Function at 0x406c30
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x522298]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x648d90]
push esi
push edi
movss xmm0, dword [ebx + 0x37c0]
movss xmm1, dword [ebx + 0x37bc]
addss xmm0, xmm0
mov eax, dword [ebx + 0x74]
addss xmm1, xmm1
cmp dword [eax + 0x24], 0
addss xmm0, dword [ebx + 0x3be0]
addss xmm1, dword [ebx + 0x3be0]
movss dword [0x648d74], xmm0
movss xmm0, dword [ebx + 0x3794]
addss xmm0, xmm0
addss xmm1, xmm0
movss dword [0x648d78], xmm1
jne 0x406ca5
call fcn.00409c80
mov ebx, dword [0x648d90]
test ebx, ebx
je 0x406cae
mov esi, dword [ebx + 0x70]
jmp 0x406cb0
xor esi, esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], esi
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2c], xmm0
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
movd xmm1, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [eax + 0x14]
call fcn.004b4b40
mov eax, dword [ebp - 0x30]
cvtsd2ss xmm0, xmm0
mov edx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x18]
movss dword [ebp - 8], xmm0
call fcn.004b4b40
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov eax, dword [ebp - 0x30]
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [eax + 0x10], edi
mov edi, eax
mov dword [edi + 0x14], esi
mov esi, dword [0x648d90]
test esi, esi
je 0x406d5a
mov eax, dword [esi + 0x70]
mov dword [ebp - 0x30], eax
jmp 0x406d61
mov dword [ebp - 0x30], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
cmp eax, edx
jne 0x406df9
cmp byte [esi + 0x93], 0
je 0x406dba
cvttss2si eax, dword [esi + 0xdb8]
mov dword [ebp - 0xc], eax
cvttss2si eax, dword [esi + 0xdbc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x406dae
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp byte [esi + 0x93], 0
mov ecx, dword [ebp - 0x30]
jne 0x406df9
cmp dword [ecx + 8], 0
jne 0x406df9
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x406df9
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x30]
push dword [eax]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x406df9
movd xmm2, dword [ebp - 8]
lea ecx, [esi + 8]
movd xmm1, dword [ebp - 0xc]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
call fcn.0040e140
call fcn.0040a520
cmp byte [ebx + 0x44], 0
je 0x406e09
or eax, 0xffffffff
jmp 0x406e14
mov eax, dword [0x648d90]
mov eax, dword [eax + 0x4ad4]
cmp dword [edi + 0x20], eax
je 0x406e21
mov dword [edi + 0x20], eax
call fcn.0040a3f0
call fcn.0040a6d0
call fcn.00411c90
movsx eax, word [0x6414b8]
mov ecx, dword [0x648d90]
mov byte [ebp - 0x1c], 0
movd xmm1, eax
movsx eax, word [0x6414ba]
or dword [ecx + 0x472c], 3
cvtdq2ps xmm1, xmm1
mov dword [ecx + 0x473c], 0
mov dword [ecx + 0x4740], 0
mov dword [ecx + 0x4744], 0
mov dword [ecx + 0x4748], 0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov dword [ecx + 0x4730], 1
mov dword [ecx + 0x4734], 1
movss dword [ecx + 0x474c], xmm1
movss dword [ecx + 0x4750], xmm0
xor ecx, ecx
movaps xmm0, xmmword [0x515e40]
movups xmmword [ebp - 0x2c], xmm0
mov al, byte [ebp - 0x2c]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 0xf
jb 0x406eb1
push 0x22
mov edx, 0x6414b4
mov byte [ebp - 0x1c], 0
lea ecx, [ebp - 0x2b]
call fcn.004168f0
mov eax, dword [0x648d90]
add esp, 4
mov eax, dword [eax + 0x3e78]
push 6
mov al, byte [eax + 0xad]
mov byte [0x648d7c], al
test al, al
je 0x406f1b
cvttss2si eax, dword [0x648d74]
push eax
movsx eax, word [0x6414b8]
push eax
push 0
push 0
push 0
push dword [0x648d60]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [0x648d90]
jmp 0x406f66
movsx eax, word [0x6414ba]
push eax
movsx eax, word [0x6414b8]
push eax
push 0
push 0
push 0
push dword [0x648d60]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [0x648d90]
mov ecx, dword [esi + 0x3e78]
cvttss2si eax, dword [ecx + 0x1c]
movzx edx, ax
cvttss2si eax, dword [ecx + 0x20]
mov word [0x6414b8], dx
movzx eax, ax
mov word [0x6414ba], ax
mov eax, dword [0x648df0]
test eax, eax
jne 0x407105
mov eax, dword [esi + 0x3e78]
xor edi, edi
movss xmm0, dword [0x648d84]
addss xmm0, dword [0x515b9c]
movss xmm1, dword [eax + 0x1c]
movss xmm2, dword [eax + 0x20]
mulss xmm1, dword [0x515bc8]
mulss xmm2, dword [0x515bc8]
movss dword [0x648d84], xmm0
movss dword [ebp - 0x14], xmm1
movss dword [ebp - 8], xmm2
nop word [eax + eax]
movd xmm0, edi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x515bcc]
movss dword [ebp - 0x30], xmm0
cvtps2pd xmm0, xmm0
call fcn.004e53c0
movss xmm2, dword [ebp - 0x14]
mulsd xmm0, qword [0x515c40]
cvtps2pd xmm1, xmm2
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [ebp - 0x24], xmm1
movss xmm1, dword [ebp - 0x30]
cvtps2pd xmm0, xmm1
call fcn.004e60d0
mulsd xmm0, qword [0x515c40]
movss xmm2, dword [ebp - 8]
cvtps2pd xmm1, xmm2
addsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x20], xmm0
movss xmm0, dword [ebp - 0x30]
addss xmm0, dword [0x648d84]
movss dword [ebp - 0x30], xmm0
cvtps2pd xmm0, xmm0
call fcn.004e53c0
movss xmm2, dword [ebp - 0x14]
mulsd xmm0, qword [0x515c40]
cvtps2pd xmm1, xmm2
addsd xmm0, xmm1
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [ebp - 0x38], xmm1
movss xmm1, dword [ebp - 0x30]
cvtps2pd xmm0, xmm1
call fcn.004e60d0
movss xmm2, dword [ebp - 8]
mulsd xmm0, qword [0x515c40]
mov eax, dword [esi + 0x3e78]
cvtps2pd xmm1, xmm2
push ecx
mov dword [esp], 0x40000000
mov byte [eax + 0xac], 1
lea eax, [ebp - 0x38]
mov ecx, dword [esi + 0x3e78]
push 0xffffffffffffffff
push eax
addsd xmm0, xmm1
mov ecx, dword [ecx + 0x264]
lea eax, [ebp - 0x24]
push eax
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x34], xmm0
call fcn.0042db70
inc edi
cmp edi, 0xc
jge 0x4070cb
mov esi, dword [0x648d90]
jmp 0x406fc0
cmp byte [0x648df4], 0
jne 0x4070f0
push 0
push 0
push 0
push 0x401940
push 0
push 0
mov byte [0x648df4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [0x648d58], 0
je 0x40711b
mov dword [0x648df0], 1
jmp 0x40711b
cmp eax, 1
jne 0x407111
call fcn.00408230
jmp 0x40711b
cmp eax, 2
jne 0x40711b
call fcn.00408a50
call fcn.00419180
call fcn.00413bd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b3f14
mov esp, ebp
pop ebp
ret