Function at 0x46766c
Capabilities:
Contain obfuscated stackstrings
Delete file
Extract resource via kernel32 functions

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0xbe8
push 0x100
push 0
push 0x873420
call fcn.0046dfcc
add esp, 0xc
lea esi, [esp + 0x520]
mov edi, 0x662280
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467696
lea edi, [esp + 0x520]
mov edx, 0x87e924
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x4676b6
lea eax, [esp + 0x520]
push 0x879a58
push eax
call fcn.0047115f
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x468086
push ebx
push 0x80
push 1
push 0x873420
call fcn.0047122b
push ebx
call fcn.004714c5
add esp, 0x14
mov eax, 1
mov dword [esp + 0x7ac], eax
mov edx, 1
mov dword [esp + 0x7b0], edx
lea eax, [esp + 0x8e0]
push 0x100
push 0
push eax
call fcn.0046dfcc
add esp, 0xc
mov edi, 0x873420
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x467740
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x467738
mov edx, eax
test edx, edx
jle 0x46807f
xor ebx, ebx
xor ebp, ebp
movzx esi, byte [ebx + 0x873420]
movzx eax, byte [esi + 0x59c0c0]
inc eax
movsx ecx, al
cmp ecx, 2
je 0x468019
mov ecx, ebx
inc ebx
movzx eax, byte [ecx + 0x873420]
mov esi, ebp
inc ebp
mov byte [esp + esi + 0x8e0], al
cmp ebx, edx
jl 0x46774e
xor eax, eax
mov byte [esp + ebp + 0x8e0], al
push 0x100
push eax
push 0x873420
call fcn.0046dfcc
add esp, 0xc
mov esi, 0x873420
lea edi, [esp + 0x8e0]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4677a9
mov eax, 0x873420
call fcn.00454990
lea eax, [esp + 0xae0]
push 0x100
push 0
push eax
call fcn.0046dfcc
add esp, 0xc
lea esi, [esp + 0x7b4]
mov edi, 0x87e9a8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4677e0
lea esi, [esp + 0x7b7]
mov edi, 0x87e9ac
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4677f6
lea esi, [esp + 0x7ba]
mov edi, 0x87e9b0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x46780c
lea esi, [esp + 0x7bd]
mov edi, 0x87e9b4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467822
lea esi, [esp + 0x7c0]
mov edi, 0x87e9b8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467838
lea esi, [esp + 0x7c3]
mov edi, 0x87e9bc
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x46784e
lea esi, [esp + 0x7c6]
mov edi, 0x87e9c0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467864
lea esi, [esp + 0x7c9]
mov edi, 0x87e9c4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x46787a
lea esi, [esp + 0x7cc]
mov edi, 0x87e9c8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467890
lea esi, [esp + 0x7cf]
mov edi, 0x87e9cc
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4678a6
lea esi, [esp + 0x7d2]
mov edi, 0x87d470
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4678bc
lea esi, [esp + 0x7d5]
mov edi, 0x87e9d0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4678d2
lea esi, [esp + 0x7d8]
mov edi, 0x87e9d4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4678e8
lea esi, [esp + 0x7db]
mov edi, 0x87e9d8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4678fe
lea esi, [esp + 0x7de]
mov edi, 0x87e9dc
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467914
lea esi, [esp + 0x7e1]
mov edi, 0x87e9e0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x46792a
lea esi, [esp + 0x7e4]
mov edi, 0x87e9e4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467940
lea esi, [esp + 0x7e7]
mov edi, 0x87e9e8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467956
lea esi, [esp + 0x7ea]
mov edi, 0x87e9ec
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x46796c
lea esi, [esp + 0x7ed]
mov edi, 0x87ae84
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467982
lea esi, [esp + 0x7f0]
mov edi, 0x87ae88
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467998
lea esi, [esp + 0x7f3]
mov edi, 0x87e9f0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4679ae
lea esi, [esp + 0x7f6]
mov edi, 0x87e9f4
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4679c4
lea esi, [esp + 0x7f9]
mov edi, 0x87e9f8
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4679da
lea esi, [esp + 0x7fc]
mov edi, 0x87e9fc
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x4679f0
lea esi, [esp + 0x7ff]
mov edi, 0x87ea00
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467a06
lea esi, [esp + 0x802]
mov edi, 0x87ea04
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467a1c
lea esi, [esp + 0x805]
mov edi, 0x87ea08
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467a32
xor eax, eax
mov byte [esp + eax + 0x9e0], 0
inc eax
cmp eax, 0x100
jl 0x467a3e
xor eax, eax
mov byte [esp + 0xa10], al
mov byte [esp + 0xa11], 1
mov byte [esp + 0xa12], 2
mov byte [esp + 0xa13], 3
mov byte [esp + 0xa14], 4
mov byte [esp + 0xa15], 5
mov byte [esp + 0xa16], 6
mov byte [esp + 0xa17], 7
mov byte [esp + 0xa18], 8
mov byte [esp + 0xa19], 9
mov byte [esp + 0xa21], 0xa
mov byte [esp + 0xa22], 0xb
mov byte [esp + 0xa23], 0xc
mov byte [esp + 0xa24], 0xd
mov byte [esp + 0xa25], 0xe
mov byte [esp + 0xa26], 0xf
mov byte [esp + 0xa41], 0xa
mov byte [esp + 0xa42], 0xb
mov byte [esp + 0xa43], 0xc
mov byte [esp + 0xa44], 0xd
mov byte [esp + 0xa45], 0xe
mov byte [esp + 0xa46], 0xf
lea edx, [esp + 0x6a8]
push 0x100
push eax
push edx
call fcn.0046dfcc
lea eax, [esp + 0x42c]
push 0x100
push 0
push eax
call fcn.0046dfcc
add esp, 0x18
lea esi, [esp + 0x6a8]
mov edi, 0x873420
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467b35
lea esi, [esp + 0x420]
lea edi, [esp + 0x6a8]
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467b4d
lea edi, [esp + 0x420]
mov edx, 0x879d2c
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x467b6d
lea edi, [esp + 0x6a8]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x467b90
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x467b88
mov ebx, eax
xor edx, edx
mov dword [esp + 0x628], edx
mov dword [esp + 0x62c], edx
mov dword [esp + 0x630], edx
mov dword [esp + 0x634], edx
cmp ebx, 2
jle 0x467bf0
mov ecx, 2
xor eax, eax
mov dl, byte [esp + ecx + 0x6a8]
xor ebp, ebp
cmp dl, byte [esp + ebp + 0x7b4]
je 0x468005
add ebp, 3
inc eax
cmp eax, 0x1c
jl 0x467bc5
xor eax, eax
mov dword [esp + ecx*8 + 0x628], eax
mov dword [esp + ecx*8 + 0x62c], eax
inc ecx
cmp ecx, ebx
jl 0x467bba
mov eax, dword [esp + 0x638]
shl eax, 4
mov edx, dword [esp + 0x640]
mov ecx, dword [esp + 0x644]
shld ecx, edx, 0x1e
shl edx, 0x1e
add ecx, eax
mov ebx, dword [esp + 0x648]
mov ebp, dword [esp + 0x64c]
shld ebp, ebx, 0x18
shl ebx, 0x18
add ebx, edx
adc ebp, ecx
mov esi, dword [esp + 0x650]
mov edi, dword [esp + 0x654]
shld edi, esi, 0x12
shl esi, 0x12
add esi, ebx
adc edi, ebp
mov eax, dword [esp + 0x658]
mov edx, dword [esp + 0x65c]
shld edx, eax, 0xc
shl eax, 0xc
add eax, esi
adc edx, edi
mov ebx, dword [esp + 0x660]
mov ecx, dword [esp + 0x664]
shld ecx, ebx, 6
shl ebx, 6
add ebx, eax
adc ecx, edx
add ebx, dword [esp + 0x668]
adc ecx, dword [esp + 0x66c]
push 0
push 0x1c
push ecx
push ebx
call fcn.004734e0
mov dword [esp + 0x670], eax
mov dword [esp + 0x674], edx
mov cl, byte [esp + 0x6b1]
lea ebx, [eax + eax]
add ebx, eax
cmp cl, byte [esp + ebx + 0x7b4]
je 0x467d0a
lea esi, [esp + 0x218]
mov edi, 0x662280
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467cbd
lea edi, [esp + 0x218]
mov edx, 0x87e924
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x467cdd
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x7ac]
add eax, 0xfffffffe
add esp, 0xbe8
pop ebx
pop ebp
pop esi
pop edi
ret
lea eax, [esp + 0x420]
lea edx, [esp + 0x320]
call fcn.004673b8
lea eax, [esp + 0x420]
mov edx, 0x11
call fcn.0041c070
lea edx, [esp + 0x320]
push eax
push edx
push 0x87ea0c
push 0x661a00
call fcn.00470878
add esp, 0x10
mov edi, 0x661a00
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x467d60
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x467d58
mov ecx, eax
shr ecx, 1
test ecx, ecx
jle 0x467d9b
xor edx, edx
movsx ebx, byte [edx*2 + 0x661a00]
movzx eax, byte [esp + ebx + 0x9e0]
shl eax, 4
movsx ebp, byte [edx*2 + 0x661a01]
movzx esi, byte [esp + ebp + 0x9e0]
add eax, esi
mov byte [esp + edx + 0xae0], al
inc edx
cmp edx, ecx
jl 0x467d6a
push 0x87e930
push 0x94
push dword [0x87399c]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
je 0x467ff5
push ebx
push dword [0x87399c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x7a8], eax
mov edx, eax
test edx, edx
je 0x467ff5
push ebx
push dword [0x87399c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, dword [esp + 0x7a8]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x467fe7
xor edi, edi
movzx ecx, byte [esp + 0xae0]
lea ebp, [edi + edi]
add ebp, ebp
lea edx, [ebp + ebp]
add edx, edx
add edx, edx
sub edx, ebp
lea ebp, [eax + edx]
movzx ebx, byte [edx + eax]
cmp ecx, ebx
jne 0x467e79
movzx ebx, byte [esp + 0xae1]
movzx esi, byte [edx + eax + 1]
cmp ebx, esi
jne 0x467e79
xor esi, esi
xor ebx, ebx
mov dword [esp + 0xbe4], edi
mov dword [esp + 0xbe0], eax
movzx edi, byte [esp + ebx + 0xae0]
movzx eax, byte [ebp + ebx]
cmp edi, eax
mov eax, 0
sete al
add esi, eax
inc ebx
cmp ebx, 0x18
jl 0x467e43
mov edi, dword [esp + 0xbe4]
mov eax, dword [esp + 0xbe0]
cmp esi, 0x18
je 0x467f0a
inc edi
cmp edi, 0x7531
jl 0x467e06
mov eax, dword [esp + 0x7a8]
test eax, eax
je 0x467e94
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x7b0]
cmp eax, 0x1f6
je 0x467f68
cmp eax, 0x1f7
je 0x467fda
lea esi, [esp + 0x110]
mov edi, 0x662280
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467ebd
lea edi, [esp + 0x110]
mov edx, 0x87e924
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x467edd
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x7ac]
add eax, 0xfffffffe
add esp, 0xbe8
pop ebx
pop ebp
pop esi
pop edi
ret
add dword [esp + 0x7b0], 0x1f6
movzx ecx, byte [edx + eax + 0x18]
shl ecx, 0x18
movzx ebx, byte [edx + eax + 0x19]
shl ebx, 0x10
add ecx, ebx
movzx esi, byte [edx + eax + 0x1a]
shl esi, 8
movzx ebp, byte [edx + eax + 0x1b]
add esi, ebp
add ecx, esi
movzx ebp, byte [edx + eax + 0x14]
shl ebp, 0x18
movzx edi, byte [edx + eax + 0x15]
shl edi, 0x10
add ebp, edi
movzx ebx, byte [edx + eax + 0x16]
shl ebx, 8
movzx eax, byte [edx + eax + 0x17]
add ebx, eax
add ebp, ebx
add ecx, ebp
mov dword [0x873754], ecx
jmp 0x467e82
lea esi, [esp + 8]
mov edi, 0x662280
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x467f71
lea edi, [esp + 8]
mov edx, 0x87e924
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
test al, al
jne 0x467f8e
lea eax, [esp + 8]
push 0x87a368
push eax
call fcn.0047115f
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x467fda
mov edi, 0x873420
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x467fc7
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x467fbf
push ebx
push eax
push 1
push edi
call fcn.0047272e
push ebx
call fcn.004714c5
add esp, 0x14
xor eax, eax
add esp, 0xbe8
pop ebx
pop ebp
pop esi
pop edi
ret
mov eax, dword [esp + 0x7a8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0xffffffff
add esp, 0xbe8
pop ebx
pop ebp
pop esi
pop edi
ret
cdq
mov dword [esp + ecx*8 + 0x628], eax
mov dword [esp + ecx*8 + 0x62c], edx
jmp 0x467beb
movzx eax, byte [ebx + 0x873421]
shl esi, 8
add esi, eax
push esi
mov dword [esp + 0xbe8], edx
call fcn.00472ff5
mov edx, dword [esp + 0xbe8]
add esp, 4
cmp eax, esi
jne 0x46806d
movzx ecx, byte [ebx + 0x873420]
mov byte [esp + ebp + 0x8e0], cl
lea esi, [ebx + 1]
add ebx, 2
movzx eax, byte [esi + 0x873420]
lea edi, [ebp + 1]
add ebp, 2
mov byte [esp + edi + 0x8e0], al
jmp 0x46777d
mov ecx, ebp
inc ebp
mov byte [esp + ecx + 0x8e0], al
add ebx, 2
jmp 0x46777d
xor ebp, ebp
jmp 0x467781
xor eax, eax
push eax
push 0x45cd28
push eax
push 0x87e9a0
push dword [0x87399c]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
je 0x467ff5
movsx eax, byte [0x873420]
test eax, eax
jne 0x4680c4
mov eax, 1
add esp, 0xbe8
pop ebx
pop ebp
pop esi
pop edi
ret
xor eax, eax
mov dword [esp + 0x7ac], eax
xor edx, edx
mov dword [esp + 0x7b0], edx
jmp 0x467712