Function at 0x4085d0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x858
mov al, 0x8b
push ebx
mov byte [esp + 0x17], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1f], al
mov al, 0x66
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
mov al, 0x81
push ebp
mov ebp, dword [esp + 0x864]
mov byte [esp + 0x29], al
mov byte [esp + 0x2f], al
mov al, 0xeb
mov cl, 0xaf
mov byte [esp + 0x30], al
mov byte [esp + 0x35], al
mov byte [esp + 0x3d], al
mov eax, dword [ebp]
push esi
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], cl
push edi
mov dl, 0x33
mov cl, 0x3b
push eax
mov dword [esp + 0x60], 0
mov byte [esp + 0x14], 0xa1
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], 0xc0
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x28], 0x38
mov byte [esp + 0x29], 0x48
mov byte [esp + 0x2b], 0xc8
mov byte [esp + 0x2c], 0xf2
mov byte [esp + 0x30], 0x1f
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], 0xdb
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], 0x4d
mov byte [esp + 0x38], 0x5a
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 8
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 1
mov byte [esp + 0x40], 0
mov byte [esp + 0x42], 0xf1
mov byte [esp + 0x43], 0xe8
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0x5d
mov byte [esp + 0x4a], 0x50
mov byte [esp + 0x4b], 0x17
mov byte [esp + 0x4c], 0x40
mov byte [esp + 0x4d], 0x70
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], 0x16
mov byte [esp + 0x50], 0xce
mov byte [esp + 0x51], 0x3a
mov byte [esp + 0x52], 0x45
mov byte [esp + 0x53], 0x84
mov byte [esp + 0x54], 0xa3
mov byte [esp + 0x55], 0xcc
mov byte [esp + 0x56], 0x77
mov byte [esp + 0x57], 0x91
mov byte [esp + 0x58], 0x59
mov byte [esp + 0x59], 0xb5
mov byte [esp + 0x5a], 0x1d
mov byte [esp + 0x5b], 0x10
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], 0x21
mov byte [esp + 0x5e], 0x47
mov byte [esp + 0x5f], 0xa2
call dword [sym.imp.MSVCRT.dll__filelength]
mov ecx, dword [ebp]
mov dword [esp + 0x68], eax
push ecx
call fcn.004063b0
add esp, 8
test eax, eax
jne 0x408743
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov cx, word [0x417d82]
test cx, cx
ja 0x40875c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
xor eax, eax
mov esi, 0x415e14
mov ax, cx
lea edi, [eax + eax*4]
shl edi, 3
lea eax, [edi + 0x417dd0]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40879a
test cl, cl
je 0x408796
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40879a
add eax, 2
add esi, 2
test cl, cl
jne 0x408772
xor eax, eax
jmp 0x40879f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4087b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
cmp dword [edi + 0x417df4], 0xe0000020
je 0x4087c9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov eax, dword [ebp]
mov ecx, dword [0x417da8]
push eax
push ecx
call fcn.00406470
mov edx, dword [ebp]
mov edi, dword [sym.imp.MSVCRT.dll__lseek]
mov esi, eax
push 0
push esi
push edx
mov dword [esp + 0x74], esi
call edi
add esp, 0x14
cmp eax, 0xffffffff
jne 0x408803
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov ecx, dword [ebp]
mov ebx, dword [sym.imp.MSVCRT.dll__read]
lea eax, [esp + 0x468]
push 0x1f4
push eax
push ecx
call ebx
add esp, 0xc
cmp eax, 0x1f4
je 0x408833
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
xor eax, eax
mov cl, 0xb9
cmp byte [esp + eax + 0x468], cl
jne 0x40884a
cmp byte [esp + eax + 0x46d], 0xac
je 0x40885f
cmp eax, 0x1ef
jge 0x408736
inc eax
cmp eax, 0x1ef
jle 0x408837
jmp 0x408871
mov dl, byte [esp + eax + 0x469]
lea ecx, [eax + 6]
mov byte [esp + 0x10], dl
mov dword [esp + 0x5c], ecx
cmp eax, 0x1ef
jg 0x4088a9
cmp byte [esp + eax + 0x468], 0xaa
jne 0x40888c
cmp byte [esp + eax + 0x469], 0xe2
je 0x4088a1
cmp eax, 0x1ef
jge 0x408736
inc eax
cmp eax, 0x1ef
jle 0x408878
jmp 0x4088a9
lea edx, [eax + esi + 3]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp]
push 0
push eax
push ecx
call edi
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4088cb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov eax, dword [ebp]
lea edx, [esp + 0x68]
push 0x1f4
push edx
push eax
call ebx
add esp, 0xc
cmp eax, 0x1f4
je 0x4088f2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], 0
lea esi, [esp + eax + 0x469]
lea ebp, [esp + eax + 0x468]
lea edi, [esp + eax + 0x46a]
mov al, byte [ebp]
cmp al, 0xaa
jne 0x408929
cmp byte [esi], 0xe2
je 0x408a4c
xor ecx, ecx
mov cl, byte [edi]
and ecx, 0x80000007
jns 0x40893a
dec ecx
or ecx, 0xfffffff8
inc ecx
and eax, 0xff
mov byte [esp + 0x14], cl
sub eax, 0x34
je 0x408a1e
sub eax, 0x8c
je 0x4089af
sub eax, 0x12
je 0x408960
inc edi
inc ebp
inc esi
jmp 0x408a33
mov ecx, dword [esp + 0x10]
and ecx, 0xff
and ecx, 0x80000007
jns 0x408977
dec ecx
or ecx, 0xfffffff8
inc ecx
mov al, byte [esp + ebx + 0x68]
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
mov cl, 8
and edx, 0xff
mov bl, al
sub cl, dl
add edi, 2
shr bl, cl
mov ecx, edx
mov edx, dword [esp + 0x18]
shl al, cl
add ebp, 2
or al, bl
add esi, 2
mov byte [esp + edx + 0x68], al
mov ebx, edx
jmp 0x408a33
mov al, byte [esi]
cmp al, 0xc0
jne 0x4089e6
mov edx, dword [esp + 0x14]
mov al, byte [esp + ebx + 0x68]
and edx, 0xff
mov cl, 8
sub cl, dl
mov bl, al
shr bl, cl
mov ecx, edx
add edi, 3
shl al, cl
mov ecx, dword [esp + 0x18]
add ebp, 3
or al, bl
add esi, 3
mov byte [esp + ecx + 0x68], al
mov ebx, ecx
jmp 0x408a33
cmp al, 0xc8
jne 0x408736
mov edx, dword [esp + 0x14]
mov al, byte [esp + ebx + 0x68]
and edx, 0xff
mov ecx, 8
sub ecx, edx
mov dl, al
shl dl, cl
mov cl, byte [esp + 0x14]
add edi, 3
shr al, cl
add ebp, 3
or al, dl
add esi, 3
mov byte [esp + ebx + 0x68], al
jmp 0x408a33
mov al, byte [esi]
mov cl, byte [esp + ebx + 0x68]
xor cl, al
add edi, 2
add ebp, 2
mov byte [esp + ebx + 0x68], cl
add esi, 2
mov eax, dword [esp + 0x1c]
mov ecx, eax
inc eax
cmp ecx, 0x64
mov dword [esp + 0x1c], eax
jg 0x408736
jmp 0x408919
mov al, byte [esp + 0x10]
test al, al
jne 0x408a5b
mov byte [esp + 0x10], 0xff
jmp 0x408a5f
dec byte [esp + 0x10]
inc ebx
cmp ebx, 0x1f4
mov dword [esp + 0x18], ebx
jl 0x4088f8
mov ecx, 0xf
lea edi, [esp + 0x68]
lea esi, [esp + 0x20]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x408a90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov al, byte [esp + 0x870]
test al, al
jne 0x408aab
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x858
ret
mov eax, dword [esp + 0x1fd]
mov edx, dword [0x417db4]
mov ecx, dword [esp + 0x64]
not eax
sub eax, edx
cmp eax, ecx
jbe 0x408ad1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x858
ret
mov dword [0x417da8], eax
xor eax, eax
mov ax, word [0x417d82]
mov esi, dword [0x417dd0]
mov ecx, 0xa
lea edx, [eax + eax*4]
shl edx, 3
mov eax, dword [edx + 0x417dd8]
lea edi, [edx + 0x417dd0]
sub esi, eax
xor eax, eax
mov dword [0x417dd0], esi
mov esi, dword [esp + 0x86c]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
push ecx
call fcn.00407a50
dec word [0x417d82]
mov edx, dword [esi]
push edx
call fcn.00407a50
mov eax, dword [esp + 0x68]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__chsize]
add esp, 0x10
xor edx, edx
cmp eax, 0xffffffff
pop edi
pop esi
setne dl
pop ebp
mov eax, edx
pop ebx
add esp, 0x858
ret