Function at 0x404910
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c96ec
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x4fd01c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov ebx, dword [0x4da2bc]
push 5
push 0x4da8d8
call ebx
add esp, 8
mov dword [edi], eax
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call dword [0x4da2e8]
lea ecx, [edi + 8]
call dword [0x4da2e8]
lea ecx, [edi + 0xc]
call dword [0x4da2e8]
lea ecx, [edi + 0x10]
call dword [0x4da2e8]
lea ecx, [edi + 0x14]
call dword [0x4da2e8]
push 0xe
push str.C:_tmp_linchen
mov byte [ebp - 4], 5
call ebx
add esp, 8
mov dword [edi + 0x18], eax
mov eax, dword [0x4da098]
mov dword [edi + 0x1c], eax
lea esi, [edi + 0x20]
push esi
lea ecx, [ebp - 0xd]
call fcn.00419d80
push 0x2e
push str.Design_by_linchen___QQ_:_741603528___n_n_n_n_n_n_n_n_n_n
mov byte [ebp - 4], 8
add edi, 0x24
call ebx
add esp, 8
mov dword [edi], eax
push esi
lea ecx, [ebp - 0x18]
call dword [0x4da280]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0xa
push eax
push 0x4da920
call fcn.00536c18
nop
mov esi, dword [0x4da0e8]
add esp, 4
mov ecx, eax
call esi
mov ecx, eax
mov byte [ebp - 4], 0xb
call dword [0x4da2e4]
push eax
push dword [0x4da05c]
call fcn.004043d0
add esp, 8
lea ecx, [ebp - 0x14]
call dword [0x4da2dc]
lea ecx, [ebp - 0x18]
call dword [0x4da284]
push edi
lea ecx, [ebp - 0x20]
call dword [0x4da280]
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xc
push eax
push 0x4da920
call fcn.00536c18
nop
add esp, 4
mov ecx, eax
call esi
mov ecx, eax
mov byte [ebp - 4], 0xd
call dword [0x4da2e4]
push eax
push dword [0x4da05c]
call fcn.004043d0
add esp, 8
lea ecx, [ebp - 0x1c]
call dword [0x4da2dc]
lea ecx, [ebp - 0x20]
call dword [0x4da284]
mov esi, dword [ebp - 0x24]
movsd xmm0, qword [0x4e9ad0]
push 0
push 0x4da6f9
mov dword [ebp - 4], 0xe
movsd qword [esi + 0x28], xmm0
call ebx
mov dword [esi + 0x30], eax
push 0
push 0x4da6f9
mov byte [ebp - 4], 0xf
call ebx
mov dword [esi + 0x34], eax
push 3
push 0x4dc2e0
mov byte [ebp - 4], 0x10
mov word [esi + 0x38], pe_nt_image_headers32
call ebx
mov dword [esi + 0x3c], eax
push 3
push 0x4dc2e4
mov byte [ebp - 4], 0x11
call ebx
mov dword [esi + 0x40], eax
push 3
push 0x4dc2e8
mov byte [ebp - 4], 0x12
call ebx
mov dword [esi + 0x44], eax
push 3
push 0x4dc2ec
mov byte [ebp - 4], 0x13
call ebx
mov dword [esi + 0x48], eax
push 3
push 0x4dc2f0
mov byte [ebp - 4], 0x14
call ebx
mov dword [esi + 0x4c], eax
push 3
push 0x4dc2f4
mov byte [ebp - 4], 0x15
call ebx
add esp, 0x40
mov dword [esi + 0x50], eax
push 3
push 0x4dc2f8
mov byte [ebp - 4], 0x16
call ebx
mov dword [esi + 0x54], eax
push 3
push 0x4dc2fc
mov byte [ebp - 4], 0x17
call ebx
mov dword [esi + 0x58], eax
push 4
push str.gko1
mov byte [ebp - 4], 0x18
call ebx
mov dword [esi + 0x5c], eax
push 4
push str.gko2
mov byte [ebp - 4], 0x19
call ebx
mov dword [esi + 0x60], eax
push 3
push 0x4dc310
mov byte [ebp - 4], 0x1a
call ebx
mov dword [esi + 0x64], eax
push 4
push str.drl2
mov byte [ebp - 4], 0x1b
call ebx
mov dword [esi + 0x68], eax
push 2
push 0x4dc31c
mov byte [ebp - 4], 0x1c
call ebx
mov dword [esi + 0x6c], eax
push 3
push 0x4dc320
mov byte [ebp - 4], 0x1d
call ebx
add esp, 0x40
mov dword [esi + 0x70], eax
push 3
push 0x4dc324
mov byte [ebp - 4], 0x1e
call ebx
mov dword [esi + 0x74], eax
push 4
push str.npth
mov byte [ebp - 4], 0x1f
call ebx
mov dword [esi + 0x78], eax
push 3
push 0x4dc330
mov byte [ebp - 4], 0x20
call ebx
mov dword [esi + 0x7c], eax
push 3
push 0x4dc334
mov byte [ebp - 4], 0x21
call ebx
mov dword [esi + 0x80], eax
push 3
push 0x4dc338
mov byte [ebp - 4], 0x22
call ebx
mov dword [esi + 0x84], eax
push 3
push 0x4dc33c
mov byte [ebp - 4], 0x23
call ebx
mov dword [esi + 0x88], eax
push 3
push 0x4dc340
mov byte [ebp - 4], 0x24
call ebx
mov dword [esi + 0x8c], eax
mov byte [ebp - 4], 0x25
push 2
push 0x4dc344
call ebx
add esp, 0x40
mov dword [esi + 0x90], eax
push 3
push 0x4dc348
mov byte [ebp - 4], 0x26
call ebx
mov dword [esi + 0x94], eax
push 2
push 0x4dc34c
mov byte [ebp - 4], 0x27
call ebx
mov dword [esi + 0x98], eax
push 2
push 0x4dc34c
mov byte [ebp - 4], 0x28
call ebx
mov dword [esi + 0x9c], eax
push 4
push str.orig
mov byte [ebp - 4], 0x29
call ebx
mov dword [esi + 0xa0], eax
push 3
push 0x4dc358
mov byte [ebp - 4], 0x2a
call ebx
mov dword [esi + 0xa4], eax
push 4
push str.edit
mov byte [ebp - 4], 0x2b
call ebx
mov dword [esi + 0xa8], eax
push 3
push 0x4da970
mov byte [ebp - 4], 0x2c
call ebx
mov dword [esi + 0xac], eax
push 5
push str.panel
mov byte [ebp - 4], 0x2d
call ebx
add esp, 0x40
mov dword [esi + 0xb0], eax
push 4
push str.r150
mov byte [ebp - 4], 0x2e
mov byte [esi + 0xb4], 1
call ebx
mov dword [esi + 0xb8], eax
movaps xmm0, xmmword [0x4e9be0]
movups xmmword [esi + 0xe0], xmm0
mov byte [ebp - 4], 0x2f
movsd xmm0, qword [0x4e9ab8]
mov dword [esi + 0xbc], 0x96
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0x32
mov dword [esi + 0xc8], 0x96
mov dword [esi + 0xcc], 0xc8
mov dword [esi + 0xd0], 0x18ce
mov dword [esi + 0xd4], 0x258
mov dword [esi + 0xd8], 0x18ce
mov dword [esi + 0xf0], 1
mov byte [esi + 0xf4], 1
movsd qword [esi + 0xf8], xmm0
mov dword [esi + 0x100], 0
mov byte [esi + 0x104], 1
mov dword [esi + 0x108], 1
mov dword [esi + 0x10c], 1
movaps xmm0, xmmword [0x4e9cb0]
movups xmmword [esi + 0x130], xmm0
push 5
movaps xmm0, xmmword [0x4e9c80]
movups xmmword [esi + 0x140], xmm0
push str.r2050
movaps xmm0, xmmword [0x4e9cc0]
movups xmmword [esi + 0x158], xmm0
mov dword [esi + 0x110], 0
movsd xmm0, qword [0x4e9b68]
mov dword [esi + 0x114], 0
mov dword [esi + 0x118], 0
mov byte [esi + 0x11c], 0
mov dword [esi + 0x120], 0x1388
mov byte [esi + 0x124], 1
mov dword [esi + 0x128], 0x2bc
mov dword [esi + 0x150], 0x2d
mov byte [esi + 0x154], 0
movsd qword [esi + 0x168], xmm0
call ebx
mov dword [esi + 0x170], eax
push 5
push str.r2250
mov byte [ebp - 4], 0x30
call ebx
mov dword [esi + 0x174], eax
push 5
push str.r1050
mov byte [ebp - 4], 0x31
call ebx
mov dword [esi + 0x178], eax
push 5
push str.r2000
mov byte [ebp - 4], 0x32
call ebx
mov dword [esi + 0x17c], eax
push 0x10
push str.donut_r3500x2500
mov byte [ebp - 4], 0x33
call ebx
mov dword [esi + 0x180], eax
movaps xmm0, xmmword [0x4e9c00]
movsd xmm1, qword [0x4e9b60]
movsd xmm2, qword [0x4e9bc8]
movaps xmm3, xmmword [0x4e9cb0]
movups xmmword [esi + 0x190], xmm0
mov byte [ebp - 4], 0x34
movsd xmm0, qword [0x4e9ba8]
movsd qword [esi + 0x1b8], xmm0
movaps xmm0, xmmword [0x4e9c20]
movups xmmword [esi + 0x1c0], xmm0
mov dword [esi + 0x184], 0
movsd xmm0, qword [0x4da6b8]
movsd qword [esi + 0x1e0], xmm0
movsd qword [esi + 0x1f0], xmm0
movsd xmm0, qword [0x4e9b70]
movsd qword [esi + 0x218], xmm0
movaps xmm0, xmmword [0x4e9ca0]
movsd qword [esi + 0x1d8], xmm1
movsd qword [esi + 0x1e8], xmm1
movaps xmm1, xmmword [0x4e9c70]
movups xmmword [esi + 0x220], xmm0
mov byte [esi + 0x188], 1
movsd qword [esi + 0x250], xmm0
movaps xmm0, xmmword [0x4e9c60]
mov byte [esi + 0x1a0], 1
movsd qword [esi + 0x1a8], xmm2
mov byte [esi + 0x1b0], 1
mov byte [esi + 0x1d0], 1
movups xmmword [esi + 0x1f8], xmm1
movups xmmword [esi + 0x208], xmm1
movups xmmword [esi + 0x230], xmm3
movups xmmword [esi + 0x240], xmm3
movups xmmword [esi + 0x258], xmm1
movsd qword [esi + 0x268], xmm0
movsd qword [esi + 0x270], xmm2
movups xmmword [esi + 0x290], xmm1
push 3
movsd qword [esi + 0x2a0], xmm1
movsd xmm1, qword [0x4e9b78]
push 0x4dc3a8
movups xmmword [esi + 0x278], xmm0
mov dword [esi + 0x2b8], 1
movsd qword [esi + 0x288], xmm0
movsd qword [esi + 0x2a8], xmm1
movsd qword [esi + 0x2b0], xmm0
mov byte [esi + 0x2bc], 0
movups xmmword [esi + 0x2c0], xmm3
mov dword [esi + 0x2f0], 0x2d
movups xmmword [esi + 0x2d0], xmm3
mov dword [esi + 0x2f4], 4
movups xmmword [esi + 0x2e0], xmm3
call ebx
mov dword [esi + 0x2f8], eax
movaps xmm0, xmmword [0x4e9c90]
movups xmmword [esi + 0x300], xmm0
mov byte [esi + 0x310], 1
movaps xmm0, xmmword [0x4e9c50]
movups xmmword [esi + 0x318], xmm0
push 2
movaps xmm0, xmmword [0x4e9c40]
movups xmmword [esi + 0x328], xmm0
push 0x4dc3ac
movaps xmm0, xmmword [0x4e9c70]
movups xmmword [esi + 0x338], xmm0
mov byte [ebp - 4], 0x35
movups xmmword [esi + 0x348], xmm0
movsd qword [esi + 0x358], xmm0
movaps xmm0, xmmword [0x4e9c30]
mov word [esi + 0x360], 1
mov dword [esi + 0x364], 0x1f4
mov dword [esi + 0x368], 0x1f4
movups xmmword [esi + 0x370], xmm0
mov byte [esi + 0x380], 1
movaps xmm0, xmmword [0x4e9cd0]
movups xmmword [esi + 0x388], xmm0
movaps xmm0, xmmword [0x4e9cb0]
movups xmmword [esi + 0x398], xmm0
movaps xmm0, xmmword [0x4e9c00]
movups xmmword [esi + 0x3a8], xmm0
xorps xmm0, xmm0
movsd qword [esi + 0x3b8], xmm0
call ebx
add esp, 0x40
mov dword [esi + 0x3c0], eax
movsd xmm0, qword [0x4e9b80]
xorps xmm1, xmm1
movups xmmword [esi + 0x3c8], xmm1
mov byte [esi + 0x3d8], 0
movsd qword [esi + 0x3e0], xmm0
movaps xmm0, xmmword [0x4e9c00]
movups xmmword [esi + 0x3e8], xmm0
mov dword [esi + 0x3f8], 0x384
movaps xmm0, xmmword [0x4e9bf0]
mov dword [esi + 0x3fc], 0xfa
movups xmmword [esi + 0x400], xmm0
push 0x34
movsd qword [esi + 0x410], xmm1
mov dword [esi + 0x418], 0xfa
push str.2000_1800_1600_1500_1400_1300_1200_1100_1000_900_800
mov byte [ebp - 4], 0x36
mov dword [esi + 0x41c], 0x7d0
call ebx
mov dword [esi + 0x420], eax
mov dword [esi + 0x424], 0x640
mov dword [esi + 0x428], 0x320
mov dword [esi + 0x42c], 0x258
mov dword [esi + 0x430], 0x1f4
mov dword [esi + 0x434], 0xfa
push 6
mov dword [esi + 0x438], 5
mov byte [ebp - 4], 0x37
mov dword [esi + 0x43c], 0
push str.d:_cam
call ebx
mov dword [esi + 0x440], eax
push 6
push str.e:_cam
mov byte [ebp - 4], 0x38
call ebx
mov dword [esi + 0x444], eax
push 4
push str.r100
mov byte [ebp - 4], 0x39
call ebx
movaps xmm0, xmmword [0x4e9c10]
add esp, 0x20
mov dword [esi + 0x448], eax
mov eax, esi
movups xmmword [esi + 0x450], xmm0
movsd xmm0, qword [0x4e9b50]
movsd qword [esi + 0x460], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret