Function at 0x410e40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp], edi
call dword [0x4ae844]
test eax, eax
push esi
je 0x4111f0
test ebx, ebx
jne 0x410ed8
mov eax, dword [0x4ab5d8]
test eax, eax
je 0x411200
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 4]
add eax, eax
mov dword [esp + 0x20], str.Text
mov dword [esp + 0x1c], str.Thread
mov dword [esp + 0x18], str.WndProc
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Style
mov dword [esp + 8], str.Class_Name
mov dword [esp + 4], str.Window_handle
mov dword [esp], str.__20.20s___17.17s___8.8s___.s___8.8s__s_n
call fcn.004218d0
lea esp, [ebp - 0xc]
pop ebx
mov eax, edi
pop esi
xor edx, edx
pop edi
pop ebp
jmp fcn.0040fa80
lea esi, [ebp - 0x10c]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [0x4ae7ec]
sub esp, 0xc
test eax, eax
je 0x4112d8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [0x4ae838]
sub esp, 0xc
test eax, eax
je 0x4112b0
lea ebx, [ebp - 0x12c]
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [0x4ae7f4]
test eax, eax
push ecx
push ecx
jne 0x411280
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x12c], 0
lea eax, [ebp - 0x11c]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [0x4ae834]
test eax, eax
push edx
push edx
jne 0x410faa
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [0x4ae824]
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x11c]
push ebx
mov dword [ebp - 0x140], eax
push ebx
mov ebx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x13c], ebx
mov ebx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x110]
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x144], eax
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x14c], ebx
mov eax, dword [ebp - 0x12c]
mov ebx, dword [0x4ae830]
mov dword [esp + 4], 0xfffffffc
mov dword [esp], edi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x150], eax
call ebx
mov dword [ebp - 0x154], eax
push edx
push edx
mov dword [esp + 4], 0xffffffec
mov dword [esp], edi
call ebx
mov dword [ebp - 0x158], eax
push ecx
push ecx
mov dword [esp + 4], 0xfffffff0
mov dword [esp], edi
call ebx
mov dword [ebp - 0x15c], eax
push edx
push edx
mov dword [esp + 4], 0xfffffff4
mov dword [esp], edi
call ebx
mov dword [ebp - 0x160], eax
push ecx
push ecx
mov dword [esp], edi
call dword [0x4ae80c]
mov dword [ebp - 0x164], eax
push edx
mov dword [esp + 4], 0xfffffffa
mov dword [esp], edi
call ebx
mov ebx, dword [0x4ae82c]
mov dword [ebp - 0x174], eax
push ecx
push ecx
mov dword [esp + 4], 4
mov dword [esp], edi
call ebx
mov dword [ebp - 0x168], eax
push edx
push edx
mov dword [esp], edi
call dword [0x4ae814]
mov dword [ebp - 0x16c], eax
push ecx
mov dword [esp + 4], 5
mov dword [esp], edi
call ebx
mov dword [ebp - 0x170], eax
push edx
push edx
mov dword [esp + 4], 2
mov dword [esp], edi
call ebx
mov edx, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x13c]
push ecx
push ecx
mov ecx, dword [ebp - 0x134]
mov dword [esp + 0x50], ecx
mov ecx, dword [ebp - 0x140]
mov dword [esp + 0x44], ecx
mov ecx, dword [ebp - 0x144]
mov dword [esp + 0x40], ecx
mov ecx, dword [ebp - 0x150]
mov dword [esp + 0x34], ecx
lea ecx, [ebp - 0x8c]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp - 0x154]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp - 0x158]
mov dword [esp + 0x54], edx
mov dword [esp + 0x28], ecx
mov edx, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x15c]
mov dword [esp + 0x4c], edx
mov dword [esp + 0x24], ecx
mov edx, dword [ebp - 0x148]
mov ecx, dword [ebp - 0x164]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x3c], edx
mov ebx, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x160]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x174]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov esi, dword [ebp - 0x168]
mov edx, dword [ebp - 0x170]
mov dword [esp + 0x10], esi
mov esi, dword [ebp - 0x16c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.next_p__child_p__parent_p__owner_p__class_s_ninst_p__active_p__idmenu_08Ix_nstyle0x_08lx__exstyle0x_08lx__wndproc_p__text_s_nclient_ld__ld__ld__ld__window_ld__ld__ld__ld_sysmenu_p_n
call fcn.004218d0
mov dword [esp + 4], 0xffffffee
mov dword [esp], edi
mov esi, dword [0x4ae7e8]
call esi
test eax, eax
push ebx
push ebx
jne 0x411210
mov dword [esp], 0x43d0d9
call fcn.004218d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [0x4ae7fc]
mov edi, eax
jmp 0x410e64
mov eax, 8
jmp 0x410e7d
mov dword [esp], str.Extra_bytes:
xor ebx, ebx
call fcn.004218d0
jmp 0x411254
lea eax, [ebx + ebx]
mov dword [esp], edi
mov dword [esp + 4], eax
inc ebx
call dword [0x4ae840]
xor edx, edx
mov dl, al
shr ax, 8
push ecx
push ecx
and eax, 0xffff
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], str.__02x__02x
call fcn.004218d0
mov dword [esp + 4], 0xffffffee
mov dword [esp], edi
call esi
shr eax, 1
push edx
cmp eax, ebx
push edx
ja 0x411220
mov dword [esp], 0x43d0d9
call fcn.004218d0
jmp 0x4111dc
mov dword [esp + 0xc], 2
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [0x4ae850]
sub esp, 0x10
test eax, eax
je 0x410f41
jmp 0x410f69
mov dword [ebp - 0x8c], 0x45202d2d
mov dword [ebp - 0x88], 0x7974706d
mov dword [ebp - 0x84], 0x2d2d20
jmp 0x410f24
mov dword [ebp - 0x10c], 0x55202d2d
mov dword [ebp - 0x108], 0x6f6e6b6e
mov dword [ebp - 0x104], 0x2d206e77
mov word [ebp - 0x100], 0x2d
jmp 0x410efe