Function at 0x407951
Capabilities:
Contain obfuscated stackstrings
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403338
push 0x419748
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x4014ec
push 0x4013b0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call ebx
mov ecx, eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
and dword [ebp - 4], 0
push dword [ebp + 8]
call ecx
inc eax
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x407b81
push dword [ebp + 8]
push esi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov dword [ebp - 0x1c], esi
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov ecx, esi
cmp byte [ecx], 0x5c
jne 0x407a37
lea eax, [ecx + 1]
cmp byte [eax], 0x5c
jne 0x407a37
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x407a06
cmp al, 0x5c
je 0x407a06
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x4079ee
mov eax, 1
mov eax, 0xffffffff
nop
nop
cmp byte [esi], 0
je 0x407a1b
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x407a30
cmp al, 0x5c
je 0x407a30
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
jmp 0x407a18
cmp byte [esi], 0
je 0x407a56
jmp 0x407a52
lea eax, [ecx + 1]
cmp byte [eax], 0x3a
jne 0x407a56
mov esi, eax
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
mov al, byte [esi]
test al, al
je 0x407a56
cmp al, 0x5c
jne 0x407a56
inc esi
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x3c], 0x47
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x46
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x41
mov byte [ebp - 0x34], 0x74
mov byte [ebp - 0x33], 0x74
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x62
mov byte [ebp - 0x2f], 0x75
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x41
and byte [ebp - 0x2a], 0
mov al, byte [esi]
test al, al
je 0x407b5e
cmp al, 0x5c
jne 0x407b4d
and byte [esi], 0
lea eax, [ebp - 0x3c]
push eax
push 0x4013b0
call edi
push eax
call ebx
mov dword [ebp - 0x40], eax
push dword [ebp - 0x28]
call eax
mov dword [ebp - 0x20], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
cmp dword [ebp - 0x20], 0xffffffff
jne 0x407b40
push 0
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x407b4a
mov byte [ebp - 0x54], 0x47
mov byte [ebp - 0x53], 0x65
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x4c
mov byte [ebp - 0x50], 0x61
mov byte [ebp - 0x4f], 0x73
mov byte [ebp - 0x4e], 0x74
mov byte [ebp - 0x4d], 0x45
mov byte [ebp - 0x4c], 0x72
mov byte [ebp - 0x4b], 0x72
mov byte [ebp - 0x4a], 0x6f
mov byte [ebp - 0x49], 0x72
and byte [ebp - 0x48], al
lea eax, [ebp - 0x54]
push eax
push 0x4013b0
call edi
push eax
call ebx
mov dword [ebp - 0x44], eax
call eax
cmp eax, 0xb7
je 0x407b4a
jmp 0x407b77
mov eax, dword [ebp - 0x20]
and eax, 0x10
cmp al, 0x10
jne 0x407b77
mov byte [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov dword [ebp - 0x1c], esi
jmp 0x407aa2
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov al, 1
jmp 0x407b87
push dword [ebp - 0x28]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4