Function at 0x5415f0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5bbee1
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x62ece4]
xor eax, esp
mov dword [esp + 0x154], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x16c]
mov dword fs:[0], eax
mov ebx, 0xff
mov al, 0xea
mov dl, 0x7e
mov esi, ecx
mov cl, 0xc6
mov dword [esp + 0x24], esi
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], bl
mov byte [esp + 0x6b], bl
mov byte [esp + 0x6c], 0xfc
mov byte [esp + 0x6d], al
mov byte [esp + 0x6e], cl
mov byte [esp + 0x6f], 0xb4
mov byte [esp + 0x70], 0xb4
mov byte [esp + 0x71], 0xb4
mov byte [esp + 0x72], cl
mov byte [esp + 0x73], 0xfc
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], bl
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], bl
mov byte [esp + 0x7a], bl
mov byte [esp + 0x7b], al
mov byte [esp + 0x7c], al
mov byte [esp + 0x7d], al
mov byte [esp + 0x7e], al
mov byte [esp + 0x7f], cl
mov byte [esp + 0x80], 0xb4
mov byte [esp + 0x81], 0x90
mov byte [esp + 0x82], dl
mov byte [esp + 0x83], dl
mov byte [esp + 0x84], cl
mov byte [esp + 0x85], bl
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], bl
mov byte [esp + 0x88], bl
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], al
mov byte [esp + 0x8b], 0xfc
mov byte [esp + 0x8c], 0xfc
mov byte [esp + 0x8d], al
mov byte [esp + 0x8e], al
mov byte [esp + 0x8f], cl
mov byte [esp + 0x90], 0xb4
mov byte [esp + 0x91], 0x90
mov byte [esp + 0x92], dl
mov byte [esp + 0x93], 0x6c
mov byte [esp + 0x94], 0x5a
mov byte [esp + 0x95], 0x90
mov byte [esp + 0x96], bl
mov byte [esp + 0x97], bl
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], al
mov byte [esp + 0x9a], 0xfc
mov byte [esp + 0x9b], 0xfc
mov byte [esp + 0x9c], 0xfc
mov byte [esp + 0x9d], al
mov byte [esp + 0x9e], al
mov byte [esp + 0x9f], cl
mov byte [esp + 0xa0], 0xb4
mov byte [esp + 0xa1], 0x90
mov byte [esp + 0xa2], dl
mov byte [esp + 0xa3], 0x6c
mov byte [esp + 0xa4], 0x5a
mov byte [esp + 0xa5], 0x36
mov byte [esp + 0xa6], dl
mov byte [esp + 0xa7], bl
mov byte [esp + 0xa8], al
mov byte [esp + 0xa9], 0xfc
mov byte [esp + 0xaa], 0xfc
mov byte [esp + 0xab], 0xfc
mov byte [esp + 0xac], 0xfc
mov byte [esp + 0xad], al
mov byte [esp + 0xae], al
mov byte [esp + 0xaf], cl
mov byte [esp + 0xb0], 0xb4
mov byte [esp + 0xb1], 0x90
mov byte [esp + 0xb2], dl
mov byte [esp + 0xb3], 0x6c
mov byte [esp + 0xb4], 0x5a
mov byte [esp + 0xb5], 0x36
mov byte [esp + 0xb6], 0x24
mov byte [esp + 0xb7], al
mov byte [esp + 0xb8], al
mov byte [esp + 0xb9], 0xfc
mov byte [esp + 0xba], 0xfc
mov byte [esp + 0xbb], 0xfc
mov byte [esp + 0xbc], 0xfc
mov byte [esp + 0xbd], al
mov byte [esp + 0xbe], al
mov byte [esp + 0xbf], cl
mov byte [esp + 0xc0], 0xb4
mov byte [esp + 0xc1], 0x90
mov byte [esp + 0xc2], dl
mov byte [esp + 0xc3], 0x6c
mov byte [esp + 0xc4], 0x48
mov byte [esp + 0xc5], 0x36
mov byte [esp + 0xc6], 0x24
mov byte [esp + 0xc7], 0x5a
mov byte [esp + 0xc8], al
mov byte [esp + 0xc9], al
mov byte [esp + 0xca], al
mov byte [esp + 0xcb], al
mov byte [esp + 0xcc], al
mov byte [esp + 0xcd], al
mov byte [esp + 0xce], cl
mov byte [esp + 0xcf], 0xb4
mov byte [esp + 0xd0], 0x90
mov byte [esp + 0xd1], 0x90
mov byte [esp + 0xd2], dl
mov byte [esp + 0xd3], 0x6c
mov byte [esp + 0xd4], 0x48
mov byte [esp + 0xd5], 0x24
mov byte [esp + 0xd6], 0x12
mov byte [esp + 0xd7], 0x24
mov byte [esp + 0xd8], cl
mov byte [esp + 0xd9], al
mov byte [esp + 0xda], al
mov byte [esp + 0xdb], al
mov byte [esp + 0xdc], cl
mov byte [esp + 0xdd], cl
mov byte [esp + 0xde], cl
mov byte [esp + 0xdf], 0xb4
mov byte [esp + 0xe0], 0x90
mov byte [esp + 0xe1], dl
mov byte [esp + 0xe2], dl
mov byte [esp + 0xe3], 0x48
mov byte [esp + 0xe4], 0x36
mov byte [esp + 0xe5], 0x24
mov byte [esp + 0xe6], 0x12
mov byte [esp + 0xe7], 0x12
mov byte [esp + 0xe8], cl
mov byte [esp + 0xe9], cl
mov byte [esp + 0xea], cl
mov byte [esp + 0xeb], cl
mov byte [esp + 0xec], cl
mov byte [esp + 0xed], 0xb4
mov byte [esp + 0xee], 0xb4
mov byte [esp + 0xef], 0x90
mov byte [esp + 0xf0], dl
mov byte [esp + 0xf1], dl
mov byte [esp + 0xf2], 0x6c
mov byte [esp + 0xf3], 0x48
mov byte [esp + 0xf4], 0x36
mov byte [esp + 0xf5], 0x12
mov byte [esp + 0xf6], 0x12
mov byte [esp + 0xf7], 0
mov byte [esp + 0xf8], cl
mov byte [esp + 0xf9], 0xb4
mov byte [esp + 0xfa], 0xb4
mov byte [esp + 0xfb], 0xb4
mov byte [esp + 0xfc], 0xb4
mov byte [esp + 0xfd], 0xb4
mov byte [esp + 0xfe], 0x90
mov byte [esp + 0xff], dl
mov byte [esp + 0x100], dl
mov byte [esp + 0x101], 0x6c
mov byte [esp + 0x102], 0x5a
mov byte [esp + 0x103], 0x36
mov byte [esp + 0x104], 0x24
mov byte [esp + 0x105], 0x12
mov byte [esp + 0x106], 0
mov byte [esp + 0x107], 0
mov byte [esp + 0x108], cl
mov byte [esp + 0x109], 0x90
mov byte [esp + 0x10a], 0x90
mov byte [esp + 0x10b], 0x90
mov byte [esp + 0x10c], 0x90
mov byte [esp + 0x10d], 0x90
mov byte [esp + 0x10e], dl
mov byte [esp + 0x10f], dl
mov byte [esp + 0x110], 0x6c
mov byte [esp + 0x111], 0x6c
mov byte [esp + 0x112], 0x48
mov byte [esp + 0x113], 0x36
mov byte [esp + 0x114], 0x24
mov byte [esp + 0x115], 0x12
mov byte [esp + 0x116], 0
mov byte [esp + 0x117], 0x36
mov byte [esp + 0x118], 0xfc
mov byte [esp + 0x119], 0x90
mov byte [esp + 0x11a], dl
mov byte [esp + 0x11b], dl
mov byte [esp + 0x11c], dl
mov byte [esp + 0x11d], dl
mov byte [esp + 0x11e], 0x6c
mov byte [esp + 0x11f], 0x6c
mov byte [esp + 0x120], 0x5a
mov byte [esp + 0x121], 0x5a
mov byte [esp + 0x122], 0x36
mov byte [esp + 0x123], 0x24
mov byte [esp + 0x124], 0x12
mov byte [esp + 0x125], 0
mov byte [esp + 0x126], 0
mov byte [esp + 0x127], 0xb4
mov byte [esp + 0x128], bl
mov byte [esp + 0x129], cl
mov byte [esp + 0x12a], 0x6c
mov byte [esp + 0x12b], 0x6c
mov byte [esp + 0x12c], 0x6c
mov byte [esp + 0x12d], 0x6c
mov byte [esp + 0x12e], 0x5a
mov byte [esp + 0x12f], 0x5a
mov byte [esp + 0x130], 0x5a
mov byte [esp + 0x131], 0x48
mov byte [esp + 0x132], 0x36
mov byte [esp + 0x133], 0x24
mov byte [esp + 0x134], 0x12
mov byte [esp + 0x135], 0
mov byte [esp + 0x136], 0x48
mov byte [esp + 0x137], bl
mov byte [esp + 0x138], bl
mov byte [esp + 0x139], bl
mov byte [esp + 0x13a], 0xb4
mov byte [esp + 0x13b], 0x6c
mov byte [esp + 0x13c], 0x5a
mov byte [esp + 0x13d], 0x5a
mov byte [esp + 0x13e], 0x5a
mov byte [esp + 0x13f], 0x48
mov byte [esp + 0x140], 0x48
mov byte [esp + 0x141], 0x36
mov byte [esp + 0x142], 0x24
mov byte [esp + 0x143], 0x12
mov byte [esp + 0x144], 0
mov byte [esp + 0x145], 0x36
mov byte [esp + 0x146], bl
mov byte [esp + 0x147], bl
mov byte [esp + 0x148], bl
mov byte [esp + 0x149], bl
mov byte [esp + 0x14a], bl
mov byte [esp + 0x14b], cl
mov byte [esp + 0x14c], 0x5a
mov byte [esp + 0x14d], 0x48
mov byte [esp + 0x14e], 0x48
mov byte [esp + 0x14f], 0x48
mov byte [esp + 0x150], 0x36
mov byte [esp + 0x151], 0x24
mov byte [esp + 0x152], 0x24
mov byte [esp + 0x153], 0x12
mov byte [esp + 0x154], 0x6c
lea ecx, [esi + 0x580]
mov byte [esp + 0x155], bl
mov byte [esp + 0x156], bl
mov byte [esp + 0x157], bl
mov byte [esp + 0x158], bl
mov byte [esp + 0x159], bl
mov byte [esp + 0x15a], bl
mov byte [esp + 0x15b], bl
mov byte [esp + 0x15c], 0xfc
mov byte [esp + 0x15d], 0xb4
mov byte [esp + 0x15e], 0x6c
mov byte [esp + 0x15f], 0x48
mov byte [esp + 0x160], 0x36
mov byte [esp + 0x161], 0x5a
mov byte [esp + 0x162], dl
mov byte [esp + 0x163], al
mov byte [esp + 0x164], bl
mov byte [esp + 0x165], bl
mov byte [esp + 0x166], bl
mov byte [esp + 0x167], bl
call fcn.00484cc2
mov eax, dword [esi + 0x4e0]
cmp eax, 0xffffffff
jne 0x541da1
mov eax, dword [esi + 0x4dc]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x4ec]
cmp eax, 0xffffffff
jne 0x541dbc
mov ecx, dword [esi + 0x4e8]
mov dword [esp + 0x14], ecx
jmp 0x541dc0
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.0047f1b7
push eax
lea ecx, [esp + 0x58]
call fcn.00486264
xor ebp, ebp
lea ecx, [esp + 0x44]
mov dword [esp + 0x174], ebp
call fcn.00485c33
mov edx, dword [esp + 0x58]
push edx
mov byte [esp + 0x178], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esp + 0x48]
call fcn.0048613d
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], vtable.CBitmap.0
mov eax, dword [esp + 0x58]
push 0x10
push 0x10
push eax
mov byte [esp + 0x180], 2
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x20]
call fcn.0048640f
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x48]
push ecx
push edx
call fcn.004864ee
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
movzx esi, al
movzx ecx, dl
mov dword [esp + 0x34], esi
sub esi, ecx
mov cx, dx
shr cx, 8
mov word [esp + 0x14], cx
mov cx, ax
shr cx, 8
shr edx, 0x10
shr eax, 0x10
mov dword [esp + 0x3c], esi
mov word [esp + 0x18], cx
mov dword [esp + 0x28], edx
mov dword [esp + 0x30], eax
jmp 0x541e99
mov cx, word [esp + 0x18]
mov esi, dword [esp + 0x3c]
movzx edi, byte [esp + ebp + 0x68]
imul esi, edi
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x34]
sub eax, edx
mov dword [esp + 0x40], eax
movzx eax, byte [esp + 0x14]
movzx ecx, cl
mov esi, ecx
sub esi, eax
imul esi, edi
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx edx, byte [esp + 0x28]
sub ecx, eax
mov dword [esp + 0x38], ecx
movzx ecx, byte [esp + 0x30]
mov esi, ecx
sub esi, edx
imul esi, edi
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
sub ecx, eax
cmp edi, ebx
jne 0x541f17
mov eax, 0xff00
jmp 0x541f2e
movzx edx, byte [esp + 0x40]
movzx eax, cl
movzx ecx, byte [esp + 0x38]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
push eax
mov eax, ebp
and eax, 0x8000000f
jns 0x541f3d
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x4c]
push eax
mov eax, ebp
cdq
and edx, 0xf
add eax, edx
sar eax, 4
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetPixel]
inc ebp
cmp ebp, 0x100
jl 0x541e90
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x541f6d
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x48]
push eax
push edx
call fcn.004864ee
mov ecx, dword [esp + 0x24]
push 0
push 1
push 0x19
push 0x10
push 0x10
add ecx, 0x580
call fcn.00484dff
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x584]
push 0xff00
push ecx
push eax
call fcn.004840f7
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.004bd360
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 1
mov dword [esp + 0x1c], vtable.CBitmap.0
call fcn.00407390
lea ecx, [esp + 0x44]
mov byte [esp + 0x174], 0
call fcn.004861bc
lea ecx, [esp + 0x54]
mov dword [esp + 0x174], 0xffffffff
call fcn.004862b8
mov ecx, dword [esp + 0x16c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.00499aa8
add esp, 0x164
ret