Function at 0x406d20
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413344
mov eax, dword fs:[0]
push eax
mov eax, 0x1090
call fcn.00412a60
mov eax, dword [0x41b014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
jmp 0x406d64
push 0x100
lea eax, [ebp - 0x270]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x1070]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x870]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0xc70]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0xe0], 0x89a63dc1
mov dword [ebp - 0xdc], 0xae739c24
mov dword [ebp - 0xd8], 0xb0763fee
mov dword [ebp - 0xd4], 0x819d1b8d
mov dword [ebp - 0xd0], 0xfe97661f
mov dword [ebp - 0xcc], 0x5fdf8a2b
mov dword [ebp - 0xc8], 0x2f662f5c
mov dword [ebp - 0xc4], 0xbbd63fcb
mov dword [ebp - 0xc0], 0xbcd86fbb
mov dword [ebp - 0xbc], 0x5d83803a
mov dword [ebp - 0xb8], 0x9253a1f1
mov dword [ebp - 0xb4], 0x5d6f6cfb
mov dword [ebp - 0xb0], 0x94daa7ed
mov dword [ebp - 0xac], 0x68724664
mov dword [ebp - 0xa8], 0x244d2964
mov dword [ebp - 0xa4], 0xca0dd712
mov dword [ebp - 0xa0], 0x6f206a19
mov dword [ebp - 0x9c], 0xed256bcd
mov dword [ebp - 0x98], 0x2b834
mov dword [ebp - 0x94], 0x82079112
mov dword [ebp - 0x90], 0x57b92387
mov dword [ebp - 0x8c], 0x2cf558f7
mov dword [ebp - 0x88], 0xd99a9c5f
mov dword [ebp - 0x84], 0x92beb111
mov dword [ebp - 0x80], 0xf186aa56
mov dword [ebp - 0x7c], 0xdef2f23b
mov dword [ebp - 0x78], 0xaf932e24
mov dword [ebp - 0x74], 0x77b80424
mov dword [ebp - 0x70], 0x2211ad84
mov dword [ebp - 0x6c], 0x6a781f91
mov dword [ebp - 0x68], 0x5b2734c6
mov dword [ebp - 0x64], 0x6d78651e
mov dword [ebp - 0x60], 0x82519dea
mov dword [ebp - 0x5c], 0x759112e8
mov dword [ebp - 0x58], 0x25dcdbd4
mov dword [ebp - 0x54], 0x2265fe08
mov dword [ebp - 0x170], 0x23209292
mov dword [ebp - 0x16c], 0x546b55e3
mov dword [ebp - 0x168], 0x5b33121d
mov dword [ebp - 0x164], 0x17a238bf
mov dword [ebp - 0x160], 0xced9d559
mov dword [ebp - 0x15c], 0xbf1334f6
mov dword [ebp - 0x158], 0x28993db6
mov dword [ebp - 0x154], 0x5acd0adc
mov dword [ebp - 0x150], 0x93481b4d
mov dword [ebp - 0x14c], 0x109532da
mov dword [ebp - 0x148], 0x4e7e9b09
mov dword [ebp - 0x144], 0xfb6fe2af
mov dword [ebp - 0x140], 0x32c35e27
mov dword [ebp - 0x13c], 0x3d27ad33
mov dword [ebp - 0x138], 0x5e85550
mov dword [ebp - 0x134], 0x5365b29e
mov dword [ebp - 0x130], 0x52a24bf0
mov dword [ebp - 0x12c], 0x36ee4c32
mov dword [ebp - 0x128], 0x5c36a2e2
mov dword [ebp - 0x124], 0xa5e6f287
mov dword [ebp - 0x120], 0x886d2947
mov dword [ebp - 0x11c], 0xfe2a8d9b
mov dword [ebp - 0x118], 0xec5e67d0
mov dword [ebp - 0x114], 0x5d16f4
mov ecx, 1
mov dword [ebp - 0x110], 0x43a59e73
mov dword [ebp - 0x10c], 0x2c19d273
mov dword [ebp - 0x108], 0xe185f450
mov dword [ebp - 0x104], 0xdcfc34fe
mov dword [ebp - 0x100], 0x4f1bd848
mov dword [ebp - 0xfc], 0xe797c91b
mov dword [ebp - 0xf8], 0xa2bcadda
mov dword [ebp - 0xf4], 0xcfc411b1
mov dword [ebp - 0xf0], 0x4fca1880
mov dword [ebp - 0xec], 0x5c49ca39
mov dword [ebp - 0xe8], 0xb146050d
mov dword [ebp - 0xe4], 0xc0f4bc99
mov dword [ebp - 0x50], 0xf49b8907
mov dword [ebp - 0x4c], 0x78d0ca85
mov dword [ebp - 0x48], 0x745ff20a
mov dword [ebp - 0x44], 0x1ec012ac
mov dword [ebp - 0x40], 0x19e82e70
mov dword [ebp - 0x3c], 0xedae914e
mov dword [ebp - 0x38], 0xe38abfdb
mov dword [ebp - 0x34], 0x17ac10d2
mov dword [ebp - 0x30], 0xcf2e72fc
mov dword [ebp - 0x2c], 0x38a97926
mov dword [ebp - 0x28], 0x885201c5
mov dword [ebp - 0x24], 0xc5c74a16
mov dword [ebp - 0x20], 0xebddb8a1
mov dword [ebp - 0x1c], 0x6a006a01
mov dword [ebp - 0x18], 0x89108b02
mov dword [ebp - 0x14], 0x28428bc1
call fcn.00406880
push eax
push 0x415ca0
push 0x41c6b0
call fcn.0040fe90
xor ecx, ecx
call fcn.00406880
push eax
push 0x415ca0
push 0x41c5b0
call fcn.0040fe50
add esp, 0x48
mov dword [ebp - 0x1074], 0x90
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xe0]
push 0x90
push eax
call fcn.0040a2a0
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x1074], 0x18
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push 0x18
push eax
call fcn.0040a2a0
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x1074], 0x90
push eax
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x170]
push 0x90
push eax
call fcn.0040a2a0
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x1074], 0x18
push eax
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x50]
push 0x18
push eax
call fcn.0040a2a0
add esp, 0x50
lea eax, [ebp - 0x870]
push 0
push 0x41c5b0
push eax
lea eax, [ebp - 0x270]
push eax
push 0x232a
lea eax, [ebp - 0xc70]
push eax
call dword [sym.imp.plfl32.dll_P_LoadSystem]
test eax, eax
je 0x4073f1
push 0x41c6b0
push 0x41c6b0
call dword [sym.imp.plfl32.dll_P_UserLogin]
mov edi, dword [sym.imp.plfl32.dll_P_GetLoginValue]
push 1
call edi
mov esi, eax
test esi, esi
je 0x407406
lea ecx, [ebp - 0x107c]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x1078]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push esi
lea ecx, [ebp - 0x107c]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
push 2
call edi
push eax
lea ecx, [ebp - 0x109c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x1078]
push dword [ebp - 0x107c]
push str._ws__ws
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x109c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [0x41bc98]
push 1
push dword [ebp - 0x1078]
push 0
call dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneText]
push 2
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
push 0x415ca0
push 0x41c6d8
call fcn.0040fe50
add esp, 0xc
cmp byte [esi], 0x52
jne 0x4073d7
cmp byte [esi + 4], 0x74
jne 0x4073d7
push ecx
call fcn.00411420
sub esp, 8
call fcn.00406af0
add esp, 8
cmp dword [0x41bc64], 0
je 0x4073d2
push 0x1c
lea eax, [ebp - 0x1098]
push eax
push fcn.00405b60
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x1094]
push 0x415bc8
push 0x84
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x407320
lea ecx, [ebp - 0x1078]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x107c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x407416
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov esi, eax
lea eax, [ebp - 0x370]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x100
lea eax, [ebp - 0x470]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x109c]
mov dword [ebp - 0x109c], 0
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.00406c10
push str.Releasephysx27_netbios.dll
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x470]
push 0x415bac
push eax
call fcn.0040fe50
lea eax, [ebp - 0x470]
push 0x41583c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0x38
test edi, edi
je 0x4073d7
push edi
push ebx
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push edi
call esi
push edi
call esi
add esp, 0x18
jmp 0x4073d7
call fcn.00405b60
lea ecx, [ebp - 0x1078]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x107c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x407406
mov ecx, dword [0x41bc98]
push 1
push 0x415d14
push 0
call dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneText]
jmp 0x407416
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411c65
mov esp, ebp
pop ebp
ret