Function at 0x4ba372
Capabilities:
Contain obfuscated stackstrings
Get file version info
Query environment variable
Set environment variable
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x5ce3ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x540
mov eax, dword [0x63094c]
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x34], esi
mov dword [esi + 0x24], eax
mov ecx, dword [0x63094c]
lea edi, [esi + 0x28]
xor ebx, ebx
mov dword [esp + 0x558], ebx
mov dword [edi], ecx
push fcn.00598032
push 0x418690
push 0xa
lea edx, [esi + 0x2c]
push 4
push edx
mov byte [esp + 0x56c], 1
call fcn.004f4f72
push fcn.00598032
push 0x418690
push 0xa
lea eax, [esi + 0x54]
push 4
push eax
mov byte [esp + 0x56c], 2
call fcn.004f4f72
mov ecx, dword [0x63094c]
mov dword [esi + 0x7c], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0x80], edx
mov eax, dword [0x63094c]
mov dword [esi + 0x84], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0x88], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0x8c], edx
mov eax, dword [0x63094c]
mov dword [esi + 0x90], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0x94], ecx
mov edx, dword [0x63094c]
lea ebp, [esi + 0x98]
mov dword [ebp], edx
mov eax, dword [0x63094c]
mov dword [esi + 0x9c], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0xa0], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0xa4], edx
mov eax, dword [0x63094c]
mov dword [esi + 0xc4], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0xc8], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0xcc], edx
mov eax, dword [0x63094c]
mov dword [esi + 0xd0], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0xd4], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0xd8], edx
mov eax, dword [0x63094c]
mov dword [esi + 0xf8], eax
mov ecx, dword [0x63094c]
mov dword [esi + 0x198], ecx
mov edx, dword [0x63094c]
mov dword [esi + 0x1a0], edx
mov eax, dword [0x63094c]
mov dword [esi + 0x1a4], eax
mov ecx, dword [esp + 0x57c]
lea eax, [esi + 0x100]
push eax
mov byte [esp + 0x55c], 0x18
mov dword [esi], 0x5e5924
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 4], ecx
mov dword [eax], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push ebx
call fcn.004f68de
push eax
call fcn.004f7015
mov edx, dword [esp + 0x568]
add esp, 8
lea ecx, [esi + 0x24]
push edx
call fcn.005981bb
mov eax, dword [esp + 0x564]
mov ecx, edi
push eax
call fcn.005981bb
mov ecx, dword [esp + 0x568]
push ecx
lea ecx, [esi + 0x7c]
call fcn.005981bb
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov dword [esi + 0xe4], ebx
mov dword [esi + 0xe8], ebx
call fcn.004f7022
lea edx, [esp + 0x24]
inc eax
push edx
mov dword [esp + 0x24], eax
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
call fcn.0058fcb2
mov eax, dword [eax]
push ebx
mov dword [esi + 0xa8], eax
call fcn.004f68de
add esp, 4
lea ecx, [esp + 0x38]
mov dword [0x640970], eax
mov dword [esi + 8], ebx
push 0x118
push ecx
push ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x2c]
lea eax, [esp + 0x38]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
je 0x4ba63e
push edi
call fcn.004f5323
mov ecx, dword [esp + 0x30]
add esp, 4
lea edx, [esp + 0x38]
mov dword [esp + 0x18], eax
push eax
push edi
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4ba631
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x61e354
push edx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov dword [esi + 8], ecx
mov edx, dword [eax + 8]
and edx, 0xffff
mov dword [esi + 0xc], edx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
mov dword [esi + 0x10], ecx
mov edx, dword [eax + 0xc]
and edx, 0xffff
mov dword [esi + 0x14], edx
mov eax, dword [esp + 0x18]
push eax
call fcn.004f5907
add esp, 4
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esp + ecx + 0x37]
cmp ecx, edx
jb 0x4ba66f
mov al, byte [ecx]
cmp al, 0x5c
je 0x4ba66f
cmp al, 0x2f
je 0x4ba66f
cmp al, 0x3a
je 0x4ba66f
dec ecx
lea eax, [esp + 0x38]
cmp ecx, eax
jae 0x4ba658
lea eax, [ecx + 1]
push 0x2e
push eax
mov byte [ecx], bl
mov dword [esp + 0x18], eax
call fcn.004f6420
add esp, 8
cmp eax, ebx
je 0x4ba689
mov byte [eax], bl
push 0x61e354
lea ecx, [esp + 0x1c]
call fcn.005980a0
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x564], 0x19
call fcn.0059833b
lea edi, [esi + 0x94]
push eax
mov ecx, edi
mov byte [esp + 0x55c], 0x1a
call fcn.0059816b
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x19
call fcn.00598032
lea ecx, [esp + 0x18]
mov byte [esp + 0x558], 0x18
call fcn.00598032
mov eax, dword [esp + 0x10]
mov ecx, ebp
push eax
call fcn.005981bb
push str..exe
lea ecx, [esp + 0x14]
push ebp
push ecx
call fcn.005982c7
push eax
lea ecx, [esi + 0x9c]
mov byte [esp + 0x55c], 0x1b
call fcn.0059816b
lea ecx, [esp + 0x10]
mov byte [esp + 0x558], 0x18
call fcn.00598032
mov edx, dword [esp + 0x56c]
lea ecx, [esi + 0x80]
push edx
call fcn.005981bb
push ebp
lea eax, [esp + 0x18]
push edi
push eax
call fcn.00598261
lea ecx, [esi + 0x80]
mov byte [esp + 0x558], 0x1c
push ecx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00598261
push eax
lea ecx, [esi + 0xa0]
mov byte [esp + 0x55c], 0x1d
call fcn.0059816b
lea ecx, [esp + 0x10]
mov byte [esp + 0x558], 0x1c
call fcn.00598032
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x18
call fcn.00598032
push ebp
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.00598261
push 0x62e258
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x560], 0x1e
push eax
call fcn.005982c7
lea ecx, [esi + 0x80]
mov byte [esp + 0x558], 0x1f
push ecx
lea ecx, [esp + 0x14]
push eax
push ecx
call fcn.00598261
push eax
lea ecx, [esi + 0xa4]
mov byte [esp + 0x55c], 0x20
call fcn.0059816b
lea ecx, [esp + 0x10]
mov byte [esp + 0x558], 0x1f
call fcn.00598032
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x1e
call fcn.00598032
lea ecx, [esp + 0x18]
mov byte [esp + 0x558], 0x18
call fcn.00598032
push ebp
lea edx, [esp + 0x18]
push edi
push edx
call fcn.00598261
push str..ini
push eax
lea eax, [esp + 0x18]
mov byte [esp + 0x560], 0x21
push eax
call fcn.005982c7
push eax
lea ecx, [esi + 0x198]
mov byte [esp + 0x55c], 0x22
call fcn.0059816b
lea ecx, [esp + 0x10]
mov byte [esp + 0x558], 0x21
call fcn.00598032
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x18
call fcn.00598032
push 0x63df70
lea ecx, [esi + 0xc4]
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xac], ebx
call fcn.005981bb
push 0x63df70
lea ecx, [esi + 0xcc]
call fcn.005981bb
mov ebp, dword [esp + 0x570]
lea ecx, [esi + 0x84]
push ebp
mov dword [esp + 0x2c], ecx
call fcn.005981bb
mov eax, dword [esp + 0x578]
cmp eax, ebx
jne 0x4ba8d2
mov eax, ebp
push eax
lea ecx, [esi + 0x88]
call fcn.005981bb
push ebp
lea ecx, [esi + 0xc8]
call fcn.005981bb
push ebp
lea ecx, [esi + 0xd0]
call fcn.005981bb
mov ecx, dword [esp + 0x574]
push ecx
lea ecx, [esi + 0x8c]
call fcn.005981bb
push str.None
lea ecx, [esi + 0xd4]
call fcn.005981bb
lea eax, [esi + 0x7c]
lea edx, [esp + 0x18]
push eax
push str.SOFTWARE_
push edx
call fcn.0059833b
push 0x61e354
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x560], 0x23
push eax
call fcn.005982c7
lea ebp, [esi + 0x24]
lea ecx, [esp + 0x10]
push ebp
push eax
push ecx
mov byte [esp + 0x564], 0x24
call fcn.00598261
mov edx, dword [esi + 0x14]
mov eax, dword [eax]
neg edx
sbb edx, edx
mov byte [esp + 0x558], 0x25
and edx, 0xfffffffa
add edx, 7
push edx
push 0x62e240
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004ba2b0
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esi + 0xbc], eax
mov byte [esp + 0x558], 0x24
call fcn.00598032
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x23
call fcn.00598032
lea ecx, [esp + 0x18]
mov byte [esp + 0x558], 0x18
call fcn.00598032
mov eax, dword [esi + 0xbc]
mov dword [esi + 0xfc], ebx
mov dword [esi + 0xc0], eax
mov eax, dword [esp + 0x57c]
cmp eax, ebx
mov dword [0x640974], esi
je 0x4baad8
mov ecx, dword [esp + 0x20]
push ebx
push ebx
push ebx
push ecx
mov ecx, esi
call fcn.004bed90
cmp eax, dword [esp + 0x20]
je 0x4baad8
push str._program_files_are_damaged__most_probably_by_a_computer_virus_that_infected_your_machine._It_will_no_longer_run__please_clean_your_system_from_viruses__then_download_and_install_a_fresh_copy_of
lea edx, [esp + 0x28]
push ebp
push edx
call fcn.005982c7
push ebp
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x560], 0x26
push eax
call fcn.00598261
push str._from
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x564], 0x27
call fcn.005982c7
mov edx, dword [esp + 0x28]
mov byte [esp + 0x558], 0x28
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00598261
push 0x61ea1c
lea ecx, [esp + 0x14]
push eax
push ecx
mov byte [esp + 0x564], 0x29
call fcn.005982c7
mov eax, dword [eax]
push ebx
push ebx
push eax
mov byte [esp + 0x564], 0x2a
call fcn.005a0073
lea ecx, [esp + 0x10]
mov byte [esp + 0x558], 0x29
call fcn.00598032
lea ecx, [esp + 0x14]
mov byte [esp + 0x558], 0x28
call fcn.00598032
lea ecx, [esp + 0x20]
mov byte [esp + 0x558], 0x27
call fcn.00598032
lea ecx, [esp + 0x18]
mov byte [esp + 0x558], 0x26
call fcn.00598032
lea ecx, [esp + 0x24]
mov byte [esp + 0x558], 0x18
call fcn.00598032
push ebx
call fcn.004f548a
mov edx, dword [0x63094c]
mov dword [esp + 0x30], edx
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
mov bl, 0x2b
mov eax, dword [eax - 8]
mov byte [esp + 0x558], bl
dec eax
push eax
push ecx
mov ecx, edi
call fcn.0058f61d
lea edx, [esp + 0x150]
push 0x400
push edx
push str.Path
mov byte [esp + 0x564], 0x2c
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x150]
push eax
call fcn.0058c412
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.00598566
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x150]
push ecx
push edx
call fcn.004f6130
add esp, 8
test eax, eax
jne 0x4bab7f
push 0x62e23c
lea ecx, [esp + 0x20]
call fcn.0059840e
lea eax, [esp + 0x150]
lea ecx, [esp + 0x1c]
push eax
call fcn.0059840e
mov ecx, dword [esp + 0x1c]
push ecx
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x558], bl
call fcn.00598032
lea ecx, [esp + 0x30]
mov byte [esp + 0x558], 0x18
call fcn.00598032
mov ecx, dword [esp + 0x550]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54c
ret 0x20