Function at 0x407b30
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
sub esp, 0x84c
mov al, 0x8b
push ebx
mov byte [esp + 0x17], al
mov byte [esp + 0x1a], al
mov byte [esp + 0x1f], al
mov al, 0x66
mov byte [esp + 0x21], al
mov byte [esp + 0x24], al
push ebp
mov al, 0x81
push esi
push edi
mov edi, dword [esp + 0x860]
mov byte [esp + 0x31], al
mov byte [esp + 0x37], al
mov al, 0xeb
mov cl, 0xaf
mov byte [esp + 0x38], al
mov byte [esp + 0x3d], al
mov byte [esp + 0x45], al
mov eax, dword [edi]
mov byte [esp + 0x29], cl
mov byte [esp + 0x2a], cl
mov dl, 0x33
mov cl, 0x3b
push eax
mov dword [esp + 0x54], 0
mov byte [esp + 0x14], 0xa3
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], 0xc0
mov byte [esp + 0x26], 0x64
mov byte [esp + 0x28], 0x38
mov byte [esp + 0x29], 0x48
mov byte [esp + 0x2b], 0xc8
mov byte [esp + 0x2c], 0xf2
mov byte [esp + 0x30], 0x1f
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], 0xdb
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], 0x4d
mov byte [esp + 0x38], 0x5a
mov byte [esp + 0x39], 0x74
mov byte [esp + 0x3a], 8
mov byte [esp + 0x3d], 0
mov byte [esp + 0x3e], 0
mov byte [esp + 0x3f], 1
mov byte [esp + 0x40], 0
mov byte [esp + 0x42], 0xf1
mov byte [esp + 0x43], 0xe8
mov byte [esp + 0x44], 0
mov byte [esp + 0x45], 0
mov byte [esp + 0x46], 0
mov byte [esp + 0x47], 0
mov byte [esp + 0x48], 0x5d
mov byte [esp + 0x4a], 0x4f
mov byte [esp + 0x4b], 0x17
mov byte [esp + 0x4c], 0x40
mov byte [esp + 0x4d], 0x70
mov byte [esp + 0x4e], cl
mov byte [esp + 0x4f], 0x16
mov byte [esp + 0x50], 0xce
mov byte [esp + 0x51], 0x3a
mov byte [esp + 0x52], 0x45
mov byte [esp + 0x53], 0x84
call dword [sym.imp.MSVCRT.dll__filelength]
mov ecx, dword [edi]
mov dword [esp + 0x5c], eax
push ecx
call fcn.004063b0
add esp, 8
test eax, eax
jne 0x407c65
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov cx, word [0x417d82]
test cx, cx
ja 0x407c7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
xor eax, eax
mov esi, 0x415e14
mov ax, cx
lea ebp, [eax + eax*4]
shl ebp, 3
lea eax, [ebp + 0x417dd0]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x407cbc
test cl, cl
je 0x407cb8
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x407cbc
add eax, 2
add esi, 2
test cl, cl
jne 0x407c94
xor eax, eax
jmp 0x407cc1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407cd2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
cmp dword [ebp + 0x417df4], 0xe0000020
je 0x407ceb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov eax, dword [edi]
mov ecx, dword [0x417da8]
push eax
push ecx
call fcn.00406470
mov edx, dword [edi]
mov ebp, dword [sym.imp.MSVCRT.dll__lseek]
mov esi, eax
push 0
push esi
push edx
mov dword [esp + 0x68], esi
call ebp
add esp, 0x14
cmp eax, 0xffffffff
jne 0x407d23
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov ecx, dword [edi]
mov ebx, dword [sym.imp.MSVCRT.dll__read]
lea eax, [esp + 0x5c]
push 0x1f4
push eax
push ecx
call ebx
add esp, 0xc
cmp eax, 0x1f4
je 0x407d4f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
xor eax, eax
mov dl, 0xb9
mov cl, 0x51
cmp byte [esp + eax + 0x5c], dl
jne 0x407d76
cmp byte [esp + eax + 0x5d], 0xa3
jne 0x407d76
cmp byte [esp + eax + 0x5e], cl
jne 0x407d76
cmp byte [esp + eax + 0x5f], 0
jne 0x407d76
cmp byte [esp + eax + 0x60], 0
je 0x407d8b
cmp eax, 0x1ef
jge 0x407c58
inc eax
cmp eax, 0x1ef
jle 0x407d55
jmp 0x407d92
lea edx, [eax + 6]
mov dword [esp + 0x50], edx
cmp eax, 0x1ef
jg 0x407dc4
cmp byte [esp + eax + 0x5c], 0xaa
jne 0x407da7
cmp byte [esp + eax + 0x5d], 0xe2
je 0x407dbc
cmp eax, 0x1ef
jge 0x407c58
inc eax
cmp eax, 0x1ef
jle 0x407d99
jmp 0x407dc4
lea eax, [eax + esi + 3]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [edi]
push 0
push ecx
push edx
call ebp
add esp, 0xc
cmp eax, 0xffffffff
jne 0x407de5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov ecx, dword [edi]
lea eax, [esp + 0x45c]
push 0x1f4
push eax
push ecx
call ebx
add esp, 0xc
cmp eax, 0x1f4
je 0x407e0e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], 0
lea esi, [esp + eax + 0x5d]
lea ebp, [esp + eax + 0x5c]
lea edi, [esp + eax + 0x5e]
mov al, byte [ebp]
cmp al, 0xaa
jne 0x407e3c
cmp byte [esi], 0xe2
je 0x407f77
xor ecx, ecx
mov cl, byte [edi]
and ecx, 0x80000007
jns 0x407e4d
dec ecx
or ecx, 0xfffffff8
inc ecx
and eax, 0xff
mov byte [esp + 0x14], cl
sub eax, 0x34
je 0x407f43
sub eax, 0x8c
je 0x407ec8
sub eax, 0x12
je 0x407e73
inc edi
inc ebp
inc esi
jmp 0x407f5e
mov edx, dword [esp + 0x10]
and edx, 0xff
and edx, 0x80000007
jns 0x407e8a
dec edx
or edx, 0xfffffff8
inc edx
mov al, byte [esp + ebx + 0x45c]
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x14]
mov cl, 8
and edx, 0xff
mov bl, al
sub cl, dl
add edi, 2
shr bl, cl
mov ecx, edx
add ebp, 2
shl al, cl
mov ecx, dword [esp + 0x18]
or al, bl
add esi, 2
mov byte [esp + ecx + 0x45c], al
mov ebx, ecx
jmp 0x407f5e
mov al, byte [esi]
cmp al, 0xc0
jne 0x407f05
mov edx, dword [esp + 0x14]
mov al, byte [esp + ebx + 0x45c]
and edx, 0xff
mov cl, 8
sub cl, dl
mov bl, al
shr bl, cl
mov ecx, edx
mov edx, dword [esp + 0x18]
shl al, cl
add edi, 3
add ebp, 3
or al, bl
add esi, 3
mov byte [esp + edx + 0x45c], al
mov ebx, edx
jmp 0x407f5e
cmp al, 0xc8
jne 0x407c58
mov edx, dword [esp + 0x14]
mov al, byte [esp + ebx + 0x45c]
and edx, 0xff
mov ecx, 8
sub ecx, edx
mov dl, al
shl dl, cl
mov cl, byte [esp + 0x14]
add edi, 3
shr al, cl
add ebp, 3
or al, dl
add esi, 3
mov byte [esp + ebx + 0x45c], al
jmp 0x407f5e
mov al, byte [esi]
mov cl, byte [esp + ebx + 0x45c]
xor cl, al
add edi, 2
add ebp, 2
mov byte [esp + ebx + 0x45c], cl
add esi, 2
mov eax, dword [esp + 0x1c]
mov ecx, eax
inc eax
cmp ecx, 0x64
mov dword [esp + 0x1c], eax
jg 0x407c58
jmp 0x407e2c
mov al, byte [esp + 0x10]
test al, al
jne 0x407f86
mov byte [esp + 0x10], 0xff
jmp 0x407f8a
dec byte [esp + 0x10]
inc ebx
cmp ebx, 0x1f4
mov dword [esp + 0x18], ebx
jl 0x407e14
mov ecx, 0xc
lea edi, [esp + 0x45c]
lea esi, [esp + 0x20]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
je 0x407fbe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov al, byte [esp + 0x864]
test al, al
jne 0x407fd9
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x84c
ret
mov eax, dword [esp + 0x5f1]
mov edx, dword [0x417db4]
mov ecx, dword [esp + 0x58]
sub eax, edx
cmp eax, ecx
jbe 0x407ffd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x84c
ret
mov dword [0x417da8], eax
xor eax, eax
mov ax, word [0x417d82]
mov esi, dword [0x417dd0]
mov ecx, 0xa
lea edx, [eax + eax*4]
shl edx, 3
mov eax, dword [edx + 0x417dd8]
lea edi, [edx + 0x417dd0]
sub esi, eax
xor eax, eax
mov dword [0x417dd0], esi
mov esi, dword [esp + 0x860]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
push ecx
call fcn.00407a50
dec word [0x417d82]
mov edx, dword [esi]
push edx
call fcn.00407a50
mov eax, dword [esp + 0x5c]
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__chsize]
add esp, 0x10
xor edx, edx
cmp eax, 0xffffffff
pop edi
pop esi
setne dl
pop ebp
mov eax, edx
pop ebx
add esp, 0x84c
ret