Function at 0x4014e2
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4096a0
push 0xffffffffffffffff
push 0x49cd88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0040178f
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x18]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x38], edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push str.RButton
push str.SoftwareMicrosoftWindowsCurrentVersion_run
lea ecx, [esp + 0x14]
call fcn.004012f8
push edi
mov dword [esi + 0x2a8], eax
call fcn.0040110e
push edi
call fcn.0040149c
add esp, 8
push edi
call dword [sym.imp.USER32.dll_ShowCursor]
mov ecx, esi
call fcn.00401b77
push 1
mov dword [esi + 0x5c], eax
call fcn.0040118b
push 1
call fcn.004016b8
add esp, 8
mov ecx, esi
mov dword [esi + 0xb8], edi
push 0xc8
push 1
call fcn.004022bb
push 0x2710
push 2
mov ecx, esi
mov dword [esi + 0x9c], eax
call fcn.004022bb
mov ebp, dword [esp + 0x18]
mov dword [esi + 0xa0], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x70], edi
sub eax, ebp
mov ebp, dword [esp + 0x1c]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x234], eax
mov eax, dword [esp + 0x24]
sub eax, ebp
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x238], eax
mov eax, 0xff
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov edx, dword [0x4c903c]
mov eax, dword [edx + 0x14c]
cmp eax, 1
jne 0x4097a4
push edi
call fcn.00401d66
jmp 0x4097af
cmp eax, 3
jne 0x4097b2
push edi
call fcn.00401087
add esp, 4
lea eax, [esi + 0x190]
mov ecx, 5
mov dword [eax - 4], edi
mov dword [eax], edi
add eax, 8
dec ecx
jne 0x4097bd
cmp dword [esi + 0x98], edi
je 0x409971
mov ebp, dword [sym.imp.USER32.dll_ScreenToClient]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
cmp dword [esi + 0x70], edi
je 0x409890
lea eax, [esp + 0x14]
push eax
call ebx
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x14]
push ecx
push edx
call ebp
mov eax, dword [esi + 0xa0]
mov ecx, esi
push eax
call fcn.00401b18
push 0x2710
push 2
mov ecx, esi
call fcn.004022bb
mov dword [esi + 0xa0], eax
mov eax, dword [esi + 0xb8]
cmp eax, 0x14
jge 0x409964
cmp eax, edi
jl 0x409964
inc eax
mov ecx, esi
push eax
call fcn.00401343
mov ecx, dword [esi + 0x1f8]
mov edx, dword [esp + 0x14]
push 0xa
lea eax, [esi + ecx*8 + 0x18c]
mov ecx, dword [esi + ecx*8 + 0x18c]
add ecx, edx
mov dword [eax], ecx
mov eax, dword [esi + 0x1f8]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + eax*8 + 0x190]
lea eax, [esi + eax*8 + 0x190]
add edx, ecx
mov dword [eax], edx
mov ecx, dword [esi + 0xb8]
inc ecx
mov dword [esi + 0xb8], ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x409964
mov eax, dword [esi + 0xb8]
cmp eax, 0x14
jge 0x4098db
cmp eax, edi
jle 0x4098d2
mov edx, dword [esi + 0x1f8]
mov dword [esi + 0xb8], edi
mov dword [esi + edx*8 + 0x18c], edi
mov eax, dword [esi + 0x1f8]
mov dword [esi + eax*8 + 0x190], edi
mov ecx, dword [esi + 0xb8]
push ecx
mov ecx, esi
call fcn.00401343
jmp 0x409964
cmp eax, 0x14
jl 0x409964
mov edx, dword [esi + 0x1f8]
mov dword [esi + 0xb8], edi
mov eax, 0x66666667
lea ecx, [esi + edx*8 + 0x18c]
mov edx, dword [esi + edx*8 + 0x18c]
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x66666667
mov dword [ecx], edx
mov ecx, dword [esi + 0x1f8]
mov edx, dword [esi + ecx*8 + 0x190]
lea ecx, [esi + ecx*8 + 0x190]
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [ecx], edx
mov ecx, dword [esi + 0xb8]
push ecx
mov ecx, esi
call fcn.00401343
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.0040224d
cmp dword [esi + 0x1f8], 4
jl 0x40995e
mov ecx, esi
call fcn.004020cc
inc dword [esi + 0x1f8]
cmp dword [esi + 0x98], edi
jne 0x4097e1
pop ebx
mov ecx, dword [0x4c903c]
mov eax, dword [ecx + 0x14c]
cmp eax, 1
jne 0x4099a0
mov edx, dword [esi + 0x2a8]
push edx
call fcn.0040110e
push 1
call fcn.00401d66
mov eax, dword [esi + 0x5c]
push eax
call fcn.0040118b
jmp 0x4099c1
cmp eax, 3
jne 0x4099c4
mov ecx, dword [esi + 0x2a8]
push ecx
call fcn.0040149c
push 1
call fcn.00401087
mov edx, dword [esi + 0x5c]
push edx
call fcn.004016b8
add esp, 0xc
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040228e
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret