Function at 0x4100ca
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a08
call fcn.00443bd0
push edi
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x299c], eax
cmp dword [ebp - 0x299c], 0
jne 0x410114
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0040fdc5
add esp, 4
test eax, eax
je 0x41010d
jmp 0x4108fb
xor eax, eax
jmp 0x410900
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x288c], eax
cmp dword [ebp - 0x288c], 0
jne 0x41014f
push 0x10
push 0x4f81dc
push 0x4f81e4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x410900
mov ecx, dword [ebp - 0x288c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x52d9a4], eax
cmp dword [0x52d9a4], 0
jne 0x410185
push 0x10
push 0x4f8200
push str.Cant_load_dll_from_Res_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x410900
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2658
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x52d9a4]
lea edx, [ecx + eax - 0x2658]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1ff
div ecx
mov dword [0x52dc8c], edx
mov byte [ebp - 0x2678], 0x14
mov byte [ebp - 0x2677], 0x28
mov byte [ebp - 0x2676], 0x30
mov byte [ebp - 0x2675], 0x60
mov byte [ebp - 0x2674], 0xc8
mov byte [ebp - 0x2673], 0x30
mov byte [ebp - 0x2672], 0x45
mov byte [ebp - 0x2671], 0x12
mov byte [ebp - 0x2670], 0x18
mov byte [ebp - 0x266f], 0x61
mov byte [ebp - 0x266e], 0xe
mov byte [ebp - 0x266d], 0
mov byte [ebp - 0x266c], 0x22
mov byte [ebp - 0x266b], 0
mov byte [ebp - 0x266a], 0x20
mov byte [ebp - 0x2669], 0
mov byte [ebp - 0x2668], 0x90
mov byte [ebp - 0x2667], 0x66
mov byte [ebp - 0x2666], 0xe
mov byte [ebp - 0x2665], 0
mov byte [ebp - 0x2664], pe_nt_image_headers32
mov byte [ebp - 0x2663], 2
mov byte [ebp - 0x2662], 0x7f
mov byte [ebp - 0x2661], 0x3a
mov byte [ebp - 0x2660], 0x6b
mov byte [ebp - 0x265f], 0x23
mov byte [ebp - 0x265e], 0x36
mov byte [ebp - 0x265d], 0x20
mov byte [ebp - 0x265c], 0x80
mov byte [ebp - 0x265b], 0x60
mov byte [ebp - 0x265a], 0x30
mov byte [ebp - 0x2659], 0
push 0x4cc
lea edx, [ebp - 0x2678]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0x128
push eax
call fcn.00402fd5
add esp, 0x10
mov dword [ebp - 0x2884], 0
mov cl, byte [0x52dcc0]
mov byte [ebp - 0x2880], cl
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x287f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x2880]
push edx
call fcn.0040fd2d
add esp, 4
push 0x2658
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2658]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, 1
test edx, edx
je 0x41084f
mov dword [ebp - 0x29b8], 0xffffffa4
push 0x2658
lea eax, [ebp - 0x2658]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x410394
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp - 0x2884]
push edx
mov ecx, dword [0x52dc50]
call fcn.00409946
mov dword [ebp - 0x29b8], eax
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [0x52dc50]
call fcn.00406930
jmp 0x4103c7
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x560]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x564]
push edx
mov eax, dword [ebp - 0x2884]
push eax
mov ecx, dword [0x52dc50]
call fcn.004098f8
mov dword [ebp - 0x29b8], eax
cmp dword [ebp - 0x29b8], 0
je 0x41042c
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x558]
cmp edx, 1
jne 0x410419
cmp dword [0x52dc08], 0
jne 0x410419
mov dword [0x52dc08], 1
lea eax, [ebp - 0x2880]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040fff9
add esp, 8
test eax, eax
je 0x410419
mov dword [ebp - 0x2884], 0
jmp 0x410322
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040fb65
add esp, 4
xor eax, eax
jmp 0x410900
lea eax, [ebp - 0x2998]
push eax
push 0x10
mov ecx, dword [ebp + 0xc]
add ecx, 0x118
push ecx
call fcn.00402f3d
add esp, 0xc
test eax, eax
jne 0x410450
jmp 0x4108f6
lea edx, [ebp - 0x2998]
push edx
push 0x118
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402f3d
add esp, 0xc
test eax, eax
jne 0x410471
jmp 0x4108f1
mov ecx, dword [ebp + 0xc]
add ecx, 0x5f4
push ecx
push 0x118
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040325d
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 4]
test ecx, ecx
jne 0x4104ac
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x558]
cmp eax, 1
jne 0x4105f1
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29d4]
push edx
mov ecx, dword [0x52dc50]
call fcn.0040d323
test eax, eax
je 0x4104ce
jmp 0x4108ec
mov al, byte [0x52dcc4]
mov byte [ebp - 0x29d0], al
xor ecx, ecx
mov dword [ebp - 0x29cf], ecx
mov dword [ebp - 0x29cb], ecx
mov dword [ebp - 0x29c7], ecx
mov dword [ebp - 0x29c3], ecx
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29d0]
push eax
mov ecx, dword [0x52dc50]
call fcn.0040d5b7
test eax, eax
je 0x410515
jmp 0x4108e7
lea ecx, [ebp - 0x29d0]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x105
push edx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
je 0x410537
jmp 0x4108e2
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x126]
cmp ecx, 1
jne 0x4105f1
cmp dword [0x52dcb8], 0
jne 0x410588
mov dword [0x52dcb8], 1
lea edx, [ebp - 0x2880]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040fff9
add esp, 8
test eax, eax
jne 0x410588
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040fb65
add esp, 4
xor eax, eax
jmp 0x410900
mov dl, byte [0x52dcc8]
mov byte [ebp - 0x29f8], dl
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x29f7]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2998]
push eax
lea ecx, [ebp - 0x29f8]
push ecx
mov ecx, dword [0x52dc50]
call fcn.0040b128
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x4105d0
jmp 0x4108dd
lea edx, [ebp - 0x29f8]
push edx
call dword [0x52dbf8]
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x4105f1
jmp 0x4108d8
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x570]
cmp ecx, 3
jne 0x410655
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x410655
lea ecx, [ebp - 0x2998]
push ecx
mov ecx, dword [0x52dc50]
call fcn.00406930
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x568]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x56c]
push eax
mov ecx, dword [ebp - 0x2884]
push ecx
mov ecx, dword [0x52dc50]
call fcn.004098aa
test eax, eax
je 0x410655
jmp 0x4108d3
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x41068f
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x29]
test edx, edx
je 0x41068d
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e50f
add esp, 8
test eax, eax
jne 0x41068d
jmp 0x4108ce
jmp 0x4106b7
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x4106b7
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e50f
add esp, 8
test eax, eax
jne 0x4106b7
jmp 0x4108c9
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x2b]
test ecx, ecx
je 0x4106df
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e5ad
add esp, 8
test eax, eax
jne 0x4106df
jmp 0x4108c4
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x570]
cmp edx, 1
je 0x410717
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x29]
test ecx, ecx
je 0x410717
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e440
add esp, 8
test eax, eax
jne 0x410717
jmp 0x4108bf
cmp dword [0x52dcb8], 0
je 0x410726
call dword [0x52dbd4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x118]
push edx
push 0x4f8224
lea eax, [ebp - 0x29a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x11c]
push edx
push 0x4f8228
lea eax, [ebp - 0x29b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29b4]
push edx
lea eax, [ebp - 0x29a8]
push eax
push 0
lea ecx, [ebp - 0x2890]
push ecx
mov ecx, dword [0x52dc50]
call fcn.00409379
test eax, eax
jne 0x41083b
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29b4]
push eax
lea ecx, [ebp - 0x29a8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040fa97
add esp, 0x10
test eax, eax
jne 0x4107bf
jmp 0x4108ba
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2b]
test eax, eax
je 0x4107ed
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [0x52dc84]
mov eax, dword [0x52dc50]
mov dword [ebp - 0x2a04], eax
mov ecx, dword [ebp - 0x2a04]
mov dword [ebp - 0x2a00], ecx
cmp dword [ebp - 0x2a00], 0
je 0x410827
push 1
mov edx, dword [ebp - 0x2a00]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2a00]
call dword [eax]
mov dword [ebp - 0x2a08], eax
jmp 0x410831
mov dword [ebp - 0x2a08], 0
mov eax, 1
jmp 0x410900
mov ecx, dword [ebp - 0x2884]
add ecx, 1
mov dword [ebp - 0x2884], ecx
jmp 0x410322
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x55c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x222
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x254
push edx
push 0
call fcn.0041184f
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2888], eax
mov eax, dword [ebp - 0x2888]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2894], eax
push 0
mov ecx, dword [ebp - 0x2894]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x2894]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x410900
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41083b
jmp 0x41019b
pop edi
mov esp, ebp
pop ebp
ret