Function at 0x424ac0
Capabilities:
Extract resource via kernel32 functions
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x53299d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
mov ecx, ebp
call fcn.0051f9cb
xor esi, esi
mov dword [esp + 0x4c], esi
mov dword [ebp], 0x55d6b0
mov ecx, ebp
mov dword [ebp + 0x1c], 0x55d69c
call fcn.0052b47e
mov dword [esp + 0x4c], 1
mov dword [ebp], 0x563178
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], esi
mov byte [esp + 0x4c], 3
call fcn.0051ffd3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0x2c], eax
push 0xa
lea ecx, [ebp + 0x30]
mov byte [esp + 0x50], 4
call fcn.0051f3e7
mov dword [ebp + 0x4c], 0x563824
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x5c], esi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x64], 0xa
lea eax, [ebp + 0x68]
push eax
mov byte [esp + 0x50], 6
call fcn.004037e0
lea edi, [ebp + 0x88]
mov dword [edi], esi
lea ebx, [ebp + 0x8c]
mov dword [ebx], esi
push 0x60
mov byte [esp + 0x50], 9
call fcn.0051fe69
add esp, 4
cmp eax, esi
je 0x424b96
mov esi, eax
call fcn.00410ee0
xor esi, esi
jmp 0x424b98
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp eax, esi
je 0x424baa
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [edi]
mov edx, dword [edi + 0x10]
lea eax, [edi + 0x10]
push esi
push eax
call dword [edx + 0x48]
push 0x58
call fcn.0051fe69
mov edi, eax
add esp, 4
cmp edi, esi
je 0x424be4
mov ecx, edi
call fcn.0042ba30
mov dword [edi], 0x563100
mov dword [edi + 8], 0x5630dc
mov dword [edi + 0x10], 0x5630a4
jmp 0x424be6
xor edi, edi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp eax, esi
je 0x424bf8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x10
push 1
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_LoadResource]
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
movzx edx, word [esi + 0x36]
movzx eax, word [esi + 0x30]
movzx ecx, word [esi + 0x32]
push edx
add eax, 0x30
push eax
add ecx, 0x30
push ecx
push str.NetBox_Version__c._c_Build__d
push 0x58d190
call fcn.004bc41d
add esp, 0x14
push str.CoGetObjectContext
push 0x564440
mov dword [0x58d18c], eax
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.Set_scriptObject__Err
mov edi, str.VBScript
mov dword [0x58d1ec], eax
call fcn.004279c0
add esp, 4
test eax, eax
jne 0x424c8f
push 0x10
push 0x58d190
push str.Cannot_initializes_the_scripting_engine____
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
push str.var_scriptObject__new_Object__
mov edi, str.JScript
call fcn.004279c0
push 0x6c
call fcn.0051fe69
add esp, 8
test eax, eax
je 0x424cb5
mov ecx, eax
call fcn.00470800
jmp 0x424cb7
xor eax, eax
push eax
push 0x58d28c
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
je 0x424ccd
mov edx, dword [eax]
push eax
call dword [edx + 8]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x58d190
call fcn.00429610
push ecx
mov byte [esp + 0x54], 0xa
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.APP_Version
call fcn.0040e1f0
mov byte [esp + 0x54], 9
mov ecx, dword [0x58d28c]
call fcn.00424710
push 0x22
push 0x564344
push esi
mov eax, 0x1000
call fcn.00424a60
add esp, 8
add eax, 0x22
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0040e1f0
push ecx
mov byte [esp + 0x54], 0xb
mov ecx, esp
mov dword [esp + 0x18], esp
push str.APP_Created
call fcn.0040e1f0
mov byte [esp + 0x54], 9
mov ecx, dword [0x58d28c]
call fcn.00424650
xor ecx, ecx
xor eax, eax
mov bl, 0x2d
movzx esi, byte [ecx + 0x58d204]
mov edx, esi
shr edx, 4
mov dl, byte [edx + str.0123456789ABCDEF]
mov byte [esp + eax + 0x18], dl
inc eax
and esi, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x424d78
dec esi
or esi, 0xfffffff0
inc esi
mov dl, byte [esi + str.0123456789ABCDEF]
mov byte [esp + eax + 0x18], dl
inc eax
cmp ecx, 4
je 0x424d97
cmp ecx, 6
je 0x424d97
cmp ecx, 8
je 0x424d97
cmp ecx, 0xa
jne 0x424d9c
mov byte [esp + eax + 0x18], bl
inc eax
inc ecx
cmp ecx, 0x10
jl 0x424d54
push ecx
mov byte [esp + eax + 0x1c], 0
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.00429610
push ecx
mov byte [esp + 0x54], 0xc
mov ecx, esp
mov dword [esp + 0x18], esp
push str.APP_Info
call fcn.0040e1f0
mov byte [esp + 0x54], 9
mov ecx, dword [0x58d28c]
call fcn.00424710
mov eax, dword [0x58d230]
mov edi, 0x35363439
cmp eax, edi
jne 0x424e85
xor esi, esi
xor ecx, ecx
movzx eax, byte [esi + 0x58d1f4]
mov edx, eax
shr edx, 4
mov dl, byte [edx + str.0123456789ABCDEF]
mov byte [esp + ecx + 0x18], dl
inc ecx
and eax, reloc.OLEAUT32.dll_SafeArrayDestroy
jns 0x424e17
dec eax
or eax, 0xfffffff0
inc eax
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [esp + ecx + 0x18], al
inc ecx
cmp esi, 4
je 0x424e36
cmp esi, 6
je 0x424e36
cmp esi, 8
je 0x424e36
cmp esi, 0xa
jne 0x424e3b
mov byte [esp + ecx + 0x18], bl
inc ecx
inc esi
cmp esi, 0x10
jl 0x424df4
push ecx
mov byte [esp + ecx + 0x1c], 0
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.00429610
push ecx
mov byte [esp + 0x54], 0xd
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PROG_Info
call fcn.0040e1f0
mov byte [esp + 0x54], 9
mov ecx, dword [0x58d28c]
call fcn.00424710
cmp dword [0x58d230], edi
je 0x424e8e
mov eax, dword [0x58d3a0]
test eax, eax
jne 0x424edd
test byte [0x58d588], 1
jne 0x424ec6
mov edx, dword [0x58d588]
mov eax, 1
or edx, eax
push 0x534100
mov dword [0x58d588], edx
mov dword [0x58d584], eax
mov dword [0x58d580], 0x562afc
call fcn.004baa4a
add esp, 4
push 0x58d580
push 0x54860c
push 0x542148
call fcn.0045d010
add esp, 0xc
push 0
mov ecx, ebp
call fcn.0052abfb
push str.netbox
mov edi, eax
call fcn.00427760
push 0
mov ecx, 0x58d2f0
call fcn.0052abfb
push str.shell
mov edi, eax
call fcn.00427760
push 0x560388
xor ecx, ecx
call fcn.00427810
push 0x561118
xor ecx, ecx
call fcn.00427810
push 0x561644
xor ecx, ecx
call fcn.00427810
push 0x5607e0
xor ecx, ecx
call fcn.00427810
push 0x562500
xor ecx, ecx
call fcn.00427810
push 0x5609f4
xor ecx, ecx
call fcn.00427810
push 0x5605a8
xor ecx, ecx
call fcn.00427810
push 0x562054
xor ecx, ecx
call fcn.00427810
test byte [0x58d57c], 1
mov esi, 1
jne 0x424fa3
mov edx, dword [0x58d57c]
or edx, esi
push 0x534110
mov dword [0x58d57c], edx
mov dword [0x58d578], esi
mov dword [0x58d574], 0x562e90
call fcn.004baa4a
add esp, 4
push 0x58d574
push 0x55f218
push str.NetBox.Dictionary
call fcn.0045d010
mov al, byte [0x58d558]
add esp, 0xc
test al, 1
jne 0x424fee
mov edx, dword [0x58d558]
or edx, esi
push 0x534140
mov dword [0x58d558], edx
mov dword [0x58d554], esi
mov dword [0x58d550], 0x563bbc
call fcn.004baa4a
add esp, 4
push 0x58d550
push 0x5627b0
push str.NetBox.Queue
call fcn.0045d010
mov al, byte [0x58d570]
add esp, 0xc
test al, 1
jne 0x425039
mov edx, dword [0x58d570]
or edx, esi
push 0x534120
mov dword [0x58d570], edx
mov dword [0x58d56c], esi
mov dword [0x58d568], 0x562b34
call fcn.004baa4a
add esp, 4
push 0x58d568
push 0x55d538
push str.NetBox.Arguments
call fcn.0045d010
mov al, byte [0x58d54c]
add esp, 0xc
test al, 1
jne 0x425084
mov edx, dword [0x58d54c]
or edx, esi
push 0x534150
mov dword [0x58d54c], edx
mov dword [0x58d548], esi
mov dword [0x58d544], 0x562c6c
call fcn.004baa4a
add esp, 4
push 0x58d544
push 0x562790
push str.NetBox.List
call fcn.0045d010
mov al, byte [0x58d4c8]
add esp, 0xc
test al, 1
jne 0x4250cf
mov edx, dword [0x58d4c8]
or edx, esi
push 0x534200
mov dword [0x58d4c8], edx
mov dword [0x58d4c4], esi
mov dword [0x58d4c0], 0x563680
call fcn.004baa4a
add esp, 4
push 0x58d4c0
push 0x5626e0
push str.NetBox.MessageManager
call fcn.0045d010
mov al, byte [0x58d540]
add esp, 0xc
test al, 1
jne 0x42511a
mov edx, dword [0x58d540]
or edx, esi
push 0x534160
mov dword [0x58d540], edx
mov dword [0x58d53c], esi
mov dword [0x58d538], 0x562ca4
call fcn.004baa4a
add esp, 4
push 0x58d538
push 0x562780
push str.NetBox.Http
call fcn.0045d010
mov al, byte [0x58d564]
add esp, 0xc
test al, 1
jne 0x425165
mov edx, dword [0x58d564]
or edx, esi
push 0x534130
mov dword [0x58d564], edx
mov dword [0x58d560], esi
mov dword [0x58d55c], 0x5637e8
call fcn.004baa4a
add esp, 4
push 0x58d55c
push 0x5627e0
push str.NetBox.Stream
call fcn.0045d010
mov al, byte [0x58d534]
add esp, 0xc
test al, 1
jne 0x4251b0
mov edx, dword [0x58d534]
or edx, esi
push 0x534170
mov dword [0x58d534], edx
mov dword [0x58d530], esi
mov dword [0x58d52c], 0x56296c
call fcn.004baa4a
add esp, 4
push 0x58d52c
push 0x562770
push str.NetBox.File
call fcn.0045d010
mov al, byte [0x58d528]
add esp, 0xc
test al, 1
jne 0x4251fb
mov edx, dword [0x58d528]
or edx, esi
push 0x534180
mov dword [0x58d528], edx
mov dword [0x58d524], esi
mov dword [0x58d520], 0x563088
call fcn.004baa4a
add esp, 4
push 0x58d520
push 0x562760
push str.NetBox.Comm
call fcn.0045d010
mov al, byte [0x58d51c]
add esp, 0xc
test al, 1
jne 0x425246
mov edx, dword [0x58d51c]
or edx, esi
push 0x534190
mov dword [0x58d51c], edx
mov dword [0x58d518], esi
mov dword [0x58d514], 0x562834
call fcn.004baa4a
add esp, 4
push 0x58d514
push 0x562750
push str.NetBox.PipeLine
call fcn.0045d010
mov al, byte [0x58d510]
add esp, 0xc
test al, 1
jne 0x425291
mov edx, dword [0x58d510]
or edx, esi
push 0x5341a0
mov dword [0x58d510], edx
mov dword [0x58d50c], esi
mov dword [0x58d508], 0x5637cc
call fcn.004baa4a
add esp, 4
push 0x58d508
push 0x562740
push str.NetBox.Identity
call fcn.0045d010
mov al, byte [0x58d504]
add esp, 0xc
test al, 1
jne 0x4252dc
mov edx, dword [0x58d504]
or edx, esi
push 0x5341b0
mov dword [0x58d504], edx
mov dword [0x58d500], esi
mov dword [0x58d4fc], 0x56313c
call fcn.004baa4a
add esp, 4
push 0x58d4fc
push 0x562730
push str.NetBox.Hash
call fcn.0045d010
mov al, byte [0x58d4f8]
add esp, 0xc
test al, 1
jne 0x425327
mov edx, dword [0x58d4f8]
or edx, esi
push 0x5341c0
mov dword [0x58d4f8], edx
mov dword [0x58d4f4], esi
mov dword [0x58d4f0], 0x563120
call fcn.004baa4a
add esp, 4
push 0x58d4f0
push 0x562720
push str.NetBox.RSA
call fcn.0045d010
mov al, byte [0x58d4ec]
add esp, 0xc
test al, 1
jne 0x425372
mov edx, dword [0x58d4ec]
or edx, esi
push 0x5341d0
mov dword [0x58d4ec], edx
mov dword [0x58d4e8], esi
mov dword [0x58d4e4], 0x562c88
call fcn.004baa4a
add esp, 4
push 0x58d4e4
push 0x562710
push str.NetBox.Random
call fcn.0045d010
mov al, byte [0x58d4e0]
add esp, 0xc
test al, 1
jne 0x4253bd
mov edx, dword [0x58d4e0]
or edx, esi
push 0x5341e0
mov dword [0x58d4e0], edx
mov dword [0x58d4dc], esi
mov dword [0x58d4d8], 0x563830
call fcn.004baa4a
add esp, 4
push 0x58d4d8
push 0x562700
push str.NetBox.Cipher
call fcn.0045d010
mov al, byte [0x58d4d4]
add esp, 0xc
test al, 1
jne 0x425408
mov edx, dword [0x58d4d4]
or edx, esi
push 0x5341f0
mov dword [0x58d4d4], edx
mov dword [0x58d4d0], esi
mov dword [0x58d4cc], 0x562c50
call fcn.004baa4a
add esp, 4
push 0x58d4cc
push 0x5626f0
push str.NetBox.HtmlWindow
call fcn.0045d010
mov al, byte [0x58d4bc]
add esp, 0xc
test al, 1
jne 0x425453
mov edx, dword [0x58d4bc]
or edx, esi
push 0x534210
mov dword [0x58d4bc], edx
mov dword [0x58d4b8], esi
mov dword [0x58d4b4], 0x562b18
call fcn.004baa4a
add esp, 4
push 0x58d4b4
push 0x5626d0
push str.NetBox.UDPSocket
call fcn.0045d010
mov al, byte [0x58d4b0]
add esp, 0xc
test al, 1
jne 0x42549e
mov edx, dword [0x58d4b0]
or edx, esi
push 0x534220
mov dword [0x58d4b0], edx
mov dword [0x58d4ac], esi
mov dword [0x58d4a8], 0x563244
call fcn.004baa4a
add esp, 4
push 0x58d4a8
push 0x5626c0
push str.NetBox.Image
call fcn.0045d010
mov al, byte [0x58d4a4]
add esp, 0xc
test al, 1
jne 0x4254e9
mov edx, dword [0x58d4a4]
or edx, esi
push 0x534230
mov dword [0x58d4a4], edx
mov dword [0x58d4a0], esi
mov dword [0x58d49c], 0x562f80
call fcn.004baa4a
add esp, 4
push 0x58d49c
push 0x5626b0
push str.NetBox.Database
call fcn.0045d010
mov al, byte [0x58d498]
add esp, 0xc
test al, 1
jne 0x425534
mov edx, dword [0x58d498]
or edx, esi
push 0x534240
mov dword [0x58d498], edx
mov dword [0x58d494], esi
mov dword [0x58d490], 0x563158
call fcn.004baa4a
add esp, 4
push 0x58d490
push 0x5626a0
push str.NetBox.Recordset
call fcn.0045d010
mov edx, dword [0x58d240]
add esp, 0xc
test edx, edx
jne 0x425559
xor eax, eax
jmp 0x425569
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425560
sub eax, esi
push eax
lea esi, [ebp + 0x2c]
push edx
mov ecx, esi
call fcn.00403060
mov eax, dword [esi]
push 0x2e
push eax
call fcn.004bb5c9
add esp, 8
test eax, eax
jne 0x42558b
or eax, 0xffffffff
jmp 0x42558d
sub eax, dword [esi]
cmp eax, 0xffffffff
jne 0x4255a9
mov eax, dword [esi]
test eax, eax
je 0x4255ad
lea edx, [eax + 1]
jmp 0x4255a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4255a0
sub eax, edx
test eax, eax
jl 0x4255e4
mov edx, dword [ebp + 0x2c]
cmp eax, dword [edx - 8]
lea ecx, [ebp + 0x2c]
jg 0x4255e4
mov dword [edx - 0xc], eax
mov edx, dword [ecx]
push 4
push str..ini
mov byte [eax + edx], 0
call fcn.00404200
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret 4
push 0x80070057
call fcn.00401780
int3