Function at 0x66406e50
Capabilities:
Access peb ldr_data
Check if file exists
Contain obfuscated stackstrings
Delete file
Get common file path
Get file attributes
Get process heap flags
Query environment variable

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x108
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0xac], eax
test edi, edi
je 0x66407120
mov esi, ebx
and si, 0x100
test byte [0x66444750], 8
je 0x66407046
mov eax, 0x6644693b
test bx, bx
mov edx, str.OF_REOPEN
mov ecx, str.OF_SHARE_COMPAT
cmovns edx, eax
test bh, 0x40
mov dword [ebp - 0xb0], edx
mov edx, str.OF_EXIST
cmove edx, eax
test bh, 0x20
mov dword [ebp - 0xb4], edx
mov edx, str.OF_PROMPT
cmove edx, eax
test bh, 0x10
mov dword [ebp - 0xb8], edx
mov edx, str.OF_CREATE
cmove edx, eax
test bh, 8
mov dword [ebp - 0xbc], edx
mov edx, str.OF_CANCEL
cmove edx, eax
test bh, 4
mov dword [ebp - 0xc0], edx
mov edx, str.OF_SEARCH
cmove edx, eax
mov dword [ebp - 0xd0], edx
mov edx, str.OF_VERIFY
cmove edx, eax
test bh, 2
mov dword [ebp - 0xc4], edx
mov edx, str.OF_DELETE
cmove edx, eax
test si, si
mov dword [ebp - 0xc8], edx
mov edx, str.OF_PARSE
cmovne eax, edx
mov dword [ebp - 0xcc], eax
mov eax, ebx
and ax, 0x70
je 0x66406f70
mov ecx, str.OF_SHARE_DENY_NONE
cmp ax, 0x40
je 0x66406f70
mov ecx, str.OF_SHARE_DENY_READ
cmp ax, 0x30
je 0x66406f70
mov ecx, str.OF_SHARE_DENY_WRITE
cmp ax, 0x20
je 0x66406f70
cmp ax, 0x10
mov ecx, str.OF_SHARE_EXCLUSIVE
mov eax, str.unknown
cmovne ecx, eax
lea esi, [esi]
nop
mov eax, ebx
mov edx, str.OF_READ
and ax, 3
je 0x66406f99
mov edx, str.OF_WRITE
cmp ax, 1
je 0x66406f99
cmp ax, 2
mov edx, str.unknown
mov eax, str.OF_READWRITE
cmove edx, eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0xd4], ecx
call fcn.66405d60
mov ecx, dword [ebp - 0xb0]
mov dword [esp + 0xc], str._s__s__s__s_s_s_s_s_s_s_s_s_n
mov edx, dword [ebp - 0xd8]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp - 0xb4]
mov dword [esp], 3
mov dword [esp + 0x14], edx
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp - 0xb8]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp - 0xc0]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp - 0xd0]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0xc4]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0xc8]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0xcc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0xd4]
mov dword [esp + 0x18], ecx
call fcn.66405b50
test si, si
jne 0x66407490
test bh, 0x10
jne 0x66407138
xor edx, edx
test bx, bx
mov byte [edi], 0x88
mov word [edi + 2], dx
js 0x66407220
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x66407120
lea esi, [edi + 8]
mov dword [esp + 0xc], 0
mov dword [ebp - 0xb4], esi
mov dword [esp + 8], esi
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x66407100
mov eax, dword [ebp - 0xac]
test bh, 4
je 0x66407638
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov byte [ebp - 0xd0], 1
sub esp, 4
cmp eax, 0xffffffff
je 0x66407698
test byte [0x66444750], 8
jne 0x66407740
test bh, 2
je 0x664074c0
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
test eax, eax
jne 0x66407650
movzx eax, byte [0x66444750]
and eax, 4
mov edx, dword fs:[0x18]
mov edx, dword [edx + 0x34]
mov word [edi + 2], dx
test al, al
jne 0x664071a0
mov esi, 0xffffffff
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
movzx eax, bx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_OpenFile]
sub esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x66407100
test byte [0x66444750], 8
jne 0x664071e0
lea eax, [esi - 1]
cmp eax, 0xfffffffd
ja 0x664077ba
mov dword [esp], esi
call fcn.66405be0
sub esp, 4
mov esi, eax
cmp eax, 0xffff
je 0x66407100
and bh, 0x40
je 0x66407125
movzx eax, ax
mov dword [esp], eax
call sym.krnl386.exe16__lclose16
sub esp, 4
jmp 0x66407125
mov eax, dword [ebp - 0xac]
movzx edx, dx
mov dword [esp + 0xc], str.__s_:_return__HFILE_ERROR_error__d_n
mov dword [esp + 0x14], edx
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp + 0x10], eax
mov dword [esp], 2
call fcn.66405b50
jmp 0x66407120
mov eax, dword [ebp - 0xac]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], str.__s_:_OK__return___p_n
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.66405b50
jmp 0x66407165
lea eax, [edi + 8]
mov dword [esp + 0xc], 0
mov dword [ebp - 0xb0], eax
mov dword [esp + 8], eax
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFullPathNameA]
sub esp, 0x10
test eax, eax
je 0x66407570
mov eax, ebx
shr ax, 0xa
and eax, 1
mov byte [ebp - 0xd0], al
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0x98], 0
call sym.krnl386.exe16_GetCurrentTask
test ax, ax
jne 0x66407590
lea eax, [ebp - 0x98]
mov dword [ebp - 0xc0], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.66406db0
mov esi, dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
sub esp, 8
mov word [ebp - 0xbc], ax
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0xc4], esi
call esi
mov ecx, dword [ebp - 0xc0]
sub esp, 8
mov esi, eax
mov dword [esp], ecx
mov ecx, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0xb8], ecx
call ecx
mov ecx, dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov dword [esp], str.PATH
add esi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0xc8], ecx
call ecx
movzx edx, word [ebp - 0xbc]
add esi, eax
sub esp, 0xc
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
add esi, edx
lea ecx, [esi + 6]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov dword [ebp - 0xbc], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xbc]
sub esp, 0xc
test eax, eax
mov edx, eax
je 0x66407100
mov eax, 0x3b2e
add esi, 4
add ecx, edx
mov byte [edx + 2], 0
mov word [edx], ax
lea eax, [edx + 2]
movzx esi, si
mov dword [esp + 4], esi
mov esi, eax
mov dword [esp], eax
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xcc], edx
call fcn.66406db0
mov edx, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], esi
call edx
add eax, esi
lea esi, [eax + 1]
mov byte [eax], 0x3b
mov eax, dword [ebp - 0xbc]
mov dword [esp], esi
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc4]
call eax
mov edx, dword [ebp - 0xb8]
sub esp, 8
mov dword [esp], esi
call edx
mov edx, dword [ebp - 0xcc]
add esi, eax
mov byte [esi], 0x3b
cmp byte [ebp - 0x98], 0
lea ecx, [esi + 1]
jne 0x664075e8
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], ecx
mov dword [ebp - 0xb8], edx
mov dword [esp], str.PATH
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc8]
call eax
mov eax, dword [ebp - 0xb4]
sub esp, 0xc
mov edx, dword [ebp - 0xb8]
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], edx
mov dword [ebp - 0xb0], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SearchPathA]
mov edx, dword [ebp - 0xb0]
sub esp, 0x18
mov esi, eax
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
test esi, esi
jne 0x664070d0
jmp 0x66407100
mov eax, dword [ebp - 0xac]
movzx ebx, bx
mov dword [esp + 4], edi
xor esi, esi
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_OpenFile]
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
movzx eax, bx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb4]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll__lopen]
sub esp, 8
mov ecx, eax
cmp eax, 0xffffffff
je 0x66407100
mov esi, eax
mov dword [esp], ecx
lea eax, [ebp - 0x98]
mov dword [ebp - 0xb0], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_GetFileTime]
lea eax, [ebp - 0x9c]
lea edx, [ebp - 0x9a]
sub esp, 0x10
mov dword [esp + 4], eax
lea eax, [ebp - 0x98]
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x9c]
sub esp, 0xc
test bx, bx
jns 0x66407557
cmp byte [ebp - 0xd0], 0
mov ecx, dword [ebp - 0xb0]
jne 0x66407778
movzx edx, word [ebp - 0x9a]
mov word [edi + 4], ax
mov word [edi + 6], dx
jmp 0x6640715c
movzx eax, byte [0x66444750]
mov ebx, dword [ebp - 0xb0]
and eax, 4
mov dword [ebp - 0xac], ebx
jmp 0x6640710a
call sym.krnl386.exe16_GetCurrentTask
lea esi, [ebp - 0x98]
mov dword [esp + 8], pe_nt_image_headers32
movzx eax, ax
mov dword [esp + 4], esi
mov dword [esp], eax
mov dword [ebp - 0xc0], esi
call fcn.664268c0
sub esp, 0xc
test ax, ax
je 0x66407293
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strrchr]
test eax, eax
cmove eax, esi
mov byte [eax], 0
jmp 0x66407293
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc4], edx
mov dword [esp], ecx
mov dword [ebp - 0xc0], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_strcpy]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xb8]
mov dword [esp], ecx
call eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xc4]
add eax, ecx
lea ecx, [eax + 1]
mov byte [eax], 0x3b
jmp 0x664073e3
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xd0], 0
jmp 0x66407272
mov esi, 1
test byte [0x66444750], 8
je 0x66407125
mov eax, dword [ebp - 0xac]
mov dword [esp + 0xc], str.__s_:_OF_DELETE_return__OK_n
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.66405b50
jmp 0x66407125
mov eax, dword [ebp - 0xac]
cmp byte [eax], 0
mov dword [ebp - 0xb0], eax
je 0x664076c0
cmp byte [eax + 1], 0x3a
jne 0x664076c0
add eax, 2
mov dword [ebp - 0xb0], eax
lea esi, [esi]
nop
mov eax, dword [ebp - 0xb0]
mov dword [esp + 4], 0x5c
mov esi, dword [sym.imp.ucrtbase.dll_strrchr]
mov dword [esp], eax
call esi
mov dword [esp + 4], 0x2f
lea edx, [eax + 1]
test eax, eax
cmove edx, dword [ebp - 0xb0]
mov dword [ebp - 0xb0], edx
mov dword [esp], edx
call esi
mov byte [ebp - 0xd0], 1
lea edx, [eax + 1]
test eax, eax
mov esi, edx
cmove esi, dword [ebp - 0xb0]
cmp byte [esi], 0
mov dword [ebp - 0xb0], esi
jne 0x66407272
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 2
movzx eax, byte [0x66444750]
and eax, 4
jmp 0x6640710a
mov eax, dword [ebp - 0xb4]
call fcn.66405d60
mov dword [esp + 0xc], str.found__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp], 3
call fcn.66405b50
jmp 0x664070dd
cmp word [edi + 4], ax
jne 0x6640778f
movzx edx, word [ebp - 0x9a]
cmp word [edi + 6], dx
je 0x6640755e
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [0x66444750]
sub esp, 4
and eax, 4
jne 0x664077c9
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], 2
jmp 0x6640710a
mov esi, 0xffffffff
mov eax, 0xffffffff
jmp 0x66407189
mov eax, dword [ebp - 0xac]
mov dword [esp + 0xc], str.__s_:_OF_VERIFY_failed_n
mov dword [esp + 8], 0x66446b30
mov dword [esp + 4], 0x66444750
mov dword [esp], 2
mov dword [esp + 0x10], eax
call fcn.66405b50
movzx eax, byte [0x66444750]
and eax, 4
jmp 0x664077a7