Function at 0x4029f9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push esi
push edi
and dword [ebp - 8], 0
push 0x37
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x9e
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x52
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xae
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x42
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xd7
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xc3
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x50
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xa0
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xe9
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x8c
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xf5
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x4e
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x5c
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xcf
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xd8
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x34
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x9e
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xb0
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x3d
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x38
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 5
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xad
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xef
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xfb
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0xf5
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 0x46
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
fld qword [0x414a00]
call sub.msvcrt.dll__CIcos
fstp dword [ebp - 0x1a0]
fld dword [ebp - 0x1a0]
fcomp qword [0x4149f8]
fnstsw ax
test ah, 0x41
jne 0x402c36
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
and dword [ebp - 0x10], 0
push 0xb
call dword [sym.imp.KERNEL32.dll_AddAtomW]
movzx eax, ax
cmp eax, 0xb
je 0x402c4f
jmp fcn.0040304d
push 0
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0x58e
imul eax, eax, 0xd
imul esi, eax
mov edi, dword [ebp - 0x1c]
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or eax, 0xc3c
imul eax, eax, 0x1c
xor edi, eax
mov dword [ebp - 0x1c], edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [ebp - 8], 0
push 0xc
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
cmp eax, 0xc
jne 0x402cd4
push 0x61
call dword [sym.imp.USER32.dll_CharUpperW]
cmp eax, 0x41
jne 0x402cd4
push 0
call dword [sym.imp.oledlg.dll_OleUIBusyW]
cmp eax, 0x65
jne 0x402cd4
call fcn.00402fff
test eax, eax
jne 0x402de3
push 1
push 0
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, eax
and ecx, 0x4a59
or ecx, 0x4a896f7e
push 0xc
pop eax
xor edx, edx
div ecx
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
xor eax, 0x77
mov dword [ebp - 0x160], eax
mov eax, 0xd0
imul eax, dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
push 0x4d
pop eax
sub eax, dword [ebp - 0x168]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
add eax, 0x23259ca4
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
sub eax, 0xffffffa3
mov dword [ebp - 0x15c], eax
mov eax, 0x82
and eax, dword [ebp - 0x15c]
mov dword [ebp - 0x164], eax
push 0x38
pop eax
imul eax, dword [ebp - 0x164]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
add eax, 0x67
mov dword [ebp - 0x148], eax
push 0
push 0xf6f6bee6
push 0xf6f6bee6
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
mov ecx, eax
and ecx, 5
or ecx, 0x7a7b3d17
mov eax, dword [ebp - 0x148]
xor edx, edx
div ecx
mov dword [ebp - 0x158], edx
push 0x21
pop ecx
or ecx, 0xc23c63ec
mov eax, dword [ebp - 0x158]
xor edx, edx
div ecx
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp - 0x16c]
add eax, 0x2fe5c140
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x14], eax
push 0
call dword [sym.imp.msvcrt.dll_exit]
and dword [ebp - 0x130], 0
lea eax, [ebp - 0x1c]
push eax
push 0x4149ec
push OleUIBusyA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 6
jne 0x402e35
fld qword [0x414a00]
call sub.msvcrt.dll__CIsin
fstp dword [ebp - 0x1a4]
fld dword [ebp - 0x1a4]
fcomp qword [0x4149f0]
fnstsw ax
test ah, 0x41
jne 0x402ed1
push 0x37
pop ecx
or ecx, 0xbeb024b0
mov eax, 0x87
xor edx, edx
div ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
imul eax, eax, 0x9848901
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
or eax, 0x45722eed
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
or eax, 0x61
mov dword [ebp - 0x190], eax
push 0x18
pop eax
sub eax, dword [ebp - 0x190]
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
or ecx, 0x6fe2ce10
mov eax, dword [ebp - 0x130]
xor edx, edx
div ecx
mov dword [ebp - 0x180], eax
push 0
call dword [sym.imp.USER32.dll_IsWindowEnabled]
and eax, 0x2955
or eax, dword [ebp - 0x180]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x14], eax
jmp fcn.0040304d
push 0
call dword [sym.imp.oledlg.dll_OleUIBusyA]
cmp eax, 0x65
jne 0x402fae
call fcn.00402fff
test eax, eax
je 0x402fae
mov dword [ebp - 0x138], 0xdb0fb27e
mov dword [ebp - 0x13c], 0xdb0fb27e
push bp
pop bp
xor eax, eax
mov sp, sp
mov dword [0x429e8c], 0xffffffff
push dx
pop dx
add eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push cx
pop cx
and dword [0x429e8c], eax
xor eax, eax
push eax
pop dword [ebp - 0x140]
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp - 0x13c]
add ecx, eax
add ecx, 0x413812
mov al, al
push ecx
push eax
pop dword [ebp - 0x144]
sub ecx, 0x413812
mov bl, bl
call fcn.00402000
push bx
pop bx
xor edx, edx
mov di, di
ret
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10