Function at 0x403559
Capabilities:
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov dword [ebp - 0x248], 0
jmp 0x40357d
mov eax, dword [ebp - 0x248]
add eax, 1
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x1e
jge 0x4035b7
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
je 0x4035aa
jmp 0x4035b7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40356e
push 0
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xd]
cmp ecx, 1
jne 0x4035f6
mov edx, dword [ebp - 0x24c]
push edx
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov dword [ebp - 4], eax
jmp 0x403626
mov ecx, dword [ebp - 0x24c]
add ecx, 0x1d0
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
push edx
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24c]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x403687
mov edx, dword [ebp - 4]
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x260]
push eax
call fcn.0040a601
add esp, 4
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0x41763c
push 0x417644
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x403a04
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cl, byte [eax + 0xd]
cmp ecx, 1
jne 0x4037be
mov edx, dword [ebp - 0x24c]
push edx
call fcn.004094b4
add esp, 4
push eax
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.004094ba
add esp, 4
push eax
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x268], eax
mov edx, dword [ebp - 0x268]
mov dword [ebp - 0x250], edx
push 0
push 0
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x250]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00407dd0
add esp, 0x18
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x26c], ecx
mov edx, dword [ebp - 0x26c]
push edx
call fcn.0040a601
add esp, 4
mov eax, dword [ebp - 0x24c]
add eax, 0x1d0
push eax
call fcn.0040a60c
add esp, 4
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x270]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24c]
add edx, 0x1d0
mov dword [ebp - 0x24c], edx
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00409d90
add esp, 0xc
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x274]
push ecx
call fcn.0040a601
add esp, 4
mov edx, dword [ebp - 0x254]
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x278]
push eax
call fcn.0040a601
add esp, 4
mov byte [ebp - 0x34], 0x14
mov byte [ebp - 0x33], 0x28
mov byte [ebp - 0x32], 0x30
mov byte [ebp - 0x31], 0x60
mov byte [ebp - 0x30], 0xc8
mov byte [ebp - 0x2f], 0x30
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0x18
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0xe
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x28], 0x22
mov byte [ebp - 0x27], 0
mov byte [ebp - 0x26], 0
mov byte [ebp - 0x25], 0
mov byte [ebp - 0x24], 0x90
mov byte [ebp - 0x23], 0x66
mov byte [ebp - 0x22], 0xe
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 0xe8
mov byte [ebp - 0x1f], 2
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0x23
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0x80
mov byte [ebp - 0x17], 0x60
mov byte [ebp - 0x16], 0x30
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x14], 0x19000
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx + 0xd]
cmp edx, 1
jne 0x403859
mov dword [ebp - 0x14], 0x400
mov eax, dword [ebp - 0x24c]
sub eax, 0x1d0
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x24c]
sub ecx, 0x1d0
cmp ecx, dword [ebp - 0x14]
jbe 0x403884
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x12
push ecx
push 0x64
mov edx, dword [ebp - 4]
push edx
call fcn.00404a9e
add esp, 0x10
push 0x1d0
push 0x41d708
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax - 0x1d0]
push edx
call fcn.00409d90
add esp, 0xc
push 0
push 0x41d4e8
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x403947
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004033d8
add esp, 0x14
test eax, eax
je 0x403914
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.004034e2
add esp, 8
jmp 0x403928
push 0x10
push 0x417654
push 0x41765c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
push edx
call fcn.0040a601
add esp, 4
xor eax, eax
jmp 0x403a04
mov eax, dword [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x804
push 0x68
push 0x2346
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
test eax, eax
je 0x4039e7
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
test eax, eax
jne 0x4039e7
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004033d8
add esp, 0x14
test eax, eax
je 0x4039b7
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x240]
push ecx
call fcn.004034e2
add esp, 8
jmp 0x4039cb
push 0x10
push 0x41766c
push 0x417674
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x280], edx
mov eax, dword [ebp - 0x280]
push eax
call fcn.0040a601
add esp, 4
xor eax, eax
jmp 0x403a04
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x284], ecx
mov edx, dword [ebp - 0x284]
push edx
call fcn.0040a601
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret