Function at 0x10002950
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x174
push ebx
mov eax, 0x33463442
push esi
push edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0xab]
mov byte [ebp - 0xac], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edx, 0x33453443
lea edi, [ebp - 0x40]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], 0x38453243
mov dword [ebp - 0x38], 0x30423542
mov dword [ebp - 0x34], 0x38433142
mov dword [ebp - 0x24], ebx
lea esi, [ebp - 0xac]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 0x14], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp - 0x14]
mov byte [ebp - 0x174], bl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov byte [ebp - 0x110], bl
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x18
lea edi, [ebp - 0x173]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x44]
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0x36463842
mov dword [ebp - 0x3c], 0x35423943
mov dword [ebp - 0x38], 0x30423542
mov dword [ebp - 0x34], 0x30444442
mov dword [ebp - 0x30], 0x42433843
mov dword [ebp - 0x2c], 0x45444543
mov dword [ebp - 0x28], 0x45433443
mov dword [ebp - 0x24], ebx
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebp - 0x174]
sub edi, ecx
mov eax, ecx
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, dword [ebp - 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, 0x33454442
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], 0x39443242
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], 0x30433343
mov dword [ebp - 0x30], 0x45413543
mov dword [ebp - 0x24], ebx
mov ecx, 0x18
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [ebp - 0x3c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x110]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
push ebx
push 1
push 0x80000000
push edx
mov dword [ecx], ebx
call dword [0x1000762c]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x48], esi
jne 0x10002ad9
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebx
push 0xfffffffffffffffc
push esi
call edi
lea eax, [ebp - 4]
push ebx
push eax
lea ecx, [ebp - 0x10]
push 4
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x10], 0xadbef90c
je 0x10002b12
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push ebx
push 0xfffffffffffffff8
push esi
mov dword [ebp + 8], ebx
call edi
lea edx, [ebp - 4]
push ebx
push edx
lea eax, [ebp + 8]
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 8]
cmp ecx, eax
jbe 0x10002b4f
nop
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 2
push ebx
neg ecx
push ecx
push esi
call edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff8
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, ebx
mov dword [ebp - 0x14], edi
jne 0x10002b81
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push ebx
add eax, 0xfffffff8
push edx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
mov eax, 0xbacf914d
add ecx, 0xfffffff8
mov dword [ebp - 0x1c], ebx
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 7
test ecx, ecx
jle 0x10002d4e
mov esi, edi
mov dword [ebp - 8], esi
jmp 0x10002bc2
mov esi, dword [ebp - 8]
xor ebx, ebx
mov edi, 0x1000604c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x1000604c
xor edx, edx
lea edi, [ecx + 0x1000604c]
mov cl, byte [eax]
mov bl, byte [esi + edx]
xor bl, cl
inc eax
cmp eax, edi
mov byte [esi + edx], bl
jb 0x10002bf2
mov eax, 0x1000604c
inc edx
cmp edx, 0x94
jl 0x10002bde
lea edi, [ebp - 0x174]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x174]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
mov ebx, 0x94
mov edx, dword [ebp - 0xc]
test ebx, ebx
je 0x10002c44
mov al, byte [esi]
mov cl, byte [edi]
rol al, cl
mov byte [esi], al
inc esi
inc edi
dec ebx
dec edx
test edx, edx
jne 0x10002c28
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
jmp 0x10002c28
lea edi, [ebp - 0xac]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0xac]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], ecx
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
mov ebx, 0x94
mov edx, dword [ebp - 0x20]
test ebx, ebx
je 0x10002c90
mov al, byte [esi]
mov cl, byte [edi]
ror al, cl
mov byte [esi], al
inc esi
inc edi
dec ebx
dec edx
test edx, edx
jne 0x10002c74
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
jmp 0x10002c74
lea edi, [ebp - 0x110]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x110]
repne scasb al, byte es:[edi]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], edx
not ecx
dec ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
mov ebx, 0x94
mov edx, dword [ebp - 0x20]
test ebx, ebx
je 0x10002cdc
mov al, byte [esi]
mov cl, byte [edi]
rol al, cl
mov byte [esi], al
inc esi
inc edi
dec ebx
dec edx
test edx, edx
jne 0x10002cc0
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
jmp 0x10002cc0
mov edi, 0x1000604c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x1000604c
xor edx, edx
lea edi, [ecx + 0x1000604c]
mov esi, dword [ebp - 8]
mov cl, byte [eax]
mov bl, byte [esi + edx]
xor bl, cl
inc eax
cmp eax, edi
mov byte [esi + edx], bl
jb 0x10002d0f
mov eax, 0x1000604c
inc edx
cmp edx, 0x94
jl 0x10002cf8
mov edx, dword [ebp + 8]
mov eax, 0xbacf914d
mov edi, dword [ebp - 0x1c]
add esi, 0x94
lea ecx, [edx - 8]
inc edi
mul ecx
sub ecx, edx
mov dword [ebp - 0x1c], edi
shr ecx, 1
add ecx, edx
mov dword [ebp - 8], esi
shr ecx, 7
cmp edi, ecx
jl 0x10002bbd
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x14]
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
cmp dword [eax], 0xffffffff
jne 0x10002d84
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, 0xbacf914d
mov dword [ecx], edi
lea ecx, [edx - 8]
mul ecx
mov eax, ecx
pop edi
sub eax, edx
pop esi
shr eax, 1
add eax, edx
pop ebx
shr eax, 7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x30], eax
add ecx, 0xfffffff8
mov dword [ebp - 0x2c], eax
push ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
cmp eax, ebx
mov dword [0x100070c8], eax
jne 0x10002db4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov eax, 0xbacf914d
mov dword [ebp - 0x1c], ebx
lea ecx, [edx - 8]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 7
test ecx, ecx
jle 0x10002e4e
mov dword [ebp - 8], ebx
mov ebx, edi
lea eax, [ebx + 0x84]
push 0xf
lea ecx, [ebp - 0x30]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x30]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 0x14
test eax, eax
jne 0x10002e27
mov ecx, dword [0x100070c8]
mov edx, dword [ebp - 8]
mov esi, ebx
mov eax, edx
lea edi, [edx + ecx]
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
inc ecx
add eax, 0x94
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x1c]
inc esi
add ebx, 0x94
lea ecx, [eax - 8]
mov eax, 0xbacf914d
mul ecx
sub ecx, edx
mov dword [ebp - 0x1c], esi
shr ecx, 1
add ecx, edx
shr ecx, 7
cmp esi, ecx
jl 0x10002dd6
push edi
call fcn.10002940
mov edx, dword [ebp + 0xc]
mov ecx, dword [0x100070c8]
mov eax, dword [ebp - 0xc]
add esp, 4
mov dword [edx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret