Function at 0x40fb60
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x93c
mov ebp, dword [esp + 0x950]
mov dword [esp + 4], 0x4c0511
mov dword [esp + 0x2c], 1
mov eax, dword [ebp + 0x91c]
mov dword [esp], eax
call sym._fopen
mov esi, eax
mov eax, dword [ebp + 0x1cc]
mov eax, dword [eax]
test eax, 0x200000
jne 0x40fc90
mov edi, dword [sym.imp.msvcrt.dll__strnicmp]
lea ebx, [esp + 0x130]
test esi, esi
je 0x40fc78
lea esi, [esi]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1000
mov dword [esp], ebx
call sym._fgets
test eax, eax
je 0x40fc70
movzx eax, byte [esp + 0x130]
test al, al
setne cl
cmp al, 0x3b
setne dl
test cl, dl
je 0x40fbc0
cmp al, 0x23
je 0x40fbc0
mov dword [esp + 4], 0x3d
mov dword [esp], ebx
call sym._strchr
test eax, eax
je 0x40fbc0
mov dword [esp], ebx
call sym._strlen
mov byte [esp + eax + 0x130], 0
mov dword [esp + 8], 0xe
mov dword [esp + 4], ebx
mov dword [esp], str.timeout_dialog
call edi
test eax, eax
jne 0x40fbc0
mov dword [esp], ebx
lea ebx, [esp + 0x330]
mov dword [esp + 4], 0x3d
call sym._strchr
mov dword [esp + 8], 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._extract_var_string
test eax, eax
jne 0x40fdfe
lea esi, [esi]
lea esi, [esi]
mov dword [esp], esi
call sym._fclose
cmp dword [esp + 0x2c], 1
je 0x40fcc0
add esp, 0x93c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x91c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18c]
mov dword [esp], str.DEBUG:_d_d:open_timeout_dialog____opening__s_to_read_TIMEOUT_DIALOG_configuration._n
mov dword [esp + 4], eax
call sym._pprintf
jmp 0x40fba4
mov dword [esp + 4], str.Time_Out_Dialog
mov dword [esp], 0
call dword [sym.imp.USER32.dll_FindWindowA]
sub esp, 8
test eax, eax
je 0x40fd10
mov eax, dword [ebp + 0x1cc]
mov eax, dword [eax]
test eax, 0x200000
je 0x40fc7f
mov eax, dword [ebp + 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18c]
mov dword [esp], str.DEBUG:_d_d:open_timeout_dialog____timeout_dialog_gui.exe_already_running._n
mov dword [esp + 4], eax
call sym._pprintf
jmp 0x40fc7f
lea ebx, [esp + 0x530]
mov dword [esp + 8], 0x3ff
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
test eax, eax
jne 0x40fd48
jmp 0x40fd51
mov byte [ebx + eax], 0
test eax, eax
je 0x40fd51
sub eax, 1
cmp byte [ebx + eax], 0x5c
jne 0x40fd40
lea edi, [esp + 0x64]
mov ecx, 0x33
lea esi, [esp + 0x30]
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1cc]
mov dword [esp + 0x30], 0x6c5c2e2e
mov dword [esp + 0x34], 0x745c6269
mov dword [esp + 0x38], 0x6f656d69
mov dword [esp + 0x3c], 0x645f7475
mov dword [esp + 0x40], 0x6f6c6169
mov dword [esp + 0x44], 0x75675f67
mov dword [esp + 0x48], 0x69745c69
mov dword [esp + 0x4c], 0x756f656d
mov dword [esp + 0x50], 0x69645f74
mov dword [esp + 0x54], 0x676f6c61
mov dword [esp + 0x58], 0x6975675f
mov dword [esp + 0x5c], 0x6578652e
mov dword [esp + 0x60], 0
mov eax, dword [eax]
test eax, 0x200000
jne 0x40fe2b
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._strcat
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
sub esp, 8
jmp 0x40fc7f
mov dword [esp + 4], ebx
lea ebx, [esp + 0x2a]
mov dword [esp], ebx
call sym.sprintf_char__char_const__..._
lea eax, [esp + 0x2c]
mov dword [esp + 4], 0x4be242
mov dword [esp + 8], eax
mov dword [esp], ebx
call sym.sscanf_char_const__char_const__..._
jmp 0x40fc70
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 0x190]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18c]
mov dword [esp], str.DEBUG:_d_d:open_timeout_dialog____starting__s_s_n
mov dword [esp + 4], eax
call sym._pprintf
jmp 0x40fdd9