Function at 0x42a1e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x47a2eb
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x1b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4947a0]
xor eax, esp
push eax
lea eax, [esp + 0x1c8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1d8]
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x74], ebp
mov al, 0x46
mov cl, 0xa
mov dl, 0x4c
mov bl, 0x5a
xor edi, edi
mov dword [esp + 0x1d0], edi
mov byte [esp + 0x145], 0x32
mov byte [esp + 0x146], 0x25
mov byte [esp + 0x147], dl
mov byte [esp + 0x148], 0x44
mov byte [esp + 0x149], al
mov byte [esp + 0x14a], cl
mov byte [esp + 0x14b], 0x4e
mov byte [esp + 0x14c], al
mov byte [esp + 0x14d], bl
mov byte [esp + 0x14e], 0x3b
mov byte [esp + 0x14f], 0x20
mov byte [esp + 0x150], 0x32
mov byte [esp + 0x151], dl
mov byte [esp + 0x152], 0x47
mov byte [esp + 0x153], al
mov byte [esp + 0x154], al
mov byte [esp + 0x155], cl
mov byte [esp + 0x156], 0x44
mov byte [esp + 0x157], al
mov byte [esp + 0x158], al
mov byte [esp + 0x159], bl
mov byte [esp + 0x15a], 0x3b
mov byte [esp + 0x15b], 0x25
mov byte [esp + 0x15c], 0x26
mov byte [esp + 0x15d], dl
mov byte [esp + 0x15e], 0x47
mov byte [esp + 0x15f], al
mov byte [esp + 0x160], cl
mov byte [esp + 0x161], 0x42
mov byte [esp + 0x162], al
mov byte [esp + 0x163], bl
mov byte [esp + 0x164], 0x2e
mov byte [esp + 0x165], 0x2f
mov byte [esp + 0x166], 0x39
mov byte [esp + 0x167], dl
mov byte [esp + 0x168], al
mov byte [esp + 0x169], cl
mov byte [esp + 0x16a], al
mov byte [esp + 0x16b], bl
mov byte [esp + 0x16c], 0x39
mov byte [esp + 0x16d], 0x3f
mov byte [esp + 0x16e], 0x3b
mov byte [esp + 0x16f], dl
mov byte [esp + 0x170], al
mov byte [esp + 0x171], cl
mov byte [esp + 0x172], al
mov byte [esp + 0x173], bl
mov byte [esp + 0x174], 0x26
mov byte [esp + 0x175], 0x22
mov byte [esp + 0x176], 0x35
mov byte [esp + 0x177], dl
mov byte [esp + 0x178], 0x44
mov byte [esp + 0x179], bl
mov byte [esp + 0x17a], 0x25
mov byte [esp + 0x17b], 0x26
mov byte [esp + 0x17c], 0x22
mov byte [esp + 0x17d], dl
mov byte [esp + 0x17e], 0x47
mov byte [esp + 0x17f], cl
mov byte [esp + 0x180], 0x47
mov byte [esp + 0x181], cl
mov byte [esp + 0x182], 0x47
mov byte [esp + 0x183], cl
mov byte [esp + 0x184], 0x47
mov byte [esp + 0x185], cl
mov byte [esp + 0x186], bl
mov byte [esp + 0x187], 0x3b
mov byte [esp + 0x188], 0x39
mov byte [esp + 0x189], 0x32
mov byte [esp + 0x18a], dl
mov byte [esp + 0x198], al
mov byte [esp + 0x199], al
mov byte [esp + 0x19a], al
mov byte [esp + 0x19d], al
mov byte [esp + 0x19e], al
mov byte [esp + 0x19f], al
mov byte [esp + 0x1a0], al
mov byte [esp + 0x18b], 0x44
mov byte [esp + 0x18c], bl
mov byte [esp + 0x18d], 0x38
mov byte [esp + 0x18e], 0x23
mov byte [esp + 0x18f], 0x3b
mov byte [esp + 0x190], dl
mov byte [esp + 0x191], 0x45
mov byte [esp + 0x192], bl
mov byte [esp + 0x193], 0x22
mov byte [esp + 0x194], 0x3b
mov byte [esp + 0x195], 0x33
mov byte [esp + 0x196], dl
mov byte [esp + 0x197], 0x43
mov byte [esp + 0x19b], cl
mov byte [esp + 0x19c], 0x45
mov byte [esp + 0x1a1], bl
mov byte [esp + 0x1a2], 0x39
mov byte [esp + 0x1a3], 0x22
mov byte [esp + 0x1a4], 0x30
mov byte [esp + 0x1a5], dl
mov byte [esp + 0x1a6], 0x47
mov byte [esp + 0x1a7], cl
mov byte [esp + 0x1a8], 0x47
mov byte [esp + 0x1a9], cl
mov byte [esp + 0x1aa], 0x47
mov byte [esp + 0x1ab], cl
mov byte [esp + 0x1ac], 0x47
mov byte [esp + 0x1ad], cl
mov byte [esp + 0x1ae], bl
mov byte [esp + 0x1af], 0x39
mov byte [esp + 0x1b0], 0x3b
mov byte [esp + 0x1b1], 0x25
mov byte [esp + 0x1b2], dl
mov byte [esp + 0x1b3], 0x41
mov byte [esp + 0x1b4], cl
mov byte [esp + 0x1b5], 0x42
mov byte [esp + 0x1b6], cl
mov byte [esp + 0x1b7], bl
mov byte [esp + 0x1b8], 0x3f
mov byte [esp + 0x1b9], 0x3b
mov byte [esp + 0x1ba], 0x25
mov byte [esp + 0x1bb], dl
mov byte [esp + 0x1bc], 0x45
mov byte [esp + 0x1bd], cl
mov byte [esp + 0x1be], 0x43
mov byte [esp + 0x1bf], cl
mov byte [esp + 0x1c0], 0x4a
mov byte [esp + 0x1c1], 0x55
mov byte [esp + 0x1c2], 0x48
mov byte [esp + 0x1c3], 0x76
lea eax, [esp + 0x144]
mov byte [esp + 0x144], 0x4d
inc eax
xor byte [eax], 0x76
jne 0x42a606
lea eax, [esp + 0x144]
mov dword [esp + 0x140], 0xf
mov dword [esp + 0x13c], edi
mov byte [esp + 0x12c], 0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42a630
sub eax, ecx
push eax
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x130]
call fcn.00401bf0
mov ebx, esi
mov byte [esp + 0x1d0], 1
call fcn.004214e0
push 0
push 0
mov edi, eax
push ebp
lea edx, [esp + 0x40]
lea ecx, [esp + 0x104]
mov dword [esp + 0x28], edi
call fcn.004042c0
lea ecx, [esp + 0x90]
push ecx
call fcn.0041ac00
lea edx, [esp + 0xa8]
push edx
mov byte [esp + 0x1d4], 2
call fcn.0041ac00
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x1d4], 3
call dword [sym.imp.USER32.dll_SetRectEmpty]
call fcn.004214e0
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x42a6dd
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0x10
push ecx
call ebp
push 0
push 0
push 0
push 0
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x42a6f2
push eax
call fcn.0043e4b5
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x4c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x14c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push eax
mov byte [ecx + 4], 0
call fcn.00401910
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x100]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x68]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x70]
lea ecx, [esp + 0x15c]
call fcn.004217c0
lea edx, [esp + 0x5c]
push edx
call fcn.0041ac00
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x1d4], 4
call fcn.0041ac00
lea ecx, [esp + 0x78]
push ecx
mov byte [esp + 0x1d4], 5
call fcn.0041ac00
mov byte [esp + 0x1d0], 6
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov edx, dword [esp + 0x68]
mov dword [eax + 0xc], edx
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x74]
push esi
mov dword [eax + 8], ecx
lea esi, [esp + 0x60]
mov dword [eax + 0xc], edx
call fcn.004212b0
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
push edx
mov edx, dword [esp + 0x10c]
push eax
push ecx
mov ecx, dword [esp + 0xf0]
push edx
lea eax, [esp + 0x88]
push eax
push ecx
mov edx, dword [esp + 0xf8]
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf0]
push edx
push eax
mov eax, dword [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x3c]
push eax
push ecx
mov ecx, dword [esp + 0x128]
push edx
mov edx, dword [esp + 0x130]
lea eax, [esp + 0x11c]
push eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x148]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x14c]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x98]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x9c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xb0]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
call fcn.00422760
mov edx, dword [esp + 0x88]
sub edx, dword [esp + 0x84]
sar edx, 3
cmp edx, 2
jb 0x42a8fa
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push ecx
push edx
push eax
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x40], esp
push ecx
lea ecx, [esp + 0xa4]
call fcn.004363e0
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x54]
push edx
push eax
lea ecx, [esp + 0xf0]
push ecx
call fcn.00422180
sub esp, 0x18
mov edx, esp
mov dword [esp + 0x30], esp
push edx
lea ecx, [esp + 0xdc]
call fcn.004363e0
mov byte [esp + 0x1e8], 7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x100]
push eax
push ecx
mov ecx, dword [esp + 0x10c]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [esp + 0x120]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x124]
mov dword [eax + 8], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 0xc], ecx
mov eax, dword [esp + 0x6c]
push edx
push eax
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x64], esp
push ecx
lea ecx, [esp + 0xfc]
call fcn.00436290
sub esp, 0x18
mov byte [esp + 0x238], 8
mov edx, esp
mov dword [esp + 0xac], esp
push edx
lea ecx, [esp + 0xfc]
call fcn.00436290
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x9c]
push eax
push ecx
lea ecx, [esp + 0xcc]
mov byte [esp + 0x240], 6
call fcn.00422290
mov edx, dword [esp + 0x6c]
sub edx, dword [esp + 0x68]
sar edx, 3
test edx, edx
jbe 0x42ada4
mov ebx, dword [esp + 0x20]
call fcn.004214e0
test eax, eax
je 0x42ada4
xor esi, esi
cmp ebx, esi
jne 0x42a9e1
xor eax, eax
jmp 0x42a9e4
mov eax, dword [ebx + 0x20]
push 0x2010001
push eax
push 0x21
push edi
call ebp
push esi
push esi
push 7
push edi
call ebp
mov eax, dword [0x4b1164]
mov ecx, dword [0x4b1168]
mov dword [0x4b1164], edi
mov dword [0x4b1168], 8
cmp eax, esi
je 0x42aa1f
push esi
push esi
push ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
mov dword [0x4b116c], 1
call fcn.00432590
mov eax, dword [esp + 0x6c]
sub eax, dword [esp + 0x68]
mov dword [esp + 0x44], esi
sar eax, 3
test eax, eax
jbe 0x42ad54
mov ebx, dword [esp + 0x44]
lea eax, [esp + 0x5c]
call fcn.004364d0
mov esi, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x38], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
test edi, edi
jne 0x42aa78
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x20]
push edi
push edi
push 0x10
push edx
call ebp
jmp 0x42aaa0
push edi
call fcn.0043e4b5
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [0x4b1340], eax
mov dword [0x4b1344], ecx
movzx edx, word [0x4b1344]
movzx eax, word [0x4b1340]
shl edx, 0x10
or edx, eax
push edx
push 0
push 0x84
push edi
call ebp
movzx esi, si
movzx eax, bx
shl esi, 0x10
or esi, eax
push esi
push edi
push 0x200
push edi
mov dword [esp + 0x28], eax
call ebp
cmp ebx, dword [esp + 0x24]
jne 0x42ad36
mov ecx, dword [esp + 0x38]
cmp ecx, dword [esp + 0x28]
jne 0x42ad36
mov ecx, 0x483134
lea edi, [esp + 0x1dc]
call fcn.00401da0
test eax, eax
jne 0x42ac2e
mov ebx, dword [esp + 0x20]
call fcn.004215a0
mov edi, eax
call fcn.00421660
mov dword [esp + 0x14], eax
call fcn.00421720
mov edx, dword [esp + 0x14]
push esi
push 0x201
push 0x210
push edx
call ebp
push esi
push 0x201
push 0x210
push edi
call ebp
cmp dword [ebx + 0x26c], 0
jle 0x42ab6e
push 4
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov cx, word [ebx + 0x26c]
add cx, word [esp + 0x38]
sub cx, ax
movzx edx, cx
shl edx, 0x10
or edx, dword [esp + 0x18]
push edx
jmp 0x42ab6f
push esi
push 0x201
push 0x210
mov ecx, ebx
call fcn.004014d0
push eax
call ebp
push 0x2010001
mov ecx, ebx
call fcn.004014d0
push eax
push 0x21
call fcn.004214e0
push eax
call ebp
push 0x2010001
mov ecx, ebx
call fcn.004014d0
push eax
push 0x21
call fcn.00421660
push eax
call ebp
push 0x2010001
mov ecx, ebx
call fcn.004014d0
push eax
push 0x21
call fcn.004215a0
push eax
call ebp
mov ecx, ebx
call fcn.004014d0
push 0x2010001
push eax
push 0x21
push eax
call ebp
push 0
push 1
push 0x1c
mov ecx, ebx
call fcn.004014d0
push eax
call ebp
push 0
push 2
push 6
mov ecx, ebx
call fcn.004014d0
push eax
call ebp
push 0
push 0
push 7
push edi
call ebp
mov eax, dword [esp + 0x14]
push 0
push edi
push 7
push eax
call ebp
mov edi, dword [esp + 0x1c]
push esi
push 1
push 0x201
push edi
call ebp
push esi
push 1
push 0x202
push edi
call ebp
jmp 0x42ad32
mov ecx, 0x4832cc
lea edi, [esp + 0x1dc]
call fcn.00401da0
test eax, eax
jne 0x42ad32
mov ecx, dword [esp + 0x74]
mov esi, dword [ecx + 0x20]
mov dword [esp + 0x18], esi
test esi, esi
je 0x42ac5e
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
sub esp, 0x1c
mov byte [esp + 0x208], 9
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.onmousedown
call fcn.00401cd0
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
mov dword [eax], esi
test esi, esi
je 0x42ac9c
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
call fcn.00425ae0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.onmouseup
call fcn.00401cd0
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
mov dword [eax], esi
test esi, esi
je 0x42acd7
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
call fcn.00425ae0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.onclick
call fcn.00401cd0
push ecx
mov eax, esp
mov dword [esp + 0x50], esp
mov dword [eax], esi
test esi, esi
je 0x42ad12
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
call fcn.00425ae0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x114]
push esi
call edx
mov byte [esp + 0x1d0], 6
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x6c]
sub edx, dword [esp + 0x68]
mov eax, dword [esp + 0x44]
inc eax
sar edx, 3
mov dword [esp + 0x44], eax
cmp eax, edx
jb 0x42aa46
xor esi, esi
cmp dword [0x4b119c], esi
je 0x42ad69
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.00417860
xor esi, esi
mov eax, dword [0x4b1164]
mov ecx, dword [0x4b1168]
mov dword [0x4b119c], esi
mov dword [0x4b1198], esi
mov dword [0x4b1164], esi
mov dword [0x4b1168], 8
cmp eax, esi
je 0x42ad9e
push esi
push esi
push ecx
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x4b116c], esi
mov eax, dword [esp + 0x84]
xor esi, esi
cmp eax, esi
je 0x42adba
push eax
call fcn.004396bc
add esp, 4
mov eax, dword [esp + 0x78]
push eax
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
call fcn.004396bc
mov eax, dword [esp + 0xd0]
add esp, 4
cmp eax, esi
je 0x42adf0
push eax
call fcn.004396bc
add esp, 4
mov ecx, dword [esp + 0xc0]
push ecx
mov dword [esp + 0xd0], esi
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], esi
call fcn.004396bc
mov eax, dword [esp + 0x6c]
add esp, 4
cmp eax, esi
je 0x42ae26
push eax
call fcn.004396bc
add esp, 4
mov edx, dword [esp + 0x5c]
push edx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
call fcn.004396bc
mov eax, dword [esp + 0xb8]
add esp, 4
cmp eax, esi
je 0x42ae53
push eax
call fcn.004396bc
add esp, 4
mov eax, dword [esp + 0xa8]
push eax
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
call fcn.004396bc
mov eax, dword [esp + 0xa0]
add esp, 4
cmp eax, esi
je 0x42ae8c
push eax
call fcn.004396bc
add esp, 4
mov ecx, dword [esp + 0x90]
push ecx
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
call fcn.004396bc
mov edi, 0x10
add esp, 4
cmp dword [esp + 0x140], edi
jb 0x42aecf
mov edx, dword [esp + 0x12c]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x140], 0xf
mov dword [esp + 0x13c], esi
mov byte [esp + 0x12c], 0
cmp dword [esp + 0x1f4], edi
jb 0x42af02
mov eax, dword [esp + 0x1e0]
push eax
call fcn.004396bc
add esp, 4
mov ecx, dword [esp + 0x1c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1b0]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x1c0
ret 0x20