Function at 0x100633f0
Capabilities:
Contain obfuscated stackstrings
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e76c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x490
push ebx
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x49b]
mov byte [ebp - 0x49c], 0
mov ebx, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
mov dword [ebp - 0x10], esp
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push esi
push eax
lea ecx, [ebp - 0x49c]
push 0x3ff
push ecx
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10063470
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea edx, [ebp - 0x49c]
push 0x1025db10
push edx
call edi
add esp, 8
cmp eax, esi
jne 0x100634a1
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [eax], 0
lea eax, [ebp - 0x49c]
push str.TVSize
push eax
call edi
add esp, 8
cmp eax, esi
jne 0x100634cf
mov eax, 0xfffffffc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 7
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov esi, eax
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x9a]
mov word [ebp - 0x9c], 0
add esp, 4
rep stosd dword es:[edi], eax
push esi
lea ecx, [ebp - 0x9c]
push str.Size:_d
push ecx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea edx, [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 0x200000
jle 0x10063539
mov eax, 0xffffffee
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x54], edi
jne 0x10063563
mov esi, 0xfffffffb
jmp 0x10063984
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x54]
xor edi, edi
lea eax, [ebp - 0x14]
push edi
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ecx
push ebx
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1006359b
mov esi, 0xfffffffa
jmp 0x10063984
xor edx, edx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x73], edx
push edi
mov dword [ebp - 0x6f], edx
push eax
mov dword [ebp - 0x6b], edx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x67], edx
push 0x18
mov dword [ebp - 0x63], edx
push ecx
mov word [ebp - 0x5f], dx
push ebx
mov byte [ebp - 0x74], 0
mov byte [ebp - 0x5d], dl
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x100635d6
mov esi, 0xfffffff9
jmp 0x10063984
mov ecx, 6
mov edi, str.TrustView_UDP_Protected.
lea esi, [ebp - 0x74]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x100635fe
push str.File_check_error
mov esi, 0xfffffff8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10063984
push str.File_check_ok
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov word [ebp - 0x1b], ax
lea ecx, [ebp - 0x14]
push eax
push ecx
lea edx, [ebp - 0x1c]
push 4
push edx
push ebx
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x19], al
mov dword [ebp - 0x14], eax
call edi
test eax, eax
jne 0x1006363b
mov esi, 0xfffffff7
jmp 0x10063984
lea eax, [ebp - 0x1c]
push 4
push eax
call fcn.10063200
xor ecx, ecx
add esp, 8
mov word [ebp - 0x4f], cx
lea edx, [ebp - 0x14]
mov esi, eax
push ecx
push edx
lea eax, [ebp - 0x50]
push 4
push eax
push ebx
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4d], cl
mov dword [ebp - 0x14], ecx
call edi
test eax, eax
jne 0x10063677
mov esi, 0xfffffff6
jmp 0x10063984
xor ecx, ecx
lea edx, [ebp - 0x14]
mov word [ebp + 9], cx
lea eax, [ebp + 8]
push ecx
push edx
push 4
push eax
push ebx
mov byte [ebp + 8], 0
mov byte [ebp + 0xb], cl
mov dword [ebp - 0x14], ecx
call edi
test eax, eax
jne 0x100636a3
mov esi, 0xfffffff5
jmp 0x10063984
lea edx, [ebp + 8]
mov ecx, 0x1025da64
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x10063708
lea edx, [ebp + 8]
mov ecx, 0x1025da58
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x10063708
lea edx, [ebp + 8]
mov ecx, 0x1025da5c
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x1006371c
lea edx, [ebp + 8]
mov ecx, 0x10280ed8
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x1006371c
lea edx, [ebp + 8]
mov ecx, 0x1025da60
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
je 0x1006371c
push str.Encrypt_Type_Error.
mov esi, 0xfffffff4
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10063984
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10063715
mov dword [eax], 5
xor esi, esi
jmp 0x10063984
cmp esi, 0x200000
jle 0x1006372e
mov esi, 0xffffffed
jmp 0x10063984
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x18], edi
jne 0x1006374b
mov esi, 0xfffffff3
jmp 0x10063984
mov ecx, esi
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
push esi
push ecx
push ebx
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10063784
mov esi, 0xfffffff2
jmp 0x10063984
lea edi, [esi + 0x31]
mov bl, 0xab
mov dl, 0xcd
mov cl, 0xa3
mov al, 0x45
push edi
mov byte [ebp - 0x4c], 0x8e
mov byte [ebp - 0x4b], 0xfd
mov byte [ebp - 0x4a], 0x40
mov byte [ebp - 0x49], 0xa9
mov byte [ebp - 0x48], 0x9e
mov byte [ebp - 0x47], 0x6a
mov byte [ebp - 0x46], bl
mov byte [ebp - 0x45], 0x3b
mov byte [ebp - 0x44], 0xcf
mov byte [ebp - 0x43], 4
mov byte [ebp - 0x42], 0x2f
mov byte [ebp - 0x41], 0xdb
mov byte [ebp - 0x40], 0xdc
mov byte [ebp - 0x3f], 0x97
mov byte [ebp - 0x3e], dl
mov byte [ebp - 0x3d], 0x22
mov byte [ebp - 0x3c], 0x78
mov byte [ebp - 0x3b], 0x70
mov byte [ebp - 0x3a], 0x60
mov byte [ebp - 0x39], 0x65
mov byte [ebp - 0x38], 0x7e
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], 0x8c
mov byte [ebp - 0x35], al
mov byte [ebp - 0x34], al
mov byte [ebp - 0x33], 0xef
mov byte [ebp - 0x32], 0x3a
mov byte [ebp - 0x31], 0x91
mov byte [ebp - 0x30], 0xe4
mov byte [ebp - 0x2f], 0xed
mov byte [ebp - 0x2e], 0xa
mov byte [ebp - 0x2d], 0x3e
mov byte [ebp - 0x2c], 0x57
mov byte [ebp - 0x2b], 0xc6
mov byte [ebp - 0x2a], 0x21
mov byte [ebp - 0x29], 0xa9
mov byte [ebp - 0x28], 0x36
mov byte [ebp - 0x27], 0x87
mov byte [ebp - 0x26], 1
mov byte [ebp - 0x25], 0xbd
mov byte [ebp - 0x24], cl
mov byte [ebp - 0x23], 0x74
mov byte [ebp - 0x22], 0xf0
mov byte [ebp - 0x21], 0xb4
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1f], 0x43
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], 0x47
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [ebp - 0x58], ebx
jne 0x10063864
mov esi, 0xfffffff1
jmp 0x10063984
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [ebp - 0x4c]
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
push eax
push ebx
push esi
push ecx
push 0x20
push edx
call fcn.10063230
cmp eax, 0xffffffff
jne 0x1006389c
mov esi, 0xfffffff0
jmp 0x10063984
add ebx, 0x60
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10063929
push str.AuName
push ebx
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov edi, eax
add esp, 8
test edi, edi
jne 0x100638cc
mov esi, 0xffffffef
jmp 0x10063984
push 0x3b
push edi
call dword [sym.imp.MSVCRT.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x10063929
push str.AuName
call dword [sym.imp.MSVCRT.dll_wcslen]
sub esi, edi
add esp, 4
sar esi, 1
sub esi, eax
push esi
push str.AuName
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
lea eax, [edi + eax*2]
lea ecx, [ebp - 0x5c]
push eax
call fcn.10077d90
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.100784b0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0
call fcn.10078300
push str.PolicyType
push ebx
call dword [sym.imp.MSVCRT.dll_wcsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x10063952
mov esi, 0xffffffee
jmp 0x10063984
push 0x3b
push esi
call dword [sym.imp.MSVCRT.dll_wcschr]
add esp, 8
test eax, eax
je 0x10063967
mov word [eax], 0
add esi, 0x16
push esi
call dword [sym.imp.MSVCRT.dll__wtoi]
mov ecx, dword [ebp + 0xc]
add esp, 4
test ecx, ecx
je 0x1006397d
mov dword [ecx], eax
xor esi, esi
jmp 0x10063984
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x10063999
mov edi, dword [sym.imp.MSVCRT.dll_free]
push eax
call edi
add esp, 4
jmp 0x1006399f
mov edi, dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100639ac
push eax
call edi
add esp, 4
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x100639b9
push eax
call edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret