Function at 0x415260
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2a18
call fcn.0041cd80
push 0x2349
push 0x68
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x29c4], eax
cmp dword [ebp - 0x29c4], 0
jne 0x4152ae
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.00414f70
add esp, 4
test eax, eax
je 0x4152a7
jmp 0x41532c
xor eax, eax
jmp 0x415a09
mov edx, dword [ebp - 0x29c4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x4152e3
push 0x10
push 0x4a5dbc
push 0x4a5dc4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x415a09
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x59fb3c], eax
cmp dword [0x59fb3c], 0
jne 0x415316
push 0x10
push 0x4a5de0
push str.Cant_load_dll_from_Res_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x415a09
mov edx, dword [ebp - 0x29c4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push 0x2658
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov ecx, dword [0x59fb3c]
lea edx, [ecx + eax - 0x2658]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041c990
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x1ff
div ecx
mov dword [0x59fdc8], edx
mov byte [ebp - 0x40], 0x14
mov byte [ebp - 0x3f], 0x28
mov byte [ebp - 0x3e], 0x30
mov byte [ebp - 0x3d], 0x60
mov byte [ebp - 0x3c], 0xc8
mov byte [ebp - 0x3b], 0x30
mov byte [ebp - 0x3a], 0x45
mov byte [ebp - 0x39], 0x12
mov byte [ebp - 0x38], 0x18
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0xe
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0x22
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0
mov byte [ebp - 0x30], 0x90
mov byte [ebp - 0x2f], 0x66
mov byte [ebp - 0x2e], 0xe
mov byte [ebp - 0x2d], 0
mov byte [ebp - 0x2c], 0xe8
mov byte [ebp - 0x2b], 2
mov byte [ebp - 0x2a], 0x7f
mov byte [ebp - 0x29], 0x3a
mov byte [ebp - 0x28], 0x6b
mov byte [ebp - 0x27], 0x23
mov byte [ebp - 0x26], 0x36
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x80
mov byte [ebp - 0x23], 0x60
mov byte [ebp - 0x22], 0x30
mov byte [ebp - 0x21], 0
push 0x4cc
lea edx, [ebp - 0x40]
push edx
push 0x64
mov eax, dword [ebp + 0xc]
add eax, 0x128
push eax
call fcn.00402da0
add esp, 0x10
mov dword [ebp - 4], 0
mov cl, byte [0x4a5c46]
mov byte [ebp - 0x29c0], cl
push 0x207
push 0
lea edx, [ebp - 0x29bf]
push edx
call fcn.0041ce40
add esp, 0xc
lea eax, [ebp - 0x29c0]
push eax
call fcn.00414ed0
add esp, 4
push 0x2658
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x26a0]
push edx
call fcn.0041c990
add esp, 0xc
mov eax, 1
test eax, eax
je 0x4159a9
mov dword [ebp - 0x29c8], 0xffffffa4
push 0x2658
lea ecx, [ebp - 0x26a0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041c990
add esp, 0xc
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x570]
cmp ecx, 1
jne 0x4154bf
lea edx, [ebp - 0x27b0]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x59fda4]
call fcn.00409950
mov dword [ebp - 0x29c8], eax
lea ecx, [ebp - 0x27b0]
push ecx
mov ecx, dword [0x59fda4]
call fcn.00406860
jmp 0x4154ef
lea edx, [ebp - 0x27b0]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x560]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x564]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [0x59fda4]
call fcn.00409900
mov dword [ebp - 0x29c8], eax
cmp dword [ebp - 0x29c8], 0
je 0x415550
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x558]
cmp eax, 1
jne 0x41553d
cmp dword [0x59fda0], 0
jne 0x41553d
mov dword [0x59fda0], 1
lea ecx, [ebp - 0x29c0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00415170
add esp, 8
test eax, eax
je 0x41553d
mov dword [ebp - 4], 0
jmp 0x415451
mov eax, dword [ebp + 0xc]
push eax
call fcn.00414cf0
add esp, 4
xor eax, eax
jmp 0x415a09
lea ecx, [ebp - 0x27b0]
push ecx
push 0x10
mov edx, dword [ebp + 0xc]
add edx, 0x118
push edx
call fcn.00402d00
add esp, 0xc
test eax, eax
jne 0x415579
jmp 0x41599b
lea eax, [ebp - 0x27b0]
push eax
push 0x118
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402d00
add esp, 0xc
test eax, eax
jne 0x41559f
jmp 0x41599b
mov edx, dword [ebp + 0xc]
add edx, 0x5f4
push edx
push 0x118
mov eax, dword [ebp + 0xc]
push eax
call fcn.00403040
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 4]
test edx, edx
jne 0x4155d8
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x558]
cmp ecx, 1
jne 0x415757
lea edx, [ebp - 0x27b0]
push edx
lea eax, [ebp - 0x29e4]
push eax
mov ecx, dword [0x59fda4]
call fcn.0040d4d0
test eax, eax
je 0x4155ff
jmp 0x41599b
mov cl, byte [0x4a5c47]
mov byte [ebp - 0x29e0], cl
xor edx, edx
mov dword [ebp - 0x29df], edx
mov dword [ebp - 0x29db], edx
mov dword [ebp - 0x29d7], edx
mov dword [ebp - 0x29d3], edx
lea eax, [ebp - 0x27b0]
push eax
lea ecx, [ebp - 0x29e0]
push ecx
mov ecx, dword [0x59fda4]
call fcn.0040d780
test eax, eax
je 0x41564c
jmp 0x41599b
lea edx, [ebp - 0x29e0]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x105
push eax
call fcn.0042d9e1
add esp, 8
test eax, eax
je 0x415672
jmp 0x41599b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x126]
cmp edx, 1
jne 0x415757
cmp dword [0x59fde4], 0
jne 0x4156c2
mov dword [0x59fde4], 1
lea eax, [ebp - 0x29c0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00415170
add esp, 8
test eax, eax
jne 0x4156c2
mov edx, dword [ebp + 0xc]
push edx
call fcn.00414cf0
add esp, 4
xor eax, eax
jmp 0x415a09
mov al, byte [0x4a5c7f]
mov byte [ebp - 0x2a08], al
xor ecx, ecx
mov dword [ebp - 0x2a07], ecx
mov dword [ebp - 0x2a03], ecx
mov dword [ebp - 0x29ff], ecx
mov dword [ebp - 0x29fb], ecx
mov dword [ebp - 0x29f7], ecx
mov dword [ebp - 0x29f3], ecx
mov dword [ebp - 0x29ef], ecx
mov dword [ebp - 0x29eb], ecx
lea edx, [ebp - 0x27b0]
push edx
lea eax, [ebp - 0x2a08]
push eax
mov ecx, dword [0x59fda4]
call fcn.0040b200
mov dword [ebp - 0x2a0c], eax
cmp dword [ebp - 0x2a0c], 0
je 0x415731
jmp 0x41599b
lea ecx, [ebp - 0x2a08]
push ecx
call dword [0x59fd68]
mov dword [ebp - 0x2a0c], eax
cmp dword [ebp - 0x2a0c], 0
je 0x415757
jmp 0x41599b
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x570]
cmp eax, 3
jne 0x4157bb
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x2a]
test edx, edx
je 0x4157bb
lea eax, [ebp - 0x27b0]
push eax
mov ecx, dword [0x59fda4]
call fcn.00406860
lea ecx, [ebp - 0x27b0]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x568]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x56c]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x59fda4]
call fcn.004098b0
test eax, eax
je 0x4157bb
jmp 0x41599b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x570]
cmp edx, 1
jne 0x4157f8
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x29]
test ecx, ecx
je 0x4157f6
lea edx, [ebp - 0x27b0]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0040e7f0
add esp, 8
test eax, eax
jne 0x4157f6
jmp 0x41599b
jmp 0x415824
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x2a]
test edx, edx
je 0x415824
lea eax, [ebp - 0x27b0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040e7f0
add esp, 8
test eax, eax
jne 0x415824
jmp 0x41599b
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x2b]
test eax, eax
je 0x415850
lea ecx, [ebp - 0x27b0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e890
add esp, 8
test eax, eax
jne 0x415850
jmp 0x41599b
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax + 0x570]
cmp ecx, 1
je 0x41588b
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 0x29]
test eax, eax
je 0x41588b
lea ecx, [ebp - 0x27b0]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0040e700
add esp, 8
test eax, eax
jne 0x41588b
jmp 0x41599b
cmp dword [0x59fde4], 0
je 0x41589a
call dword [0x59fd70]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x118]
push ecx
push 0x4a5e04
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x11c]
push ecx
push 0x4a5e08
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x27b0]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea eax, [ebp - 0x26a1]
push eax
mov ecx, dword [0x59fda4]
call fcn.00409370
test eax, eax
jne 0x41599b
lea ecx, [ebp - 0x27b0]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040fce0
add esp, 0x10
test eax, eax
jne 0x415920
jmp 0x41599b
lea edx, [ebp - 0x27b0]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0x2b]
test edx, edx
je 0x41594d
lea eax, [ebp - 0x27b0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x59fdd0]
mov edx, dword [0x59fda4]
mov dword [ebp - 0x2a14], edx
mov eax, dword [ebp - 0x2a14]
mov dword [ebp - 0x2a10], eax
cmp dword [ebp - 0x2a10], 0
je 0x41598a
push 1
mov ecx, dword [ebp - 0x2a10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2a10]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x2a18], eax
jmp 0x415994
mov dword [ebp - 0x2a18], 0
mov eax, 1
jmp 0x415a09
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x415451
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x55c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x222
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x254
push edx
push 0
call fcn.00416930
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x27b4], eax
mov eax, dword [ebp - 0x27b4]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20], eax
push 0
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret