Function at 0x401210
Capabilities:
Contain obfuscated stackstrings
Delete file
Execute command
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x12eb8
call fcn.00404630
mov eax, dword [0x408008]
xor eax, esp
mov dword [esp + 0x12eb4], eax
push esi
push edi
push str.Russian
push 0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 0x4052bc
push str.pat.txt
call esi
push 0x4052e4
push str.output.txt
mov dword [esp + 0x5c], eax
call esi
push 0x4052e4
push str.teemp.txt
mov dword [esp + 0x60], eax
call esi
push 0x4052e4
push str.p.txt
mov dword [esp + 0x74], eax
call esi
push 0x400
mov dword [esp + 0x8c], eax
lea eax, [esp + 0xd4]
push 0
push eax
mov dword [esp + 0x118e0], 0x75766974
mov dword [esp + 0x118e4], 0x6f787065
mov dword [esp + 0x118e8], 0x30733021
mov word [esp + 0x118ec], 0x171
mov dword [esp + 0xc8], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x98], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x34
mov byte [esp + 0x8a8], 0
lea eax, [esp + 0x8ac]
push 0x10ffc
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xorps xmm0, xmm0
movss dword [esp + 0x58], xmm0
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], edx
mov dword [esp + 0x48], 0
push 0x4052bc
push str.paklz4.exe
call esi
push 2
mov edi, eax
push 0
push edi
mov dword [esp + 0x80], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0x14
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
add esp, 4
mov esi, eax
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
add esp, 4
add esi, 0xfffffffc
mov byte [esp + 0x36], 0
mov dword [esp + 0x68], esi
mov esi, dword [esp + 0x6c]
mov byte [esp + 0x5c], 0
mov byte [esp + 0x50], 0
mov byte [esp + 0x38], 0
je 0x4013c6
nop
push esi
call edi
mov ecx, dword [esp + 0x4c]
add esp, 4
add ecx, eax
mov eax, ecx
mov dword [esp + 0x48], ecx
shr eax, 0x18
mov dword [esp + 0x38], eax
mov eax, ecx
shr eax, 0x10
mov dword [esp + 0x50], eax
mov eax, ecx
shr eax, 8
sub dword [esp + 0x68], 1
mov dword [esp + 0x5c], eax
mov byte [esp + 0x36], cl
jne 0x401390
push esi
call edi
add esp, 4
mov byte [esp + 0x56], al
push esi
call edi
add esp, 4
mov byte [esp + 0x57], al
push esi
call edi
add esp, 4
mov byte [esp + 0x37], al
push esi
call edi
mov cl, byte [esp + 0x3a]
add esp, 4
mov dl, al
cmp cl, byte [esp + 0x56]
jne 0x401d45
mov al, byte [esp + 0x57]
cmp byte [esp + 0x5c], al
jne 0x401d45
mov al, byte [esp + 0x37]
cmp byte [esp + 0x50], al
jne 0x401d45
cmp byte [esp + 0x38], dl
jne 0x401d45
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
call fcn.00401ef0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
mov dword [esp + 0x50], 4
cmp dword [esp + 0x9c], 0xa98ac7
je 0x401510
push 0x4052bc
push str.33.wav
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
push 0x4052e4
push 0x40547c
mov dword [esp + 0x6c], esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
push 0
push 0x463f0a
push esi
mov dword [esp + 0x54], eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0x1c
mov esi, 0x1004000
push dword [esp + 0x38]
push dword [esp + 0x60]
call edi
add esp, 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
sub esi, 1
jne 0x4014a2
push dword [esp + 0x38]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push esi
push esi
push str.temp.wav
call dword [sym.imp.WINMM.dll_PlaySoundW]
push 0x40547c
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
call fcn.00401ef0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea eax, [esp + 0x9c]
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::operator___int__]
sub dword [esp + 0x50], 1
jne 0x401451
push 0x405360
push str.z.log
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__ctime64]
add esp, 0xc
push eax
push str._Time_start:_s_n
push esi
call fcn.00401020
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [esp + 0x118bc]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__strtime]
mov esi, dword [esp + 0x48]
add esp, 4
cmp byte [esp + 0x118bc], 0x32
cmove esi, dword [esp + 0x60]
mov dword [esp + 0x44], esi
test esi, esi
jne 0x40159b
push 0x40537c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_puts]
add esp, 4
lea eax, [esi + 1]
pop edi
pop esi
mov ecx, dword [esp + 0x12eb4]
xor ecx, esp
call fcn.004038c4
mov esp, ebp
pop ebp
ret
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
add esp, 4
cmp esi, 0x200
jne 0x4015cb
push str.C:WindowsSystem32calc.exe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push dword [esp + 0x44]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 4
lea eax, [esp + 0x118c8]
push dword [esp + 0x44]
push 1
push esi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [esp + 0x54]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov eax, dword [esp + 0xa8]
xor ecx, ecx
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 0x14
mov edx, 0x110
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call esi
mov eax, dword [esp + 0x98]
xor ecx, ecx
add esp, 4
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call esi
add esp, 4
push dword [esp + 0x44]
call edi
add esp, 4
mov dword [esp + 0x48], eax
cmp eax, 0xffffffff
je 0x4016c7
mov esi, dword [esp + 0x48]
lea edx, [esp + 0x8a8]
xor ecx, ecx
nop dword [eax]
mov al, byte [edx]
mov byte [esp + 0x37], al
movzx eax, al
cmp esi, eax
je 0x4016aa
cmp byte [esp + 0x37], 0
je 0x401685
inc ecx
add edx, 0x110
cmp ecx, 0x100
jl 0x401660
jmp 0x4016b5
mov edx, dword [esp + 0x48]
imul eax, ecx, 0x110
inc dword [esp + 0x94]
mov dword [esp + ecx*4 + 0xa8], 1
mov byte [esp + eax + 0x8a8], dl
jmp 0x4016b1
inc dword [esp + ecx*4 + 0xa8]
inc dword [esp + 0x3c]
push dword [esp + 0x44]
call edi
add esp, 4
mov dword [esp + 0x48], eax
cmp eax, 0xffffffff
jne 0x401650
mov esi, dword [esp + 0x3c]
xor eax, eax
movd xmm0, esi
pshufd xmm0, xmm0, 0
movaps xmmword [esp + 0x70], xmm0
nop dword [eax + eax]
dec byte [esp + eax + 0x118ac]
inc eax
cmp eax, 0xe
jl 0x4016e0
cmp dword [ebp + 8], 2
mov dword [esp + 0x5c], eax
jle 0x40170d
lea eax, [esp + 0x118ac]
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm0, xmmword [esp + 0x74]
add esp, 4
mov edx, dword [esp + 0x94]
xor ecx, ecx
test edx, edx
jle 0x401813
cmp edx, 8
jb 0x4017cf
mov eax, edx
and eax, 0x80000007
jns 0x401735
dec eax
or eax, 0xfffffff8
inc eax
mov dword [esp + 0x48], edx
sub dword [esp + 0x48], eax
lea eax, [esp + 0x9bc]
cvtdq2ps xmm1, xmm0
nop word [eax + eax]
movups xmm0, xmmword [esp + ecx*4 + 0xa8]
lea eax, [eax + 0x880]
cvtdq2ps xmm0, xmm0
divps xmm0, xmm1
movss dword [eax - 0x990], xmm0
shufps xmm0, xmm0, 0xe5
movss dword [eax - 0x880], xmm0
unpckhps xmm0, xmm0
movss dword [eax - 0x770], xmm0
unpckhps xmm0, xmm0
movss dword [eax - 0x660], xmm0
movups xmm0, xmmword [esp + ecx*4 + 0xb8]
add ecx, 8
cvtdq2ps xmm0, xmm0
divps xmm0, xmm1
movss dword [eax - 0x550], xmm0
shufps xmm0, xmm0, 0xe5
movss dword [eax - 0x440], xmm0
unpckhps xmm0, xmm0
movss dword [eax - 0x330], xmm0
unpckhps xmm0, xmm0
movss dword [eax - 0x220], xmm0
cmp ecx, dword [esp + 0x48]
jl 0x401750
cmp ecx, edx
jge 0x401813
imul eax, ecx, 0x110
movd xmm1, esi
cvtdq2ps xmm1, xmm1
lea eax, [esp + eax + 0x8ac]
nop word [eax + eax]
movd xmm0, dword [esp + ecx*4 + 0xa8]
lea eax, [eax + 0x110]
cvtdq2ps xmm0, xmm0
inc ecx
divss xmm0, xmm1
movss dword [eax - 0x110], xmm0
cmp ecx, edx
jl 0x4017f0
xor eax, eax
test edx, edx
jle 0x401832
lea ecx, [esp + 0x8a8]
mov dword [esp + eax*4 + 0x4a8], ecx
inc eax
add ecx, 0x110
cmp eax, edx
jl 0x401820
cmp edx, 1
jle 0x4018d2
lea eax, [edx - 1]
lea ecx, [edx - 1]
mov dword [esp + 0x60], eax
mov dword [esp + 0x50], ecx
nop dword [eax]
test eax, eax
jle 0x4018bc
lea edx, [esp + 0x8a8]
mov dword [esp + 0x38], eax
nop
movss xmm0, dword [edx + 0x114]
comiss xmm0, dword [edx + 4]
jbe 0x4018a5
mov eax, dword [esp + 0x38]
lea edi, [esp + 0xa8]
mov ecx, 0x44
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x44
lea esi, [edx + 0x110]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x44
lea esi, [esp + 0xa8]
lea edi, [edx + 0x110]
rep movsd dword es:[edi], dword [esi]
add edx, 0x110
sub eax, 1
mov dword [esp + 0x38], eax
jne 0x401860
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x50]
sub ecx, 1
mov dword [esp + 0x50], ecx
jne 0x401850
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov edx, dword [esp + 0x94]
xor eax, eax
mov dword [esp + 0x38], eax
test edx, edx
jle 0x401943
lea esi, [esp + 0x8a8]
nop dword [eax]
nop word [eax + eax]
movss xmm1, dword [esi + 4]
mov eax, dword [esp + eax*4 + 0x4a8]
movaps xmm0, xmm1
addss xmm0, dword [esp + 0x58]
movzx eax, byte [eax]
push eax
movzx eax, byte [esi]
sub esp, 8
movss dword [esp + 0x64], xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push eax
push 0x4053b8
call fcn.00401050
mov eax, dword [esp + 0x4c]
add esp, 0x14
inc eax
add esi, 0x110
mov dword [esp + 0x38], eax
cmp eax, dword [esp + 0x94]
jl 0x4018f0
movss xmm0, dword [esp + 0x58]
sub esp, 8
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + 0x44]
push 0x405408
call fcn.00401050
mov edx, dword [esp + 0xa4]
lea ecx, [esp + 0x4b8]
call fcn.00401090
mov ecx, eax
call fcn.00401170
mov esi, dword [esp + 0x54]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
add esp, 0x14
push esi
call edi
mov edx, eax
add esp, 4
mov dword [esp + 0x38], edx
cmp edx, 0xffffffff
je 0x4019fb
nop dword [eax + eax]
mov ecx, dword [esp + 0x94]
xor edi, edi
test ecx, ecx
jle 0x4019e4
lea esi, [esp + 0x8b0]
movzx eax, byte [esi - 8]
cmp edx, eax
jne 0x4019d5
push dword [esp + 0x40]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputs]
mov ecx, dword [esp + 0x9c]
add esp, 8
mov edx, dword [esp + 0x38]
inc edi
add esi, 0x110
cmp edi, ecx
jl 0x4019b4
mov esi, dword [esp + 0x44]
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
push esi
call edi
mov edx, eax
mov dword [esp + 0x3c], eax
add esp, 4
cmp edx, 0xffffffff
jne 0x4019a0
push dword [esp + 0x40]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push 0x4052bc
push str.output.txt
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
push esi
mov dword [esp + 0x48], esi
call edi
add esp, 0xc
cmp eax, 0xffffffff
je 0x401a3f
nop dword [eax]
inc dword [esp + 0x64]
push esi
call edi
add esp, 4
cmp eax, 0xffffffff
jne 0x401a30
mov eax, dword [esp + 0x64]
and eax, 0x80000007
jns 0x401a4f
dec eax
or eax, 0xfffffff8
inc eax
push dword [esp + 0x4c]
mov dword [esp + 0x9c], eax
push 0x18
push 1
push str.Compressing
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esp + 0x5c]
lea eax, [esp + 0xa8]
push 1
push 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esp + 0x6c]
lea eax, [esp + 0xbc]
push 1
push 4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x30
mov dword [esp + 0x40], 0
cmp dword [esp + 0x94], 0
jle 0x401af7
lea esi, [esp + 0x8ac]
push dword [esp + 0x4c]
lea eax, [esi - 4]
push 1
push 0x110
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [esp + 0x5c]
push 1
push 0x110
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov eax, dword [esp + 0x60]
add esp, 0x20
inc eax
add esi, 0x110
mov dword [esp + 0x40], eax
cmp eax, dword [esp + 0x94]
jl 0x401ab1
mov esi, dword [esp + 0x3c]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov eax, dword [esp + 0x68]
add esp, 4
sub eax, dword [esp + 0x98]
mov esi, dword [esp + 0x60]
mov byte [esp + 0x36], 0
mov dword [esp + 0x40], 0
test eax, eax
jle 0x401be7
push dword [esp + 0x3c]
call edi
mov dl, byte [esp + 0x3a]
add esp, 4
movsx ecx, dl
mov dword [esp + ecx*4 + 0x70], eax
cmp dl, 7
jne 0x401bc5
mov ecx, dword [esp + 0x8c]
and esi, 0xffffff00
mov eax, dword [esp + 0x88]
and ecx, 1
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x84]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x80]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x7c]
push dword [esp + 0x4c]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x7c]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x78]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x74]
and eax, 1
add ecx, ecx
or eax, ecx
or eax, esi
mov dword [esp + 0x5c], eax
movzx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov esi, dword [esp + 0x60]
add esp, 8
xor dl, dl
mov ecx, dword [esp + 0x40]
inc dl
mov eax, dword [esp + 0x64]
inc ecx
sub eax, dword [esp + 0x98]
mov byte [esp + 0x36], dl
mov dword [esp + 0x40], ecx
cmp ecx, eax
jl 0x401b25
xor dl, dl
mov dword [esp + 0x40], 0
cmp dword [esp + 0x98], 0
mov byte [esp + 0x36], dl
jl 0x401cc9
push dword [esp + 0x3c]
movsx edi, dl
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov dword [esp + edi*4 + 0x74], eax
add esp, 4
mov eax, dword [esp + 0x98]
cmp edi, eax
jne 0x401cae
mov ecx, dword [esp + 0x8c]
and esi, 0xffffff00
mov eax, dword [esp + 0x88]
and ecx, 1
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x84]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x80]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x7c]
push dword [esp + 0x4c]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x7c]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x78]
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, dword [esp + 0x74]
and eax, 1
add ecx, ecx
or eax, ecx
or eax, esi
mov dword [esp + 0x5c], eax
movzx eax, al
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov eax, dword [esp + 0xa0]
add esp, 8
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x40]
mov dl, byte [esp + 0x36]
inc ecx
inc dl
mov dword [esp + 0x40], ecx
mov byte [esp + 0x36], dl
cmp ecx, eax
jle 0x401c03
push dword [esp + 0x44]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call esi
add esp, 4
push dword [esp + 0x3c]
call esi
add esp, 4
push dword [esp + 0x4c]
call esi
add esp, 4
cmp dword [esp + 0x5c], 0xffffffff
jae 0x401cff
push str.z.log
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add esp, 4
cmp byte [esp + 0x118c8], 0x30
jne 0x401d2f
sub esp, 0x18
mov ecx, esp
push 0xb
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push ecx
mov byte [ecx], 0
call fcn.00401db0
call fcn.00402310
add esp, 0x18
mov ecx, dword [esp + 0x12ebc]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.004038c4
mov esp, ebp
pop ebp
ret
push str._n
call fcn.00401050
add esp, 4
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3