Function at 0x404010
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb04
push ebx
push esi
push edi
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], eax
mov eax, 0x475490
call fcn.00468644
lea eax, [ebp - 0xc4]
call fcn.004025e4
lea eax, [ebp - 0xcc]
call fcn.004025e4
mov dword [ebp - 0xb4], 0x400
push dword [ebp - 0xb4]
lea edx, [ebp - 0x4ec]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x474635
lea ecx, [ebp - 0x4ec]
push ecx
call fcn.00468350
add esp, 8
push 0x474639
lea eax, [ebp - 0x4ec]
push eax
call fcn.00468350
add esp, 8
push 0x47463d
lea edx, [ebp - 0x4ec]
push edx
call fcn.00468350
add esp, 8
push 0x474641
lea ecx, [ebp - 0x4ec]
push ecx
call fcn.00468350
add esp, 8
push 0x474643
lea eax, [ebp - 0x4ec]
push eax
call fcn.00468350
add esp, 8
push 0x474645
lea edx, [ebp - 0x4ec]
push edx
call fcn.00468350
add esp, 8
push 0x474647
push 0x47bc94
call fcn.004683d8
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xb8], ecx
mov word [ebp - 0x98], 8
lea eax, [ebp - 4]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x300]
call fcn.0043bc6c
lea eax, [ebp - 4]
call fcn.004026c0
push eax
push 0x47bc94
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 4]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x14
lea eax, [ebp - 8]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x308]
call fcn.0043bc6c
lea eax, [ebp - 8]
call fcn.004026c0
push eax
push 0x47be94
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 8]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x20
lea eax, [ebp - 0xc]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x324]
call fcn.0043bc6c
lea eax, [ebp - 0xc]
call fcn.004026c0
push eax
push 0x47c094
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x2c
lea eax, [ebp - 0x10]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x32c]
call fcn.0043bc6c
lea eax, [ebp - 0x10]
call fcn.004026c0
push eax
push 0x47c194
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x38
lea eax, [ebp - 0x14]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x340]
call fcn.0043bc6c
lea eax, [ebp - 0x14]
call fcn.004026c0
push eax
push 0x47c214
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x50
lea eax, [ebp - 0x20]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, str.Dbase.ini
lea eax, [ebp - 0x1c]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x18]
call fcn.004015a4
inc dword [ebp - 0x8c]
call fcn.0045e074
lea eax, [ebp - 0x18]
pop edx
pop ecx
call fcn.00472790
lea ecx, [ebp - 0x20]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x41cda4]
call fcn.00402614
mov dword [ebp - 0xd0], eax
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x44
lea eax, [ebp - 0x2c]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x358]
call fcn.0043bc6c
lea edx, [ebp - 0x2c]
push dword [edx]
mov edx, str.DAT_Web_Server
lea eax, [ebp - 0x28]
call fcn.0047267c
inc dword [ebp - 0x8c]
push dword [eax]
mov word [ebp - 0x98], 0x5c
mov edx, str.DataBase
lea eax, [ebp - 0x24]
call fcn.0047267c
inc dword [ebp - 0x8c]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd0]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 4]
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0047274c
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 0
je 0x40440e
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov dword [ebp - 0x30], edx
mov word [ebp - 0x98], 0x74
mov edx, 3
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call dword [ecx - 4]
mov word [ebp - 0x98], 0x68
mov word [ebp - 0x98], 0x80
lea eax, [ebp - 0x38]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x358]
call fcn.0043bc6c
lea eax, [ebp - 0x38]
call fcn.004026c0
push eax
push 0x47c294
call fcn.004683d8
add esp, 8
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.0047274c
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x31c]
mov edx, dword [eax]
call dword [edx + 0xb4]
test al, al
je 0x4048c0
push 0x47466b
push 0x47c3c0
call fcn.004683d8
add esp, 8
mov dword [0x47d4e0], 1
lea ecx, [ebp - 0x4fc]
push ecx
call sub.KERNEL32.DLL_GetSystemTime
mov cx, word [0x47d0d8]
mov dx, word [0x47ccd4]
mov ax, word [0x47c8d0]
call fcn.0045eb24
fstp qword [ebp - 0xc4]
lea eax, [ebp - 0xc4]
mov edx, 0x2d
call fcn.00404e1c
mov ecx, dword [ebp - 0xac]
fstp qword [ecx + 0x370]
mov cx, word [ebp - 0x4f6]
mov dx, word [ebp - 0x4fa]
mov ax, word [ebp - 0x4fc]
call fcn.0045eb24
fstp qword [ebp - 0xcc]
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 0xac]
add eax, 0x370
call fcn.00402e94
fstp qword [ebp - 0xd8]
lea eax, [ebp - 0xd8]
call fcn.00402ec0
mov dword [0x47c4c0], eax
cmp dword [0x47c4c0], 0
jle 0x404623
mov word [ebp - 0x98], 0x8c
lea eax, [ebp - 0x3c]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov eax, dword [0x47c4c0]
call fcn.004026e0
lea edx, [ebp - 0x3c]
push edx
lea eax, [ebp - 0x40]
call fcn.004015a4
mov ecx, eax
inc dword [ebp - 0x8c]
mov eax, 0x474670
pop edx
call fcn.004729fc
lea ecx, [ebp - 0x40]
push ecx
lea eax, [ebp - 0x48]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, 0x474678
lea eax, [ebp - 0x44]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x44]
pop ecx
pop eax
call fcn.00472790
lea edx, [ebp - 0x48]
push dword [edx]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x2d0]
mov eax, dword [eax + 0x1f0]
mov edx, 1
call fcn.00449614
pop edx
call fcn.0044958c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.0047274c
jmp 0x404780
mov word [ebp - 0x98], 0x98
mov edx, 0x47be94
lea eax, [ebp - 0x4c]
call fcn.0047267c
inc dword [ebp - 0x8c]
push dword [eax]
mov edx, 0x47bf94
lea eax, [ebp - 0x50]
call fcn.0047267c
inc dword [ebp - 0x8c]
push dword [eax]
call fcn.00406e7c
add esp, 8
push eax
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.0047274c
pop ecx
test cl, cl
je 0x404780
cmp dword [0x47c4c0], 0
jle 0x404780
mov word [ebp - 0x98], 0xa4
lea eax, [ebp - 0x54]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov eax, dword [0x47c4c0]
call fcn.004026e0
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x58]
call fcn.004015a4
mov ecx, eax
inc dword [ebp - 0x8c]
mov eax, 0x47467b
pop edx
call fcn.004729fc
lea ecx, [ebp - 0x58]
push ecx
lea eax, [ebp - 0x60]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, 0x474683
lea eax, [ebp - 0x5c]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x5c]
pop ecx
pop eax
call fcn.00472790
lea edx, [ebp - 0x60]
push dword [edx]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x2d0]
mov eax, dword [eax + 0x1f0]
mov edx, 1
call fcn.00449614
pop edx
call fcn.0044958c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0xb0
lea eax, [ebp - 0x68]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, 0x47469b
lea eax, [ebp - 0x64]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0xac]
add eax, 0x370
pop ecx
call fcn.00472b8c
lea eax, [ebp - 0x68]
push dword [eax]
lea eax, [ebp - 0x70]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, 0x474698
lea eax, [ebp - 0x6c]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0xac]
add eax, 0x370
pop ecx
call fcn.00472b8c
lea edx, [ebp - 0x70]
push dword [edx]
lea eax, [ebp - 0x78]
call fcn.004015a4
push eax
inc dword [ebp - 0x8c]
mov edx, str.yyyy
lea eax, [ebp - 0x74]
call fcn.0047267c
inc dword [ebp - 0x8c]
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 0xac]
add eax, 0x370
pop ecx
call fcn.00472b8c
lea edx, [ebp - 0x78]
push dword [edx]
push 0x474686
push 0x47c394
call fcn.00469db4
add esp, 0x14
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x6c]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.0047274c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.0047274c
jmp 0x40492c
mov word [ebp - 0x98], 0xbc
mov edx, 0x47469e
lea eax, [ebp - 0x7c]
call fcn.0047267c
inc dword [ebp - 0x8c]
push dword [eax]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x2d0]
mov eax, dword [eax + 0x1f0]
mov edx, 1
call fcn.00449614
pop edx
call fcn.0044958c
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.0047274c
push 0x47469f
push 0x47c3c0
call fcn.004683d8
add esp, 8
xor eax, eax
mov dword [0x47d4e0], eax
mov word [ebp - 0x98], 0xc8
mov word [ebp - 0x98], 0xd4
lea eax, [ebp - 0x80]
call fcn.004015a4
mov edx, eax
inc dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 0x2f8]
call fcn.0043bc6c
lea eax, [ebp - 0x80]
mov eax, dword [eax]
call fcn.0045dbdc
mov dword [0x47d4dc], eax
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.0047274c
mov word [ebp - 0x98], 0x44
jmp 0x4049a4
mov word [ebp - 0x98], 0xe0
mov word [ebp - 0x98], 0xec
lea edx, [ebp - 0x4ec]
lea eax, [ebp - 0x84]
call fcn.0047267c
inc dword [ebp - 0x8c]
mov eax, dword [eax]
mov edx, 1
call fcn.0045dc30
mov dword [ebp - 0xb8], eax
dec dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.0047274c
cmp dword [ebp - 0xb8], 0
jle 0x404db6
push 0x47bc94
call fcn.00468408
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x100
jl 0x404a29
mov dword [ebp - 0xbc], 0x100
xor ecx, ecx
mov dword [ebp - 0xdc], ecx
mov word [ebp - 0x98], 0xe0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xbc]
jge 0x404a8c
mov edx, dword [ebp - 0xdc]
mov cl, byte [edx + 0x47c4d0]
mov eax, dword [ebp - 0xdc]
xor cl, byte [eax + 0x47c8d4]
mov edx, dword [ebp - 0xdc]
xor cl, byte [edx + 0x47bc94]
mov eax, dword [ebp - 0xdc]
mov byte [eax + 0x47d0dc], cl
inc dword [ebp - 0xdc]
mov edx, dword [ebp - 0xdc]
cmp edx, dword [ebp - 0xbc]
jl 0x404a48
mov ecx, dword [ebp - 0xbc]
mov al, byte [ecx + 0x47c4d0]
mov edx, dword [ebp - 0xbc]
xor al, byte [edx + 0x47c8d4]
mov ecx, dword [ebp - 0xbc]
mov byte [ecx + 0x47d0dc], al
push 0x47c094
call fcn.00468408
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xff
jle 0x404ad7
mov dword [ebp - 0xbc], 0xff
xor eax, eax
mov dword [ebp - 0xe0], eax
mov word [ebp - 0x98], 0xe0
mov edx, dword [ebp - 0xe0]
cmp edx, dword [ebp - 0xbc]
jge 0x404b3a
mov ecx, dword [ebp - 0xe0]
mov al, byte [ecx + 0x47c5d0]
mov edx, dword [ebp - 0xe0]
xor al, byte [edx + 0x47c9d4]
mov ecx, dword [ebp - 0xe0]
xor al, byte [ecx + 0x47c094]
mov edx, dword [ebp - 0xe0]
mov byte [edx + 0x47d1dc], al
inc dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xbc]
jl 0x404af6
mov ecx, dword [ebp - 0xbc]
mov al, byte [ecx + 0x47c5d0]
mov edx, dword [ebp - 0xbc]
xor al, byte [edx + 0x47c9d4]
mov ecx, dword [ebp - 0xbc]
mov byte [ecx + 0x47d1dc], al
push 0x47c194
call fcn.00468408
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x80
jle 0x404b85
mov dword [ebp - 0xbc], 0x80
xor eax, eax
mov dword [ebp - 0xe4], eax
mov word [ebp - 0x98], 0xe0
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 0xbc]
jge 0x404be8
mov ecx, dword [ebp - 0xe4]
mov al, byte [ecx + 0x47c6d0]
mov edx, dword [ebp - 0xe4]
xor al, byte [edx + 0x47cad4]
mov ecx, dword [ebp - 0xe4]
xor al, byte [ecx + 0x47c194]
mov edx, dword [ebp - 0xe4]
mov byte [edx + 0x47d2dc], al
inc dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xbc]
jl 0x404ba4
mov ecx, dword [ebp - 0xbc]
mov al, byte [ecx + 0x47c6d0]
mov edx, dword [ebp - 0xbc]
xor al, byte [edx + 0x47cad4]
mov ecx, dword [ebp - 0xbc]
mov byte [ecx + 0x47d2dc], al
push 0x47c214
call fcn.00468408
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x80
jle 0x404c33
mov dword [ebp - 0xbc], 0x80
xor eax, eax
mov dword [ebp - 0xe8], eax
mov word [ebp - 0x98], 0xe0
mov edx, dword [ebp - 0xe8]
cmp edx, dword [ebp - 0xbc]
jge 0x404c96
mov ecx, dword [ebp - 0xe8]
mov al, byte [ecx + 0x47c750]
mov edx, dword [ebp - 0xe8]
xor al, byte [edx + 0x47cb54]
mov ecx, dword [ebp - 0xe8]
xor al, byte [ecx + 0x47c214]
mov edx, dword [ebp - 0xe8]
mov byte [edx + 0x47d35c], al
inc dword [ebp - 0xe8]
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0xbc]
jl 0x404c52
mov ecx, dword [ebp - 0xbc]
mov al, byte [ecx + 0x47c750]
mov edx, dword [ebp - 0xbc]
xor al, byte [edx + 0x47cb54]
mov ecx, dword [ebp - 0xbc]
mov byte [ecx + 0x47d35c], al
push 0x47be94
call fcn.00468408
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xff
jle 0x404ce1
mov dword [ebp - 0xbc], 0xff
xor eax, eax
mov dword [ebp - 0xec], eax
mov word [ebp - 0x98], 0xe0
mov edx, dword [ebp - 0xec]
cmp edx, dword [ebp - 0xbc]
jge 0x404d44
mov ecx, dword [ebp - 0xec]
mov al, byte [ecx + 0x47c7d0]
mov edx, dword [ebp - 0xec]
xor al, byte [edx + 0x47cbd4]
mov ecx, dword [ebp - 0xec]
xor al, byte [ecx + 0x47be94]
mov edx, dword [ebp - 0xec]
mov byte [edx + 0x47d3dc], al
inc dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xbc]
jl 0x404d00
mov ecx, dword [ebp - 0xbc]
mov al, byte [ecx + 0x47c7d0]
mov edx, dword [ebp - 0xbc]
xor al, byte [edx + 0x47cbd4]
mov ecx, dword [ebp - 0xbc]
mov byte [ecx + 0x47d3dc], al
mov edx, 0x47c4d0
mov ecx, 0x1014
mov eax, dword [ebp - 0xb8]
call fcn.0045dcc0
cmp eax, 0x1014
je 0x404dab
push 0x4746a9
push 0x47bc94
call fcn.004683d8
add esp, 8
push 0
push 0x4746c6
push 0x4746aa
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x404db6
mov eax, dword [ebp - 0xac]
call fcn.0040644c
mov word [ebp - 0x98], 0x44
jmp 0x404df4
cmp dword [ebp - 0xb8], 0
jle 0x404e08
mov eax, dword [ebp - 0xb8]
call fcn.0045dcf8
mov edx, dword [ebp - 0xa8]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret