Function at 0x4353d0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
cmp byte [0x4b6e9b], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push esi
push edi
jne 0x43542c
mov ecx, dword [0x4b6ed8]
mov eax, dword [0x4b70f4]
add dword [0x4b6ed0], ecx
add eax, ecx
lea ecx, [ebp - 0x44]
mov dword [0x4b6dd0], eax
push ecx
push 1
lea ecx, [ebp - 0x35]
mov dword [0x4b6ec8], eax
push ecx
push eax
push dword [0x4b6e90]
call ebx
cmp byte [ebp - 0x35], 0x55
jne 0x436602
mov byte [0x4b6e9b], 1
cmp dword [0x4b7130], 0
jne 0x435443
cmp dword [0x4b7138], 0
je 0x435443
call fcn.00424950
mov esi, dword [0x4b6d20]
lea eax, [ebp - 0x28]
push eax
push dword [0x4b7150]
xorps xmm0, xmm0
mov dword [ebp - 0x10], esi
movups xmmword [ebp - 0x28], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
movd xmm1, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 8]
cvtdq2ps xmm0, xmm0
push eax
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 8]
mov ecx, edi
sub ecx, dword [0x4b7158]
mov esi, dword [ebp - 4]
mov edx, esi
sbb edx, dword [0x4b715c]
call fcn.0047b020
mov edx, dword [0x4b7164]
mov ecx, dword [0x4b7160]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0xc], xmm0
call fcn.0047b020
movss xmm1, dword [ebp - 0xc]
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 0x10]
push 0x11
divss xmm1, xmm0
movss dword [eax + 0x18], xmm1
mov dword [0x4b715c], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x4b7158], edi
call esi
mov edi, dword [ebp - 0x10]
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xfd], al
call esi
mov esi, dword [0x4b6d20]
shr eax, 0xf
and al, 1
mov byte [edi + 0xff], 0
mov byte [edi + 0xfe], al
cmp byte [esi + 0x357], 0
je 0x435571
cvttss2si eax, dword [esi + 0xe4]
mov dword [ebp - 0x40], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x40]
push eax
push dword [0x4b7150]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x435571
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x4b7150]
jne 0x4355d5
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4355d5
lea eax, [ebp - 0x14]
push eax
push dword [0x4b7150]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x4355d5
movd xmm0, dword [ebp - 0x14]
movd xmm1, dword [ebp - 0x10]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [edi + 0xb0], 0
je 0x4355e3
or eax, 0xffffffff
jmp 0x4355ee
mov eax, dword [0x4b6d20]
mov eax, dword [eax + 0x1e40]
cmp dword [0x4b40d0], eax
je 0x435600
mov dword [0x4b40d0], eax
call fcn.00424d20
call fcn.00424e50
call fcn.00407d60
mov eax, dword [0x4b6e2c]
push 0x4b6db8
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc0]
lea eax, [ebp - 0x3c]
push eax
push 4
lea eax, [ebp - 0x44]
push eax
push dword [0x4b70e8]
push dword [0x4b6e90]
call ebx
cmp dword [ebp - 0x44], 0
jbe 0x4356c3
call fcn.00430d00
call fcn.00430d00
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push dword [0x4b70e8]
push dword [0x4b6e90]
call ebx
cmp dword [ebp - 0x10], 0
jbe 0x4356be
call fcn.0042af00
push dword [0x4b7260]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x4b716c]
shr eax, 0xf
and al, 1
test ecx, ecx
jne 0x4356a5
cmp byte [0x4b6d96], 1
jne 0x4356be
call fcn.00430890
push 0
push 0
push 0
push 0
test al, al
je 0x4356b6
push 2
jmp 0x4356b8
js 0x4356be
cmp byte [0x4b6d96], 0
je 0x4356be
test al, al
je 0x4356be
jmp 0x435690
push 4
call dword [sym.imp.USER32.dll_mouse_event]
call fcn.00433ac0
cmp byte [0x4b7141], 0
movss xmm2, dword [0x492d48]
je 0x4364b8
mov eax, dword [0x4b6dc0]
movss xmm4, dword [0x492d14]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4936b0]
mov eax, dword [0x4b6dc4]
cvtpd2ps xmm3, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm3, xmm4
addsd xmm0, qword [eax*8 + 0x4936b0]
mov eax, dword [0x4b6d78]
movss dword [ebp - 0xc], xmm3
cvtpd2ps xmm1, xmm0
mulss xmm1, xmm4
movss dword [ebp - 0x10], xmm1
test eax, eax
jne 0x435963
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x435753
xorps xmm2, xmm2
jmp 0x435757
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 8], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 4], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 0x20], xmm3
shl eax, 0x18
or eax, 0xff
movss dword [ebp - 0x1c], xmm0
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x4357e5
xorps xmm3, xmm3
jmp 0x4357f1
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x43588c
xorps xmm3, xmm3
jmp 0x435898
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x43593a
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0xff
jmp 0x43645d
cmp eax, 1
jne 0x435b96
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x435986
xorps xmm2, xmm2
jmp 0x43598a
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 0x20], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 0x1c], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 8], xmm3
shl eax, 0x18
or eax, 0xf500
movss dword [ebp - 4], xmm0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435a18
xorps xmm3, xmm3
jmp 0x435a24
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xf500
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435abf
xorps xmm3, xmm3
jmp 0x435acb
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xf500
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x435b6d
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0xf500
jmp 0x43645d
cmp eax, 2
jne 0x435dc9
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x435bb9
xorps xmm2, xmm2
jmp 0x435bbd
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 0x20], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 0x1c], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 8], xmm3
shl eax, 0x18
or eax, 0x99cb28
movss dword [ebp - 4], xmm0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435c4b
xorps xmm3, xmm3
jmp 0x435c57
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0x99cb28
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435cf2
xorps xmm3, xmm3
jmp 0x435cfe
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0x99cb28
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x435da0
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0x99cb28
jmp 0x43645d
cmp eax, 3
jne 0x435ffc
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x435dec
xorps xmm2, xmm2
jmp 0x435df0
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 0x20], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 0x1c], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 8], xmm3
shl eax, 0x18
or eax, 0xff04f6
movss dword [ebp - 4], xmm0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435e7e
xorps xmm3, xmm3
jmp 0x435e8a
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xff04f6
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x435f25
xorps xmm3, xmm3
jmp 0x435f31
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xff04f6
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x435fd3
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0xff04f6
jmp 0x43645d
cmp eax, 4
jne 0x43622f
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x43601f
xorps xmm2, xmm2
jmp 0x436023
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 0x20], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 0x1c], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 8], xmm3
shl eax, 0x18
or eax, 0x53ff
movss dword [ebp - 4], xmm0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x4360b1
xorps xmm3, xmm3
jmp 0x4360bd
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0x53ff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x436158
xorps xmm3, xmm3
jmp 0x436164
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0x53ff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x436206
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0x53ff
jmp 0x43645d
cmp eax, 5
jne 0x4364b8
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm5, dword [eax + 0x1518]
comiss xmm0, xmm5
jbe 0x436252
xorps xmm2, xmm2
jmp 0x436256
minss xmm2, xmm5
mov eax, dword [eax + 0x1cfc]
movaps xmm0, xmm1
mulss xmm2, dword [0x492dd4]
mov edx, 1
subss xmm0, dword [0x492d74]
mov ecx, dword [eax]
addss xmm2, xmm4
movss dword [ebp - 0x20], xmm3
push ecx
mov dword [esp], 0x40000000
movss dword [ebp - 0x1c], xmm0
movaps xmm0, xmm1
subss xmm0, dword [0x492d98]
cvttss2si eax, xmm2
movss dword [ebp - 8], xmm3
shl eax, 0x18
or eax, 0xffff
movss dword [ebp - 4], xmm0
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x4362e4
xorps xmm3, xmm3
jmp 0x4362f0
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
subss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
subss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xffff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm0, xmm0
movss xmm1, dword [eax + 0x1518]
comiss xmm0, xmm1
jbe 0x43638b
xorps xmm3, xmm3
jmp 0x436397
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mov eax, dword [eax + 0x1cfc]
mov edx, 1
mulss xmm3, dword [0x492dd4]
movss xmm0, dword [ebp - 0xc]
mov ecx, dword [eax]
addss xmm3, dword [0x492d14]
addss xmm0, dword [0x492d74]
movss xmm1, dword [ebp - 0x10]
push ecx
mov dword [esp], 0x40000000
cvttss2si eax, xmm3
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x492d98]
shl eax, 0x18
or eax, 0xffff
movss dword [ebp - 0x1c], xmm1
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 4], xmm1
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm0
push eax
push str.Foreground
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
mov eax, dword [0x4b6d20]
xorps xmm3, xmm3
movss xmm1, dword [eax + 0x1518]
comiss xmm3, xmm1
ja 0x436439
movss xmm3, dword [0x492d48]
minss xmm3, xmm1
mulss xmm3, dword [0x492dd4]
mov eax, dword [eax + 0x1cfc]
addss xmm3, dword [0x492d14]
mov ecx, dword [eax]
cvttss2si eax, xmm3
shl eax, 0x18
or eax, 0xffff
movss xmm1, dword [ebp - 0x10]
mov edx, 1
movss xmm2, dword [ebp - 0xc]
movaps xmm0, xmm1
addss xmm1, dword [0x492d98]
addss xmm0, dword [0x492d74]
push ecx
mov dword [esp], 0x40000000
push eax
lea eax, [ebp - 0x20]
movss dword [ebp - 0x20], xmm2
push eax
lea eax, [ebp - 8]
movss dword [ebp - 8], xmm2
push eax
push str.Foreground
movss dword [ebp - 4], xmm1
movss dword [ebp - 0x1c], xmm0
call fcn.00406d80
add esp, 4
mov ecx, eax
call fcn.0041f4e0
cmp byte [0x49db9e], 0
je 0x4364e1
cmp byte [0x4b6db1], 0
jne 0x4364ff
push 0x11
push dword [0x4b6f14]
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [0x4b6db1], 1
jmp 0x4364ff
cmp byte [0x4b6db1], 1
jne 0x4364ff
push 0
push dword [0x4b6f14]
call dword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
mov byte [0x4b6db1], 0
cmp byte [0x4b40cd], 0
je 0x43650d
call fcn.0042baf0
call fcn.00409fa0
mov eax, dword [0x4b6e2c]
push 0
push 7
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4b6e2c]
push 0
push 0x1b
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4b6e2c]
push 0
push 0xae
push eax
mov ecx, dword [eax]
call dword [ecx + 0xe4]
mov eax, dword [0x4b6e2c]
push 0
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push 0
push 1
push 0
push 0
push eax
call dword [ecx + 0xac]
mov eax, dword [0x4b6e2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
test eax, eax
js 0x4365ac
call fcn.0040a2b0
mov eax, dword [0x4b6d20]
mov eax, dword [eax + 0x1cfc]
mov ecx, dword [eax]
xor eax, eax
add ecx, 0x34
cmp byte [ecx], al
cmove ecx, eax
call fcn.004244c0
mov eax, dword [0x4b6e2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa8]
mov eax, dword [0x4b6e2c]
push 0
push 0
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x44]
cmp eax, 0x88760868
jne 0x4365fb
mov eax, dword [0x4b6e2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x4365fb
call fcn.00424cb0
mov eax, dword [0x4b6e2c]
push 0x4b6dd4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [0x4b7138], 0
je 0x4365fb
call fcn.00424950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x493f50]
lea ecx, [ebp - 0x34]
push 5
push 0
push 0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x68d0999a
mov dword [ebp - 0x20], 0x66516560
mov dword [ebp - 0x1c], 0x5f436341
mov word [ebp - 0x18], 0x43
mov byte [ebp - 0x16], 1
mov dword [ebp - 0x3e], 0x9e8a9e82
mov word [ebp - 0x3a], 0x100
call fcn.0042bac0
push eax
lea ecx, [ebp - 0x3e]
call fcn.00429f10
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
push 0x429f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
movaps xmm0, xmmword [0x493770]
mov ecx, 0x4b4150
movups xmmword [ebp - 0x9f], xmm0
push 0x10
movaps xmm0, xmmword [0x493f30]
movups xmmword [ebp - 0x8f], xmm0
mov dword [ebp - 0x4f], 0x226d595c
movaps xmm0, xmmword [0x493c00]
movups xmmword [ebp - 0x7f], xmm0
mov dword [ebp - 0x4b], 0x13072705
movaps xmm0, xmmword [0x493a80]
movups xmmword [ebp - 0x6f], xmm0
mov word [ebp - 0x47], 0xf
movaps xmm0, xmmword [0x4937a0]
movups xmmword [ebp - 0x5f], xmm0
mov byte [ebp - 0x45], 1
call fcn.00439950
push eax
lea ecx, [ebp - 0x9f]
call fcn.004366f0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0046303a
int3