Function at 0x401000
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xcd8
push esi
push edi
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xc
push eax
push 1
push str.D:_A_OICI_GA___WD_
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
push 0x104
lea eax, [esp + 0x5c4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x5c0]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x4b7], al
test al, al
jne 0x401050
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x4b8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
push str.NOTDARK
push str.__s_
lea eax, [esp + 0x3a8]
push 0x114
push eax
call fcn.004016c0
lea eax, [esp + 0x4c8]
push eax
push str._ORIGIN:__s_
lea eax, [esp + 0x3b8]
push 0x114
push eax
call fcn.004016c0
add esp, 0x20
cmp byte [str.02223f0982a7ac96], 0x30
jne 0x401153
cmp byte [0x417add], 0x32
jne 0x401153
cmp byte [0x417ade], 0x32
jne 0x401153
cmp byte [0x417adf], 0x32
jne 0x401153
cmp byte [0x417ae0], 0x33
jne 0x401153
cmp byte [0x417ae1], 0x66
jne 0x401153
cmp byte [0x417ae2], 0x30
jne 0x401153
cmp byte [0x417ae3], 0x39
jne 0x401153
cmp byte [0x417ae4], 0x38
jne 0x401153
cmp byte [0x417ae5], 0x32
jne 0x401153
cmp byte [0x417ae6], 0x61
jne 0x401153
cmp byte [0x417ae7], 0x37
jne 0x401153
cmp byte [0x417ae8], 0x61
jne 0x401153
cmp byte [0x417ae9], 0x63
jne 0x401153
cmp byte [0x417aea], 0x39
jne 0x401153
cmp byte [0x417aeb], 0x36
je 0x401172
push str.02223f0982a7ac96
push str.userkey__s_
lea eax, [esp + 0x3a8]
push 0x114
push eax
call fcn.004016c0
add esp, 0x10
cmp byte [str.VISOTESTNAMEVIVE], 0x56
jne 0x401206
cmp byte [0x417af1], 0x49
jne 0x401206
cmp byte [0x417af2], 0x53
jne 0x401206
cmp byte [0x417af3], 0x4f
jne 0x401206
cmp byte [0x417af4], 0x54
jne 0x401206
cmp byte [0x417af5], 0x45
jne 0x401206
cmp byte [0x417af6], 0x53
jne 0x401206
cmp byte [0x417af7], 0x54
jne 0x401206
cmp byte [0x417af8], 0x4e
jne 0x401206
cmp byte [0x417af9], 0x41
jne 0x401206
cmp byte [0x417afa], 0x4d
jne 0x401206
cmp byte [0x417afb], 0x45
jne 0x401206
cmp byte [0x417afc], 0x56
jne 0x401206
cmp byte [0x417afd], 0x49
jne 0x401206
cmp byte [0x417afe], 0x56
jne 0x401206
cmp byte [0x417aff], 0x45
je 0x401225
push str.VISOTESTNAMEVIVE
push str.gname__s_
lea eax, [esp + 0x3a8]
push 0x114
push eax
call fcn.004016c0
add esp, 0x10
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0xa
push str.DECOMPRESSOR
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
call esi
push 0xa
push str.ARCHIVE
push 0
mov dword [esp + 0x1c], eax
call edi
push eax
call esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4016a0
push eax
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
call esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], eax
push 0
call edi
push eax
call esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
push eax
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call esi
push dword [esp + 0x14]
mov dword [esp + 0x30], eax
push 0
call edi
push eax
call esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x190]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40168c
push str.USERNAME
call fcn.00404614
mov esi, eax
add esp, 4
mov ecx, esi
xor edx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4012e6
sub ecx, edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x40139e
nop dword [eax + eax]
mov al, byte [edx + esi]
cmp al, 0x20
je 0x401326
test al, al
js 0x401326
mov ecx, esi
inc edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401311
sub ecx, edi
cmp edx, ecx
jb 0x401300
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40139e
push str.AllUsersProfile
call fcn.00404614
mov esi, eax
add esp, 4
lea edx, [esi - 1]
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x401338
mov eax, dword [str.yake_trainer_]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [edx], eax
mov eax, dword [0x417b78]
mov dword [edx + 4], eax
mov eax, dword [0x417b7c]
mov dword [edx + 8], eax
mov ax, word [0x417b80]
mov word [edx + 0xc], ax
mov al, byte [0x417b82]
push 0
push esi
mov byte [edx + 0xe], al
call edi
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401380
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x194]
push esi
push eax
call fcn.00404620
add esp, 0xc
lea ecx, [esp + 0x190]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4013a6
mov eax, dword [str.cetrainers]
mov dword [ecx], eax
mov eax, dword [0x417b88]
mov dword [ecx + 4], eax
mov ax, word [0x417b8c]
mov word [ecx + 8], ax
mov al, byte [0x417b8e]
mov byte [ecx + 0xa], al
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x194]
push eax
call edi
lea eax, [esp + 0x88]
push eax
push 0
push 0x417b90
lea eax, [esp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40166e
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x8c]
push eax
call edi
test eax, eax
je 0x401650
xor ecx, ecx
nop dword [eax]
mov al, byte [esp + ecx + 0x88]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x6c7], al
test al, al
jne 0x401430
lea edi, [esp + 0x6c8]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x401450
mov ax, word [0x417b94]
lea ecx, [esp + 0x6c8]
mov word [edi], ax
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x401470
mov eax, dword [str.CET_Archive.dat]
mov dword [ecx], eax
mov eax, dword [0x417b9c]
mov dword [ecx + 4], eax
mov eax, dword [0x417ba0]
push 0
mov dword [ecx + 8], eax
mov eax, dword [0x417ba4]
push 0x80
push 2
mov dword [ecx + 0xc], eax
lea eax, [esp + 0x24]
push eax
push 3
push 0x40000000
lea eax, [esp + 0x6e0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
je 0x4014e1
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x2c]
push dword [esp + 0x20]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x5c0]
push eax
lea eax, [esp + 0x8c]
push eax
push str._s_s
lea eax, [esp + 0x2a4]
push 0x104
push eax
call fcn.004016c0
add esp, 0x14
lea eax, [esp + 0x3a0]
push eax
lea eax, [esp + 0x29c]
push eax
push str.__s___s
lea eax, [esp + 0xad4]
push 0x218
push eax
call fcn.004016c0
add esp, 0x14
lea eax, [esp + 0x18]
push 0
push 0x80
push 2
push eax
push 3
push 0x40000000
lea eax, [esp + 0x2b0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x401577
push 0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x30]
push dword [esp + 0x38]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x30]
mov dword [esp + 0x40], 0x44
push eax
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x90]
movlpd qword [esp + 0x4c], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xae8]
movlpd qword [esp + 0x6c], xmm0
push eax
lea eax, [esp + 0x2bc]
movlpd qword [esp + 0x78], xmm0
push eax
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movlpd qword [esp + 0x9c], xmm0
movlpd qword [esp + 0xa4], xmm0
movaps xmmword [esp + 0x58], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40160a
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40161e
push 0x10
push str.Trainer_failure
push str.Failure_loading_the_trainer._Your_tempfolder_must_allow_execution.__Check_your_anti_virus__n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x298]
push eax
call esi
lea eax, [esp + 0x6c8]
push eax
call esi
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Launch_Error
push str.Failure_creating_a_temporary_folder
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Launch_Error
push str.Failure_assigning_a_temporary_name
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 0x10
push str.Launch_Error
push str.Failure_getting_the_temp_folder
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10