Function at 0x41dce0
Capabilities:
Check if file exists
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x7c]
sub esp, 0x13c
mov dword [ebp - 0x11c], ecx
mov dword [esp], eax
call fcn.0042f800
mov esi, dword [ebp - 0x78]
mov eax, 0x7fffffff
sub eax, esi
cmp eax, 0xb
jbe 0x41e610
mov edx, dword [ebp - 0x7c]
lea ebx, [ebp - 0x74]
mov eax, 0xf
lea ecx, [esi + 0xc]
cmp edx, ebx
cmovne eax, dword [ebp - 0x74]
mov edi, ecx
cmp ecx, eax
ja 0x41e030
add edx, esi
mov dword [edx], 0x6f637241
mov dword [edx + 4], 0x6769666e
mov dword [edx + 8], 0x7461642e
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
mov byte [eax + esi + 0xc], 0
lea eax, [ebp - 0x104]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x41e060
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x104], edx
mov edx, dword [ebp - 0x78]
mov dword [esp], eax
mov dword [ebp - 0x108], edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
sub esp, 4
cmp eax, 1
je 0x41de10
call fcn.0042c430
lea edi, [ebp - 0x7c]
mov dword [esp + 0x10], str.WriteUrl_failed
mov dword [esp + 0xc], 0x217
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [esp + 8], edi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x74], 0x74697257
mov dword [ebp - 0x70], 0x6c725565
mov dword [ebp - 0x78], 8
mov byte [ebp - 0x6c], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x41ddea
mov dword [esp], eax
call fcn.004ed8c0
xor esi, esi
mov eax, dword [ebp - 0x10c]
lea edi, [ebp - 0x104]
cmp eax, edi
je 0x41de04
mov dword [esp], eax
call fcn.004ed8c0
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 4
lea eax, [ebp - 0x10c]
lea ecx, [ebp - 0x7c]
mov dword [esp], eax
call fcn.00407c80
lea eax, [ebp - 0x7c]
sub esp, 4
lea ecx, [ebp - 0xf4]
mov dword [esp + 4], 7
mov dword [esp], eax
call fcn.004237b0
mov edx, dword [ebp - 0xf0]
sub esp, 8
test edx, edx
je 0x41e270
lea eax, [ebp - 0xd4]
lea esi, [ebp - 0xdc]
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xd4], 0
mov dword [ebp - 0x120], eax
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xf4]
mov ecx, esi
mov dword [esp], eax
call fcn.004cdfc0
mov eax, dword [ebp - 0x11c]
sub esp, 4
cmp dword [eax + 0x1dc], 2
je 0x41e090
mov ecx, dword [ebp - 0x11c]
mov dword [esp], esi
add ecx, 0x18
call fcn.004cdfc0
sub esp, 4
lea ecx, [ebp - 0x7c]
mov dword [esp + 4], esi
mov dword [esp], 6
call fcn.004239c0
sub esp, 8
cmp eax, 1
mov esi, eax
je 0x41e331
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x120]
je 0x41dee8
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xec]
cmp eax, edx
je 0x41df00
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x7c], 0x508564
cmp eax, edx
je 0x41df19
mov dword [esp], eax
call fcn.004ed8c0
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x41df70
lea eax, [ebp - 0x48]
mov dword [ebp - 0x11c], eax
mov ecx, eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.004e3180
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 8]
lea ecx, [esi + 0x1c]
sub esp, 4
cmp edx, ecx
mov edi, eax
je 0x41df50
mov dword [esp], edx
call fcn.004ed8c0
mov dword [esp], esi
call fcn.004ed8c0
test edi, edi
je 0x41df70
mov esi, edi
mov ecx, dword [ebp - 0x11c]
jmp 0x41df2b
mov esi, dword [ebp - 0x58]
test esi, esi
je 0x41dfc0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x11c], eax
mov ecx, eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
call fcn.004e3180
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 8]
lea ecx, [esi + 0x1c]
sub esp, 4
cmp edx, ecx
mov edi, eax
je 0x41dfa7
mov dword [esp], edx
call fcn.004ed8c0
mov dword [esp], esi
call fcn.004ed8c0
test edi, edi
je 0x41dfc0
mov esi, edi
mov ecx, dword [ebp - 0x11c]
jmp 0x41df82
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x41dd93
lea edx, [ebp - 0x78]
mov edi, eax
mov dword [ebp - 0x11c], edx
mov ecx, edx
mov edx, dword [edi + 0xc]
mov dword [esp], edx
call fcn.004e29c0
mov edx, dword [edi + 0x2c]
lea ecx, [edi + 0x34]
sub esp, 4
mov esi, dword [edi + 8]
cmp edx, ecx
je 0x41dffb
mov dword [esp], edx
call fcn.004ed8c0
mov edx, dword [edi + 0x14]
lea ecx, [edi + 0x1c]
cmp edx, ecx
je 0x41e00d
mov dword [esp], edx
call fcn.004ed8c0
mov dword [esp], edi
call fcn.004ed8c0
test esi, esi
je 0x41dd93
mov edi, esi
mov ecx, dword [ebp - 0x11c]
jmp 0x41dfd8
lea ecx, [ebp - 0x7c]
mov dword [esp + 0xc], 0xc
mov dword [esp + 8], str.Arconfig.dat
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004ce110
sub esp, 0x10
jmp 0x41dd44
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x104]
jmp 0x41dd75
lea eax, [ebp - 0xbc]
lea ecx, [ebp - 0xc4]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0xbc], 0x7265763f
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb8], 0x6e6f6973
mov byte [ebp - 0xb4], 0x3d
mov dword [ebp - 0xc0], 9
mov byte [ebp - 0xb3], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp + 8], eax
call fcn.004cb7a0
lea edx, [ebp - 0xa4]
sub esp, 0x10
mov dword [ebp - 0xac], edx
mov ecx, dword [eax]
lea edx, [eax + 8]
cmp ecx, edx
je 0x41e5c0
mov dword [ebp - 0xac], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xa4], ecx
mov ecx, dword [eax + 4]
mov byte [eax + 8], 0
mov dword [ebp - 0xa8], ecx
mov dword [eax], edx
lea ecx, [ebp - 0xac]
mov edx, dword [ebp - 0x11c]
mov dword [eax + 4], 0
mov eax, dword [edx + 0x168]
mov dword [esp + 4], eax
mov eax, dword [edx + 0x164]
mov dword [esp], eax
call fcn.004cde40
lea edx, [ebp - 0x8c]
sub esp, 8
mov dword [ebp - 0x94], edx
mov ecx, dword [eax]
mov dword [ebp - 0x124], edx
lea edx, [eax + 8]
cmp ecx, edx
je 0x41e591
mov dword [ebp - 0x94], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x90], ecx
mov dword [eax], edx
mov dword [eax + 4], 0
mov byte [eax + 8], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x124]
mov edx, dword [ebp - 0xdc]
je 0x41e522
cmp edx, dword [ebp - 0x120]
mov edi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x128], edi
je 0x41e560
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x128]
test edx, edx
mov edi, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], eax
je 0x41e572
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x90], 0
mov byte [edx], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x124]
je 0x41e22d
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa4]
cmp eax, edx
je 0x41e245
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xbc]
cmp eax, ecx
je 0x41de9d
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x41de9d
call fcn.0042c430
lea edx, [ebp - 0x94]
lea esi, [ebp - 0x8c]
mov dword [esp + 0x10], str.ReadIniString_domain_failed
mov dword [esp + 0xc], 0x202
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x8c], 0x74697257
mov dword [ebp - 0x88], 0x6c725565
mov dword [ebp - 0x90], 8
mov byte [ebp - 0x84], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x94]
cmp eax, esi
je 0x41e2e8
mov dword [esp], eax
call fcn.004ed8c0
lea eax, [ebp - 0xd4]
lea esi, [ebp - 0xdc]
mov dword [ebp - 0xd8], 0
mov byte [ebp - 0xd4], 0
mov dword [ebp - 0x120], eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xf0]
test eax, eax
jne 0x41de77
mov eax, dword [ebp + 8]
mov ecx, esi
mov dword [esp], eax
call fcn.004cdfc0
jmp 0x41de87
call fcn.0042c430
lea edx, [ebp - 0x94]
lea ebx, [ebp - 0x8c]
mov dword [esp + 0x10], str.WriteUrl_successed
mov dword [esp + 0xc], 0x212
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x8c], 0x74697257
mov dword [ebp - 0x88], 0x6c725565
mov dword [ebp - 0x90], 8
mov byte [ebp - 0x84], 0
call fcn.0042ce70
mov eax, dword [ebp - 0x94]
cmp eax, ebx
je 0x41e3a9
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x120]
je 0x41e3bf
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xec]
cmp eax, edx
je 0x41e3d7
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
mov dword [ebp - 0x7c], 0x508564
cmp eax, edx
je 0x41e3f0
mov dword [esp], eax
call fcn.004ed8c0
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x41e44c
lea eax, [ebp - 0x48]
mov dword [ebp - 0x11c], eax
mov ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call fcn.004e3180
mov eax, dword [ebx + 0x14]
lea edx, [ebx + 0x1c]
sub esp, 4
mov edi, dword [ebx + 8]
cmp eax, edx
je 0x41e440
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.004ed8c0
test edi, edi
je 0x41e44c
mov ebx, edi
mov ecx, dword [ebp - 0x11c]
jmp 0x41e402
mov dword [esp], ebx
call fcn.004ed8c0
test edi, edi
jne 0x41e431
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x41e4ac
lea eax, [ebp - 0x60]
mov dword [ebp - 0x11c], eax
mov ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call fcn.004e3180
mov eax, dword [ebx + 0x14]
lea edx, [ebx + 0x1c]
sub esp, 4
mov edi, dword [ebx + 8]
cmp eax, edx
je 0x41e4a0
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.004ed8c0
test edi, edi
je 0x41e4ac
mov ebx, edi
mov ecx, dword [ebp - 0x11c]
jmp 0x41e45e
mov dword [esp], ebx
call fcn.004ed8c0
test edi, edi
jne 0x41e48d
mov edi, dword [ebp - 0x70]
test edi, edi
je 0x41ddec
lea eax, [ebp - 0x78]
mov dword [ebp - 0x11c], eax
mov ecx, eax
mov eax, dword [edi + 0xc]
mov dword [esp], eax
call fcn.004e29c0
mov eax, dword [edi + 0x2c]
lea edx, [edi + 0x34]
sub esp, 4
mov ebx, dword [edi + 8]
cmp eax, edx
je 0x41e4e5
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [edi + 0x14]
lea edx, [edi + 0x1c]
cmp eax, edx
je 0x41e511
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], edi
call fcn.004ed8c0
test ebx, ebx
je 0x41ddec
mov edi, ebx
mov ecx, dword [ebp - 0x11c]
jmp 0x41e4c2
mov dword [esp], edi
call fcn.004ed8c0
test ebx, ebx
jne 0x41e507
jmp 0x41ddec
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x41e54a
cmp eax, 1
jne 0x41e5e9
movzx eax, byte [ebp - 0x8c]
mov byte [edx], al
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xd8], eax
mov byte [edx + eax], 0
mov edx, dword [ebp - 0x94]
jmp 0x41e20a
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], edi
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x124], eax
mov edx, eax
jmp 0x41e20a
mov ecx, dword [eax + 8]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x88], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x84], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x80], ecx
jmp 0x41e18c
mov ecx, dword [eax + 8]
mov dword [ebp - 0xa4], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xa0], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x9c], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x98], ecx
jmp 0x41e121
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x124]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0xdc]
jmp 0x41e54a
mov dword [esp], 0x4fcfdf
lea ebx, [ebp - 0x74]
call fcn.004e7d10
mov edx, dword [ebp - 0x7c]
mov esi, eax
cmp edx, ebx
je 0x41e630
mov dword [esp], edx
call fcn.004ed8c0
mov dword [esp], esi
call fcn.0043f8d0
mov ebx, eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x120]
je 0x41e650
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [ebp - 0xf4]
lea edx, [ebp - 0xec]
cmp eax, edx
je 0x41e668
mov dword [esp], eax
call fcn.004ed8c0
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0x508540
call fcn.0044e4a0
mov eax, dword [ebp - 0x10c]
lea edi, [ebp - 0x104]
cmp eax, edi
je 0x41e68f
mov dword [esp], eax
call fcn.004ed8c0
mov dword [esp], ebx
call fcn.0043f8d0
mov ebx, eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x124]
je 0x41e63a
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x41e63a