Function at 0x406950
Capabilities:
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa50
mov eax, dword [0x42b5cc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x406976
xor al, al
mov ecx, dword [ebp - 4]
call fcn.00411d12
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov ebx, 2
push edi
mov edi, edi
push str.Nqaac
push str.Sogb
push str.Aoeic
mov ecx, 0x11
mov esi, str.Zaiqxuheeneaeaouyemloupieeenmidkix
lea edi, [ebp - 0x60]
rep movsd dword es:[edi], dword [esi]
push str.Eeeokomfa
push str.Wwiugieai
push 0xb4f9
push str.Bx__d_Maqimot__s_Conzy__s_Npqey__s_Eaga__s_K_Liiu__s_S_Weeexe_Xceuhaduzy
lea eax, [ebp - 0x60]
push 0x22
push eax
movsw word es:[edi], word [esi]
call fcn.0040d97b
add esp, 0x24
dec ebx
jne 0x406980
push 0x121
xor eax, eax
mov byte [ebp - 0x4ec], 0
mov ecx, 0x48
lea edi, [ebp - 0x4eb]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x4ec]
push ecx
xor ebx, ebx
push ebx
push str.Vuauxenularuxiedvotomanavqcgsujaokhibyvilumaoexuypheaitfeameygiaxiaeiicotikzbiqtngviawltbiheeajoxlhaeekgevbaseoetoavowcimqcjpiuwezpevlruvexuujjeaarxkicaeoieaotigoxyuueakatewucruobahomveoxkyaeuopctsuwuiusibelidoimvfmoeglqwurfirnimeobboiupywiioaqmotonqiuamqohatueakewuaiyaaextyewvejkeohapperxyabiaaaddevuamxoueeukipacohoqcosvizihbqurumoriikbssixtoijayveiaipioiauliwyxojjaadeiasacoewidworoiaperyoftoreiapejobwmusueuwudifejiheeizuyouulaqugabosorcsuzeiojugsbuconouozufiaoxuhcyskuviivnoxuooxiayaefuwbpoveyiocgiuuecfabiieiiktgwcukgukduepdsgoaxspvertiiluuueuoaerejfoouloxapnurwubzloponahifuitaigeqvhisisoougivulljatiaoeawabbeizaivninpsevehudedebzqrkotaaytaekeakuiutowouaaaaiozoidocyebjadqezkorifixuxhijsizohijoejuioidjltjeeeaa
push ebx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
mov dword [0x6e9a24], eax
mov esi, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
dec esi
mov dword [0x6e9a18], eax
jne 0x406a05
push 0x7f1
call fcn.0040db03
mov edx, eax
add esp, 4
cmp edx, ebx
je 0x406a6b
mov eax, 0xf6f6f6f6
mov edi, edx
mov ecx, 0x19d
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x36
mov eax, 0xa3a3a3a3
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov ecx, 0xb9
mov eax, 0x4040404
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x23232323
mov edi, edx
mov ecx, 0x1b
push edx
rep stosd dword es:[edi], eax
call fcn.0040d9eb
add esp, 4
push 0x798
call fcn.0040db03
mov edx, eax
add esp, 4
cmp edx, ebx
je 0x406ad4
mov eax, 0x34343434
mov edi, edx
mov ecx, 0x10f
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x13f
mov eax, 0xf1f1f1f1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x5b5b5b5b
mov edi, edx
mov ecx, 0x74
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x1e2
mov eax, 0x99999999
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov ecx, 0xa1
mov eax, 0x2d2d2d2d
rep stosd dword es:[edi], eax
push edx
stosw word es:[edi], ax
call fcn.0040d9eb
add esp, 4
push str.Qiur
push 0x7c70
push str.Iutleascii
push 0x950d
push str.Zxoosugu
push str.Tuifiebxi
push str.Dtiszo__s_Vggarub_Atiov_Xe__s_Yduieewu__d_Dlu_G__s_Dduosoy__d_Cxykla_Piisye__s_W_Vifzdokiat
lea edx, [ebp - 0x5c4]
push 0x6b
mov ecx, 0x36
mov esi, str.Zzdupetcaoaaaoutyorjeikadsepkunoaaioslsulafjmqxuhmeknogonipizamuoeckgejudpiltepoauyekiepjegoalbidazyhoaiurt
lea edi, [ebp - 0x5c4]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.0040d97b
mov eax, dword [ebp + 8]
add esp, 0x24
push eax
push ebx
push 0x100001
call dword [0x6e9960]
mov ecx, 9
mov esi, str.Lenkluhzaiwutouvvuvmievofiwilafqcalof
lea edi, [ebp - 0xcc]
rep movsd dword es:[edi], dword [esi]
push str.Eakgaunu
push str.Vnahdog
push str.Auilfap__s_Yueam__s_Uv_Soi
lea ecx, [ebp - 0xcc]
push 0x25
push ecx
mov dword [ebp - 0xa50], eax
movsw word es:[edi], word [esi]
call fcn.0040db84
add esp, 0x14
push 3
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Toabjece
push str.Heragesoei
mov word [ebp - 0x164], bx
xor eax, eax
mov ecx, 0x15
lea edi, [ebp - 0x162]
push 0xb80
rep stosd dword es:[edi], eax
push str._d_Baemmuda_Xeiynuqbia_Cpgogilg__s_Irqbzauei_Pealo__s_Qloi
lea edx, [ebp - 0x164]
push 0x2b
push edx
stosw word es:[edi], ax
call fcn.0040d97b
add esp, 0x18
mov esi, 2
mov edi, edi
push 0x7b5
call fcn.0040db03
mov edx, eax
add esp, 4
cmp edx, ebx
je 0x406c2b
mov edi, edx
mov ecx, 0x191
mov eax, 0x54545454
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
mov ecx, 0x118
mov eax, 0x97979797
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov ecx, 0x46
mov eax, 0xf9f9f9f9
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, edx
mov ecx, 0x1df
mov eax, 0xd5d5d5d5
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov ecx, 0xa
mov eax, 0xdbdbdbdb
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x8a8a8a8a
mov edi, edx
mov ecx, 0x98
push edx
rep stosd dword es:[edi], eax
call fcn.0040d9eb
add esp, 4
dec esi
jne 0x406bb0
push str.Guqq
xor eax, eax
mov word [ebp - 0x3c8], bx
mov ecx, 0x33
lea edi, [ebp - 0x3c6]
push str._s_Naga_Mpa
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c8]
push 0x66
push eax
call fcn.0040d97b
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringA]
add esp, 0x10
mov esi, 3
lea ebx, [ebx]
mov eax, dword [0x423238]
mov ecx, dword [str.Hjoabonhftauhhte]
mov edx, dword [0x423234]
push 0x11
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0xe
push str.Hoeueuouiifiufcetocbaobeuoouaibfzunukoqpleqehipahoralavuvsaomlzhqivnkaqadfmaaoaleagejgpzvevprhkukiiyhapjcioeqaoqcepvfjcutoexdexolguomehubaceaareqraayetiafgulauwhiguiewokoeanorgaokahetebetebvuebkxixacveevuiijgouthiijayyeaueseaqfeajonmaxooowaaowhreffumsucxriligleagofivukebixohamgenoihaevhisoolgiitiowugeoneoriutxocfboaihupshukelumupiucoupucogirouqaaeuigxubxohzieuuamisaoawemqkayekubocoevtaueawdxbakaeahajacinukeeeeamiurkamezbcofuceuujniieijimabenqhixoyaeozekunqyioeyfvojkeouiyopaburuuatacoiaoakwyezeuuvxtitvuufazueinevazkcuvioejokaciiacueyiucuiivehaaqvuueeowuviawkawooafisocezucsobjuleahfevaiataleeyyuugvohehioazesxmmqurguoaeaeaorecalaworubeqafierkieoiaaizaakxuueohqudlaoxineyibibztaiuqaaocevuiuzeoqoiseujragizqvadidizqgepeiugomkzejueduiaakigagahsoauaeokkeixybqvoeametaruoaeokyioyuaezowemiebxeievubofuajoareoumalvumvofjupfumaaajerikaoayxuzpalaivmirpowwuqiotceieuikehjvnooaiboiueofenoxhaiuapuamnogmyrdafvvoleeekixavfaaiijidozamietdottldhevuegwoqooiaojrzozoxisduaamauzijopusexegksihkr
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x42323c]
mov dword [ebp - 0x14], edx
mov dl, byte [0x423240]
push 1
push 0x800
mov dword [ebp - 0xc], ecx
mov byte [ebp - 8], dl
call edi
dec esi
mov dword [0x6e9a24], eax
jne 0x406c70
push 0x1770
push str.Qufu
mov word [ebp - 0x2f8], bx
xor eax, eax
mov ecx, 0x29
lea edi, [ebp - 0x2f6]
rep stosd dword es:[edi], eax
push str.Rouoxovuoe
push str._s_Uvip__s_Moye_Zpin__d_Et
lea ecx, [ebp - 0x2f8]
push 0x53
push ecx
stosw word es:[edi], ax
call fcn.0040d97b
add esp, 0x18
push 0x69
lea edx, [ebp - 0xa4c]
mov ecx, 0xcf
mov esi, str.Cspeiosnpugutauyzeiiiinolorjnakonejukebihebevqzamcephouesaiicredmazgauyulljiaoiasieijijuouhiuajuxkelkamqdbbaylomwuicopxorendpoynulaagjnoteyeeuhaqweuyehidehasieuyehxuzaosplakecoeheiwaelnadrraxiniclniuiiuuikaeezodaxdfipualpegyaekaseaapozabarueeaohisxaaqimeeueuiaoddueiixzecpaoaorudopubxounenunaxeuinzfeouuxsoycuugufotawopidiwisuuteewvkcgoleenjelwoimilwrwpiorujoazioivoqwajeexxfmpawgeowiubafniqsiegetowsloqubozeckxix
lea edi, [ebp - 0xa4c]
push edx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
xor eax, eax
mov byte [ebp - 0x710], 0
mov ecx, 0x52
lea edi, [ebp - 0x70f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x710]
push eax
push 0x14c
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xe89
push str.Figxp
push str.Doeari
mov byte [ebp - 0x10c], 0
xor eax, eax
mov ecx, 0xf
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
push 0xe430
push str.H__d_Rbmk_Bhsu__s_Iioawaxei_Kfweaeuey__s_Aehohas_Zoues__d_Wxeoravmqo_Wdnovew
lea ecx, [ebp - 0x10c]
push 0x3d
push ecx
stosb byte es:[edi], al
call fcn.0040db84
add esp, 0x1c
mov esi, 3
lea esp, [esp]
push 0x31e
call fcn.0040db03
mov edx, eax
add esp, 4
cmp edx, ebx
je 0x406df4
mov eax, 0xc8c8c8c8
mov edi, edx
mov ecx, 0x7a
rep stosd dword es:[edi], eax
mov edi, edx
mov ecx, 0x3b
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, edx
mov ecx, 0x5c
mov eax, 0xd7d7d7d7
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, edx
mov ecx, 0x1a
mov eax, 0x8f8f8f8f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, edx
mov ecx, 0x5d
mov eax, 0xd4d4d4d4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
call fcn.0040d9eb
add esp, 4
dec esi
jne 0x406d90
push 0xcb07
push 0xd641
push 0x466b
push 0x422e34
push str.Kuij
push str.Oizy
push str.T__s_Xue__s_Svdajosjae_De__s_Kosyqoju__d_Deeenice_Sieacamt_Rbubtu__d_Nueiuu_Xaum__d_Jwio
lea edx, [ebp - 0x250]
xor eax, eax
push 0x78
mov byte [ebp - 0x250], 0
mov ecx, 0x1e
lea edi, [ebp - 0x24f]
push edx
rep stosd dword es:[edi], eax
call fcn.0040db84
mov eax, dword [ebp - 0xa50]
add esp, 0x24
cmp eax, 1
jae 0x406e5d
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
call fcn.00411d12
mov esp, ebp
pop ebp
ret
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0xf
mov esi, str.Hurtturiucyukihomuxoluwiquiyzusiaequmzuibexooecefocajusgooduyo
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
push 0x1cf5
push str.Zoeajubx
push 0x422d78
push 0x2229
push 0x422d74
movsw word es:[edi], word [esi]
push str._s_Eiqbda__d_Blvcluxqj_Veukzoe__s_Luejx__s_L_Uhihlabaea__d_Prrhyopih_Ssaeh
lea eax, [ebp - 0x58]
push 0x3e
push eax
movsb byte es:[edi], byte [esi]
call fcn.0040db84
push 0x1486
push str.Kaoeuuhu
mov byte [ebp - 0xa4], 0
xor eax, eax
mov ecx, 0xb
lea edi, [ebp - 0xa3]
rep stosd dword es:[edi], eax
push str.Lxpu
push str.Aeuiza__s_Lzzomup__s_Iqzkxiuiyx__d_Rvzenufbj
lea ecx, [ebp - 0xa4]
push 0x2d
push ecx
stosb byte es:[edi], al
call fcn.0040db84
push str.Jvuqruveiv
push str.Soublan
push str.Yeyokalcie
push str.Baok
push 0xb36e
push 0x429084
push str._s_Xa__d_Vgeesa__s_Woaezuha_Qwio__s_Qax_Llafnep__s_Stiomari_Gulezayooi__s_Axttmeb_Xheg
lea edx, [ebp - 0x1d4]
xor eax, eax
push 0x6c
mov byte [ebp - 0x1d4], 0
mov ecx, 0x1b
lea edi, [ebp - 0x1d3]
push edx
rep stosd dword es:[edi], eax
call fcn.0040db84
add esp, 0x5c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, 3
mov edi, edi
push str.Hoeueuouiifiufcetocbaobeuoouaibfzunukoqpleqehipahoralavuvsaomlzhqivnkaqadfmaaoaleagejgpzvevprhkukiiyhapjcioeqaoqcepvfjcutoexdexolguomehubaceaareqraayetiafgulauwhiguiewokoeanorgaokahetebetebvuebkxixacveevuiijgouthiijayyeaueseaqfeajonmaxooowaaowhreffumsucxriligleagofivukebixohamgenoihaevhisoolgiitiowugeoneoriutxocfboaihupshukelumupiucoupucogirouqaaeuigxubxohzieuuamisaoawemqkayekubocoevtaueawdxbakaeahajacinukeeeeamiurkamezbcofuceuujniieijimabenqhixoyaeozekunqyioeyfvojkeouiyopaburuuatacoiaoakwyezeuuvxtitvuufazueinevazkcuvioejokaciiacueyiucuiivehaaqvuueeowuviawkawooafisocezucsobjuleahfevaiataleeyyuugvohehioazesxmmqurguoaeaeaorecalaworubeqafierkieoiaaizaakxuueohqudlaoxineyibibztaiuqaaocevuiuzeoqoiseujragizqvadidizqgepeiugomkzejueduiaakigagahsoauaeokkeixybqvoeametaruoaeokyioyuaezowemiebxeievubofuajoareoumalvumvofjupfumaaajerikaoayxuzpalaivmirpowwuqiotceieuikehjvnooaiboiueofenoxhaiuapuamnogmyrdafvvoleeekixavfaaiijidozamietdottldhevuegwoqooiaojrzozoxisduaamauzijopusexegksihkr
push 0x1ae
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
dec esi
jne 0x406f30
push 0x14b1
push 0x2406
push 0xbef6
push str._d_Vay_Qzjenou__d_Yieenobai_Cwh_Yey__d_Fhyut_Agiwe
lea eax, [ebp - 0x74]
push 0x5b
mov ecx, 0x17
mov esi, str.Jcossainoauiihjabiwoiotiuoyrmuagurhetavoyidduenexytjiiofgidedlffkibwozseieouxobhojsozufiqaf
lea edi, [ebp - 0x74]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0040db84
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add esp, 0x18
mov ebx, 3
nop
mov esi, 4
call edi
dec esi
mov dword [0x6e9a3c], eax
jne 0x406f85
dec ebx
jne 0x406f80
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, 1
pop ebx
call fcn.00411d12
mov esp, ebp
pop ebp
ret