Function at 0x420870
Capabilities:
Authenticate hmac
Check mutex on windows
Contain obfuscated stackstrings
Create thread
Encode data using xor
Get common file path
Inspect load icon resource
Log keystrokes via polling
Parse pe header
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x148
mov eax, dword [0x4dc100]
xor eax, esp
mov dword [esp + 0x144], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
movaps xmm0, xmmword [0x4d68a0]
push esi
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0xa0], xmm0
mov word [esp + 0xb0], 7
nop word [eax + eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0x10
jb 0x4208c0
lea eax, [esp + 0xa1]
mov byte [esp + 0xb1], 0
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x420913
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x144]
xor ecx, esp
call fcn.004748e0
mov esp, ebp
pop ebp
ret 0x10
push 0x4dfd00
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movaps xmm0, xmmword [0x4d6870]
xor ecx, ecx
movups xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb0], 0x795740
nop
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0x12
jb 0x420940
lea eax, [esp + 0xa1]
mov byte [esp + 0xb3], 0
push eax
lea ecx, [esp + 0x11c]
call fcn.00406540
movaps xmm0, xmmword [0x4d6810]
xor ecx, ecx
movups xmmword [esp + 0xa0], xmm0
mov byte [esp + 0xb0], 0
nop dword [eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x420990
lea eax, [esp + 0x118]
mov byte [esp + 0xb0], 0
push eax
push 0x4dfd00
lea ecx, [esp + 0x38]
call fcn.00406540
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.00408af0
lea ecx, [esp + 0xa5]
add esp, 4
mov edx, eax
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4209e0
sub ecx, esi
lea eax, [esp + 0xa1]
push ecx
push eax
mov ecx, edx
call fcn.00406260
push eax
lea ecx, [esp + 0xd4]
call fcn.004063f0
push 0x10
push 0
push 0
push 0
lea ecx, [esp + 0xe0]
call fcn.00402620
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
lea ecx, [esp + 0xd0]
call fcn.00402630
lea ecx, [esp + 0x48]
call fcn.00402630
lea ecx, [esp + 0x30]
call fcn.00402630
mov dh, 0x18
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov al, 0x4f
mov byte [esp + 0x14], 0x47
xor al, dh
mov byte [esp + 0x27], 2
mov byte [esp + 0xc1], al
mov cl, 0x51
xor cl, dh
mov byte [esp + 0x26], 0x15
mov byte [esp + 0xc2], cl
mov al, 0xb
xor al, byte [esp + 0x14]
mov cl, 6
xor cl, byte [esp + 0x14]
mov ah, 0x4c
mov byte [esp + 0x15], al
xor ah, dh
mov al, byte [esp + 0x27]
mov dl, 0x5c
mov byte [esp + 0x16], cl
xor dl, dh
mov cl, byte [esp + 0x14]
mov ch, 0x50
xor al, cl
mov byte [esp + 0xc4], ah
mov byte [esp + 0x1b], al
xor ch, dh
mov al, byte [esp + 0x26]
mov ah, 9
xor ah, cl
mov byte [esp + 0xc0], dh
xor al, cl
mov byte [esp + 0x18], ah
push 0
mov byte [esp + 0x20], al
mov dh, 0xf
push 0x320
mov byte [esp + 0xcb], dl
lea eax, [esp + 0xc9]
mov byte [esp + 0xcd], ch
mov dl, 0x12
push eax
mov ch, 4
mov byte [esp + 0xd2], 0
lea eax, [esp + 0x21]
mov byte [esp + 0x29], 0
xor dl, cl
mov byte [esp + 0xd2], 0
xor ch, cl
mov byte [esp + 0x23], dl
xor dh, cl
mov byte [esp + 0x25], ch
push eax
mov byte [esp + 0x2a], dh
mov byte [esp + 0x2d], 0
call esi
mov dword [0x4ddf68], eax
mov cl, 0x4d
mov al, 0x40
mov byte [esp + 0xc0], 8
mov ch, al
mov byte [esp + 0x14], 2
xor al, byte [esp + 0xc0]
mov dl, 0x41
mov byte [esp + 0xc1], al
mov ah, 0x4f
mov al, byte [esp + 0xc0]
mov dh, 0x5c
xor cl, al
mov byte [esp + 0x26], 0x47
xor dl, al
mov byte [esp + 0xc2], cl
xor ah, al
mov byte [esp + 0x27], 0x50
xor ch, al
mov byte [esp + 0xc4], ah
xor dh, al
mov byte [esp + 0xc3], dl
mov al, 0x4e
mov byte [esp + 0xc5], ch
xor al, byte [esp + 0x14]
mov cl, 0x43
xor cl, byte [esp + 0x14]
mov ah, 0x4c
mov byte [esp + 0x15], al
mov dl, 0x57
mov al, byte [esp + 0x26]
mov ch, 0x41
mov byte [esp + 0x16], cl
mov cl, byte [esp + 0x14]
xor al, cl
mov byte [esp + 0xc6], dh
mov byte [esp + 0x1b], al
xor ah, cl
mov al, byte [esp + 0x27]
mov dh, 0x4a
xor al, cl
mov byte [esp + 0x18], ah
push 0
mov byte [esp + 0x20], al
xor dl, cl
push 0x258
lea eax, [esp + 0xc9]
mov byte [esp + 0xcf], 0
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x29], 0
xor ch, cl
mov byte [esp + 0xd3], 0
xor dh, cl
mov byte [esp + 0x23], dl
push eax
mov byte [esp + 0x29], ch
mov byte [esp + 0x2a], dh
mov byte [esp + 0x2d], 0
call esi
mov dword [0x4ddf98], eax
mov cl, 0xf
mov al, 0x57
mov byte [esp + 0x90], cl
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
mov dl, 0x7b
mov al, 0x39
mov byte [esp + 0xc3], 0
xor al, dl
mov byte [esp + 0x92], 0
mov cl, 0x3c
mov byte [esp + 0xc1], al
xor cl, dl
mov byte [esp + 0xc0], dl
push 0
mov byte [esp + 0xc6], cl
lea eax, [esp + 0x95]
mov byte [esp + 0xc7], 0
push 0
push eax
lea eax, [esp + 0xcd]
push eax
call esi
mov edx, eax
mov byte [esp + 0x92], 0
mov al, 0x35
mov byte [esp + 0xc3], 0
mov byte [esp + 0x90], al
mov cl, 0x6c
xor cl, al
mov byte [esp + 0x92], 0
mov ah, 0x55
mov byte [esp + 0x91], cl
mov al, 0x17
movd xmm0, edx
xor al, ah
mov byte [esp + 0xc0], ah
push 0
mov cl, 0x12
mov byte [esp + 0xc5], al
xor cl, ah
mov byte [esp + 0xc7], 0
cvtdq2ps xmm0, xmm0
push 0
lea eax, [esp + 0x99]
mov byte [esp + 0xca], cl
push eax
lea eax, [esp + 0xcd]
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm0, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x4c
mov byte [esp + 0x90], cl
movd xmm1, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
mov dword [0x4e0070], eax
mov al, 0x14
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
mov cl, 0x18
mov byte [esp + 0x92], 0
xor eax, eax
mov dword [esp + 0x14], 0x594c4b18
unpcklps xmm0, xmm1
movq qword [0x4e0068], xmm0
mov dword [esp + 0x18], 0x5a474c4a
mov dword [esp + 0x1c], 0x574c4c4d
mov word [esp + 0x20], 0x56
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xc
jae 0x420d62
mov cl, byte [esp + 0x14]
jmp 0x420d52
push 0
push 0x163
lea eax, [esp + 0x99]
mov byte [esp + 0x29], 0
push eax
lea eax, [esp + 0x21]
push eax
call esi
mov edx, eax
mov byte [esp + 0x92], 0
mov al, 0x26
mov byte [esp + 0x92], 0
mov cl, 0x7f
mov byte [esp + 0x90], al
xor cl, al
mov dword [esp + 0x14], 0x5e4b4c1f
mov byte [esp + 0x91], cl
xor eax, eax
mov cl, 0x1f
mov dword [esp + 0x18], 0x5d404b4d
mov dword [esp + 0x1c], 0x504b4b4a
mov word [esp + 0x20], 0x51
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xc
jae 0x420dd6
mov cl, byte [esp + 0x14]
jmp 0x420dc6
push 0
movd xmm0, edx
lea eax, [esp + 0x95]
cvtdq2ps xmm0, xmm0
push 0x1ed
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x2d], 0
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm1, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x4c
mov byte [esp + 0x90], cl
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
mov dword [0x4ddf74], eax
mov al, 0x14
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
xor ecx, ecx
mov byte [esp + 0x92], 0
mov byte [esp + 0xb0], 0
unpcklps xmm1, xmm0
movaps xmm0, xmmword [0x4d65b0]
movq qword [0x4ddf6c], xmm1
movups xmmword [esp + 0xa0], xmm0
nop dword [eax + eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x420e70
push 0
push 0x1e7
lea eax, [esp + 0x99]
mov byte [esp + 0xb8], 0
push eax
lea eax, [esp + 0xad]
push eax
call esi
movaps xmm0, xmmword [0x4d67e0]
mov edx, eax
mov al, 0x76
mov byte [esp + 0x92], 0
mov cl, 0x2f
mov byte [esp + 0x90], al
xor cl, al
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], cl
xor ecx, ecx
movups xmmword [esp + 0xa0], xmm0
mov byte [esp + 0xb0], 0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x420ef0
push 0
movd xmm0, edx
lea eax, [esp + 0x95]
cvtdq2ps xmm0, xmm0
push 0x1ed
push eax
lea eax, [esp + 0xad]
mov byte [esp + 0xbc], 0
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm1, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x6f
mov byte [esp + 0x90], cl
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
mov dword [0x4ddfa4], eax
mov al, 0x37
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
xor ecx, ecx
mov byte [esp + 0x92], 0
mov byte [esp + 0xb0], 0
unpcklps xmm1, xmm0
movaps xmm0, xmmword [0x4d66b0]
movq qword [0x4ddf9c], xmm1
movups xmmword [esp + 0xa0], xmm0
nop dword [eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x420fa0
push 0
push 0x26b
lea eax, [esp + 0x99]
mov byte [esp + 0xb8], 0
push eax
lea eax, [esp + 0xad]
push eax
call esi
movaps xmm0, xmmword [0x4d6a30]
mov edx, eax
mov al, 0x10
mov byte [esp + 0x92], 0
mov cl, 0x49
mov byte [esp + 0x90], al
xor cl, al
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], cl
xor ecx, ecx
movups xmmword [esp + 0xa0], xmm0
mov byte [esp + 0xb0], 0
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x421020
push 0
movd xmm0, edx
lea eax, [esp + 0x95]
cvtdq2ps xmm0, xmm0
push 0x1ed
push eax
lea eax, [esp + 0xad]
mov byte [esp + 0xbc], 0
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm1, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x15
mov byte [esp + 0x90], cl
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
mov dword [0x4ddff8], eax
mov al, 0x4d
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
mov cl, 0xe
mov byte [esp + 0x92], 0
xor eax, eax
mov dword [esp + 0x14], 0x41424d0e
unpcklps xmm1, xmm0
movq qword [0x4ddff0], xmm1
mov dword [esp + 0x18], 0x4c514b5d
mov dword [esp + 0x1c], 0x415a5a5b
mov word [esp + 0x20], 0x40
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xc
jae 0x4210e6
mov cl, byte [esp + 0x14]
jmp 0x4210d6
push 0
push 0x2fd
lea eax, [esp + 0x99]
mov byte [esp + 0x29], 0
push eax
lea eax, [esp + 0x21]
push eax
call esi
mov edx, eax
mov byte [esp + 0x92], 0
mov al, 0x50
mov byte [esp + 0x92], 0
mov cl, 9
mov byte [esp + 0x90], al
xor cl, al
mov dword [esp + 0x14], 0x1f1c1350
mov byte [esp + 0x91], cl
mov cl, al
mov dword [esp + 0x18], 0x120f1503
xor eax, eax
mov dword [esp + 0x1c], 0x1f040405
mov word [esp + 0x20], 0x1e
nop word [eax + eax]
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xc
jae 0x421160
mov cl, byte [esp + 0x14]
jmp 0x421150
push 0
movd xmm0, edx
lea eax, [esp + 0x95]
cvtdq2ps xmm0, xmm0
push 0x14
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x2d], 0
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm1, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x47
mov byte [esp + 0x90], cl
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
mov dword [0x4ddfb0], eax
mov al, 0x1f
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
mov cl, 9
mov byte [esp + 0x92], 0
xor eax, eax
mov dword [esp + 0x14], 0x465b5909
unpcklps xmm1, xmm0
movq qword [0x4ddfa8], xmm1
mov dword [esp + 0x18], 0x5a4c5b4e
mov dword [esp + 0x1c], 0x5b484b5a
mov byte [esp + 0x20], 0
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xb
jae 0x421207
mov cl, byte [esp + 0x14]
jmp 0x4211f7
push 0
push 0x164
lea eax, [esp + 0x99]
mov byte [esp + 0x28], 0
push eax
lea eax, [esp + 0x21]
push eax
call esi
mov edx, eax
mov byte [esp + 0x92], 0
mov al, 0x21
mov byte [esp + 0x92], 0
mov cl, 0x78
mov byte [esp + 0x90], al
xor cl, al
mov dword [esp + 0x14], 0x130e0c5c
mov byte [esp + 0x91], cl
xor eax, eax
mov cl, 0x5c
mov dword [esp + 0x18], 0xf190e1b
mov dword [esp + 0x1c], 0xe1d1e0f
mov byte [esp + 0x20], 0
nop dword [eax]
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xb
jae 0x421280
mov cl, byte [esp + 0x14]
jmp 0x421270
push 0
movd xmm0, edx
lea eax, [esp + 0x95]
cvtdq2ps xmm0, xmm0
push 0x1c8
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x2c], 0
push eax
movups xmmword [esp + 0xe0], xmm0
call esi
movups xmm1, xmmword [esp + 0xd0]
mov dword [esp + 0x1c], 0
mov cl, 0x6e
mov byte [esp + 0x90], cl
movd xmm0, eax
mov eax, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
mov dword [0x4ddf94], eax
mov al, 0x36
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
xor ecx, ecx
mov byte [esp + 0x92], 0
mov byte [esp + 0xb0], 0
unpcklps xmm1, xmm0
movaps xmm0, xmmword [str.s__4_6__12_]
movq qword [0x4ddf8c], xmm1
movups xmmword [esp + 0xa0], xmm0
nop dword [eax]
nop word [eax + eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x421320
push 0
push 0x173
lea eax, [esp + 0x99]
mov byte [esp + 0xb8], 0
push eax
lea eax, [esp + 0xad]
push eax
call esi
movaps xmm0, xmmword [0x4d6630]
mov cl, 0x10
mov dword [esp + 0xc0], eax
mov al, 0x49
xor cl, al
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], cl
xor ecx, ecx
mov byte [esp + 0x90], al
mov byte [esp + 0x92], 0
movups xmmword [esp + 0xa0], xmm0
mov byte [esp + 0xb0], 0
nop dword [eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x4213a0
push 0
push 0x1c8
lea eax, [esp + 0x99]
mov byte [esp + 0xb8], 0
push eax
lea eax, [esp + 0xad]
push eax
call esi
movaps xmm0, xmmword [str.s__4_6__12_]
mov edi, eax
mov ah, 0x45
mov byte [esp + 0x96], 0
mov cl, 0x12
mov byte [esp + 0x90], ah
mov ch, 1
mov byte [esp + 0x96], 0
mov dl, 0xc
mov byte [esp + 0xb0], 0
mov dh, 0x11
mov al, 0xd
xor cl, ah
xor ch, ah
xor dl, ah
mov byte [esp + 0x91], cl
xor dh, ah
mov byte [esp + 0x93], ch
xor al, ah
mov byte [esp + 0x92], dl
mov byte [esp + 0x94], dh
xor ecx, ecx
mov byte [esp + 0x95], al
movups xmmword [esp + 0xa0], xmm0
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0xf
jb 0x421440
push 0
push 0x170
lea eax, [esp + 0x99]
mov byte [esp + 0xb8], 0
push eax
lea eax, [esp + 0xad]
push eax
call esi
movd xmm1, dword [esp + 0xc0]
mov cl, 3
mov dword [esp + 0x1c], 0
mov ch, 0x13
mov eax, dword [esp + 0x1c]
mov dl, 2
mov dword [0x4ddfec], eax
mov dh, 0x1f
mov byte [esp + 0x14], 0x4c
mov al, 0xa
xor al, byte [esp + 0x14]
mov ah, 0x18
xor cl, byte [esp + 0x14]
mov byte [esp + 0x15], al
mov byte [esp + 0x16], cl
mov cl, byte [esp + 0x14]
mov byte [esp + 0x26], 5
xor ah, cl
mov al, byte [esp + 0x26]
xor ch, cl
xor al, cl
mov byte [esp + 0x27], 0x16
mov byte [esp + 0x1b], al
xor dl, cl
mov al, byte [esp + 0x27]
xor dh, cl
xor al, cl
mov byte [esp + 0x13], 9
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x13]
xor al, cl
mov byte [esp + 0x18], ah
mov byte [esp + 0x1d], al
mov ah, 0x6d
mov byte [esp + 0x19], ch
mov al, 0x7f
mov ch, 0x39
movd xmm0, edi
xor al, ch
mov byte [esp + 0x17], dl
xor ah, ch
mov byte [esp + 0xc1], al
push 0
cvtdq2ps xmm1, xmm1
mov byte [esp + 0xc8], ah
lea eax, [esp + 0x19]
push 0xe
push eax
mov cl, 0x76
mov dl, 0x77
cvtdq2ps xmm0, xmm0
lea eax, [esp + 0xcd]
mov byte [esp + 0x2a], 0
xor cl, ch
mov byte [esp + 0xd1], 0
xor dl, ch
mov byte [esp + 0x26], dh
push eax
mov byte [esp + 0x2e], 0
unpcklps xmm1, xmm0
movq qword [0x4ddfe4], xmm1
mov byte [esp + 0xd0], ch
mov byte [esp + 0xd2], cl
mov byte [esp + 0xd3], dl
mov byte [esp + 0xd5], 0
call esi
mov dword [esp + 0xc0], eax
mov cl, 0x69
mov dword [esp + 0x14], 0x27262f69
xor eax, eax
mov dword [esp + 0x18], 0x2c3e363d
mov dword [esp + 0x1c], 0x3d212e20
mov byte [esp + 0x20], 0
xor byte [esp + eax + 0x15], cl
inc eax
cmp eax, 0xb
jae 0x4215a8
mov cl, byte [esp + 0x14]
jmp 0x421598
mov ch, 7
mov byte [esp + 0x95], 0
mov al, 0x41
mov byte [esp + 0x20], 0
mov ah, 0x53
mov byte [esp + 0x90], ch
xor al, ch
mov byte [esp + 0x95], 0
xor ah, ch
mov byte [esp + 0x91], al
push 0
mov byte [esp + 0x98], ah
mov cl, 0x48
push 0x190
lea eax, [esp + 0x1d]
mov dl, 0x49
push eax
lea eax, [esp + 0x9d]
xor cl, ch
xor dl, ch
mov byte [esp + 0x9e], cl
push eax
mov byte [esp + 0xa3], dl
call esi
mov byte [esp + 0x14], 0x29
mov al, 0x6f
xor al, byte [esp + 0x14]
mov ah, 0x60
mov byte [esp + 0x15], al
mov ch, 0x65
mov al, byte [esp + 0x14]
mov cl, 0x68
xor ah, al
mov byte [esp + 0x1b], 0
xor ch, al
mov byte [esp + 0x18], ah
xor cl, al
mov byte [esp + 0x19], ch
mov ch, 0x65
mov byte [esp + 0x16], cl
mov dl, 0x64
mov byte [esp + 0x95], 0
xor dl, al
mov byte [esp + 0x1b], 0
mov dh, 0x70
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x90], ch
push 0
mov al, 0x23
mov byte [esp + 0x1e], dh
xor al, ch
mov byte [esp + 0x99], 0
mov ah, 0x31
mov byte [esp + 0x95], al
xor ah, ch
mov cl, 0x2a
mov byte [esp + 0x98], ah
mov dl, 0x2b
push 0x19
lea eax, [esp + 0x138]
xor cl, ch
push eax
push str.Verdana
lea eax, [esp + 0x25]
mov byte [esp + 0xa2], cl
push eax
lea eax, [esp + 0xa5]
xor dl, ch
push eax
mov byte [esp + 0xab], dl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov cl, 0x23
mov byte [esp + 0x92], 0
mov al, 0x7b
mov byte [esp + 0x90], cl
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x91], al
mov al, 0x5d
mov byte [esp + 0x14], 0x14
xor al, byte [esp + 0x14]
mov cl, 0x5a
xor cl, byte [esp + 0x14]
mov dh, 0x40
mov byte [esp + 0x15], al
mov ah, 0x5b
mov byte [esp + 0x16], cl
mov dl, 0x52
mov cl, byte [esp + 0x14]
mov ch, 0x4b
mov byte [esp + 0x13], 0x51
xor ah, cl
mov al, byte [esp + 0x13]
xor dl, cl
xor al, cl
mov byte [esp + 0x26], 0x4c
mov byte [esp + 0x1b], al
xor ch, cl
mov al, byte [esp + 0x26]
xor al, cl
mov byte [esp + 0x27], dh
mov byte [esp + 0x1c], al
xor dh, cl
mov al, byte [esp + 0x27]
xor al, cl
mov byte [esp + 0x18], ah
push 0
mov byte [esp + 0x21], al
lea eax, [esp + 0x95]
push 0x174
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x2a], 0
push eax
mov byte [esp + 0x27], dl
mov byte [esp + 0x29], ch
mov byte [esp + 0x2a], dh
mov byte [esp + 0x2e], 0
call esi
mov dword [0x4dfde8], eax
mov cl, 9
mov al, 0x50
mov byte [esp + 0x90], cl
xor al, cl
mov byte [esp + 0x14], 0x34
mov byte [esp + 0x91], al
mov cl, 0x7a
xor cl, byte [esp + 0x14]
mov al, 0x7d
xor al, byte [esp + 0x14]
mov dh, 0x60
mov byte [esp + 0x15], al
mov dl, 0x72
mov byte [esp + 0x13], 0x71
mov ah, 0x7b
mov al, byte [esp + 0x13]
mov ch, 0x6b
mov byte [esp + 0x16], cl
mov cl, byte [esp + 0x14]
xor al, cl
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x1b], al
xor dl, cl
mov al, byte [esp + 0x26]
xor ah, cl
xor al, cl
mov byte [esp + 0x27], dh
mov byte [esp + 0x1c], al
xor ch, cl
mov al, byte [esp + 0x27]
xor dh, cl
xor al, cl
mov byte [esp + 0x92], 0
mov byte [esp + 0x1e], 0
mov byte [esp + 0x92], 0
mov byte [esp + 0x17], dl
mov byte [esp + 0x18], ah
mov byte [esp + 0x19], ch
mov byte [esp + 0x1a], dh
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], 0
push 0
push 0x1b4
lea eax, [esp + 0x99]
push eax
lea eax, [esp + 0x21]
push eax
call esi
mov dword [0x4dfcf4], eax
mov cl, 0xb
mov al, 0x53
mov byte [esp + 0x90], cl
xor al, cl
mov byte [esp + 0x14], 0xe
mov byte [esp + 0x91], al
mov cl, 0x4f
xor cl, byte [esp + 0x14]
mov al, 0x5e
xor al, byte [esp + 0x14]
mov ah, 0x4b
mov byte [esp + 0x15], al
mov dh, 0x5a
mov byte [esp + 0x13], ah
mov dl, 0x49
mov al, byte [esp + 0x13]
mov ch, 0x51
mov byte [esp + 0x16], cl
mov cl, byte [esp + 0x14]
xor al, cl
mov byte [esp + 0x26], 0x56
mov byte [esp + 0x1b], al
xor ah, cl
mov al, byte [esp + 0x26]
xor dl, cl
xor al, cl
mov byte [esp + 0x27], dh
mov byte [esp + 0x1c], al
xor ch, cl
mov al, byte [esp + 0x27]
xor dh, cl
xor al, cl
mov byte [esp + 0x18], ah
push 0
mov byte [esp + 0x21], al
lea eax, [esp + 0x95]
push 0x174
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x9e], 0
mov byte [esp + 0x2a], 0
push eax
mov byte [esp + 0xa2], 0
mov byte [esp + 0x27], dl
mov byte [esp + 0x29], ch
mov byte [esp + 0x2a], dh
mov byte [esp + 0x2e], 0
call esi
mov cl, 0x51
mov byte [esp + 0x14], 0xa
mov byte [esp + 0x90], cl
mov al, 8
xor al, cl
mov byte [esp + 0x92], 0
mov cl, 0x4b
mov byte [esp + 0x91], al
xor cl, byte [esp + 0x14]
mov al, 0x5a
xor al, byte [esp + 0x14]
mov dl, 0x4d
mov byte [esp + 0x16], cl
mov ah, 0x4f
mov cl, byte [esp + 0x14]
mov dh, 0x5e
xor dl, cl
mov byte [esp + 0x92], 0
mov ch, 0x55
mov byte [esp + 0x13], ah
mov byte [esp + 0x26], 0x52
mov byte [esp + 0x27], dh
mov byte [esp + 0x1e], 0
mov byte [esp + 0x15], al
mov byte [esp + 0x17], dl
mov al, byte [esp + 0x13]
xor ah, cl
xor al, cl
mov byte [esp + 0x18], ah
mov byte [esp + 0x1b], al
xor ch, cl
mov al, byte [esp + 0x26]
xor dh, cl
xor al, cl
mov byte [esp + 0x19], ch
mov byte [esp + 0x1c], al
mov al, byte [esp + 0x27]
xor al, cl
mov byte [esp + 0x1a], dh
push 0
mov byte [esp + 0x21], al
lea eax, [esp + 0x95]
push 0x1b4
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x2a], 0
push eax
call esi
mov byte [esp + 0x14], 0x28
mov al, 0x7b
xor al, byte [esp + 0x14]
mov cl, 0x7c
mov byte [esp + 0x15], al
mov ch, cl
mov al, byte [esp + 0x14]
mov ah, 0x7a
xor cl, al
mov byte [esp + 0x13], 0x70
xor ah, al
mov byte [esp + 0x90], 0x4e
xor ch, al
mov byte [esp + 0x18], ah
mov dl, 0x69
mov byte [esp + 0x16], cl
xor dl, al
mov byte [esp + 0x19], ch
mov dh, 0x77
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x1c], 0
mov al, byte [esp + 0x13]
mov ah, 7
xor al, byte [esp + 0x14]
mov cl, 1
mov byte [esp + 0x1b], al
mov dl, 0x1a
xor al, al
mov byte [esp + 0x1a], dh
mov byte [esp + 0x98], al
mov ch, 0xd
xor al, byte [esp + 0x90]
mov dh, 0xb
mov byte [esp + 0x91], al
mov al, byte [esp + 0x90]
xor cl, al
mov byte [esp + 0x13], 0x1d
xor dl, al
mov byte [esp + 0x1c], 0
xor ah, al
mov byte [esp + 0x92], cl
xor ch, al
mov byte [esp + 0x94], ah
xor dh, al
mov byte [esp + 0x93], dl
mov al, byte [esp + 0x13]
xor al, byte [esp + 0x90]
push 0
mov byte [esp + 0x9b], al
lea eax, [esp + 0x19]
push 0x174
push eax
lea eax, [esp + 0x9d]
mov byte [esp + 0xa1], ch
mov byte [esp + 0xa2], dh
mov byte [esp + 0xa4], 0
push eax
call esi
mov dword [0x4dfd80], eax
mov cl, 0x2e
mov byte [esp + 0x14], 0x7a
mov al, 0x29
xor al, byte [esp + 0x14]
mov ch, cl
mov byte [esp + 0x15], al
mov dl, 0x3b
mov al, byte [esp + 0x14]
mov ah, 0x28
xor cl, al
mov byte [esp + 0x13], 0x23
xor dl, al
mov byte [esp + 0x90], 0x2a
xor ah, al
mov byte [esp + 0x16], cl
xor ch, al
mov byte [esp + 0x18], ah
mov dh, 0x25
mov byte [esp + 0x17], dl
xor dh, al
mov byte [esp + 0x19], ch
mov al, byte [esp + 0x13]
mov cl, 0x65
xor al, byte [esp + 0x14]
mov dl, 0x7e
mov byte [esp + 0x1b], al
mov ah, 0x63
mov al, 0x64
mov byte [esp + 0x1a], dh
xor al, byte [esp + 0x90]
mov ch, 0x69
mov byte [esp + 0x91], al
mov dh, 0x6f
mov al, byte [esp + 0x90]
xor cl, al
mov byte [esp + 0x13], 0x79
xor dl, al
mov byte [esp + 0x1c], 0
xor ah, al
mov byte [esp + 0x98], 0
xor ch, al
mov byte [esp + 0x94], ah
xor dh, al
mov byte [esp + 0x1c], 0
mov al, byte [esp + 0x13]
xor al, byte [esp + 0x90]
push 0
mov byte [esp + 0x9b], al
lea eax, [esp + 0x19]
push 0x1b4
push eax
lea eax, [esp + 0x9d]
mov byte [esp + 0x9e], cl
push eax
mov byte [esp + 0xa3], dl
mov byte [esp + 0xa5], ch
mov byte [esp + 0xa6], dh
mov byte [esp + 0xa8], 0
call esi
mov cl, 0x2d
mov byte [esp + 0x90], 0x6b
mov dl, cl
mov dword [0x4dfd84], eax
xor cl, byte [esp + 0x90]
mov al, 0x24
xor al, byte [esp + 0x90]
mov ah, 0x38
mov byte [esp + 0x92], cl
mov ch, 0x2e
mov cl, byte [esp + 0x90]
mov dh, 0x3f
xor dl, cl
mov byte [esp + 0x13], 0x34
xor ah, cl
mov byte [esp + 0x26], 0x32
mov byte [esp + 0x99], 0
mov byte [esp + 0x91], al
mov byte [esp + 0x93], dl
mov byte [esp + 0x94], ah
mov al, byte [esp + 0x13]
xor ch, cl
xor al, cl
mov byte [esp + 0x14], 0x18
mov byte [esp + 0x97], al
xor dh, cl
mov al, byte [esp + 0x26]
mov dl, 0x4c
xor al, cl
mov byte [esp + 0x95], ch
mov byte [esp + 0x98], al
mov cl, 0x57
mov al, 0x56
mov byte [esp + 0x96], dh
xor al, byte [esp + 0x14]
mov ah, 0x51
mov byte [esp + 0x15], al
mov ch, 0x5b
mov al, byte [esp + 0x14]
mov dh, 0x5d
xor cl, al
mov byte [esp + 0x13], 0x4b
xor dl, al
mov byte [esp + 0x1c], 0
xor ah, al
mov byte [esp + 0x99], 0
xor ch, al
mov byte [esp + 0x18], ah
xor dh, al
mov byte [esp + 0x16], cl
mov al, byte [esp + 0x13]
xor al, byte [esp + 0x14]
push 0
mov byte [esp + 0x1f], al
lea eax, [esp + 0x95]
push 0x17
push eax
lea eax, [esp + 0x21]
mov byte [esp + 0x23], dl
push eax
mov byte [esp + 0x29], ch
mov byte [esp + 0x2a], dh
mov byte [esp + 0x2c], 0
call esi
mov eax, dword [0x4ddf98]
mov ecx, dword [0x4ddf68]
mov dword [0x4dfcfc], eax
mov dword [0x4dfd8c], eax
mov eax, dword fs:[0x2c]
mov dword [0x4dfcf8], ecx
mov dword [0x4dfd88], ecx
mov ecx, dword [eax]
mov eax, dword [0x5600ec]
cmp eax, dword [ecx + 4]
jle 0x421c9e
push 0x5600ec
call fcn.00474ce0
add esp, 4
cmp dword [0x5600ec], 0xffffffff
jne 0x421c9e
push 0x5600ec
call fcn.00474c8f
add esp, 4
push 0
mov dword [esp + 0x64], 0x30
mov dword [esp + 0x68], 0x3000
mov dword [esp + 0x6c], 0x423300
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [esp + 0x28]
push 0x65
push edi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0x4d1530
mov dword [esp + 0x94], 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [esp + 0x78]
mov byte [esp + 0x1c], 0x42
mov al, 0xe
xor al, byte [esp + 0x1c]
mov cl, 0x23
xor cl, byte [esp + 0x1c]
mov ah, 0x2c
push 0
push 0
push dword [0x4ddf98]
mov byte [esp + 0x29], al
mov dl, 0x37
push dword [0x4ddf68]
mov byte [esp + 0x2e], cl
mov ch, 0x21
mov cl, byte [esp + 0x2c]
mov dh, 0x2a
mov byte [esp + 0x2b], 0x27
xor ah, cl
mov al, byte [esp + 0x2b]
xor dl, cl
xor al, cl
mov byte [esp + 0x3e], 0x30
mov byte [esp + 0x33], al
xor ch, cl
mov al, byte [esp + 0x3e]
xor dh, cl
push 0x64
push 0x64
xor al, cl
mov byte [esp + 0x38], ah
push accept
mov byte [esp + 0x40], al
lea eax, [esp + 0x39]
push eax
push dword [esp + 0xb0]
mov byte [esp + 0x49], 0
push 0
mov byte [esp + 0x47], dl
mov byte [esp + 0x49], ch
mov byte [esp + 0x4a], dh
mov byte [esp + 0x4d], 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push dword [0x4ddf98]
mov esi, eax
xor edx, edx
push dword [0x4ddf68]
mov ecx, esi
mov dword [esp + 0x30], esi
call fcn.00420580
add esp, 8
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push 0xea00ff
push esi
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov ecx, esi
mov dword [0x4dfc78], esi
call fcn.00422600
test al, al
jne 0x421e1b
call fcn.00422940
jmp 0x421e40
push 0xa
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.0041f3e0
test al, al
jne 0x421e58
call fcn.00422940
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0x74]
push dword [esp + 0x8c]
call dword [sym.imp.USER32.dll_UnregisterClassA]
xor esi, esi
jmp 0x4225d1
xorps xmm0, xmm0
mov dword [0x4dfce4], edi
push 0x290
movups xmmword [0x4dfcb4], xmm0
mov dword [0x4dfcc4], 0
mov dword [0x4dfcc8], 0
call fcn.004748f3
add esp, 4
mov esi, eax
push 0x290
push 0
push esi
call fcn.00476480
add esp, 0xc
mov ecx, esi
call fcn.00423a00
mov edi, dword [esp + 0x2c]
mov edx, edi
mov ecx, dword [0x4dfc78]
mov dword [0x4dfca8], eax
mov dword [eax + 0x148], ecx
lea ecx, [eax + 0x154]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x421ec2
sub edx, esi
push edx
push edi
call fcn.00402690
cmp dword [0x4dfcd4], 0
jne 0x421f0e
push 0x4dfcd4
lea eax, [esp + 0x134]
push eax
push 8
push 6
push 0
push 1
push 0
push 0
push 0x2bc
push 0
push dword [esp + 0xe8]
push dword [0x4e0078]
call dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
lea eax, [esp + 0x110]
push eax
call fcn.0047f8a1
add esp, 4
lea eax, [esp + 0x110]
push eax
call fcn.0047fb9a
mov edx, eax
add esp, 4
xor al, al
mov dword [esp + 0xc0], eax
mov ecx, dword [edx + 0x14]
add ecx, 0x76c
cmp ecx, 0x7ee
jle 0x421f54
mov byte [esp + 0xc0], 1
jmp 0x421f91
mov esi, dword [edx + 0x10]
cmp esi, 0xb
jle 0x421f6e
cmp ecx, 0x7ee
jne 0x421f6e
mov byte [esp + 0xc0], 1
jmp 0x421f91
cmp dword [edx + 0xc], 1
jle 0x421f91
cmp esi, 0xb
jne 0x421f91
cmp ecx, 0x7ee
movzx eax, al
mov edx, 1
cmove eax, edx
mov dword [esp + 0xc0], eax
mov eax, dword [0x4dfca8]
sub esp, 0x18
add eax, 0x130
mov ecx, esp
push eax
call fcn.00406580
call fcn.00420650
add esp, 0x18
test al, al
je 0x421fd6
cmp byte [esp + 0xc0], 0
jne 0x421fd6
push 0
push 0
push 0
push 0x41f3d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x422055
movaps xmm0, xmmword [0x4d6950]
xor ecx, ecx
movups xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xb0], 0x7a767265
mov word [esp + 0xb4], 0x39
nop dword [eax]
mov al, byte [esp + 0xa0]
xor byte [esp + ecx + 0xa1], al
inc ecx
cmp ecx, 0x14
jb 0x422000
lea eax, [esp + 0xa1]
mov byte [esp + 0xb5], 0
push eax
lea ecx, [esp + 0xd4]
call fcn.00406540
mov ecx, dword [0x4dfca8]
lea eax, [esp + 0xd0]
push eax
lea ecx, [ecx + 0x274]
call fcn.00406340
lea ecx, [esp + 0xd0]
call fcn.00402630
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push 0
call esi
push 0x7f00
push 0
mov dword [0x4e0064], eax
call esi
push 0x7f00
push 0
mov dword [0x4e0058], eax
call esi
push dword [0x4e0064]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x4e0054], eax
call edi
mov eax, dword [0x4dfca8]
add eax, 0x2c
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 1
call fcn.004748f3
xorps xmm0, xmm0
mov dword [0x4dfdc0], eax
add esp, 4
movaps xmmword [esp + 0xf0], xmm0
movq qword [esp + 0x100], xmm0
mov dword [esp + 0x108], 0
push 1
push 0
push 0
push 0
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x422110
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0xf0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x42259c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x422125
push dword [0x4e0054]
jmp 0x42212b
push dword [0x4e0064]
call edi
mov eax, dword [0x4e0078]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e0078]
push 1
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e0078]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4e0078]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0xffffffffffffffff
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x4e0078]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x42255f
mov eax, dword [0x4dfca8]
mov dword [0x4dfe10], 0
push 0x10
movzx ecx, byte [eax + 0x28c]
mov eax, dword [0x4dfdb0]
add eax, 0xffffffe2
mov dword [0x4dfe14], 0
imul ecx, eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [0x4dfe18], eax
mov eax, dword [0x4dfdb4]
mov dword [0x4dfe1c], eax
mov eax, dword [0x4dfdb8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov eax, dword [0x4dfdb8]
push 0xffffffffffffffff
push 0x4e0068
push 0
mov ecx, dword [eax]
push 0
push dword [0x4dfe20]
push eax
call dword [ecx + 0x24]
mov edx, dword [0x4dfdb8]
mov ecx, dword [0x4dfcb4]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
test ecx, ecx
jne 0x42222c
mov eax, dword [0x4dfcb0]
jmp 0x42223b
mov eax, dword [0x4dfcdc]
cmp ecx, 2
cmove eax, dword [0x4dfe24]
push 0xffffffffffffffff
push 0x4ddf6c
push 0
push 0
push eax
push edx
call esi
mov edx, dword [0x4dfdb8]
mov ecx, dword [0x4dfcb8]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
test ecx, ecx
jne 0x422266
mov eax, dword [0x4dfe0c]
jmp 0x422275
mov eax, dword [0x4dfe28]
cmp ecx, 2
cmove eax, dword [0x4dfcd0]
push 0xffffffffffffffff
push 0x4ddf9c
push 0
push 0
push eax
push edx
call esi
mov edx, dword [0x4dfdb8]
mov ecx, dword [0x4dfcbc]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
test ecx, ecx
jne 0x4222a0
mov eax, dword [0x4dfca4]
jmp 0x4222af
mov eax, dword [0x4dfca0]
cmp ecx, 2
cmove eax, dword [0x4dfd90]
push 0xffffffffffffffff
push 0x4ddff0
push 0
push 0
push eax
push edx
call esi
mov edx, dword [0x4dfdb8]
mov ecx, dword [0x4dfcc0]
mov eax, dword [edx]
mov esi, dword [eax + 0x24]
test ecx, ecx
jne 0x4222da
mov eax, dword [0x4dfd94]
jmp 0x4222e9
mov eax, dword [0x4dfcec]
cmp ecx, 2
cmove eax, dword [0x4dfcac]
push 0xffffffffffffffff
push 0x4ddfa8
push 0
push 0
push eax
push edx
call esi
mov eax, dword [0x4dfdb8]
push 0xffffffffffffffff
push 0x4ddf8c
push 0
mov ecx, dword [eax]
push 0
push dword [0x4dfdbc]
push eax
call dword [ecx + 0x24]
mov eax, dword [0x4dfdb8]
push 0xffffffffffffffff
push 0x4ddfe4
push 0
mov ecx, dword [eax]
push 0x4dfe10
push dword [0x4dfde4]
push eax
call dword [ecx + 0x24]
mov eax, dword [0x4dfdb8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [0x4dfca8]
lea ecx, [esp + 0x30]
mov esi, dword [0x4dfcd4]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x30]
call fcn.00402620
mov edx, esi
mov ecx, eax
call fcn.004205f0
lea ecx, [esp + 0x30]
call fcn.00402630
mov ecx, dword [0x4dfde8]
mov dword [0x4dfcf0], ecx
movups xmm0, xmmword [0x4dfcf0]
lea eax, [ecx + 3]
movups xmmword [esp + 0xc0], xmm0
add dword [esp + 0xc4], 3
mov dword [esp + 0xc0], eax
lea eax, [ecx + 2]
movups xmmword [esp + 0x90], xmm0
add dword [esp + 0x94], 2
mov dword [esp + 0x90], eax
lea eax, [ecx + 1]
movups xmmword [esp + 0xd0], xmm0
inc dword [esp + 0xd4]
lea ecx, [esp + 0x48]
mov dword [esp + 0xd0], eax
mov eax, dword [0x4dfcd4]
movups xmmword [esp + 0xa0], xmm0
mov eax, dword [eax]
mov esi, dword [eax + 0x38]
mov eax, dword [0x4dfca8]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x48]
call fcn.00402620
push 0x32000000
push 0
lea ecx, [esp + 0xc8]
push ecx
push 0xffffffffffffffff
push eax
push 0
push dword [0x4dfcd4]
call esi
lea ecx, [esp + 0x48]
call fcn.00402630
mov eax, dword [0x4dfcd4]
mov eax, dword [eax]
mov esi, dword [eax + 0x38]
lea ecx, [esp + 0x30]
mov eax, dword [0x4dfca8]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x30]
call fcn.00402620
push 0x64000000
push 0
lea ecx, [esp + 0x98]
push ecx
push 0xffffffffffffffff
push eax
push 0
push dword [0x4dfcd4]
call esi
lea ecx, [esp + 0x30]
call fcn.00402630
mov eax, dword [0x4dfcd4]
lea ecx, [esp + 0x48]
mov eax, dword [eax]
mov esi, dword [eax + 0x38]
mov eax, dword [0x4dfca8]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x48]
call fcn.00402620
push 0x96000000
push 0
lea ecx, [esp + 0xd8]
push ecx
push 0xffffffffffffffff
push eax
push 0
push dword [0x4dfcd4]
call esi
lea ecx, [esp + 0x48]
call fcn.00402630
mov eax, dword [0x4dfcd4]
lea ecx, [esp + 0x30]
mov eax, dword [eax]
mov esi, dword [eax + 0x38]
mov eax, dword [0x4dfca8]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x30]
call fcn.00402620
push 0xc8000000
push 0
lea ecx, [esp + 0xa8]
push ecx
push 0xffffffffffffffff
push eax
push 0
push dword [0x4dfcd4]
call esi
lea ecx, [esp + 0x30]
call fcn.00402630
mov eax, dword [0x4dfcd4]
lea ecx, [esp + 0x48]
mov eax, dword [eax]
mov esi, dword [eax + 0x38]
mov eax, dword [0x4dfca8]
add eax, 0x274
push eax
call fcn.00406580
lea ecx, [esp + 0x48]
call fcn.00402620
push 0xffffffffffffffff
push 0
push 0x4dfcf0
push 0xffffffffffffffff
push eax
push 0
push dword [0x4dfcd4]
call esi
lea ecx, [esp + 0x48]
call fcn.00402630
mov eax, dword [0x4e0078]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov ecx, dword [0x4e0078]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x42259c
mov eax, dword [0x4e0078]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x42259c
mov eax, dword [0x4e0078]
push 0x4e0088
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [esp + 0xf4], 0x12
jne 0x4220d5
call fcn.00422940
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0x74]
push dword [esp + 0x8c]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, dword [esp + 0xf8]
lea ecx, [esp + 0x118]
call fcn.00402630
mov ecx, dword [esp + 0x14c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004748e0
mov esp, ebp
pop ebp
ret 0x10