Function at 0x40c020
Capabilities:
Contain obfuscated stackstrings
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca5dd
mov eax, dword fs:[0]
push eax
sub esp, 0x380
mov eax, dword [0x63fbf0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 0x66
mov ecx, edi
mov dword [ebp - 0x38c], edi
call fcn.0045860f
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CLinLauncherDlg.0
mov esi, vtable.CBitmap.0
mov dword [edi + 0xac], ebx
mov dword [edi + 0xa8], esi
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb0], esi
mov dword [edi + 0xbc], ebx
mov dword [edi + 0xb8], esi
mov dword [edi + 0xc4], ebx
mov dword [edi + 0xc0], esi
mov dword [edi + 0xcc], ebx
mov dword [edi + 0xc8], esi
mov dword [edi + 0xd4], ebx
mov dword [edi + 0xd0], esi
mov dword [edi + 0xdc], ebx
mov dword [edi + 0xd8], esi
mov dword [edi + 0xe4], ebx
mov dword [edi + 0xe0], esi
mov dword [edi + 0xec], ebx
mov dword [edi + 0xe8], esi
push 0x43acb0
push 0x43aed0
push 8
push 8
lea eax, [edi + 0xf0]
push eax
mov byte [ebp - 4], 9
call fcn.0054749f
mov dword [edi + 0x134], ebx
mov dword [edi + 0x130], esi
mov dword [edi + 0x13c], ebx
mov dword [edi + 0x138], esi
mov dword [edi + 0x144], ebx
mov dword [edi + 0x140], esi
mov dword [edi + 0x14c], ebx
mov dword [edi + 0x148], esi
mov dword [edi + 0x154], ebx
mov dword [edi + 0x150], esi
mov dword [edi + 0x15c], ebx
mov dword [edi + 0x158], esi
mov dword [edi + 0x164], ebx
mov dword [edi + 0x160], esi
mov dword [edi + 0x16c], ebx
mov dword [edi + 0x168], esi
mov dword [edi + 0x174], ebx
mov dword [edi + 0x170], esi
mov dword [edi + 0x17c], ebx
mov dword [edi + 0x178], esi
mov dword [edi + 0x184], ebx
mov dword [edi + 0x180], esi
mov dword [edi + 0x1a0], ebx
mov dword [edi + method.CFont.virtual_0], vtable.CFont.0
lea ecx, [edi + 0x1bc]
mov byte [ebp - 4], 0x16
call fcn.0044fc12
mov dword [edi + method.CUpdateEdit.virtual_0], vtable.CUpdateEdit.0
lea ecx, [edi + 0x230]
mov byte [ebp - 4], 0x17
call fcn.0044fc12
mov dword [edi + method.CExplorer1.virtual_0], vtable.CExplorer1.0
mov byte [ebp - 4], 0x18
call fcn.0044bb77
call fcn.0044bb77
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [edi + 0x94], eax
call fcn.00436100
lea ecx, [ebp - 0xb0]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], 0x696e6977
mov dword [ebp - 0x20], 0x2e74656e
mov dword [ebp - 0x1c], 0x6c6c64
mov dword [ebp - 0xb0], 0x65746e49
mov dword [ebp - 0xac], 0x74656e72
mov dword [ebp - 0xa8], 0x6e65704f
mov word [ebp - 0xa4], 0x57
call fcn.00560f90
mov dword [0x64ddf8], eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x78], 0x65746e49
mov dword [ebp - 0x74], 0x74656e72
mov dword [ebp - 0x70], 0x6e65704f
mov dword [ebp - 0x6c], 0x576c7255
mov byte [ebp - 0x68], bl
call fcn.00560f90
lea edx, [ebp - 0x78]
mov dword [0x64ddfc], eax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00560f90
lea ecx, [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [0x64de00], eax
mov dword [ebp - 0xa0], 0x65746e49
mov dword [ebp - 0x9c], 0x74656e72
mov dword [ebp - 0x98], 0x6e65704f
mov dword [ebp - 0x94], 0x416c7255
mov byte [ebp - 0x90], bl
call fcn.00560f90
mov dword [0x64de14], eax
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00560f90
lea edx, [ebp - 0xc0]
mov dword [0x64de18], eax
push edx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc0], 0x70747448
mov dword [ebp - 0xbc], 0x72657551
mov dword [ebp - 0xb8], 0x666e4979
mov word [ebp - 0xb4], 0x576f
mov byte [ebp - 0xb2], bl
call fcn.00560f90
mov dword [0x64de04], eax
mov dword [ebp - 0x108], 0x65746e49
mov dword [ebp - 0x104], 0x74656e72
mov dword [ebp - 0x100], 0x736f6c43
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0xfc], 0x6e614865
mov dword [ebp - 0xf8], 0x656c64
call fcn.00560f90
mov dword [0x64de08], eax
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0xf4], 0x65746e49
mov dword [ebp - 0xf0], 0x74656e72
mov dword [ebp - 0xec], 0x64616552
mov dword [ebp - 0xe8], 0x656c6946
mov byte [ebp - 0xe4], bl
call fcn.00560f90
lea edx, [ebp - 0x64]
mov dword [0x64de0c], eax
push edx
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x64], 0x65746e49
mov dword [ebp - 0x60], 0x74656e72
mov dword [ebp - 0x5c], 0x6e6e6f43
mov dword [ebp - 0x58], 0x57746365
mov byte [ebp - 0x54], bl
call fcn.00560f90
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [0x64de1c], eax
call fcn.00560f90
mov dword [0x64de20], eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x8c], 0x65746e49
mov dword [ebp - 0x88], 0x74656e72
mov dword [ebp - 0x84], 0x6e6e6f43
mov dword [ebp - 0x80], 0x41746365
mov byte [ebp - 0x7c], bl
call fcn.00560f90
lea edx, [ebp - 0x8c]
mov dword [0x64de24], eax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00560f90
mov dword [0x64de28], eax
mov dword [ebp - 0x18], 0x8b55ff8b
mov byte [ebp - 0x14], 0xec
mov dword [ebp - 0x1e0], 0x6f0059
mov dword [ebp - 0x1dc], 0x720075
mov dword [ebp - 0x1d8], 0x500020
mov dword [ebp - 0x1d4], 0x200043
mov dword [ebp - 0x1d0], 0x61006d
mov dword [ebp - 0x1cc], 0x200079
mov dword [ebp - 0x1c8], 0x610068
mov dword [ebp - 0x1c4], 0x650076
mov dword [ebp - 0x1c0], 0x620020
mov dword [ebp - 0x1bc], 0x650065
mov dword [ebp - 0x1b8], 0x20006e
mov dword [ebp - 0x1b4], 0x6e0069
mov dword [ebp - 0x1b0], 0x650066
mov dword [ebp - 0x1ac], 0x740063
mov dword [ebp - 0x1a8], 0x640065
mov dword [ebp - 0x1a4], 0x620020
mov dword [ebp - 0x1a0], 0x200079
mov dword [ebp - 0x19c], 0x200061
mov dword [ebp - 0x198], 0x690076
mov dword [ebp - 0x194], 0x750072
mov dword [ebp - 0x190], 0x2e0073
mov dword [ebp - 0x18c], 0xa000d
mov dword [ebp - 0x188], 0x610043
mov dword [ebp - 0x184], 0x730075
mov dword [ebp - 0x180], 0x640065
mov dword [ebp - 0x17c], 0x610020
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x178], 0x20006e
mov dword [ebp - 0x174], 0x630041
mov dword [ebp - 0x170], 0x650063
mov dword [ebp - 0x16c], 0x730073
mov dword [ebp - 0x168], 0x560020
mov dword [ebp - 0x164], 0x6f0069
mov dword [ebp - 0x160], 0x61006c
mov dword [ebp - 0x15c], 0x690074
mov dword [ebp - 0x158], 0x6e006f
mov dword [ebp - 0x154], 0x690020
mov dword [ebp - 0x150], 0x20006e
mov dword [ebp - 0x14c], 0x6f006d
mov dword [ebp - 0x148], 0x750064
mov dword [ebp - 0x144], 0x65006c
mov dword [ebp - 0x140], 0x610020
mov dword [ebp - 0x13c], 0x200074
mov dword [ebp - 0x138], 0x300030
mov dword [ebp - 0x134], 0x330032
mov dword [ebp - 0x130], 0x25003a
mov dword [ebp - 0x12c], 0x380030
mov dword [ebp - 0x128], 0x2e0058
mov word [ebp - 0x124], dx
mov dword [ebp - 0x120], 0x690057
mov dword [ebp - 0x11c], 0x4c006e
mov dword [ebp - 0x118], 0x630069
mov dword [ebp - 0x114], 0x6e0065
mov dword [ebp - 0x110], 0x650073
mov word [ebp - 0x10c], cx
call fcn.00402da0
mov eax, dword [0x64ddf8]
mov ecx, dword [ebp - 0x18]
cmp dword [eax], ecx
jne 0x40cfce
cmp byte [eax + 4], 0xec
jne 0x40cfce
mov eax, dword [0x64ddfc]
cmp dword [eax], ecx
jne 0x40cf9f
cmp byte [eax + 4], 0xec
jne 0x40cf9f
mov edx, dword [0x64de14]
mov eax, edx
cmp dword [eax], ecx
jne 0x40c69f
cmp byte [eax + 4], 0xec
je 0x40c6bc
cmp byte [edx], 0x6a
jne 0x40cf6c
cmp byte [edx + 1], 0x24
jne 0x40cf6c
cmp byte [edx + 2], 0x68
jne 0x40cf6c
mov eax, dword [0x64de04]
cmp dword [eax], ecx
jne 0x40cf4e
cmp byte [eax + 4], 0xec
jne 0x40cf4e
mov eax, dword [0x64de0c]
cmp dword [eax], ecx
jne 0x40cf18
cmp byte [eax + 4], 0xec
jne 0x40cf18
mov eax, dword [0x64de1c]
cmp dword [eax], ecx
jne 0x40cee2
cmp byte [eax + 4], 0xec
jne 0x40cee2
mov eax, dword [0x64de24]
cmp dword [eax], ecx
jne 0x40cec1
cmp byte [eax + 4], 0xec
jne 0x40cec1
call fcn.00561950
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00562180
push 0x40b510
push 0x64de00
call fcn.00562240
push 0x40ba40
push 0x64de14
call fcn.00562240
push 0x40bd20
push 0x64de1c
call fcn.00562240
push 0x40bd60
push 0x64de24
call fcn.00562240
call fcn.00561bc0
test eax, eax
je 0x40c77b
mov eax, edi
call fcn.004261c0
push ebx
call fcn.00547091
push 0x80000
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004018c0
mov esi, dword [0x64de0c]
add esp, 8
push 0x20000
push esi
call fcn.00401100
add esp, 4
push eax
mov ecx, esi
call fcn.00401790
push 0xc
call fcn.00445142
add esp, 0xc
push 0xc
mov dword [0x64de2c], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de30], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de34], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de38], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de3c], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de40], eax
call fcn.00445142
add esp, 4
push 0xc
mov dword [0x64de44], eax
call fcn.00445142
mov esi, dword [0x64de2c]
add esp, 4
mov dword [0x64de48], eax
call fcn.0043f040
mov esi, dword [0x64de30]
call fcn.0043f040
mov esi, dword [0x64de34]
call fcn.0043f040
mov esi, dword [0x64de38]
call fcn.0043f040
mov esi, dword [0x64de3c]
call fcn.0043f040
mov esi, dword [0x64de40]
call fcn.0043f040
mov esi, dword [0x64de44]
call fcn.0043f040
mov esi, dword [0x64de48]
call fcn.0043f040
mov esi, dword [0x64de2c]
push ebx
call fcn.0043efc0
mov esi, dword [0x64de30]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de34]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de38]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de3c]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de40]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de44]
add esp, 4
push ebx
call fcn.0043efc0
mov esi, dword [0x64de48]
add esp, 4
push ebx
call fcn.0043efc0
add esp, 4
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x2c], 0x5f327377
mov word [ebp - 0x28], 0x3233
mov byte [ebp - 0x26], bl
mov dword [ebp - 0x3c], 0x76636572
mov byte [ebp - 0x38], bl
mov dword [ebp - 0x44], 0x6e6e6f63
mov dword [ebp - 0x40], 0x746365
mov dword [ebp - 0x34], 0x646e6573
mov byte [ebp - 0x30], bl
call fcn.00560f90
lea edx, [ebp - 0x34]
mov dword [0x64de58], eax
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00560f90
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov dword [0x64de5c], eax
call fcn.00560f90
mov dword [0x64de50], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00560f90
lea edx, [ebp - 0x3c]
mov dword [0x64de54], eax
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00560f90
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push edx
mov dword [0x64de60], eax
call fcn.00560f90
mov dword [0x64de64], eax
mov eax, dword [0x64de5c]
mov ecx, dword [eax]
mov dword [0x64de10], 1
cmp ecx, dword [ebp - 0x18]
jne 0x40c9b5
cmp byte [eax + 4], 0xec
je 0x40ca3a
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40ca07
lea edx, [ebp - 0x1e0]
push 0x750f4248
push edx
mov edx, esi
call fcn.004049f0
lea eax, [ebp - 0x120]
push eax
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 0xc
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x64de5c]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 5
call fcn.0043af20
mov eax, dword [0x64de5c]
mov edx, dword [ebp - 0x18]
add esp, 4
cmp dword [eax], edx
jne 0x40d020
mov cl, byte [ebp - 0x14]
cmp cl, byte [eax + 4]
jne 0x40d020
mov eax, dword [0x64de54]
mov edx, dword [ebp - 0x18]
cmp dword [eax], edx
jne 0x40ca52
mov cl, byte [ebp - 0x14]
cmp cl, byte [eax + 4]
je 0x40cad7
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40caa4
lea edx, [ebp - 0x1e0]
push 0x750f4249
push edx
mov edx, esi
call fcn.004049f0
lea eax, [ebp - 0x120]
push eax
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 0xc
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x64de54]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 5
call fcn.0043af20
mov eax, dword [0x64de54]
mov edx, dword [ebp - 0x18]
add esp, 4
cmp dword [eax], edx
jne 0x40d020
mov cl, byte [ebp - 0x14]
cmp cl, byte [eax + 4]
jne 0x40d020
mov eax, dword [0x64de64]
mov edx, dword [ebp - 0x18]
cmp dword [eax], edx
jne 0x40caef
mov cl, byte [ebp - 0x14]
cmp cl, byte [eax + 4]
je 0x40cb74
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40cb41
lea edx, [ebp - 0x1e0]
push 0x750f424a
push edx
mov edx, esi
call fcn.004049f0
lea eax, [ebp - 0x120]
push eax
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 0xc
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x64de64]
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 5
call fcn.0043af20
mov eax, dword [0x64de64]
mov edx, dword [eax]
add esp, 4
cmp edx, dword [ebp - 0x18]
jne 0x40d020
mov cl, byte [ebp - 0x14]
cmp cl, byte [eax + 4]
jne 0x40d020
call fcn.00561950
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00562180
push 0x40bda0
push 0x64de60
call fcn.00562240
push 0x40bee0
push 0x64de58
call fcn.00562240
push 0x40bdd0
push 0x64de50
call fcn.00562240
call fcn.00561bc0
mov esi, dword [0x64de64]
push 0x40000
push esi
call fcn.00401100
add esp, 4
push eax
mov ecx, esi
call fcn.00401790
add esp, 8
push 0x100000
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.004018c0
add esp, 8
call fcn.00402da0
call fcn.00402da0
push ebx
push ebx
push ebx
push 0x401a80
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x800
push 0x40af30
call fcn.00401100
add esp, 4
push eax
mov ecx, 0x40af30
call fcn.00401790
add esp, 8
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x50]
push ecx
mov dword [ebp - 0x50], 0x6c64746e
mov dword [ebp - 0x4c], 0x6c642e6c
mov word [ebp - 0x48], 0x6c
mov dword [ebp - 0xe0], 0x416c7452
mov dword [ebp - 0xdc], 0x65566464
mov dword [ebp - 0xd8], 0x726f7463
mov dword [ebp - 0xd4], 0x78456465
mov dword [ebp - 0xd0], 0x74706563
mov dword [ebp - 0xcc], 0x486e6f69
mov dword [ebp - 0xc8], 0x6c646e61
mov word [ebp - 0xc4], 0x7265
mov byte [ebp - 0xc2], bl
call fcn.00560f90
lea edx, [ebp - 0xe0]
mov dword [0x64de68], eax
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.00560f90
mov esi, eax
cmp dword [0x64de68], ebx
je 0x40cce5
call fcn.00561950
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00562180
push 0x40b430
push 0x64de68
call fcn.00562240
call fcn.00561bc0
push 0x200000
push esi
call fcn.00401100
add esp, 4
push eax
mov ecx, esi
call fcn.00401790
add esp, 8
call fcn.004024b0
call fcn.004021d0
push 0x64efa8
call fcn.0040a360
push 0x64efb8
call fcn.0040a3a0
mov dword [edi + 0x98], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
mov dword [edi + 0x188], ebx
mov dword [edi + 0x18c], ebx
mov dword [edi + 0x190], ebx
mov dword [edi + 0x194], ebx
mov dword [edi + 0x198], ebx
mov word [edi + 0x1a4], 0x100
mov dword [edi + 0x1a8], ebx
mov dword [edi + 0x1ac], 0xffffffff
mov dword [edi + 0x2c8], ebx
mov dword [edi + 0x2cc], ebx
mov dword [edi + 0x2d0], ebx
mov dword [edi + 0x2d4], ebx
mov dword [edi + 0x2d8], ebx
mov dword [0x64d55c], ebx
mov dword [edi + 0x2dc], ebx
mov dword [edi + 0x2e0], ebx
mov dword [edi + 0x2e4], ebx
call fcn.004364d0
mov byte [ebp - 0x371], bl
call fcn.0043df80
test eax, eax
jne 0x40cdcf
push 0x10
push 0x61bc8c
push 0x61bc98
mov ecx, edi
mov byte [ebp - 0x371], 1
call fcn.00450032
call fcn.0056c220
lea ecx, [ebp - 0x378]
push 4
push ecx
call fcn.0056cad0
add esp, 8
cmp eax, 1
je 0x40ce04
push 0x10
push 0x61bc8c
push 0x61bcb4
mov ecx, edi
mov byte [ebp - 0x371], 1
call fcn.00450032
mov esi, dword [ebp - 0x378]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, eax
push 0xc
mov dword [ebp - 0x18], esi
call fcn.00445142
add esp, 4
mov esi, eax
mov dword [0x64de4c], eax
call fcn.0043f040
mov edx, dword [ebp - 0x18]
mov esi, dword [0x64de4c]
push edx
call fcn.0043efc0
add esp, 4
lea eax, [ebp - 0x370]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40ce6f
push 0x10
push 0x61bc8c
push 0x61bcd0
mov ecx, edi
mov byte [ebp - 0x371], 1
call fcn.00450032
jmp 0x40ce79
mov dword [0x64dde4], 1
push ebx
lea ecx, [ebp - 0x388]
push ecx
push 0x64de70
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x384], ebx
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x37c], ebx
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
cmp byte [ebp - 0x371], bl
je 0x40d030
mov eax, edi
call fcn.004261c0
push ebx
call fcn.00547091
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
push 0x750f4247
jmp 0x40cfe6
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
lea ecx, [ebp - 0x1e0]
push 0x750f4246
push ecx
mov edx, esi
call fcn.004049f0
lea edx, [ebp - 0x120]
push edx
jmp 0x40cffb
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
lea eax, [ebp - 0x1e0]
push 0x750f4245
push eax
mov edx, esi
call fcn.004049f0
lea ecx, [ebp - 0x120]
push ecx
jmp 0x40cffb
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
push 0x750f4244
jmp 0x40cfe6
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
lea ecx, [ebp - 0x1e0]
push 0x750f4243
push ecx
mov edx, esi
call fcn.004049f0
lea edx, [ebp - 0x120]
push edx
jmp 0x40cffb
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
lea eax, [ebp - 0x1e0]
push 0x750f4242
push eax
mov edx, esi
call fcn.004049f0
lea ecx, [ebp - 0x120]
push ecx
jmp 0x40cffb
push 0x600
call fcn.00445142
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40d020
push 0x750f4241
lea edx, [ebp - 0x1e0]
push edx
mov edx, esi
call fcn.004049f0
lea eax, [ebp - 0x120]
push eax
lea edx, [esi + 0x400]
call fcn.00404a10
add esp, 0xc
push ebx
push ebx
push esi
push 0x401040
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push ebx
push 0x40bff0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00544a28
mov esp, ebp
pop ebp
ret