Function at 0x411df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x5f26aa
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x6656b0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x14], 0
mov ebx, 2
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x40]
call fcn.00412c30
lea ecx, [ebx + 0x23]
lea esi, [esp + 0x24]
call fcn.00411d50
mov byte [esp + 0x34], 3
push 0x622070
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 4
mov eax, dword [eax]
push eax
push str._SYSTEM_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 3
lea ecx, [esp + 0x20]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x27]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 5
push 0x622070
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 6
mov eax, dword [eax]
push eax
push str._SYSTEMX86_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 5
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x22]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 7
push 0x622070
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 8
mov eax, dword [eax]
push eax
push str._WINDOWS_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 7
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x22]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 9
push 0x622070
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0xa
mov eax, dword [eax]
push eax
push str._WINDIR_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 9
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x24]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0xb
push 0x622070
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0xc
mov eax, dword [eax]
push eax
push str._PROGRAMFILES_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0xb
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x28]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0xd
push 0x622070
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0xe
mov eax, dword [eax]
push eax
push str._PROGRAMFILESX86_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0xd
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x2b]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0xf
push 0x622070
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x10
mov eax, dword [eax]
push eax
push str._TEMPLATES_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0xf
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x1e]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x11
push 0x622070
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x12
mov eax, dword [eax]
push eax
push str._INTERNET_CACHE_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x11
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0xe]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x13
push 0x622070
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x14
mov eax, dword [eax]
push eax
push str._DESKTOP_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x13
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
mov ecx, ebx
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x15
push 0x622070
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x16
mov eax, dword [eax]
push eax
push str._PROGRAMGROUP_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x15
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x26]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x17
push 0x622070
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x18
mov eax, dword [eax]
push eax
push str._USERDIR_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x17
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 3]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x19
push 0x622070
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x1a
mov eax, dword [eax]
push eax
push str._MYDOCUMENTS_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x19
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x21]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x1b
push 0x622070
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x1c
mov eax, dword [eax]
push eax
push str._COMMON_APPDATA_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x1b
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x18]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x1d
push 0x622070
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x1e
mov eax, dword [eax]
push eax
push str._APPDATA_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x1d
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x1a]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x1f
push 0x622070
push eax
lea edx, [esp + 0x2c]
push edx
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x20
mov eax, dword [eax]
push eax
push str._LOCAL_APPDATA_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x1f
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea ecx, [ebx + 0x2c]
lea esi, [esp + 0x20]
call fcn.00411d50
mov byte [esp + 0x34], 0x21
push 0x622070
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004146f0
add esp, 0xc
mov byte [esp + 0x34], 0x22
mov eax, dword [eax]
push eax
push str._COMMON_DOCUMENT_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], 0x21
lea ecx, [esp + 0x24]
call fcn.00401690
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
lea esi, [esp + 0x24]
call fcn.00412830
mov byte [esp + 0x34], 0x23
mov eax, dword [eax]
push eax
push str._TEMP_
lea ecx, [esp + 0x48]
call fcn.00412910
mov byte [esp + 0x34], bl
mov ecx, esi
call fcn.00401690
push str.SystemDrive
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.005b9b6c
mov eax, dword [esp + 0x28]
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
call fcn.0040ea80
mov byte [esp + 0x34], 0x24
push 1
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x20]
call fcn.00412d60
mov byte [esp + 0x34], 0x25
push 0x622070
push eax
call fcn.00409700
add esp, 8
mov byte [esp + 0x13], al
mov byte [esp + 0x34], 0x24
lea ecx, [esp + 0x24]
call fcn.00401690
cmp byte [esp + 0x13], 0
je 0x412403
push 1
push 0x622070
lea ecx, [esp + 0x20]
call fcn.00414510
mov edx, dword [esp + 0x1c]
push edx
call fcn.005b8da1
mov eax, dword [esp + 0x1c]
add esp, 4
push eax
push str._SYSTEMDRIVE_
lea ecx, [esp + 0x48]
call fcn.00412910
mov ecx, dword [esp + 0x44]
cmp dword [ecx - 0xc], 0
je 0x412461
push 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4c]
call fcn.00412d60
mov byte [esp + 0x34], 0x26
push 0x622070
push eax
mov dword [esp + 0x1c], 1
call fcn.00409700
add esp, 8
mov byte [esp + 0x13], 1
test al, al
jne 0x412466
mov byte [esp + 0x13], 0
mov dword [esp + 0x34], 0x24
test byte [esp + 0x14], 1
je 0x412483
and dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x24]
call fcn.00401690
cmp byte [esp + 0x13], 0
je 0x41249a
push 1
push 0x622070
lea ecx, [esp + 0x4c]
call fcn.00414510
mov eax, dword [esp + 0x44]
push eax
push str._TARGET_
lea ecx, [esp + 0x48]
call fcn.00412910
lea ecx, [esp + 0x40]
push ecx
mov ecx, edi
call fcn.0040e310
or dword [esp + 0x14], ebx
mov byte [esp + 0x34], bl
lea ecx, [esp + 0x18]
call fcn.00401690
mov byte [esp + 0x34], 1
lea ecx, [esp + 0x40]
call fcn.00401690
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x44]
call fcn.00401690
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x28
ret