Function at 0x40ff3a
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a08
call fcn.00443a40
push edi
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x299c], eax
cmp dword [ebp - 0x299c], 0
jne 0x40ff84
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0040fc35
add esp, 4
test eax, eax
je 0x40ff7d
jmp 0x41076b
xor eax, eax
jmp 0x410770
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x288c], eax
cmp dword [ebp - 0x288c], 0
jne 0x40ffbf
push 0x10
push 0x4f7190
push 0x4f7198
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x410770
mov ecx, dword [ebp - 0x288c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x52c964], eax
cmp dword [0x52c964], 0
jne 0x40fff5
push 0x10
push 0x4f71b4
push str.Cant_load_dll_from_Res_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x410770
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2658
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x52c964]
lea edx, [ecx + eax - 0x2658]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1ff
div ecx
mov dword [0x52cc4c], edx
mov byte [ebp - 0x2678], 0x14
mov byte [ebp - 0x2677], 0x28
mov byte [ebp - 0x2676], 0x30
mov byte [ebp - 0x2675], 0x60
mov byte [ebp - 0x2674], 0xc8
mov byte [ebp - 0x2673], 0x30
mov byte [ebp - 0x2672], 0x45
mov byte [ebp - 0x2671], 0x12
mov byte [ebp - 0x2670], 0x18
mov byte [ebp - 0x266f], 0x61
mov byte [ebp - 0x266e], 0xe
mov byte [ebp - 0x266d], 0
mov byte [ebp - 0x266c], 0x22
mov byte [ebp - 0x266b], 0
mov byte [ebp - 0x266a], 0x20
mov byte [ebp - 0x2669], 0
mov byte [ebp - 0x2668], 0x90
mov byte [ebp - 0x2667], 0x66
mov byte [ebp - 0x2666], 0xe
mov byte [ebp - 0x2665], 0
mov byte [ebp - 0x2664], 0xe8
mov byte [ebp - 0x2663], 2
mov byte [ebp - 0x2662], 0x7f
mov byte [ebp - 0x2661], 0x3a
mov byte [ebp - 0x2660], 0x6b
mov byte [ebp - 0x265f], 0x23
mov byte [ebp - 0x265e], 0x36
mov byte [ebp - 0x265d], 0x20
mov byte [ebp - 0x265c], 0x80
mov byte [ebp - 0x265b], 0x60
mov byte [ebp - 0x265a], 0x30
mov byte [ebp - 0x2659], 0
push 0x4cc
lea edx, [ebp - 0x2678]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0x128
push eax
call fcn.00402e45
add esp, 0x10
mov dword [ebp - 0x2884], 0
mov cl, byte [0x52cc80]
mov byte [ebp - 0x2880], cl
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x287f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x2880]
push edx
call fcn.0040fb9d
add esp, 4
push 0x2658
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2658]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, 1
test edx, edx
je 0x4106bf
mov dword [ebp - 0x29b8], 0xffffffa4
push 0x2658
lea eax, [ebp - 0x2658]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x410204
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp - 0x2884]
push edx
mov ecx, dword [0x52cc10]
call fcn.004097b6
mov dword [ebp - 0x29b8], eax
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [0x52cc10]
call fcn.004067a0
jmp 0x410237
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x560]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x564]
push edx
mov eax, dword [ebp - 0x2884]
push eax
mov ecx, dword [0x52cc10]
call fcn.00409768
mov dword [ebp - 0x29b8], eax
cmp dword [ebp - 0x29b8], 0
je 0x41029c
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x558]
cmp edx, 1
jne 0x410289
cmp dword [0x52cbc8], 0
jne 0x410289
mov dword [0x52cbc8], 1
lea eax, [ebp - 0x2880]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040fe69
add esp, 8
test eax, eax
je 0x410289
mov dword [ebp - 0x2884], 0
jmp 0x410192
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040f9d5
add esp, 4
xor eax, eax
jmp 0x410770
lea eax, [ebp - 0x2998]
push eax
push 0x10
mov ecx, dword [ebp + 0xc]
add ecx, 0x118
push ecx
call fcn.00402dad
add esp, 0xc
test eax, eax
jne 0x4102c0
jmp 0x410766
lea edx, [ebp - 0x2998]
push edx
push 0x118
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402dad
add esp, 0xc
test eax, eax
jne 0x4102e1
jmp 0x410761
mov ecx, dword [ebp + 0xc]
add ecx, 0x5f4
push ecx
push 0x118
mov edx, dword [ebp + 0xc]
push edx
call fcn.004030cd
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 4]
test ecx, ecx
jne 0x41031c
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x558]
cmp eax, 1
jne 0x410461
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29d4]
push edx
mov ecx, dword [0x52cc10]
call fcn.0040d193
test eax, eax
je 0x41033e
jmp 0x41075c
mov al, byte [0x52cc84]
mov byte [ebp - 0x29d0], al
xor ecx, ecx
mov dword [ebp - 0x29cf], ecx
mov dword [ebp - 0x29cb], ecx
mov dword [ebp - 0x29c7], ecx
mov dword [ebp - 0x29c3], ecx
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29d0]
push eax
mov ecx, dword [0x52cc10]
call fcn.0040d427
test eax, eax
je 0x410385
jmp 0x410757
lea ecx, [ebp - 0x29d0]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x105
push edx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
je 0x4103a7
jmp 0x410752
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x126]
cmp ecx, 1
jne 0x410461
cmp dword [0x52cc78], 0
jne 0x4103f8
mov dword [0x52cc78], 1
lea edx, [ebp - 0x2880]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040fe69
add esp, 8
test eax, eax
jne 0x4103f8
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040f9d5
add esp, 4
xor eax, eax
jmp 0x410770
mov dl, byte [0x52cc88]
mov byte [ebp - 0x29f8], dl
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x29f7]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2998]
push eax
lea ecx, [ebp - 0x29f8]
push ecx
mov ecx, dword [0x52cc10]
call fcn.0040af98
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x410440
jmp 0x41074d
lea edx, [ebp - 0x29f8]
push edx
call dword [0x52cbb8]
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x410461
jmp 0x410748
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x570]
cmp ecx, 3
jne 0x4104c5
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x4104c5
lea ecx, [ebp - 0x2998]
push ecx
mov ecx, dword [0x52cc10]
call fcn.004067a0
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x568]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x56c]
push eax
mov ecx, dword [ebp - 0x2884]
push ecx
mov ecx, dword [0x52cc10]
call fcn.0040971a
test eax, eax
je 0x4104c5
jmp 0x410743
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x4104ff
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x29]
test edx, edx
je 0x4104fd
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e37f
add esp, 8
test eax, eax
jne 0x4104fd
jmp 0x41073e
jmp 0x410527
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x410527
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e37f
add esp, 8
test eax, eax
jne 0x410527
jmp 0x410739
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x2b]
test ecx, ecx
je 0x41054f
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e41d
add esp, 8
test eax, eax
jne 0x41054f
jmp 0x410734
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x570]
cmp edx, 1
je 0x410587
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x29]
test ecx, ecx
je 0x410587
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e2b0
add esp, 8
test eax, eax
jne 0x410587
jmp 0x41072f
cmp dword [0x52cc78], 0
je 0x410596
call dword [0x52cb94]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x118]
push edx
push 0x4f71d8
lea eax, [ebp - 0x29a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x11c]
push edx
push 0x4f71dc
lea eax, [ebp - 0x29b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29b4]
push edx
lea eax, [ebp - 0x29a8]
push eax
push 0
lea ecx, [ebp - 0x2890]
push ecx
mov ecx, dword [0x52cc10]
call fcn.004091e9
test eax, eax
jne 0x4106ab
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29b4]
push eax
lea ecx, [ebp - 0x29a8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040f907
add esp, 0x10
test eax, eax
jne 0x41062f
jmp 0x41072a
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2b]
test eax, eax
je 0x41065d
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [0x52cc44]
mov eax, dword [0x52cc10]
mov dword [ebp - 0x2a04], eax
mov ecx, dword [ebp - 0x2a04]
mov dword [ebp - 0x2a00], ecx
cmp dword [ebp - 0x2a00], 0
je 0x410697
push 1
mov edx, dword [ebp - 0x2a00]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2a00]
call dword [eax]
mov dword [ebp - 0x2a08], eax
jmp 0x4106a1
mov dword [ebp - 0x2a08], 0
mov eax, 1
jmp 0x410770
mov ecx, dword [ebp - 0x2884]
add ecx, 1
mov dword [ebp - 0x2884], ecx
jmp 0x410192
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x55c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x222
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x254
push edx
push 0
call fcn.004116bf
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2888], eax
mov eax, dword [ebp - 0x2888]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2894], eax
push 0
mov ecx, dword [ebp - 0x2894]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x2894]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x410770
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x4106ab
jmp 0x41000b
pop edi
mov esp, ebp
pop ebp
ret