Function at 0x40f2c0
Capabilities:
Create thread
Encode data using xor
Get common file path
Get file size
Move file
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x650
push ebx
mov ebx, dword [esp + 0x65c]
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x40000000
push 3
push 0
push 1
push 0x80000000
push ebx
mov dword [esp + 0x40], 1
call edi
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x18], esi
jne 0x40f30c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
mov ebp, dword [sym.imp.MSVCRT.dll_wcscpy]
lea eax, [esp + 0x48]
push ebx
push eax
call ebp
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0xc
cmp eax, 4
jbe 0x40f334
mov word [esp + eax*2 + 0x40], 0
lea edx, [esp + 0x250]
push ebx
push edx
call ebp
lea eax, [esp + 0x258]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 0x10
test eax, eax
je 0x40f371
lea ecx, [esp + 0x250]
push str.TEMP.DEC
push ecx
mov word [eax + 2], 0
call dword [sym.imp.MSVCRT.dll_wcscat]
jmp 0x40f380
lea edx, [esp + 0x250]
push str.TEMP.DEC
push edx
call ebp
add esp, 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
jne 0x40f3c4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push 0x80
push 2
push ebp
push ebp
lea eax, [esp + 0x5c]
push 0x40000000
push eax
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
cmp ebp, 0xffffffff
jne 0x40f3dd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
xor edx, edx
xor eax, eax
mov dword [0x538ef8], edx
mov dword [0x538f10], eax
mov dword [0x538efc], edx
mov dword [0x538f14], eax
mov dword [0x538f00], edx
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov dword [0x538f04], edx
mov dword [0x538f18], eax
mov dword [0x538f28], ecx
mov dword [0x538f08], edx
mov dword [0x538f1c], eax
mov dword [0x538f2c], ecx
lea edx, [esp + 0x10]
mov dword [0x538f20], eax
mov dword [0x538f00], eax
mov dword [0x538f04], eax
push 0x538ef8
mov dword [0x538f30], ecx
push edx
lea eax, [esp + 0x3c]
push 0x10
mov dword [0x538f34], ecx
push eax
push esi
mov dword [0x538f38], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
push 1
push ecx
push 0x538ef8
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, 3
mov edi, str.TeStSw
lea esi, [esp + 0x34]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x40fb9f
cmp ebp, 0x10
ja 0x40f499
mov ecx, dword [esp + 0x18]
push ecx
jmp 0x40fba4
mov eax, dword [esp + 0x40]
sub ebp, eax
sub ebp, 0x10
cmp ebp, 0x20
ja 0x40fb9f
shr eax, 0xe
mov ebp, eax
cmp ebp, 0x7d0
mov dword [esp + 0x30], ebp
jbe 0x40f4d7
mov eax, dword [0x549030]
mov edx, ebp
shr edx, 6
mov ecx, dword [eax + 0xc0]
push edx
push 0
push 0x406
push ecx
jmp 0x40f4ec
mov edx, dword [0x549030]
push ebp
push 0
push 0x406
mov eax, dword [edx + 0xc0]
push eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
mov ecx, dword [0x549030]
push 0
push 0
push 0x402
mov edx, dword [ecx + 0xc0]
push edx
call esi
lea eax, [esp + 0x458]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
lea ecx, [esp + 0x4c]
push 0x41e11c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 0x10
cmp eax, 4
jbe 0x40f54a
mov word [esp + eax*2 + 0x40], 0
push 0
push 0x40000080
push 2
push 0
push 0
lea eax, [esp + 0x264]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40f58b
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
mov ecx, dword [0x549030]
lea edx, [esp + 0x48]
push edx
push 0x3eb
call sub.MFC42u.DLL_CWnd::SetDlgItemTextW
mov ecx, 0x1000
xor eax, eax
mov edi, 0x53cf40
mov edx, dword [esp + 0x3b]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x3f]
stosb byte es:[edi], al
mov al, byte [esp + 0x3a]
push ecx
mov byte [0x41e0ac], al
mov eax, dword [esp + 0x668]
push edx
push eax
call fcn.0040e9c0
mov esi, dword [esp + 0x24]
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x2c], ecx
mov dword [0x538f04], ecx
lea ecx, [esp + 0x10]
push 0x538ef8
push ecx
push 0x4000
mov eax, 0x10
push 0x541028
push esi
mov dword [esp + 0x3c], eax
mov dword [0x538f00], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
push 0x540f48
mov dword [0x538f28], edx
mov dword [0x538f2c], edx
mov dword [0x538f30], edx
mov dword [0x538f34], edx
mov dword [0x538f38], edx
call fcn.0040de90
add esp, 4
mov dword [0x54101c], 0x4000
test ebp, ebp
mov dword [0x541018], 0x538f3c
mov dword [0x541020], 1
mov dword [esp + 0x20], 0
jbe 0x40f8a3
mov eax, dword [0x549030]
mov ecx, dword [eax + 0xb38]
test ecx, ecx
jne 0x40f8a3
mov ecx, dword [esp + 0x664]
push 0x200
push 0x541028
push 2
push ecx
call fcn.00406ba0
add esp, 0x10
cmp eax, 0xffffffff
je 0x40f94a
mov ecx, 0x1000
xor eax, eax
mov edi, 0x53cf40
mov ebp, 1
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, dword [esp + 0x664]
xor ebx, ebx
push 0x4000
push 0x53cf40
push 3
push edi
call fcn.00406a90
add esp, 0x10
cmp eax, 0xffffffff
je 0x40f94a
mov eax, 0x3ff6
cmp byte [eax + 0x53cf40], 0x5a
je 0x40f6e9
xor ebp, ebp
inc eax
cmp eax, 0x4000
jb 0x40f6de
cmp ebp, ebx
jne 0x40f6bb
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
add ecx, 0x4000
lea edx, [esp + 0x10]
cmp eax, ebx
push 1
mov dword [esp + 0x2c], ecx
push edx
je 0x40f752
push 0x538ef8
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x54502c
push 0x538f10
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [0x538f1c], ebx
stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
push ecx
push 0x4000
mov dword [0x538f18], eax
push 0x54502c
jmp 0x40f790
push 0x538f10
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, 0x1000
xor eax, eax
mov edi, 0x541028
push 0x538ef8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov dword [0x538f04], ebx
stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
push ecx
push 0x4000
mov dword [0x538f00], eax
push 0x541028
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [0x541020], ebx
je 0x40f8a1
cmp dword [esp + 0x20], ebx
jne 0x40f7c0
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push 1
push edx
push 0x538f28
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [esp + 0x24]
cmp ebp, ebx
je 0x40f7e8
xor eax, eax
mov cl, byte [eax + 0x541028]
mov dl, byte [eax + 0x53cf40]
xor cl, dl
mov byte [eax + 0x538f3c], cl
inc eax
cmp eax, 0x4000
jb 0x40f7ca
jmp 0x40f806
xor eax, eax
mov dl, byte [eax + 0x54502c]
mov cl, byte [eax + 0x53cf40]
xor dl, cl
mov byte [eax + 0x538f3c], dl
inc eax
cmp eax, 0x4000
jb 0x40f7ea
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push 0x538f28
push eax
push 0x4000
push 0x538f3c
push ecx
mov dword [0x538f30], edi
mov dword [0x538f34], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x44]
push edx
push ebx
push 0x540fb0
push 0x40ea30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x20]
add edi, 0x4000
xor eax, eax
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x30]
cmp ebp, ebx
sete al
cmp edi, 0x7d0
mov dword [esp + 0x24], eax
push ebx
jbe 0x40f876
shr ecx, 6
mov edx, dword [0x549030]
push ecx
push 0x402
mov eax, dword [edx + 0xc0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x20]
inc eax
cmp eax, edi
mov dword [esp + 0x20], eax
jae 0x40f8a3
jmp 0x40f666
jmp 0x40f8a1
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40f8c6
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ecx, [esp + 0x1c]
push 1
push ecx
push 0x538f28
push edx
call ebx
jmp 0x40f8cc
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ebp, dword [esp + 0x40]
and ebp, 0x3fff
je 0x40fa66
mov ebp, dword [esp + 0x664]
push 0x200
push 0x541028
push 2
push ebp
call fcn.00406ba0
push 0x4000
push 0x53cf40
push 3
push ebp
mov edi, 1
call fcn.00406a90
add esp, 0x20
cmp eax, 0xffffffff
je 0x40f94a
mov eax, 0x3ff6
cmp byte [eax + 0x53cf40], 0x5a
je 0x40f924
xor edi, edi
inc eax
cmp eax, 0x4000
jb 0x40f919
test edi, edi
je 0x40f961
push 0x4000
push 0x53cf40
push 3
push ebp
call fcn.00406a90
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40f914
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffffd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
mov ebp, dword [esp + 0x40]
mov eax, dword [0x541020]
and ebp, 0x3fff
test eax, eax
jne 0x40f976
jmp 0x40f974
mov eax, dword [esp + 0x24]
push 1
test eax, eax
je 0x40f9e5
lea eax, [esp + 0x14]
push eax
push 0x538ef8
push esi
call ebx
xor eax, eax
test ebp, ebp
jbe 0x40f9ac
mov cl, byte [eax + 0x53cf40]
mov dl, byte [eax + 0x541028]
xor dl, cl
mov byte [eax + 0x541028], dl
inc eax
cmp eax, ebp
jb 0x40f993
push ebp
push 0x541028
push 0x540f48
call fcn.0040e220
mov edx, dword [esp + 0x38]
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [0x538f30], edx
push 0x538f28
push eax
push ebp
mov dword [0x538f34], 0
push 0x541028
jmp 0x40fa48
lea edx, [esp + 0x14]
push edx
push 0x538f10
push esi
call ebx
xor eax, eax
test ebp, ebp
jbe 0x40fa11
mov cl, byte [eax + 0x53cf40]
mov dl, byte [eax + 0x54502c]
xor dl, cl
mov byte [eax + 0x54502c], dl
inc eax
cmp eax, ebp
jb 0x40f9f8
push ebp
push 0x54502c
push 0x540f48
call fcn.0040e220
mov edx, dword [esp + 0x38]
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [0x538f30], edx
push 0x538f28
push eax
push ebp
mov dword [0x538f34], 0
push 0x54502c
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push 1
push edx
push 0x538f28
push eax
call ebx
push 0x540f48
push 0x538f3c
call fcn.0040e350
mov eax, dword [esp + 0x2c]
add esp, 8
test eax, eax
jne 0x40fa93
lea esi, [ebp + 0x54502c]
lea edi, [ebp + 0x541028]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x549034]
test eax, eax
jne 0x40fb0f
mov ecx, 8
lea edi, [ebp + 0x541028]
mov esi, 0x538f3c
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40fb0f
lea eax, [esp + 0x48]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x40facc
lea eax, [esp + 0x48]
jmp 0x40facf
add eax, 2
push eax
lea ecx, [esp + 0x45c]
push 0x41e0d4
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [0x549030]
add esp, 0xc
lea edx, [esp + 0x458]
push 0x10
push str.USBMZ
push edx
call sub.MFC42u.DLL_CWnd::MessageBoxW
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
jmp 0x40fb3d
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.MSVCRT.dll__wunlink]
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x254]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__wrename]
add esp, 0xc
mov edx, dword [0x549030]
push 0
push 0
push 0x402
mov eax, dword [edx + 0xc0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov eax, dword [0x549034]
test eax, eax
jne 0x40fb8f
mov ecx, 8
lea edi, [ebp + 0x541028]
mov esi, 0x538f3c
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x40fb8f
mov eax, 0xfffffffb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x650
ret
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0xfffffffe
pop ebx
add esp, 0x650
ret