Function at 0x417930
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488ad0
mov eax, dword fs:[0]
push eax
sub esp, 0xefc
mov eax, dword [0x4a4014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x100
lea eax, [ebp - 0x2c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0xec8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0x6c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [ebp - 0xac8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [ebp - 0xc8], 0x89a63dc1
mov dword [ebp - 0xc4], 0xae739c24
mov dword [ebp - 0xc0], 0xb0763fee
mov dword [ebp - 0xbc], 0x819d1b8d
mov dword [ebp - 0xb8], 0xfe97661f
mov dword [ebp - 0xb4], 0x5fdf8a2b
mov dword [ebp - 0xb0], 0x2f662f5c
mov dword [ebp - 0xac], 0xbbd63fcb
mov dword [ebp - 0xa8], 0xbcd86fbb
mov dword [ebp - 0xa4], 0x5d83803a
mov dword [ebp - 0xa0], 0x9253a1f1
mov dword [ebp - 0x9c], 0x5d6f6cfb
mov dword [ebp - 0x98], 0x94daa7ed
mov dword [ebp - 0x94], 0x68724664
mov dword [ebp - 0x90], 0x244d2964
mov dword [ebp - 0x8c], 0xca0dd712
mov dword [ebp - 0x88], 0x6f206a19
mov dword [ebp - 0x84], 0xed256bcd
mov dword [ebp - 0x80], 0x2b834
mov dword [ebp - 0x7c], 0x82079112
mov dword [ebp - 0x78], 0x57b92387
mov dword [ebp - 0x74], 0x2cf558f7
mov dword [ebp - 0x70], 0xd99a9c5f
mov dword [ebp - 0x6c], 0x92beb111
mov dword [ebp - 0x68], 0xf186aa56
mov dword [ebp - 0x64], 0xdef2f23b
mov dword [ebp - 0x60], 0xaf932e24
mov dword [ebp - 0x5c], 0x77b80424
mov dword [ebp - 0x58], 0x2211ad84
mov dword [ebp - 0x54], 0x6a781f91
mov dword [ebp - 0x50], 0x5b2734c6
mov dword [ebp - 0x4c], 0x6d78651e
mov dword [ebp - 0x48], 0x82519dea
mov dword [ebp - 0x44], 0x759112e8
mov dword [ebp - 0x40], 0x25dcdbd4
mov dword [ebp - 0x3c], 0x2265fe08
mov dword [ebp - 0x158], 0x8fa2142f
mov dword [ebp - 0x154], 0x67a7db4e
mov dword [ebp - 0x150], 0xc5b5ea3a
mov dword [ebp - 0x14c], 0xf7dc1066
mov dword [ebp - 0x148], 0x455e4702
mov dword [ebp - 0x144], 0xe1acc333
mov dword [ebp - 0x140], 0x2f082fd9
mov dword [ebp - 0x13c], 0x36cd9f30
mov dword [ebp - 0x138], 0xef86df79
mov dword [ebp - 0x134], 0x5902db4a
mov dword [ebp - 0x130], 0xcd804c70
mov dword [ebp - 0x12c], 0xb1dd331
mov dword [ebp - 0x128], 0x9ef383d3
mov dword [ebp - 0x124], 0xe0cec760
mov dword [ebp - 0x120], 0x5b638805
mov dword [ebp - 0x11c], 0xa02e03d8
mov dword [ebp - 0x118], 0x8f9d93ee
mov dword [ebp - 0x114], 0xd9fb205e
mov dword [ebp - 0x110], 0xe1740561
mov dword [ebp - 0x10c], 0x701111eb
mov dword [ebp - 0x108], 0x6c99e38f
mov dword [ebp - 0x104], 0xbeaf915c
mov dword [ebp - 0x100], 0xafa8c3d7
mov dword [ebp - 0xfc], 0x9dcbb1c7
mov dword [ebp - 0xf8], 0x3a199f78
mov ecx, 1
mov dword [ebp - 0xf4], 0xf2b66a63
mov dword [ebp - 0xf0], 0x365b646f
mov dword [ebp - 0xec], 0xa7db21b6
mov dword [ebp - 0xe8], 0x1e5d64aa
mov dword [ebp - 0xe4], 0xc14803f4
mov dword [ebp - 0xe0], 0x8d670833
mov dword [ebp - 0xdc], 0xc797848d
mov dword [ebp - 0xd8], 0xa0d46863
mov dword [ebp - 0xd4], 0xd4fc98fd
mov dword [ebp - 0xd0], 0x4a80ae59
mov dword [ebp - 0xcc], 0x1aa503ca
mov dword [ebp - 0xef8], 0xf49b8907
mov dword [ebp - 0xef4], 0x78d0ca85
mov dword [ebp - 0xef0], 0x745ff20a
mov dword [ebp - 0xeec], 0x1ec012ac
mov dword [ebp - 0xee8], 0x19e82e70
mov dword [ebp - 0xee4], 0xedae914e
mov dword [ebp - 0x38], 0xe38abfdb
mov dword [ebp - 0x34], 0x17ac10d2
mov dword [ebp - 0x30], 0xcf2e72fc
mov dword [ebp - 0x2c], 0x38a97926
mov dword [ebp - 0x28], 0x885201c5
mov dword [ebp - 0x24], 0xc5c74a16
mov dword [ebp - 0x20], 0xebddb8a1
mov dword [ebp - 0x1c], 0x6a006a01
mov dword [ebp - 0x18], 0x89108b02
mov dword [ebp - 0x14], 0x28428bc1
call fcn.00410bd0
push eax
push 0x49b728
push 0x4a6468
call fcn.00420640
xor ecx, ecx
call fcn.00410bd0
push eax
push 0x49b728
push 0x4a6368
call fcn.0040d9b0
add esp, 0x48
mov dword [ebp - 0xecc], 0x90
lea eax, [ebp - 0xecc]
mov edx, 0x90
lea ecx, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00413100
lea eax, [ebp - 0xecc]
mov dword [ebp - 0xecc], 0x18
push eax
lea eax, [ebp - 0x2c8]
mov edx, 0x18
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.00413100
lea eax, [ebp - 0xecc]
mov dword [ebp - 0xecc], 0x90
push eax
lea eax, [ebp - 0x6c8]
mov edx, 0x90
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x158]
call fcn.00413100
lea eax, [ebp - 0xecc]
mov dword [ebp - 0xecc], 0x18
push eax
lea eax, [ebp - 0xac8]
mov edx, 0x18
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xef8]
call fcn.00413100
push 0
push 0x4a6368
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0x232a
lea eax, [ebp - 0xac8]
push eax
call dword [sym.imp.plfl32.dll_P_LoadSystem]
test eax, eax
je 0x418296
push 0x4a6468
push 0x4a6468
call dword [sym.imp.plfl32.dll_P_UserLogin]
mov edi, dword [sym.imp.plfl32.dll_P_GetLoginValue]
push 1
call edi
push 1
mov ebx, eax
call dword [sym.imp.plfl32.dll_P_GetInfo]
mov edx, eax
mov esi, edx
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x417e01
sub esi, eax
cmp esi, 0xa
jbe 0x417e3c
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x417e11
mov edi, 0x4a65d0
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x417e20
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.plfl32.dll_P_GetLoginValue]
test ebx, ebx
je 0x4182ab
lea ecx, [ebp - 0xee0]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push ebx
lea ecx, [ebp - 0xee0]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
lea ecx, [ebp - 0xedc]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 2
mov byte [ebp - 4], 1
call dword [sym.imp.plfl32.dll_P_GetDataValue]
push eax
push 0x49b728
push 0x4a64b8
call fcn.0040d9b0
add esp, 0xc
push 2
call edi
push eax
lea ecx, [ebp - 0xed8]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0xedc]
push dword [ebp - 0xee0]
push str._ws__ws
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xed8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [0x4a5b00]
push 1
push dword [ebp - 0xedc]
push 0
call dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneText]
cmp byte [ebx], 0x52
jne 0x41827c
cmp byte [ebx + 4], 0x74
jne 0x41827c
push ecx
call fcn.0040f8a0
call fcn.004177e0
push 0x100
lea eax, [ebp - 0x1c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xecc]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xed8]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xed4]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0xed0]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 0x104
push 0x105
lea ecx, [ebp - 0xecc]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBufferSetLength]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xecc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::ReleaseBuffer]
push 0x5c
lea ecx, [ebp - 0xecc]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
inc eax
lea ecx, [ebp - 0xecc]
push eax
lea eax, [ebp - 0xf04]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__2]
push eax
lea ecx, [ebp - 0xecc]
mov byte [ebp - 4], 7
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
lea ecx, [ebp - 0xf04]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xed4]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xed0]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__4]
push str.libcurl.dll
lea ecx, [ebp - 0xecc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push str.t1.dll
lea ecx, [ebp - 0xed8]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x49bf04
lea ecx, [ebp - 0xed4]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push str.MapCode.ini
lea ecx, [ebp - 0xed0]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push 0x100
lea eax, [ebp - 0x1c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0xecc]
mov ecx, esp
lea esi, [ebp - 0x1c8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, esi
call fcn.004163e0
add esp, 4
lea eax, [ebp - 0xefc]
push 0x1c
push eax
push 0x4118a0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [ebp - 0xef8]
push str.libcurldll
push 0x87
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x418237
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 0xf04], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xf00], eax
lea eax, [ebp - 0x1c8]
push 0x49b6d0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4180f6
push ebx
push dword [ebp - 0xf04]
push 1
push dword [ebp - 0xf00]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ebx
call esi
push ebx
call esi
add esp, 0x18
push str.Networkdll
push 0x88
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x41819b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov dword [ebp - 0xf00], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov dword [ebp - 0xf04], eax
lea eax, [ebp - 0x1c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0xed4]
mov ecx, esp
lea ebx, [ebp - 0x1c8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, ebx
call fcn.004163e0
mov eax, ebx
push 0x49b6d0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41819b
push ebx
push dword [ebp - 0xf00]
push 1
push dword [ebp - 0xf04]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ebx
call esi
push ebx
call esi
add esp, 0x18
push str.MapCodeini
push 0x89
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x418237
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov dword [ebp - 0xf00], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x100
mov ebx, eax
lea eax, [ebp - 0x1c8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 8
lea eax, [ebp - 0xed0]
mov ecx, esp
lea edi, [ebp - 0x1c8]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, edi
call fcn.004163e0
mov eax, edi
push 0x49b6d0
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x418237
push edi
push dword [ebp - 0xf00]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call esi
push edi
call esi
add esp, 0x18
push str.t2.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add eax, 0x2ce400
lea ecx, [ebp - 0xed0]
mov dword [0x4a65cc], eax
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xed4]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xed8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xecc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xedc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0xee0]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
jmp 0x4182ab
mov ecx, dword [0x4a5b00]
push 1
push 0x49bf64
push 0
call dword [sym.imp.mfc140u.dll_CStatusBar::SetPaneText]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042b8bd
mov esp, ebp
pop ebp
ret