Function at 0x4072b0
Capabilities:
Contain obfuscated stackstrings
Enumerate gui resources

Disassembly:
push 0xffffffffffffffff
push 0x432d3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x10]
push 0xa
push eax
mov ecx, 0x446e20
mov dword [esp + 0x48], 1
call fcn.00423e7d
mov eax, dword [eax]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [esp + 0x10]
mov esi, eax
call fcn.004292cb
push 0xad
push 0x60
push esi
call fcn.00406cb0
push 0xad
push 0x60
push esi
call fcn.00406cb0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
push 0x1f4
call edi
call fcn.00404780
test al, al
jne 0x40734c
push ecx
lea edx, [esp + 0x50]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.00429040
call fcn.00406ef0
add esp, 4
push 0x1f4
call edi
push 0xad
push 0x29a
push esi
call fcn.00406cb0
add esp, 0xc
push 0x1f4
call edi
push 0x127
push 0x2c6
push esi
call fcn.00406cb0
add esp, 0xc
push 0x1f4
call edi
push 0x446e18
mov ecx, 0x44684c
mov dword [0x446850], ebx
call fcn.00429404
cmp dword [0x447e40], 9
jl 0x4073bc
cmp byte [0x447e48], bl
jne 0x4073bc
push 0x446774
mov ecx, 0x44684c
call fcn.00429454
mov ebp, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x10], ebx
push ebx
push 0x407030
call ebp
cmp dword [0x446850], ebx
jne 0x407413
push 0x127
push 0x2c6
push esi
call fcn.00406cb0
add esp, 0xc
push 0x1f4
call edi
cmp byte [0x4422b0], 1
je 0x407450
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 5
mov dword [esp + 0x10], eax
jl 0x4073c6
cmp dword [0x446850], ebx
je 0x4075b6
xor esi, esi
push 0x1f4
call edi
mov eax, dword [0x446e1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x40747a
push ebx
push 0x407140
call ebp
mov ecx, dword [0x446850]
push 0x13e
push 0x153
push ecx
call fcn.00406cb0
add esp, 0xc
jmp 0x40747c
mov ecx, dword [0x447e40]
mov esi, dword [esp + 0x48]
dec ecx
push 0x446774
mov dword [0x447e40], ecx
mov ecx, esi
call fcn.00429339
mov dword [esp + 0x14], 1
jmp 0x4075ce
xor esi, esi
push ebx
push 0x407030
mov dword [0x446850], ebx
call ebp
cmp dword [0x446850], ebx
je 0x4074a9
cmp byte [0x4422b0], 1
je 0x4075f0
inc esi
cmp esi, 7
jl 0x407415
cmp dword [0x447e40], 5
jl 0x407594
cmp byte [0x447e48], bl
jne 0x407594
mov al, 0x70
mov cl, 0x73
mov byte [esp + 0x25], al
mov byte [esp + 0x26], al
mov al, 0x65
mov byte [esp + 0x2c], cl
mov byte [esp + 0x34], cl
push 1
push 0x31
lea ecx, [esp + 0x20]
mov byte [0x4422b1], 1
mov byte [esp + 0x2c], 0x41
mov byte [esp + 0x2f], 0x45
mov byte [esp + 0x30], 0x76
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x6e
mov byte [esp + 0x33], 0x74
mov byte [esp + 0x35], 0x5c
mov byte [esp + 0x36], 0x53
mov byte [esp + 0x37], 0x63
mov byte [esp + 0x38], 0x68
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], 0x6d
mov byte [esp + 0x3b], al
mov byte [esp + 0x3d], bl
mov byte [esp + 0x18], 0x32
mov byte [esp + 0x19], bl
call fcn.00423bf8
mov eax, dword [eax]
lea edx, [esp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x4c], 2
call fcn.00429339
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x50], 3
call fcn.00429339
push SysReAllocString
mov ecx, 0x446dfc
mov byte [esp + 0x50], 2
call fcn.004030a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 1
call fcn.004292cb
mov byte [0x4422b0], 1
call fcn.00406f70
push ebx
push 0x407030
mov dword [0x446850], ebx
call ebp
mov eax, dword [0x446850]
cmp eax, ebx
je 0x4075b6
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x48]
push 0x446774
mov ecx, esi
call fcn.00429339
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x4c]
mov byte [esp + 0x40], bl
call fcn.004292cb
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
dec dword [0x447e40]
jmp 0x4075b6