Function at 0x41009a
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a08
call fcn.00443ba0
push edi
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x299c], eax
cmp dword [ebp - 0x299c], 0
jne 0x4100e4
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.0040fd95
add esp, 4
test eax, eax
je 0x4100dd
jmp 0x4108cb
xor eax, eax
jmp 0x4108d0
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x288c], eax
cmp dword [ebp - 0x288c], 0
jne 0x41011f
push 0x10
push 0x4f81cc
push 0x4f81d4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4108d0
mov ecx, dword [ebp - 0x288c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x52d994], eax
cmp dword [0x52d994], 0
jne 0x410155
push 0x10
push 0x4f81f0
push str.Cant_load_dll_from_Res_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x4108d0
mov edx, dword [ebp - 0x299c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2658
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x52d994]
lea edx, [ecx + eax - 0x2658]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1ff
div ecx
mov dword [0x52dc7c], edx
mov byte [ebp - 0x2678], 0x14
mov byte [ebp - 0x2677], 0x28
mov byte [ebp - 0x2676], 0x30
mov byte [ebp - 0x2675], 0x60
mov byte [ebp - 0x2674], 0xc8
mov byte [ebp - 0x2673], 0x30
mov byte [ebp - 0x2672], 0x45
mov byte [ebp - 0x2671], 0x12
mov byte [ebp - 0x2670], 0x18
mov byte [ebp - 0x266f], 0x61
mov byte [ebp - 0x266e], 0xe
mov byte [ebp - 0x266d], 0
mov byte [ebp - 0x266c], 0x22
mov byte [ebp - 0x266b], 0
mov byte [ebp - 0x266a], 0x20
mov byte [ebp - 0x2669], 0
mov byte [ebp - 0x2668], 0x90
mov byte [ebp - 0x2667], 0x66
mov byte [ebp - 0x2666], 0xe
mov byte [ebp - 0x2665], 0
mov byte [ebp - 0x2664], 0xe8
mov byte [ebp - 0x2663], 2
mov byte [ebp - 0x2662], 0x7f
mov byte [ebp - 0x2661], 0x3a
mov byte [ebp - 0x2660], 0x6b
mov byte [ebp - 0x265f], 0x23
mov byte [ebp - 0x265e], 0x36
mov byte [ebp - 0x265d], 0x20
mov byte [ebp - 0x265c], 0x80
mov byte [ebp - 0x265b], 0x60
mov byte [ebp - 0x265a], 0x30
mov byte [ebp - 0x2659], 0
push 0x4cc
lea edx, [ebp - 0x2678]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0x128
push eax
call fcn.00402fd5
add esp, 0x10
mov dword [ebp - 0x2884], 0
mov cl, byte [0x52dcb0]
mov byte [ebp - 0x2880], cl
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x287f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x2880]
push edx
call fcn.0040fcfd
add esp, 4
push 0x2658
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2658]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, 1
test edx, edx
je 0x41081f
mov dword [ebp - 0x29b8], 0xffffffa4
push 0x2658
lea eax, [ebp - 0x2658]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x410364
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp - 0x2884]
push edx
mov ecx, dword [0x52dc40]
call fcn.00409946
mov dword [ebp - 0x29b8], eax
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [0x52dc40]
call fcn.00406930
jmp 0x410397
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x560]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x564]
push edx
mov eax, dword [ebp - 0x2884]
push eax
mov ecx, dword [0x52dc40]
call fcn.004098f8
mov dword [ebp - 0x29b8], eax
cmp dword [ebp - 0x29b8], 0
je 0x4103fc
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x558]
cmp edx, 1
jne 0x4103e9
cmp dword [0x52dbf8], 0
jne 0x4103e9
mov dword [0x52dbf8], 1
lea eax, [ebp - 0x2880]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040ffc9
add esp, 8
test eax, eax
je 0x4103e9
mov dword [ebp - 0x2884], 0
jmp 0x4102f2
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040fb35
add esp, 4
xor eax, eax
jmp 0x4108d0
lea eax, [ebp - 0x2998]
push eax
push 0x10
mov ecx, dword [ebp + 0xc]
add ecx, 0x118
push ecx
call fcn.00402f3d
add esp, 0xc
test eax, eax
jne 0x410420
jmp 0x4108c6
lea edx, [ebp - 0x2998]
push edx
push 0x118
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402f3d
add esp, 0xc
test eax, eax
jne 0x410441
jmp 0x4108c1
mov ecx, dword [ebp + 0xc]
add ecx, 0x5f4
push ecx
push 0x118
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040325d
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 4]
test ecx, ecx
jne 0x41047c
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x558]
cmp eax, 1
jne 0x4105c1
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29d4]
push edx
mov ecx, dword [0x52dc40]
call fcn.0040d323
test eax, eax
je 0x41049e
jmp 0x4108bc
mov al, byte [0x52dcb4]
mov byte [ebp - 0x29d0], al
xor ecx, ecx
mov dword [ebp - 0x29cf], ecx
mov dword [ebp - 0x29cb], ecx
mov dword [ebp - 0x29c7], ecx
mov dword [ebp - 0x29c3], ecx
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29d0]
push eax
mov ecx, dword [0x52dc40]
call fcn.0040d5b7
test eax, eax
je 0x4104e5
jmp 0x4108b7
lea ecx, [ebp - 0x29d0]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x105
push edx
call sub.MSVCRT.dll__stricmp
add esp, 8
test eax, eax
je 0x410507
jmp 0x4108b2
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x126]
cmp ecx, 1
jne 0x4105c1
cmp dword [0x52dca8], 0
jne 0x410558
mov dword [0x52dca8], 1
lea edx, [ebp - 0x2880]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040ffc9
add esp, 8
test eax, eax
jne 0x410558
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040fb35
add esp, 4
xor eax, eax
jmp 0x4108d0
mov dl, byte [0x52dcb8]
mov byte [ebp - 0x29f8], dl
mov ecx, 8
xor eax, eax
lea edi, [ebp - 0x29f7]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2998]
push eax
lea ecx, [ebp - 0x29f8]
push ecx
mov ecx, dword [0x52dc40]
call fcn.0040b128
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x4105a0
jmp 0x4108ad
lea edx, [ebp - 0x29f8]
push edx
call dword [0x52dbe8]
mov dword [ebp - 0x29fc], eax
cmp dword [ebp - 0x29fc], 0
je 0x4105c1
jmp 0x4108a8
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x570]
cmp ecx, 3
jne 0x410625
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x410625
lea ecx, [ebp - 0x2998]
push ecx
mov ecx, dword [0x52dc40]
call fcn.00406930
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x568]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x56c]
push eax
mov ecx, dword [ebp - 0x2884]
push ecx
mov ecx, dword [0x52dc40]
call fcn.004098aa
test eax, eax
je 0x410625
jmp 0x4108a3
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x570]
cmp eax, 1
jne 0x41065f
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x29]
test edx, edx
je 0x41065d
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e50f
add esp, 8
test eax, eax
jne 0x41065d
jmp 0x41089e
jmp 0x410687
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2a]
test eax, eax
je 0x410687
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e50f
add esp, 8
test eax, eax
jne 0x410687
jmp 0x410899
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x2b]
test ecx, ecx
je 0x4106af
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e5ad
add esp, 8
test eax, eax
jne 0x4106af
jmp 0x410894
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0x570]
cmp edx, 1
je 0x4106e7
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0x29]
test ecx, ecx
je 0x4106e7
lea edx, [ebp - 0x2998]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e440
add esp, 8
test eax, eax
jne 0x4106e7
jmp 0x41088f
cmp dword [0x52dca8], 0
je 0x4106f6
call dword [0x52dbc4]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x118]
push edx
push 0x4f8214
lea eax, [ebp - 0x29a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x11c]
push edx
push 0x4f8218
lea eax, [ebp - 0x29b4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x2998]
push ecx
lea edx, [ebp - 0x29b4]
push edx
lea eax, [ebp - 0x29a8]
push eax
push 0
lea ecx, [ebp - 0x2890]
push ecx
mov ecx, dword [0x52dc40]
call fcn.00409379
test eax, eax
jne 0x41080b
lea edx, [ebp - 0x2998]
push edx
lea eax, [ebp - 0x29b4]
push eax
lea ecx, [ebp - 0x29a8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040fa67
add esp, 0x10
test eax, eax
jne 0x41078f
jmp 0x41088a
lea eax, [ebp - 0x2998]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 0x2b]
test eax, eax
je 0x4107bd
lea ecx, [ebp - 0x2998]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [0x52dc74]
mov eax, dword [0x52dc40]
mov dword [ebp - 0x2a04], eax
mov ecx, dword [ebp - 0x2a04]
mov dword [ebp - 0x2a00], ecx
cmp dword [ebp - 0x2a00], 0
je 0x4107f7
push 1
mov edx, dword [ebp - 0x2a00]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2a00]
call dword [eax]
mov dword [ebp - 0x2a08], eax
jmp 0x410801
mov dword [ebp - 0x2a08], 0
mov eax, 1
jmp 0x4108d0
mov ecx, dword [ebp - 0x2884]
add ecx, 1
mov dword [ebp - 0x2884], ecx
jmp 0x4102f2
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x55c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x222
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x254
push edx
push 0
call fcn.0041181f
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x2888], eax
mov eax, dword [ebp - 0x2888]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x2894], eax
push 0
mov ecx, dword [ebp - 0x2894]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x2894]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4108d0
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41080b
jmp 0x41016b
pop edi
mov esp, ebp
pop ebp
ret