Function at 0x401890
Capabilities:
Contain obfuscated stackstrings
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x70
call dbg.__main
mov byte [esp + 0x48], 0xcd
mov byte [esp + 0x49], 0xcc
mov byte [esp + 0x4a], 0xcc
mov byte [esp + 0x4b], 0x3a
mov byte [esp + 0x44], 0x3e
mov byte [esp + 0x45], 0xc3
mov byte [esp + 0x46], 0xae
mov byte [esp + 0x47], 0x3a
mov dword [esp + 4], 0x404000
mov dword [esp], str.Juiced.exe
call sym._fopen
mov dword [esp + 0x6c], eax
mov dword [esp + 4], 0x40400e
mov dword [esp], str.Juiced.exe.bak
call sym._fopen
mov dword [esp + 0x68], eax
mov dword [esp + 0x10], 4
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call sym.replace__iobuf___iobuf__unsigned_char__unsigned_char__unsigned_int_
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.Juiced.exe
call sym._remove
mov dword [esp + 4], str.Juiced.exe
mov dword [esp], str.Juiced.exe.bak
call sym._rename
mov byte [esp + 0x40], 0xbe
mov byte [esp + 0x41], 0x9f
mov byte [esp + 0x42], 0xaa
mov byte [esp + 0x43], 0x3f
mov byte [esp + 0x3c], 0x42
mov byte [esp + 0x3d], 0x45
mov byte [esp + 0x3e], 0xae
mov byte [esp + 0x3f], 0x3f
mov dword [esp + 4], 0x404000
mov dword [esp], str.Juiced.exe
call sym._fopen
mov dword [esp + 0x60], eax
mov dword [esp + 4], 0x40400e
mov dword [esp], str.Juiced.exe.bak
call sym._fopen
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], 4
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call sym.replace2__iobuf___iobuf__unsigned_char__unsigned_char__unsigned_int_
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.Juiced.exe
call sym._remove
mov dword [esp + 4], str.Juiced.exe
mov dword [esp], str.Juiced.exe.bak
call sym._rename
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
mov byte [esp + 0x36], pe_nt_image_headers32
mov byte [esp + 0x37], 0x3e
mov byte [esp + 0x38], 0x33
mov byte [esp + 0x39], 0x33
mov byte [esp + 0x3a], 0x93
mov byte [esp + 0x3b], 0x3f
mov byte [esp + 0x2c], 0
mov byte [esp + 0x2d], 0
mov byte [esp + 0x2e], pe_nt_image_headers32
mov byte [esp + 0x2f], 0x3e
mov byte [esp + 0x30], 0x3d
mov byte [esp + 0x31], 0xa
mov byte [esp + 0x32], 0x8f
mov byte [esp + 0x33], 0x3f
mov dword [esp + 4], 0x404000
mov dword [esp], str.Juiced.exe
call sym._fopen
mov dword [esp + 0x54], eax
mov dword [esp + 4], 0x40400e
mov dword [esp], str.Juiced.exe.bak
call sym._fopen
mov dword [esp + 0x50], eax
mov dword [esp + 0x10], 8
lea eax, [esp + 0x2c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x34]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sym.replace3__iobuf___iobuf__unsigned_char__unsigned_char__unsigned_int_
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call sym._fclose
mov eax, dword [esp + 0x54]
mov dword [esp], eax
call sym._fclose
mov dword [esp], str.Juiced.exe
call sym._remove
mov dword [esp + 4], str.Juiced.exe
mov dword [esp], str.Juiced.exe.bak
call sym._rename
mov eax, 0
leave
ret