Function at 0x4a2c00
Capabilities:
Create thread
Extract resource via kernel32 functions
Hide graphical window
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x552064]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [esp + 0x1c], ebx
call fcn.0050633f
add esp, 4
push 0xa
push 0x64
push dword [0x563dc8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4a2c83
push esi
push 0
call edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x4a2c83
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push ecx
push 0
push esi
push eax
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
push 0xa
push 0x65
push dword [0x563dc8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x4a2ccd
push esi
push 0
call edi
mov edi, eax
test edi, edi
je 0x4a2ccd
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
push 0
push esi
push eax
call dword [sym.imp.GDI32.dll_AddFontMemResourceEx]
call fcn.005062b0
push 0x5c
mov eax, dword [eax]
push dword [eax]
call fcn.004fd8a0
mov esi, eax
add esp, 8
test esi, esi
je 0x4a2d33
call fcn.005062b0
mov ecx, dword [eax]
sub esi, dword [ecx]
test esi, esi
jg 0x4a2cf7
xor eax, eax
jmp 0x4a2d16
lea ecx, [esi + 0xc]
and ecx, 0xfffffffc
call fcn.004a2590
mov byte [eax + 8], 0
mov dword [eax], 1
mov dword [eax + 4], esi
add eax, 8
mov byte [eax + esi], 0
mov dword [0x563dac], eax
call fcn.005062b0
push esi
mov eax, dword [eax]
push dword [eax]
push dword [0x563dac]
call fcn.004fe1f0
add esp, 0xc
call fcn.004a1de0
mov edi, eax
mov word [0x556a94], 0
lea eax, [esp + 0x14]
mov dword [0x556a98], 2
push eax
push 0x20019
push 0
push str.SoftwareKADOKAWA_rpg2003
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [0x556a9c], 0
mov word [0x556aa0], 0
mov byte [0x556aa4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a2eb2
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
push 0x556a94
push 0
push 0
push str.VideoSettings
push dword [esp + 0x28]
mov dword [esp + 0x28], 0x10
call esi
movups xmm0, xmmword [0x556a94]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 8
push eax
push 0x556924
push 0
push 0
push str.DebugSettings
push dword [esp + 0x28]
movups xmmword [0x556a84], xmm0
call esi
push edi
push str.SoftwareKADOKAWA_rpg2003
call fcn.00505fbf
add esp, 8
test eax, eax
je 0x4a2e1d
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edi
push reloc.DSOUND.dll_DirectSoundCreate
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a2eb2
push 0x108
lea eax, [esp + 0x94]
push 0
push eax
call fcn.004fdf60
add esp, 0xc
mov dword [esp + 0x10], 0x108
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x94]
push eax
push 0
push 0
push str.RuntimePackagePath
push dword [esp + 0x28]
call esi
lea esi, [esp + 0x90]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4a2e62
sub esi, ecx
jne 0x4a2e71
xor ebx, ebx
jmp 0x4a2e9e
lea ecx, [esi + 0xc]
and ecx, 0xfffffffc
call fcn.004a2590
push esi
lea ebx, [eax + 8]
mov dword [eax], 1
mov dword [eax + 4], esi
lea eax, [esp + 0x94]
push eax
push ebx
call fcn.004fe1f0
add esp, 0xc
mov byte [ebx + esi], 0
push dword [esp + 0x14]
mov dword [0x55f1c4], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x18]
test edi, edi
je 0x4a2ed1
mov eax, dword [edi - 8]
add edi, 0xfffffff8
cmp eax, 0xffffffff
je 0x4a2ed1
dec eax
mov dword [edi], eax
test eax, eax
jg 0x4a2ed1
push edi
call fcn.00501c9e
add esp, 4
push 0x800
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
call fcn.00487060
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push 0x6b
push ebx
mov dword [esp + 0x30], 0x30
mov dword [esp + 0x34], 3
mov dword [esp + 0x38], 0x4a36d0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], ebx
call esi
push 0x7f00
push 0
mov dword [esp + 0x48], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x48], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push 0x6b
push dword [esp + 0x40]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], str.rm2k3
call esi
mov dword [esp + 0x54], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push ebx
push 0
push 0
push 0
push DirectSoundCreate
push 0
push DirectSoundCreate
push 0x80cb0000
push str.RPG_RT
push str.rm2k3
push 0
mov dword [0x563dc8], ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x563870], eax
test eax, eax
jne 0x4a2fb2
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.004e66f2
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x64]
push eax
push dword [0x563870]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x5530c4]
mov edx, dword [esp + 0x1c]
add eax, eax
sub eax, dword [esp + 0x70]
push 0
sub eax, edx
add eax, dword [esp + 0x28]
push eax
mov eax, dword [0x55312c]
lea ecx, [eax + eax]
mov eax, dword [esp + 0x20]
sub ecx, dword [esp + 0x74]
sub ecx, eax
add ecx, dword [esp + 0x28]
push ecx
push edx
push eax
push dword [0x563870]
call dword [sym.imp.USER32.dll_MoveWindow]
mov byte [0x556b22], 1
call fcn.00487350
xor cl, cl
call fcn.00488770
push 0x3c
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004fdf60
add esp, 0xc
mov dword [esp + 0x28], 0xfffffff4
lea eax, [esp + 0x44]
mov dword [esp + 0x38], 0x190
mov byte [esp + 0x3f], 1
push str.Microsoft_Sans_Serif
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [0x5568e4], eax
xor ecx, ecx
mov eax, dword [0x556928]
cmp eax, 0xa
cmovl eax, ecx
xor esi, esi
mov dword [0x556930], eax
nop dword [eax]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x545508]
mulsd xmm0, qword [0x5454a0]
movsd qword [esp + 0x18], xmm0
call fcn.00523090
movsd qword [esi*8 + 0x55f9c8], xmm0
movsd xmm0, qword [esp + 0x18]
call fcn.00521e10
movsd qword [esi*8 + 0x55f1c8], xmm0
inc esi
cmp esi, 0x100
jl 0x4a3080
cmp dword [0x5646e8], 3
jle 0x4a30dc
mov eax, dword [0x5646ec]
mov esi, dword [eax + 0xc]
jmp 0x4a30e1
mov esi, 0x543724
push str.FullScreen
push esi
call fcn.00505fbf
add esp, 8
test eax, eax
jne 0x4a30fc
mov byte [0x556a85], 1
jmp 0x4a3114
push str.Window
push esi
call fcn.00505fbf
add esp, 8
neg eax
sbb al, al
and byte [0x556a85], al
call fcn.00419360
mov eax, dword [0x560210]
mov ecx, dword [0x55312c]
movsd xmm2, qword [0x5454e0]
test eax, eax
jg 0x4a313a
movsd qword [0x5602b0], xmm2
jmp 0x4a3156
movd xmm1, ecx
movd xmm0, eax
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b0], xmm1
mov edx, dword [0x560214]
mov eax, dword [0x5530c4]
test edx, edx
jg 0x4a316f
movsd qword [0x5602b8], xmm2
jmp 0x4a318b
movd xmm1, eax
movd xmm0, edx
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd qword [0x5602b8], xmm1
cmp byte [0x556b21], 0
jne 0x4a3224
cmp ecx, 0x140
jl 0x4a31ab
cmp eax, 0xf0
jge 0x4a3224
mov dword [0x564028], ecx
mov dword [0x56402c], eax
mov dword [0x55312c], 0x140
mov dword [0x5530c4], 0xf0
call fcn.004a1b70
mov esi, dword [0x560204]
push dword [esi + 4]
push dword [esi + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esi]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esi + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [0x560204]
test eax, eax
je 0x4a320e
push eax
call fcn.00501c9e
add esp, 4
mov dword [0x560204], 0
mov edx, dword [0x5530c4]
mov ecx, dword [0x55312c]
call fcn.0040aa00
mov dword [0x560204], eax
push dword [ebp + 0x14]
push dword [0x563870]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x563870]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x563db8
push 0
push 0
push 0x4a3590
push 0
push 0
mov byte [0x556bc1], 1
call fcn.005064ec
add esp, 0x18
mov dword [0x563dbc], eax
cmp byte [0x556bc2], 0
jne 0x4a354e
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x84]
push eax
call esi
test eax, eax
je 0x4a32af
cmp dword [esp + 0x78], 0x12
je 0x4a32bd
lea eax, [esp + 0x74]
push eax
call edi
lea eax, [esp + 0x74]
push eax
call ebx
cmp byte [0x556bc2], 0
je 0x4a3284
jmp 0x4a354e
push 0x1388
push dword [0x563dbc]
mov byte [0x556bc2], 1
mov byte [0x556bc3], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4a32ee
push 0
push dword [0x563dbc]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [0x563dbc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x556954]
test eax, eax
je 0x4a3314
push eax
call dword [sym.imp.WINMM.dll_timeKillEvent]
mov dword [0x556954], 0
mov eax, dword [0x5568e4]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x4a3326
push eax
call edi
mov ecx, dword [0x556958]
test ecx, ecx
je 0x4a3355
mov eax, dword [ecx - 8]
add ecx, 0xfffffff8
cmp eax, 0xffffffff
je 0x4a334b
dec eax
mov dword [ecx], eax
test eax, eax
jg 0x4a334b
push ecx
call fcn.00501c9e
add esp, 4
mov dword [0x556958], 0
mov eax, dword [0x556928]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, dword [0x556930]
je 0x4a33c6
lea eax, [esp + 0x14]
mov byte [0x55692c], 1
push eax
push 0x20006
push 0
push str.SoftwareKADOKAWA_rpg2003
push reloc.DSOUND.dll_DirectSoundCreate
call ebx
test eax, eax
jne 0x4a33b0
push 8
push 0x55692c
push 3
push eax
push str.DebugSettings
push dword [esp + 0x28]
call esi
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x55692c]
mov ecx, dword [0x556930]
mov dword [0x556924], eax
mov dword [0x556928], ecx
cmp byte [0x556aa4], 0
je 0x4a348b
mov al, byte [0x556a85]
cmp al, byte [0x556a95]
jne 0x4a343b
mov eax, dword [0x556a88]
cmp eax, dword [0x556a98]
jne 0x4a343b
mov al, byte [0x556a8c]
cmp al, byte [0x556a9c]
jne 0x4a343b
mov al, byte [0x556a8e]
cmp al, byte [0x556a9e]
jne 0x4a343b
mov al, byte [0x556a8f]
cmp al, byte [0x556a9f]
jne 0x4a343b
mov al, byte [0x556a90]
cmp al, byte [0x556aa0]
jne 0x4a343b
mov al, byte [0x556a91]
cmp al, byte [0x556aa1]
jne 0x4a343b
mov al, byte [0x556a86]
cmp al, byte [0x556a96]
je 0x4a348b
lea eax, [esp + 0x10]
mov byte [0x556a84], 1
push eax
push 0x20006
push 0
push str.SoftwareKADOKAWA_rpg2003
push reloc.DSOUND.dll_DirectSoundCreate
call ebx
test eax, eax
jne 0x4a347d
push 0x10
push 0x556a84
push 3
push eax
push str.VideoSettings
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [0x556a84]
movups xmmword [0x556a94], xmm0
push dword [0x563870]
call dword [sym.imp.USER32.dll_GetDC]
push dword [0x560304]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [0x560300]
test ecx, ecx
je 0x4a34bd
push ecx
call edi
mov dword [0x560300], 0
mov ecx, dword [0x56030c]
test ecx, ecx
je 0x4a34ec
mov eax, dword [ecx - 8]
add ecx, 0xfffffff8
cmp eax, 0xffffffff
je 0x4a34e2
dec eax
mov dword [ecx], eax
test eax, eax
jg 0x4a34e2
push ecx
call fcn.00501c9e
add esp, 4
mov dword [0x56030c], 0
push esi
push dword [0x563870]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0x560204]
mov edx, dword [ecx + 8]
test edx, edx
je 0x4a351c
mov eax, dword [ecx + 0x1c]
imul eax, dword [ecx + 0x18]
shl eax, 2
push eax
push 0
push edx
call fcn.004fdf60
add esp, 0xc
call fcn.004692f0
mov ecx, dword [0x560204]
mov edx, dword [ecx + 8]
test edx, edx
je 0x4a3544
mov eax, dword [ecx + 0x1c]
imul eax, dword [ecx + 0x18]
shl eax, 2
push eax
push 0
push edx
call fcn.004fdf60
add esp, 0xc
call fcn.004692f0
call fcn.00487d40
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x19c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e66f2
mov esp, ebp
pop ebp
ret 0x10