5fb4
mov dword [ebp - 0x84], 0x142af8c6
mov dword [ebp - 0x88], 0x1d8cd206
mov dword [ebp - 0x8c], 0x566b65af
mov dword [ebp - 0x90], 0x47ca1aec
mov dword [ebp - 0x94], 0x5329c881
mov dword [ebp - 0x98], 0x2c78db5e
mov dword [ebp - 0x9c], 0x7b49a16b
mov dword [ebp - 0xa0], 0xf533789
mov dword [ebp - 0xa4], 0x5968ec9
mov dword [ebp - 0xa8], 0x3f02ed14
mov dword [ebp - 0xac], 0x6e2217e8
mov dword [ebp - 0xb0], 0x3191d34f
mov dword [ebp - 0xb4], 0x49396e0b
mov dword [ebp - 0xb8], 0x3ef76512
mov dword [ebp - 0xbc], 0xa7ce72
mov dword [ebp - 0xc0], 0x4221d072
mov dword [ebp - 0xc4], 0x233b8093
mov dword [ebp - 0xc8], 0x726c731a
mov dword [ebp - 0xcc], 0x4aaccebd
mov dword [ebp - 0xd0], 0x236088e6
mov dword [ebp - 0xd4], 0x7525ecd7
mov dword [ebp - 0xd8], 0x47df4150
mov dword [ebp - 0xdc], 0x3c2f2030
mov dword [ebp - 0xe0], 0x6c49812b
mov dword [ebp - 0xe4], 0x2ab616fd
mov dword [ebp - 0xe8], 0x547732be
mov dword [ebp - 0xec], 0x799d6eeb
mov dword [ebp - 0xf0], 0x32981f77
mov dword [ebp - 0xf4], 0x58b5ab9a
mov dword [ebp - 0xf8], 0xd39e3eb
mov dword [ebp - 0xfc], 0x5fa38a72
mov dword [ebp - 0x100], 0x6e9680c0
mov dword [ebp - 0x104], 0x2f4a15a0
mov dword [ebp - 0x108], 0x265bcfb5
mov dword [ebp - 0x10c], 0x439c050f
mov dword [ebp - 0x110], 0x22f5c005
mov dword [ebp - 0x114], 0x44b3e635
mov dword [ebp - 0x118], 0x6413563e
mov dword [ebp - 0x11c], 0x549cad73
mov dword [ebp - 0x120], 0x307bbb82
mov dword [ebp - 0x124], 0x8e31da5
mov dword [ebp - 0x128], 0x7cf3de2b
mov dword [ebp - 0x12c], 0x195e4f54
mov dword [ebp - 0x130], 0x43dc03ea
mov dword [ebp - 0x134], 0x72ed4471
mov dword [ebp - 0x138], 0x2cf69910
mov dword [ebp - 0x13c], 0x1c9b43a9
mov dword [ebp - 0x140], 0x6fa3e189
mov dword [ebp - 0x144], 0x3003396d
mov dword [ebp - 0x148], 0x2176350e
mov dword [ebp - 0x14c], 0x46749ecd
mov dword [ebp - 0x150], 0x44a4dfd6
mov dword [ebp - 0x154], 0x58600fd8
mov dword [ebp - 0x158], 0xc0557f7
mov dword [ebp - 0x15c], 0x11642f
mov dword [ebp - 0x160], 0x6c0ef2bf
mov dword [ebp - 0x164], 0x1092c25c
mov dword [ebp - 0x168], 0x424c3a74
mov dword [ebp - 0x16c], 0x2a4d0583
mov dword [ebp - 0x170], 0x2266ff2a
mov dword [ebp - 0x174], 0x446d2ee5
mov dword [ebp - 0x178], 0x7461d9cf
mov dword [ebp - 0x17c], 0x465a1e0c
mov dword [ebp - 0x180], 0x7c7d1ca9
mov dword [ebp - 0x184], 0x2460179e
mov dword [ebp - 0x188], 0x1f8631d4
mov dword [ebp - 0x18c], 0xb6a33f5
mov dword [ebp - 0x190], 0x4a6407aa
mov dword [ebp - 0x194], 0x63128711
mov dword [ebp - 0x198], 0x4e4348ae
mov dword [ebp - 0x19c], 0x4c69b3ba
mov dword [ebp - 0x1a0], 0x1c690e56
mov dword [ebp - 0x1a4], 0x2d5b7c3f
mov dword [ebp - 0x1a8], 0x5367db80
mov dword [ebp - 0x1ac], 0x55b18b8
mov dword [ebp - 0x1b0], 0x30e575f1
mov dword [ebp - 0x1b4], 0x38ca2bd0
mov dword [ebp - 0x1b8], 0x5f07ca08
mov dword [ebp - 0x1bc], 0x187b9cad
mov dword [ebp - 0x1c0], 0x1936a442
mov dword [ebp - 0x1c4], 0x32301398
mov dword [ebp - 0x1c8], 0x50b8087b
mov dword [ebp - 0x1cc], 0x4949e4b5
mov dword [ebp - 0x1d0], 0x36ecf593
mov dword [ebp - 0x1d4], 0x48f63c0
mov dword [ebp - 0x1d8], 0x72076742
mov dword [ebp - 0x1dc], 0x67673aee
mov dword [ebp - 0x1e0], 0x60431a0e
mov dword [ebp - 0x1e4], 0x3f1b197e
mov dword [ebp - 0x1e8], 0x3712efa
mov dword [ebp - 0x1ec], 0x2ab9514
mov dword [ebp - 0x1f0], 0x4517f4c5
mov dword [ebp - 0x1f4], 0x3e0b2f30
mov dword [ebp - 0x1f8], 0x7f981663
mov dword [ebp - 0x1fc], 0x40f8728e
mov dword [ebp - 0x200], 0x174540b1
mov dword [ebp - 0x204], 0x76b9c750
mov dword [ebp - 0x208], 0x29e8e315
mov dword [ebp - 0x20c], 0x76a7c3ac
mov dword [ebp - 0x210], 0x6f57d4d2
mov dword [ebp - 0x214], 0x45980f1c
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x10]
shr edx, 5
mov dword [ebp - 8], edx
cmp dword [0x427b1c], 0xb0b
jne 0x4118ce
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [0x4487bc], 0xdf40e3ca
jmp 0x4113b4
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov dword [ecx + eax], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dword [ecx + eax], edx
mov dword [0x427b30], 0x957ad4c2
mov dword [0x427b34], 0xffffffff
mov esp, ebp
pop ebp
ret