Function at 0x42de00
Capabilities:
Contain obfuscated stackstrings
Delete file
Get common file path
Read file on windows

Disassembly:
push ebp
xor edx, edx
mov eax, 0x64
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x74c
call fcn.0042d9c0
test eax, eax
je 0x42de84
mov ebx, eax
lea eax, [ebp - 0x40c]
mov dword [esp + 0x10], 0x100
mov esi, dword [sym.imp.gdi32.dll_ExtEscape]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x14
mov dword [esp], ebx
call esi
sub esp, 0x18
test eax, eax
jg 0x42de8c
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x600
mov dword [esp], str.Default_printer_is_not_a_PostScript_device_n
call fcn.0042b440
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteDC]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x40c], 0x74736f50
jne 0x42de5a
cmp dword [ebp - 0x408], 0x69726353
jne 0x42de5a
cmp dword [ebp - 0x405], 0x747069
jne 0x42de5a
mov ecx, dword [sym.imp.gdi32.dll_Escape]
lea edi, [ebp - 0x730]
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0x201
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov dword [ebp - 0x738], ecx
call ecx
sub esp, 0x14
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x607
xor eax, eax
mov dword [esp + 4], str.GETFACENAME_is_supported_n
mov edx, dword [ebp - 0x73c]
test edx, edx
sete al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [ebp - 0x730], 0x202
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov ecx, dword [ebp - 0x738]
call ecx
sub esp, 0x14
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x60b
xor eax, eax
mov dword [esp + 4], str.DOWNLOADFACE_is_not_supported_n
cmp dword [ebp - 0x73c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [ebp - 0x730], 0x100e
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov ecx, dword [ebp - 0x738]
call ecx
sub esp, 0x14
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x60f
xor eax, eax
mov dword [esp + 4], str.OPENCHANNEL_is_not_supported_n
cmp dword [ebp - 0x73c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [ebp - 0x730], 0x100f
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov ecx, dword [ebp - 0x738]
call ecx
sub esp, 0x14
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x613
xor eax, eax
mov dword [esp + 4], str.DOWNLOADHEADER_is_not_supported_n
cmp dword [ebp - 0x73c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [ebp - 0x730], 0x1010
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov ecx, dword [ebp - 0x738]
call ecx
sub esp, 0x14
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x617
xor eax, eax
mov dword [esp + 4], str.CLOSECHANNEL_is_not_supported_n
cmp dword [ebp - 0x73c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [ebp - 0x730], 0x1013
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 8
mov dword [esp], ebx
mov ecx, dword [ebp - 0x738]
call ecx
sub esp, 0x14
mov edi, eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x61b
xor eax, eax
cmp edi, 1
lea edi, [ebp - 0x714]
sete al
mov dword [esp + 4], str.POSTSCRIPT_PASSTHROUGH_is_not_supported_n
mov dword [esp], eax
call fcn.0042b9e0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x201
mov dword [esp], ebx
call esi
sub esp, 0x18
mov dword [ebp - 0x73c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x61e
xor eax, eax
mov dword [esp + 4], str.GETFACENAME_failed_n
cmp dword [ebp - 0x73c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x61f
mov dword [esp + 4], edi
lea edi, [ebp - 0x614]
mov dword [esp], str.face_name:__s_n
call fcn.0042b450
mov dword [esp + 4], edi
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
lea edx, [ebp - 0x510]
sub esp, 8
mov dword [esp + 0xc], edx
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x49d940
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
lea edx, [ebp - 0x510]
lea eax, [ebp - 0x728]
mov dword [ebp - 0x728], 0x14
sub esp, 0x10
mov dword [ebp - 0x720], edx
mov dword [ebp - 0x724], str.Lets_dance
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x718], 0
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_StartDocA]
sub esp, 8
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5c7
mov eax, dword [ebp - 0x72c]
mov dword [esp + 4], str.StartDoc_failed:__ld_n
test eax, eax
mov dword [esp + 8], eax
setne al
movzx eax, al
mov dword [esp], eax
call fcn.0042b9e0
lea edx, [ebp - 0x40c]
mov eax, 0x23
mov dword [ebp - 0x40a], 0x3d20250a
mov dword [ebp - 0x406], 0x203e3d3d
mov dword [ebp - 0x402], 0x6f666562
mov dword [ebp - 0x3fe], 0x44206572
mov dword [ebp - 0x3fa], 0x4c4e574f
mov dword [ebp - 0x3f6], 0x4844414f
mov dword [ebp - 0x3f2], 0x45444145
mov dword [ebp - 0x3ee], 0x3d3c2052
mov dword [ebp - 0x3ea], 0xa3d3d
mov word [ebp - 0x40c], ax
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1013
mov dword [esp], ebx
mov edi, dword [ebp - 0x738]
call edi
sub esp, 0x14
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5cc
mov eax, dword [ebp - 0x72c]
mov dword [esp + 4], str.POSTSCRIPT_PASSTHROUGH_failed:__ld_n
mov dword [esp + 8], eax
movzx edx, word [ebp - 0x40c]
cmp edx, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0042b9e0
lea ecx, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0x64616564
mov dword [ebp - 0x408], 0x66656562
mov byte [ebp - 0x404], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x100f
mov dword [esp], ebx
call esi
sub esp, 0x18
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5d0
xor eax, eax
mov dword [esp + 4], str.DOWNLOADHEADER_failed_n
cmp dword [ebp - 0x72c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
call fcn.00492bc0
lea ecx, [ebp - 0x40c]
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5d1
mov dword [esp], ecx
mov dword [esp + 4], str.deadbeef
call dword [sym.imp.msvcrt.dll_strcmp]
mov dword [esp + 4], str.DOWNLOADHEADER_failed_n
test eax, eax
setne al
movzx eax, al
mov dword [esp], eax
call fcn.0042b9e0
lea ecx, [ebp - 0x40c]
mov edx, 0x22
mov dword [ebp - 0x3ee], 0x3d3d3c20
mov word [ebp - 0x40c], dx
mov dword [ebp - 0x40a], 0x3d20250a
mov dword [ebp - 0x406], 0x203e3d3d
mov dword [ebp - 0x402], 0x65746661
mov dword [ebp - 0x3fe], 0x4f442072
mov dword [ebp - 0x3fa], 0x4f4c4e57
mov dword [ebp - 0x3f6], 0x45484441
mov dword [ebp - 0x3f2], 0x52454441
mov dword [ebp - 0x3eb], 0xa3d3d
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1013
mov dword [esp], ebx
call edi
lea edi, [ebp - 0x40c]
sub esp, 0x14
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5d6
mov eax, dword [ebp - 0x72c]
mov dword [esp + 4], str.POSTSCRIPT_PASSTHROUGH_failed:__ld_n
mov dword [esp + 8], eax
movzx edx, word [ebp - 0x40c]
cmp edx, eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0042b9e0
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_EndDoc]
sub esp, 4
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5d9
xor eax, eax
mov dword [esp + 4], str.EndDoc_failed_n
cmp dword [ebp - 0x72c], 1
sete al
mov dword [esp], eax
call fcn.0042b9e0
lea ecx, [ebp - 0x510]
mov dword [esp + 0x18], 0
mov dword [esp], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.kernel32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5dc
xor eax, eax
cmp esi, 0xffffffff
setne al
mov dword [esp + 4], str.CreateFile_failed_n
mov dword [esp], eax
call fcn.0042b9e0
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x72c]
mov dword [esp], esi
lea edi, [ebp - 0x40c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x40c]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
mov dword [ebp - 0x72c], eax
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5df
mov dword [esp + 4], str.ReadFile_failed_n
mov eax, dword [ebp - 0x72c]
mov dword [esp], eax
call fcn.0042b9e0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_CloseHandle]
movzx eax, byte [ebp - 0x40c]
mov byte [ebp - 0xd], 0
mov esi, dword [sym.imp.msvcrt.dll_strchr]
sub esp, 4
test al, al
je 0x42e729
lea esi, [esi]
nop
cmp al, 0x1b
je 0x42e6e0
cmp dword [edi], 0x4c4a5040
jne 0x42e672
mov dword [esp], edi
mov dword [esp + 4], 0xa
call esi
mov edi, eax
test eax, eax
jne 0x42e663
jmp 0x42e6ef
add edi, 1
movzx eax, byte [edi]
cmp al, 0xd
je 0x42e660
cmp al, 0xa
je 0x42e660
test al, al
jne 0x42e630
call fcn.00492bc0
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5ef
cmp dword [edi], 0x53502125
je 0x42e709
mov eax, 1
xor eax, 1
mov dword [ebp - 0x734], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str.wrong_signature:__.14s_n
mov eax, dword [ebp - 0x734]
mov dword [esp], eax
call fcn.0042b9e0
lea eax, [ebp - 0x510]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.gdi32.dll_DeleteDC]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [edi + 1], 0x25
jne 0x42e638
jmp 0x42e640
call fcn.00492bc0
lea edi, [ebp - 0x40c]
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5ef
jmp 0x42e69a
cmp dword [edi + 4], 0x6f64412d
jne 0x42e68c
xor eax, eax
cmp word [edi + 8], 0x6562
jne 0x42e68c
jmp 0x42e691
call fcn.00492bc0
lea edi, [ebp - 0x40c]
mov dword [eax], 0x49d404
mov dword [eax + 4], 0x5ef
jmp 0x42e684