Function at 0x425680
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3df8
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x4c2014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x104
push 0x105
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBufferSetLength]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push 0x5c
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
inc eax
lea ecx, [ebp - 0x214]
push eax
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 4
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__6]
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__6]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__6]
push str.libcurl.dll
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x4b7730
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x4b7740
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push str.MapCode.ini
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x244]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x244]
push 0
push 0
push 0
push 0
push dword [eax - 0xc]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0
push 0
call edi
mov ecx, dword [ebp - 0x244]
mov esi, eax
push 0
push 0
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ecx - 0xc]
lea ecx, [ebp - 0x244]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
push eax
push 0
push 0
call edi
lea ecx, [ebp - 0x244]
mov byte [ebp + esi - 0x110], 0
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x1c
lea eax, [ebp - 0x240]
push eax
push fcn.00425680
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x23c]
push str.libcurldll
push 0x87
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x425b38
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov dword [ebp - 0x250], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0x4b7704
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 8
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [ebp - 0x244], eax
test eax, eax
je 0x42591a
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.Networkdll
push 0x88
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x4259d4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x21c]
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
lea ecx, [ebp - 0x110]
call fcn.0042c590
lea eax, [ebp - 0x110]
push 0x4b7704
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 0xc
mov dword [ebp - 0x244], eax
test eax, eax
je 0x4259d4
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.TerSafedll
push 0x8a
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x425a8e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x220]
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
lea ecx, [ebp - 0x110]
call fcn.0042c590
lea eax, [ebp - 0x110]
push 0x4b7704
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 0xc
mov dword [ebp - 0x244], eax
test eax, eax
je 0x425a8e
push eax
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x244]
call edi
push dword [ebp - 0x244]
call edi
add esp, 0x18
push str.MapCodeini
push 0x89
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x425b38
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x110]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0x218]
mov ecx, esp
lea esi, [ebp - 0x110]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, esi
call fcn.0042c590
mov eax, esi
push 0x4b7704
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x425b38
push esi
push dword [ebp - 0x250]
push 1
push dword [ebp - 0x24c]
call ebx
push esi
call edi
push esi
call edi
add esp, 0x18
lea ecx, [ebp - 0x218]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x220]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x214]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0x100
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.t1.dll
call esi
mov ebx, eax
push str.CreateObj
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.t2.dll
mov edi, eax
call esi
add eax, 0x2ce400
lea ecx, [ebx + 0x35e598]
mov dword [0x4c5164], eax
lea esi, [ebx + 0xe21e1]
lea eax, [ebx + 0xa584fa]
mov dword [0x4c5178], ecx
mov dword [0x4c5174], eax
lea ecx, [ebx + 0x3261d0]
lea eax, [ebx + 0xa18094]
mov dword [0x4c3298], ecx
mov dword [0x4c5170], eax
lea eax, [ebx + 0x9cb469]
mov dword [0x4c516c], eax
lea eax, [ebx + 0x92a218]
push edi
mov dword [0x4c5168], eax
call fcn.004255a0
add esp, 4
mov dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
push 0x40
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x24c], 0x9051118b
mov cl, 0x57
mov eax, dword [ebp - 0x24c]
mov dword [esi], eax
mov byte [esi + 4], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044612d
mov esp, ebp
pop ebp
ret