Function at 0x404a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xe4]
mov dword [0x4785c0], edi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [0x455090]
mov ecx, dword [0x477f20]
push str.20:32:45
push str.Jun_24_1998
push eax
push ecx
push str.Win95
push str.Callus95
push str._s__s_v_d._02d__s__s
push 2
push 0x708ac0
call fcn.0042d090
add esp, 0x24
push str.Copyright_1998_Bloodlust_Software
push 2
push 0x708ac0
call fcn.0042d090
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x40
push 0x4000
push 0x4247c0
call esi
test eax, eax
je 0x4051a3
lea eax, [esp + 0x10]
push eax
push 0x40
push 0x1000
push 0x42a968
call esi
test eax, eax
je 0x4051a3
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 0x1000
push 0x42d926
call esi
test eax, eax
je 0x4051a3
call fcn.0043f170
call fcn.00402850
push 8
call fcn.004471b0
xor esi, esi
add esp, 4
cmp eax, esi
je 0x404b50
mov ecx, eax
call fcn.00401ed0
jmp 0x404b52
xor eax, eax
mov edx, dword [esp + 0xec]
mov ecx, eax
push edx
mov dword [0x4785b8], eax
call fcn.00401e40
mov ecx, str.NOMMX
call fcn.004018f0
test eax, eax
jne 0x4051bf
call fcn.00402e42
test eax, eax
je 0x4051bf
push str.MMX_processor_detected
push 2
push 0x708ac0
mov byte [0x4785ec], 1
call fcn.0042d090
add esp, 0xc
mov eax, dword [0x4785c0]
push 0x67
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x405820
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x30], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0x65
push ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], str.Callus95
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x4051b0
push esi
push edi
push esi
push esi
push closesocket
push closesocket
push closesocket
push closesocket
push 0xca0000
push str.Callus95
push str.Callus95
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, esi
mov dword [0x478170], eax
je 0x4051b0
mov edx, dword [esp + 0xf0]
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x478170]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [0x478170]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ebp, dword [sym.imp.WINMM.dll_timeGetTime]
call ebp
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
shl edx, 2
mov dword [0x478118], edx
call fcn.00442e90
push esi
push 0x4785d0
push esi
call sub.DDRAW.dll_DirectDrawCreate
test eax, eax
jne 0x404ccc
mov eax, dword [0x4785d0]
push 0x478180
push 0x454040
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jne 0x404ccc
push str.DirectDraw_initialized
push 2
push 0x708ac0
call fcn.0042d090
add esp, 0xc
call fcn.00404110
jmp 0x404cdc
push str.Unable_to_create_DirectDraw_object
call fcn.00403f70
add esp, 4
or eax, 0xffffffff
cmp eax, esi
je 0x404d91
cmp dword [0x478180], esi
je 0x4051b0
mov eax, dword [0x478188]
cmp eax, esi
je 0x404d05
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x478188], esi
mov eax, dword [0x4785d8]
cmp eax, esi
je 0x404d1a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x4785d8], esi
mov eax, dword [0x478128]
cmp eax, esi
je 0x404d2f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x478128], esi
mov eax, dword [0x478124]
cmp eax, esi
je 0x404d44
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x478124], esi
call fcn.00403e80
mov eax, dword [0x478180]
push eax
mov edx, dword [eax]
call dword [edx + 0x4c]
mov eax, dword [0x478180]
cmp eax, esi
je 0x404d69
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x478180], esi
mov eax, dword [0x4785d0]
cmp eax, esi
je 0x4051b0
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x4785d0], esi
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd0
ret 0x10
mov ecx, str.nosound
call fcn.004018f0
test eax, eax
jne 0x404daa
mov ecx, dword [0x478170]
call fcn.00403480
call fcn.0042ca90
test eax, eax
je 0x404e60
call fcn.00403c90
cmp dword [0x478180], esi
je 0x404e56
mov eax, dword [0x478188]
cmp eax, esi
je 0x404ddd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x478188], esi
mov eax, dword [0x4785d8]
cmp eax, esi
je 0x404df2
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x4785d8], esi
mov eax, dword [0x478128]
cmp eax, esi
je 0x404e07
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x478128], esi
mov eax, dword [0x478124]
cmp eax, esi
je 0x404e1c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x478124], esi
call fcn.00403e80
mov eax, dword [0x478180]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [0x478180]
cmp eax, esi
je 0x404e41
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x478180], esi
mov eax, dword [0x4785d0]
cmp eax, esi
je 0x404e56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x4785d0], esi
push str.Unable_to_initialize
jmp 0x4051a8
mov edx, dword [0x4785c0]
push 0x6a
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [0x4785b4], eax
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
mov esi, dword [sym.imp.USER32.dll_ShowCursor]
call fcn.00402f00
push 1
push 0
push 0
lea eax, [esp + 0x64]
push 0
push eax
call ebx
test eax, eax
je 0x404eea
cmp dword [esp + 0x5c], 0x12
je 0x40517b
mov edx, dword [0x4785b4]
mov eax, dword [0x478170]
lea ecx, [esp + 0x58]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x404ed0
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x58]
push edx
call edi
push 1
push 0
push 0
lea eax, [esp + 0x64]
push 0
push eax
call ebx
test eax, eax
jne 0x404e9e
mov eax, dword [0x4785c8]
test eax, eax
jne 0x404f04
mov eax, dword [0x455da4]
test eax, eax
je 0x404f04
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x404e86
mov eax, dword [0x4785f8]
test eax, eax
je 0x404f82
mov al, byte [0x4785dc]
mov dword [0x4785f8], 0
test al, al
je 0x404f5e
push 0
call esi
cmp eax, 0xffffffff
jge 0x404f32
push 1
call esi
cmp eax, 0xffffffff
jl 0x404f29
jle 0x404f3d
push 0
call esi
cmp eax, 0xffffffff
jg 0x404f34
mov ecx, dword [0x4785d8]
test ecx, ecx
je 0x404f5e
call fcn.00404020
mov eax, dword [0x4785d8]
push 0x404060
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
call fcn.00434750
call ebp
lea eax, [eax + eax*2]
mov ecx, 0x40
mov edi, 0x478018
lea edx, [eax + eax*4]
shl edx, 2
xor eax, eax
mov dword [0x478118], edx
rep stosd dword es:[edi], eax
mov eax, dword [0x478174]
test eax, eax
je 0x4050c2
mov eax, dword [0x4785f4]
test eax, eax
jne 0x405089
xor esi, esi
call ebp
mov ecx, dword [0x478118]
lea eax, [eax + eax*2]
add ecx, 0x3e8
lea eax, [eax + eax*4]
shl eax, 2
cmp eax, ecx
jbe 0x4050c2
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
inc esi
cmp esi, 5
jge 0x405076
call fcn.00402f00
push 1
push 0
push 0
lea edx, [esp + 0x48]
push 0
push edx
call ebx
test eax, eax
je 0x405032
cmp dword [esp + 0x40], 0x12
je 0x40517b
mov ecx, dword [0x4785b4]
mov edx, dword [0x478170]
lea eax, [esp + 0x3c]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x405018
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x3c]
push ecx
call edi
push 1
push 0
push 0
lea edx, [esp + 0x48]
push 0
push edx
call ebx
test eax, eax
jne 0x404fe5
call dword [0x478174]
mov eax, dword [0x4785f0]
mov edx, dword [0x478118]
inc eax
add edx, 0x3e8
mov dword [0x4785f0], eax
mov dword [0x478118], edx
call ebp
mov ecx, dword [0x478118]
lea eax, [eax + eax*2]
add ecx, 0x3e8
lea eax, [eax + eax*4]
shl eax, 2
cmp eax, ecx
ja 0x404fc3
jmp 0x4050c2
call ebp
lea eax, [eax + eax*2]
lea edx, [eax + eax*4]
shl edx, 2
mov dword [0x478118], edx
jmp 0x4050c2
xor esi, esi
test eax, eax
jle 0x4050c2
call fcn.004053c0
test eax, eax
jne 0x40517b
call dword [0x478174]
inc dword [0x4785f0]
call ebp
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 2
mov dword [0x478118], eax
mov eax, dword [0x4785f4]
inc esi
cmp esi, eax
jl 0x40508f
mov al, byte [0x47817c]
test al, al
je 0x405171
mov eax, dword [0x478124]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x60]
test eax, eax
je 0x4050f4
mov eax, dword [0x478124]
push eax
mov edx, dword [eax]
call dword [edx + 0x6c]
mov ecx, dword [0x478124]
call fcn.00404020
mov eax, dword [0x478124]
push 0
lea edx, [esp + 0x78]
push 1
mov ecx, dword [eax]
push edx
push 0
push eax
mov dword [esp + 0x88], 0x6c
call dword [ecx + 0x64]
test eax, eax
jne 0x405160
mov ecx, dword [esp + 0x84]
call fcn.00435a40
mov eax, dword [0x4785bc]
mov edx, dword [esp + 0x98]
imul eax, dword [0x46c798]
add eax, edx
mov dword [0x47811c], eax
mov eax, dword [0x4785d4]
test eax, eax
je 0x40514a
call eax
mov eax, dword [0x478124]
mov edx, dword [esp + 0x98]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + pe_nt_image_headers32]
call fcn.00433d70
call fcn.004051d0
mov byte [0x47817c], 0
call fcn.00443900
jmp 0x404e7a
call fcn.0042cbf0
call fcn.00403c90
call fcn.004047e0
call fcn.00442ee0
call fcn.00401fb0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd0
ret 0x10
push str.Unable_to_unprotect_code_pages
call fcn.00403f70
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xd0
ret 0x10
mov byte [0x4785ec], 0
jmp 0x404ba0