Function at 0x4328c9
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov eax, 0x4cad8b
call fcn.004ca750
sub esp, 0x1e0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [0x4cd8c4]
mov dword [ebp - 0x18], eax
add eax, 0x8af79146
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], 0x43b4
cmp dword [ebp - 0x2c], 0x4685
jle 0x432936
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
and edx, esi
mov eax, edx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc ebx
cmp ebx, 0x745e
jl 0x432905
inc edi
cmp edi, 0x7712
jl 0x432903
inc esi
cmp esi, 0x5e22
jl 0x432901
mov dword [ebp - 0x24], 0x2b1
mov dword [ebp - 0x20], 0x6a59
cmp dword [ebp - 0x20], 0x6b41
jle 0x432994
xor esi, esi
xor edi, edi
mov ebx, 0x70b
mov eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xb4]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x432970
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0xb4]
call fcn.004032c9
add edi, esi
dec ebx
jne 0x432956
inc esi
cmp esi, 0x6198
jl 0x43294f
mov dword [ebp - 0x1c], 0x6f57
cmp dword [ebp - 0x1c], 0x708d
jle 0x432a00
xor edi, edi
xor esi, esi
mov dword [ebp - 0x30], esi
mov ebx, esi
mov esi, 0x6d0a
mov eax, ebx
and eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x84]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x4329ce
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x84]
call fcn.004032c9
dec ebx
dec esi
jne 0x4329b2
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x6f71
jl 0x4329ab
inc edi
cmp edi, 0x7cb8
jl 0x4329a6
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x409c
jge 0x432a1c
mov edx, str.nha_psx_qyazgoyn
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x1930
cmp dword [ebp - 0x14], 0x1a4c
jle 0x432a68
xor esi, esi
xor edi, edi
mov eax, edi
and eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x785b
jl 0x432a34
inc esi
cmp esi, 0x73bf
jl 0x432a32
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp - 0x24], 0x2573
jle 0x432c9c
mov dword [ebp - 0x30], 0x1ffb
cmp dword [ebp - 0x30], 0x20f0
jle 0x432aed
xor edi, edi
xor esi, esi
mov dword [ebp - 0x2c], esi
mov ebx, esi
mov esi, 0x6ccc
mov eax, ebx
xor eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x144]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x432aaf
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x144]
call fcn.004032c9
dec ebx
dec esi
jne 0x432a93
mov esi, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x57e1
jl 0x432a8c
inc edi
cmp edi, 0x5a18
jl 0x432a87
push 0
push 0x19
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov dword [ebp - 0x28], 0x1cca
cmp dword [ebp - 0x28], 0x1e3c
jle 0x432b50
push 0
push 0x9dd
push 0x1470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor edi, edi
xor esi, esi
xor ebx, ebx
lea eax, [esi + edi]
and eax, ebx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc ebx
cmp ebx, 0x6a1e
jl 0x432b23
inc dword [ebx - 0x7f]
sti
push ds
push 0
add byte [ebp + 0x46], bh
inc esi
cmp esi, 0x542a
jl 0x432b21
inc edi
cmp edi, 0x4af8
jl 0x432b1f
mov dword [ebp - 0x24], 0x6cb
cmp dword [ebp - 0x24], 0xaa4
jle 0x432b97
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x2c], 0x27d5
mov eax, ebx
or eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
add ebx, edi
dec dword [ebp - 0x2c]
jne 0x432b6d
inc edi
cmp edi, 0x7b8d
jl 0x432b64
inc esi
cmp esi, 0x1b32
jl 0x432b62
add dword [ecx - 0x60], ecx
loope 0x432b34
xor ebp, edx
loop 0x432be9
xchg edi, eax
xor dword [esi], eax
xor bl, dh
inc ebx
int 0xeb
or eax, 0x6aa6b6cc
movsd dword es:[edi], dword [esi]
wait
and byte [edx], ah
sahf
imul ecx, dword [eax], 0x12
leave
clc
fmul dword [edi + ebx*2 + 0x42]
mov esi, 0x366c8fed
jg 0x432bd1
test eax, 0x43bdf6ff
xor bl, bl
or byte [ecx + 0x2c132091], ah
mov dword [esi], eax
push es
lodsd eax, dword [esi]
xlatb
dec esi
pop eax
insb byte es:[edi], dx
inc eax
cmp eax, dword [ecx - 0x2324c219]
scasb al, byte es:[edi]
xor esi, esp
jb 0x432c4f
idiv byte [ebx - 0x6709acd3]
in eax, dx
mov dh, 0x65
enter 0xfffffffffffff8ed, 0xffffffffffffff91
pop ds
cmpsb byte [esi], byte es:[edi]
ror byte [ebp + 0x79], cl
les edx, [edi]
dec eax
adc dh, byte [esi + 0x31]
and eax, 0x447a984e
jne 0x432c50
fisttp qword [ebx + edx*8 - 0x60570beb]
adc dword [0x82c8a2ea], 0xe9c195e9
pop ss
sub al, 0xfd
invalid
or byte [eax], al
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 4
add byte [ecx - 0x7d], bl
dec ebp
cld
inc edi
inc ebp
cld
add al, 0
add byte [eax], al
cmp dword [ebp - 0x28], 0x1c76
jge 0x432c75
mov edx, str.dma_bimf_hnckdnsl
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 6
cmp dword [ebp - 0x24], 0x332
jge 0x432c98
mov edx, str.qsut_hsxst_ltvtrakzk_pflhso_njhmz_nhgvdbh_jsyph_sqgyg_zbvqjch_zljqfw
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 8
cmp dword [ebp - 0x20], 0x6925
jge 0x432cb7
push str.mtzrt_simsjy_ont_rjqzfcung_mmpj_ohdzisfz
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x1c], 0x6df2
jge 0x432cd6
push str.qnflg_lkrdcct_pxsozgc_gwfguxsm_sxggtbra_wkob_hrlhkn_cdezuux_mtl_vmicmc_qqesuipyi
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x14], 0x1555
jge 0x432cf9
mov edx, str.lgnvwna_ijyroe_vybq_sqgy
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x6851
cmp dword [ebp - 0x14], 0x6975
jle 0x432d59
push 0
push 0x1c63
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov eax, esi
mov ecx, ebx
sar eax, cl
or eax, edi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc ebx
cmp ebx, 0x278a
jl 0x432d29
inc esi
cmp esi, 0x1d49
jl 0x432d27
inc edi
cmp edi, 0x2221
jl 0x432d25
mov dword [ebp - 0x28], 0x142
mov dword [ebp - 0x1c], 0x5686
cmp dword [ebp - 0x1c], 0x5943
jle 0x432dae
push 0x570
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
or eax, ebx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc ebx
cmp ebx, 0x11cc
jl 0x432d81
inc edi
cmp edi, 0x231c
jl 0x432d7f
inc esi
cmp esi, 0x263d
jl 0x432d7d
mov dword [ebp - 0x20], 0x5ecc
cmp dword [ebp - 0x20], 0x6178
jle 0x432e0f
xor esi, esi
xor edi, edi
mov eax, edi
or eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0x54]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x432ddb
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.004032c9
inc edi
cmp edi, 0x76af
jl 0x432dc2
inc esi
cmp esi, 0x3b9d
jl 0x432dc0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x14], 0x67b5
jge 0x432e2e
mov edx, str.fpeyrrxo_mbykits_zskdecidk_vcfuwst_vyxkt_dldaeezey_dgrtdee_dgwis_gpeqxt_pbbjtxza_hui_niioxeijs_keqgizzu
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x1838
cmp dword [ebp - 0x24], 0x1b3c
jle 0x432e76
push 0x1aa6
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor esi, esi
xor edi, edi
mov eax, edi
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x623
jl 0x432e53
inc esi
cmp esi, 0x736d
jl 0x432e51
cmp dword [ebp - 0x28], 0x2132
jle 0x432f87
mov dword [ebp - 0x14], 0xa6d
cmp dword [ebp - 0x14], 0xd6f
jle 0x432eff
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x432ec8
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1a4]
call fcn.004032c9
inc ebx
cmp ebx, 0x7fa1
jl 0x432ea5
inc edi
cmp edi, 0x5a47
jl 0x432ea3
inc esi
cmp esi, 0x242
jl 0x432ea1
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
push eax
invalid
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x1c], 0x5336
jge 0x432fa6
mov edx, str.jsxvhrn_vnsdv_mijoawu_sklwh_uwyqwpa_kry_lrx_qccu
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x28], 0x27ed
cmp dword [ebp - 0x28], 0x2a20
jle 0x433043
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0x6cee
xor edi, edi
mov esi, dword [ebp - 0x30]
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, ebx
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xe4]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433001
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0xe4]
call fcn.004032c9
inc ebx
cmp ebx, 0x43e6
jl 0x432fe3
inc edi
cmp edi, 0x2f0e
mov esi, dword [ebp - 0x30]
jl 0x432fda
mov esi, dword [ebp - 0x1c]
add dword [ebp - 0x30], esi
dec dword [ebp - 0x14]
jne 0x432fd5
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x13cf
jl 0x432fc9
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x20], 0x5d4b
jge 0x43305e
push str.grdxdix_wfxczk_kccmiggwm_upuyw_wbozqfdtq_vbim_jfxaum_osgrsm
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x6568
cmp dword [ebp - 0x14], 0x667f
jle 0x4330b9
xor esi, esi
xor edi, edi
mov ebx, 0x3eb6
mov eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x174]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433095
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x174]
call fcn.004032c9
add edi, esi
dec ebx
jne 0x43307b
inc esi
cmp esi, 0x2a1d
jl 0x433074
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x24], 0x1581
jge 0x4330d8
mov edx, str.cwnrd_itu_drbwe_xbeilnb_efqjupxk_vrwnc_becc_zrz_mmexolp_atqk
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x381
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x28], 0x252c
jge 0x4330fe
push str.bajbwy_dwrf_moihpzmk_wfnazncri_sxs_uompfiqx_mepfsujzn_taf_wcvnlakd_jpezu_jvfqkgyl
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x3d4c
cmp dword [ebp - 0x20], 0x3f14
jle 0x433158
xor esi, esi
mov edi, esi
mov ebx, 0x20f6
mov eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x114]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433135
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x114]
call fcn.004032c9
dec edi
dec ebx
jne 0x43311b
inc esi
cmp esi, 0x2960
jl 0x433114
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x14], 0x6378
jge 0x433173
push str.qpbrgpa_kthcrj_afyxpc_oscgotb_avgbfvhm_fuaicwng_lajtuhp_gnrmzp
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0x15c5
jle 0x433263
mov dword [ebp - 0x1c], 0x10
cmp dword [ebp - 0x1c], 0x112
jle 0x4331d2
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov eax, esi
cdq
idiv edi
mov ebx, edx
mov esi, 0x40ac
mov eax, ebx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
dec ebx
dec esi
jne 0x4331a7
inc edi
cmp edi, 0x4238
mov esi, dword [ebp - 0x14]
jl 0x43319b
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x2d2c
jl 0x433199
out dx, eax
in eax, dx
push edi
cmpsd dword [esi], dword es:[edi]
push edx
mov ah, 0x1c
and dword [edi - 0x3a4693ff], ebx
mov esp, 0xa884af76
popal
cmp al, 0x48
pop ds
jg 0x4331aa
jbe 0x4331c4
sbb dword [ebx], eax
stosd dword es:[edi], eax
rcl byte [ebx - 4]
wait
jns 0x433258
or cl, byte [edi]
lds edx, [ebp + 0x2e8edbcc]
pop ecx
sti
pop es
insd dword es:[edi], dx
xchg ebp, eax
dec esp
adc edx, dword [eax]
wait
lds edx, [eax + 0x5772b5e5]
aad 0x68
inc esi
invalid
lodsb al, byte [esi]
add al, ch
sbb dword [edx + 0x4d83ffff], edi
cld
inc edi
inc ebp
cld
push ds
add byte [eax], al
add byte [ecx + 0x3c03e07d], al
add byte [eax], al
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0x20], 0x3c03
jge 0x43327e
push str.lfoqezqzx_ocwb_ewzaigi_qrd_fohyxr_urxubfj_sivxdsphp
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x3ef
cmp dword [ebp - 0x20], 0x77f
jle 0x4332b9
xor esi, esi
xor edi, edi
mov eax, edi
or eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x334
jl 0x433296
inc esi
cmp esi, 0x157e
jl 0x433294
mov eax, dword [ebp - 0x18]
and eax, 0x8af79146
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x4f6b
cmp dword [ebp - 0x24], 0x4f8d
jle 0x43334d
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x28], edi
and edi, esi
xor esi, esi
mov eax, ebx
mov ecx, esi
sar eax, cl
xor eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x1d4]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433307
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1d4]
call fcn.004032c9
inc esi
cmp esi, 0x7dec
jl 0x4332e7
inc ebx
cmp ebx, 0x7e5d
jl 0x4332e5
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x480c
mov esi, dword [ebp - 0x1c]
jl 0x4332de
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x788d
jl 0x4332d9
mov dword [ebp - 0x1c], 0x76cb
cmp dword [ebp - 0x1c], 0x7933
jle 0x4333ce
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
xor ebx, ebx
xor edi, edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], eax
or eax, esi
or eax, edi
or eax, ebx
cdq
push edx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433392
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.004032c9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2b70
jl 0x433377
inc esi
cmp esi, 0x325b
jl 0x433372
inc edi
cmp edi, 0x5188
jl 0x433370
inc ebx
cmp ebx, 0x3d3c
jl 0x43336e
mov dword [ebp - 4], 0x20
cmp dword [ebp - 0x20], 0xcf
jge 0x4333ed
mov edx, str.bda_itkrpn_aelxmqivc
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x11b0
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x24], 0x4f4b
add byte [ecx + 0x4f4bdc7d], al
add byte [eax], al
jge 0x433413
push str.pxutno_wsccmamqi_meytf_wag_hpbrnn_crmyqbatr_afwv_tyh_juriexo_hhhjrekr_owe_xcut_czpe
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x24
cmp dword [ebp - 0x1c], 0x7642
jge 0x433432
push str.gos_gjyuomkmi_sqqr_jtt_psbhngyyb_bftpavgl
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0x1dba
jle 0x43348a
inc esi
aam 0xdb
push cs
sbb al, 0x65
das
push ebp
jg 0x4333de
jo 0x4333fe
popal
in al, dx
dec esp
imul ecx, dword [edx - 0x3829c811], 0x70
loope 0x433447
inc esp
mov dword [ebp - 0x20], 0x1353
mov dword [ebp - 0x24], 0x6cd7
cmp dword [ebp - 0x24], 0x6e19
jle 0x43351d
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, ebx
cdq
idiv esi
and edx, edi
mov eax, edx
cdq
push edx
push eax
lea ecx, [ebp - 0x9c]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x4334d7
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.004032c9
inc esi
cmp esi, 0x495f
jl 0x4334b6
inc ebx
cmp ebx, 0x268b
jl 0x4334b4
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x6e91
mov esi, dword [ebp - 0x1c]
jl 0x4334ab
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x739f
jl 0x4334a6
cmp dword [ebp - 0x20], 0x186e
jle 0x43368b
mov dword [ebp - 0x20], 0x1171
cmp dword [ebp - 0x20], 0x13d5
jle entry0
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x28], eax
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, esi
or eax, edi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc esi
cmp esi, 0x33f5
jl 0x433557
inc ebx
cmp ebx, 0x7117
mov eax, dword [ebp - 0x28]
jl 0x433550
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x506f
mov esi, dword [ebp - 0x1c]
jl 0x433544
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x645d
jl 0x43353f
mov dword [ebp - 4], 0x28
cmp dword [ebp - 0x24], 0x6be6
jge 0x4336a6
push str.tis_cjsn_vaj
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
and eax, 0x8af79146
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x6f6b
cmp dword [ebp - 0x1c], 0x700e
jle 0x433735
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, edi
sub ecx, edx
mov eax, esi
shl eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0xcc]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x4336f5
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0xcc]
call fcn.004032c9
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3f63
jl 0x4336d0
inc ebx
cmp ebx, 0x75c0
jl 0x4336cb
inc edi
cmp edi, 0x6b54
jl 0x4336c9
inc esi
cmp esi, 0x4062
jl 0x4336c7
mov dword [ebp - 0x20], 0x7e66
cmp dword [ebp - 0x20], 0x7fab
jle 0x4337ce
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov dword [ebp - 0x24], esi
sub esi, edx
mov edi, 0x1390
mov eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0xfc]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x43377e
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0xfc]
call fcn.004032c9
inc esi
dec edi
jne 0x433764
inc ebx
cmp ebx, 0x6e7a
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
jl 0x433755
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1168
jl 0x433753
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4447
jl 0x43374e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0x2c], 0x883
mov dword [ebp - 0x24], 0x2c78
cmp dword [ebp - 0x24], 0x2f67
jle 0x433882
push 0x2bf
push 0
push 0
push 0x1975
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x28], eax
xor esi, esi
mov edi, eax
mov ecx, ebx
shl edi, cl
mov eax, esi
xor eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x12c]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433839
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x12c]
call fcn.004032c9
inc esi
cmp esi, 0x168b
jl 0x43381d
inc ebx
cmp ebx, 0x44bb
mov eax, dword [ebp - 0x28]
jl 0x433815
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x4ac
mov esi, dword [ebp - 0x14]
jl 0x433809
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x2aab
jl 0x433804
mov dword [ebp - 0x28], 0x3bb4
cmp dword [ebp - 0x28], 0x3e80
jle 0x4338b9
xor esi, esi
xor edi, edi
mov eax, edi
or eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x3a85
jl 0x433896
inc esi
cmp esi, 0x2114
jl 0x433894
mov dword [ebp - 4], 0x2a
cmp dword [ebp - 0x1c], 0x6c37
jge 0x4338d4
push str.zzkrwqkt_cgnyi_ket_fsxjkbgu_qjqz_gygxvbfvw_makle_ivcvdnbj_gof_rwqx
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x2c
cmp dword [ebp - 0x20], 0x7c3c
jge 0x4338f3
push str.utjuoifg_gvpgjrrk_aegrj_udgycivlf_lyfabz_hpvy_roleentzi_eidy_dowif_dekqct_fqjkadnm_qqcj_ckezg_jyvgtwzsk
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 0x1aab
jle 0x433ac8
mov dword [ebp - 0x1c], 0x486
cmp dword [ebp - 0x1c], 0x867
jle 0x43394f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor esi, esi
xor edi, edi
mov eax, edi
or eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x40b6
jl 0x43392c
inc esi
cmp esi, 0x12a9
jl 0x43392a
mov dword [ebp - 0x20], 0x5dd3
cmp dword [ebp - 0x20], 0x5df3
jle 0x4339dc
xor esi, esi
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0x632e
xor edi, edi
mov esi, dword [ebp - 0x30]
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov ecx, edi
sar esi, cl
mov eax, ebx
or eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0x15c]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x43399a
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x15c]
call fcn.004032c9
inc ebx
cmp ebx, 0x3b1f
jl 0x43397e
inc edi
cmp edi, 0x554a
mov esi, dword [ebp - 0x30]
jl 0x433975
mov esi, dword [ebp - 0x14]
add dword [ebp - 0x30], esi
dec dword [ebp - 0x18]
jne 0x433970
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3253
jl 0x433964
sal ecx, 1
mov fs, ebx
add eax, 0xc740522c
pop ebx
nop
push 0xfffffffffffffffb
sahf
invalid
mov dword [ebp - 4], 0x32
cmp dword [ebp - 0x24], 0x2a1b
jge 0x433ae3
push str.ulyk_jywwpxlz_riyjg_idiuxer_uunuy_hag_dxvn_pjgp_uua
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x28], 0x3895
jge 0x433b06
mov edx, str.omkjsm_ltgtfzpfn_hiavwmr_wtslnoocs_uif_mbjm_glsr_qpumbytd_gmgsxtb
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x3da1
cmp dword [ebp - 0x14], 0x413a
jle 0x433b51
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x6f4c
mov eax, esi
xor eax, ebx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
add ebx, edi
dec dword [ebp - 0x18]
jne 0x433b27
inc edi
cmp edi, 0x6030
jl 0x433b1e
inc esi
cmp esi, 0x2991
jl 0x433b1c
mov dword [ebp - 0x18], 0x7a1
mov dword [ebp - 4], 0x36
cmp dword [ebp - 0x14], 0x3a2f
jge 0x433b77
mov edx, str.ouyld_ieo_sfgzwqsp
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x2587
jle 0x433c5e
mov dword [ebp - 0x14], 0x2d70
cmp dword [ebp - 0x14], 0x2ed2
jle 0x433bdc
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
add eax, ebx
xor eax, edi
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x2a28
jl 0x433ba3
inc ebx
cmp ebx, 0x76
jl 0x433b9e
inc edi
cmp edi, 0xd21
jl 0x433b9c
inc esi
cmp esi, 0x54af
jl 0x433b9a
push ds
fcomi st(5)
xor edi, dword [ecx + 0x2e9ec85]
xchg ebx, eax
invalid
mov dword [ebp - 0x1c], 0x47c6
cmp dword [ebp - 0x1c], 0x49f0
jle 0x433cdc
xor edi, edi
xor ebx, ebx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x18d1
mov eax, ebx
sar eax, cl
and eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433c9e
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x18c]
call fcn.004032c9
mov ecx, dword [ebp - 0x18]
add ecx, esi
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x14]
jne 0x433c80
inc esi
cmp esi, 0x2a99
jl 0x433c74
inc ebx
cmp ebx, 0x3f4b
jl 0x433c72
inc edi
cmp edi, 0x764e
jl 0x433c70
mov dword [ebp - 0x14], 0x606c
cmp dword [ebp - 0x14], 0x6273
jle 0x433d2e
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], esi
mov ecx, edi
sar esi, cl
mov eax, ebx
and eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc ebx
cmp ebx, 0x626e
jl 0x433cfc
inc edi
cmp edi, 0x31b1
mov esi, dword [ebp - 0x18]
jl 0x433cf3
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x169b
jl 0x433cf1
mov dword [ebp - 0x18], 0xa6
mov dword [ebp - 4], 0x3a
cmp dword [ebp - 0x1c], 0x47ae
jge 0x433d50
push str.lmyf_folonrh_xblsvr_mitqmper_dgmzu_zmkov_fiosfdj_wivcoonj_chgtv_xzr
call fcn.004b505d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0xa2
cmp dword [ebp - 0x20], 0x281
jle 0x433d8a
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x39d8
jl 0x433d68
inc esi
cmp esi, 0x5b74
jl 0x433d66
mov dword [ebp - 4], 0x3c
cmp dword [ebp - 0x14], 0x5d54
jge 0x433da9
mov edx, str.tsbgw_srlzykh_hmzmuzp_hskglkpg_oeqwvlago_lxmm_chpqrhh_dozqqa_lreuad_pic_ordmpfhk
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x1427
jle 0x433f33
mov dword [ebp - 0x14], 0x4d2d
cmp dword [ebp - 0x14], 0x4e80
jle 0x433e12
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov ecx, edi
shl ebx, cl
mov esi, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, esi
shl eax, cl
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc esi
cmp esi, 0x2e40
jl 0x433dde
inc edi
cmp edi, 0x2e35
mov esi, dword [ebp - 0x18]
jl 0x433dd1
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7553
jl 0x433dcf
mov dword [ebp - 0x1c], 0x7bc4
cmp dword [ebp - 0x1c], 0x7c5f
jle 0x433e8d
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov esi, edx
mov eax, ebx
and eax, esi
cdq
push edx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x433e56
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1bc]
call fcn.004032c9
inc ebx
cmp ebx, 0x6c0d
jl 0x433e3a
inc edi
cmp edi, 0xdb1
mov esi, dword [ebp - 0x18]
jl 0x433e31
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6c2f
jl 0x433e2f
push es
lodsb al, byte es:[esi]
imul esp, dword [eax - 0x6e7412cd], 0xe217323c
mov al, 0x36
pop es
push ds
mov ecx, gs
salc
push ds
std
invalid
mov dword [ebp - 4], 0x42
cmp dword [ebp - 0x20], 0xfffffde3
jge 0x433f52
mov edx, str.axn_noqhv_slejy_wrsbi_ewgyvh_jck_jkse_vcbksziee_oascg_kxiqn_lcegjhjbg
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0xa07
mov dword [ebp - 0x2c], 0x5dcb
cmp dword [ebp - 0x2c], 0x6028
jle 0x433f9d
xor esi, esi
xor edi, edi
mov eax, edi
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
inc edi
cmp edi, 0x7ad1
jl 0x433f7a
inc esi
cmp esi, 0x1db8
jl 0x433f78
cmp dword [ebp - 0x34], 0x152c
jle 0x4341ea
mov dword [ebp - 0x20], 0x20fe
cmp dword [ebp - 0x20], 0x2343
jle 0x43401e
push 0
push 0
push 0x1fdc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], 0x1a64
lea eax, [edi + ebx]
mov ecx, esi
shl eax, cl
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
dec esi
dec dword [ebp - 0x18]
jne 0x433fe3
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x2333
jl 0x433fd9
inc edi
cmp edi, 0x2230
jl 0x433fd4
inc ebx
cmp ebx, 0x4539
jl 0x433fd2
mov dword [ebp - 0x24], 0x2932
cmp dword [ebp - 0x24], 0x299f
jle 0x43408a
push 0
push 0xaee
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, esi
cdq
idiv edi
mov dword [ebp - 0x34], edx
mov esi, 0x1ec1
mov edi, edx
mov eax, ebx
cdq
push edx
push eax
mov ecx, 0xac6f98
call fcn.0042d438
add ebx, edi
dec esi
jne 0x434058
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3c5a
mov esi, dword [ebp - 0x14]
jl 0x434047
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x1065
jl 0x434042
mov dword [ebp - 0x28], 0x7cf0
cmp dword [ebp - 0x28], 0x7ece
jle 0x43410d
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x14], 0x5b3b
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], 0x228f
mov eax, ebx
mov ecx, esi
sar eax, cl
cdq
push edx
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00405444
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x4340d1
mov eax, dword [eax]
push eax
call fcn.004b505d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.004032c9
add esi, edi
dec dword [ebp - 0x18]
jne 0x4340b3
inc edi
cmp edi, 0x527c
jl 0x4340aa
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x14]
jne 0x4340a8
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xdc
jl 0x43409f
invalid
mov dword [ebp - 4], 0x4a
cmp dword [ebp - 0x2c], 0x5d53
jge 0x434209
mov edx, str.dzxkpfpt_fqeubfjnr_bxdg_colvmdpp_dixtvyifw_crhrb_pzkcwiclm_ylozqy_mvjyg_pvxcyvg_pysedfj_xnwwb_lnmsbr_asehcfvpf
mov ecx, 0xac6f98
call fcn.0042ec78
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret