Function at 0x426d51
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x64
mov eax, 0x4ba6ec
call fcn.0048f6d3
mov ebx, ecx
lea ecx, [ebp - 0x10]
call fcn.004026b1
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004026b1
mov byte [ebp - 4], 1
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 0x6c]
and dword [ebp - 0x6c], 0
mov edi, eax
mov dword [ebp - 0x70], vtable.CMenu.0
mov byte [ebp - 4], 2
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.FILE
call fcn.004012a3
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 4
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_ModifyMenuW]
push 0
push 0x400
push 0
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.OPTION
call fcn.004012a3
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 8
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
push 1
push 0x400
push 1
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.CUSTOMIZE
call fcn.004012a3
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x808d
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
push str.EXIT
call fcn.004012a3
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x38], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8003
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.PAINT_WEEKEND
call fcn.004012a3
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8078
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4d0c64
call fcn.004012a3
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x48], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x808b
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.NORTH_WEST
call fcn.004012a3
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8073
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push str.NORTH_EAST
call fcn.004012a3
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8074
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.SOUTH_WEST
call fcn.004012a3
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8075
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push str.SOUTH_EAST
call fcn.004012a3
mov byte [ebp - 4], 0x27
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
push dword [ebp - 0x10]
mov eax, 0x8076
push eax
push 0
push eax
push dword [edi + 4]
call esi
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00470b95
test eax, eax
je 0x4271a9
mov eax, dword [eax + 4]
push eax
lea ecx, [ebp - 0x70]
call fcn.00470aed
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x68], esp
push str.LEGEND_POSITION
call fcn.004012a3
mov byte [ebp - 4], 0x2b
push ecx
mov ecx, esp
mov dword [ebp - 0x64], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
push 0
push 0x400
push 0
push dword [ebp - 0x6c]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x60], esp
push str.MAX_PLOT_POINT
call fcn.004012a3
mov byte [ebp - 4], 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
push 1
push 0x400
push 1
push dword [ebp - 0x6c]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x58], esp
push str.TIME_FORMAT
call fcn.004012a3
mov byte [ebp - 4], 0x33
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x34
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401fe9
push dword [ebp - 0x10]
push 2
push 0x400
push 2
push dword [ebp - 0x6c]
call esi
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
push str.ATTRIBUTE
call fcn.004012a3
mov byte [ebp - 4], 0x37
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
push str.Menu
call fcn.004012a3
mov byte [ebp - 4], 0x38
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 2
mov ecx, ebx
call fcn.004603dd
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x10]
push eax
call fcn.00401717
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
push dword [ebp - 0x10]
push 3
push 0x400
push 3
push dword [ebp - 0x6c]
call esi
lea ecx, [ebp - 0x70]
call fcn.00470b6b
xor esi, esi
cmp dword [ebx + 0x103c], esi
je 0x42736c
push 8
push 0x8078
push dword [edi + 4]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x4cf864
push dword [ebx + 0xf7c]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x42738a
push esi
push 0x8073
jmp 0x4273cb
push 0x4cf86c
push dword [ebx + 0xf7c]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x4273a8
push esi
push 0x8074
jmp 0x4273cb
push 0x4ce9d4
push dword [ebx + 0xf7c]
call fcn.004944db
pop ecx
pop ecx
push esi
test eax, eax
jne 0x4273c6
push 0x8075
jmp 0x4273cb
push 0x8076
mov esi, dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 0x8076
push 0x8073
push dword [edi + 4]
call esi
push str._m__d
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x42740b
push eax
push 0x80a3
push 0x80aa
push 0x80a2
jmp 0x4274d7
push str._y__m__d__H:_M
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x427429
push eax
push 0x80a4
jmp 0x4273fc
push str._y__m__d
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x427447
push eax
push 0x80a5
jmp 0x4273fc
push str._d__m__y
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x427465
push eax
push 0x80a8
jmp 0x4273fc
push str._d__m__y__H:_M
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x427486
push eax
push 0x80a6
jmp 0x4273fc
push str._d._m._y__H:_M
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
test eax, eax
jne 0x4274a7
push eax
push 0x80a9
jmp 0x4273fc
push str._d._m._y
push dword [ebx + 0xf80]
call fcn.004944db
pop ecx
pop ecx
push 0
test eax, eax
jne 0x4274cb
mov eax, 0x80aa
push eax
push eax
jmp 0x427401
mov eax, 0x80a2
push eax
push 0x80aa
push eax
push dword [edi + 4]
call esi
mov eax, dword [ebx + 0x1040]
mov ecx, 0x320
cmp eax, ecx
ja 0x427569
je 0x427560
push 0x64
pop ecx
sub eax, ecx
je 0x427550
sub eax, ecx
je 0x427547
sub eax, ecx
je 0x42753b
sub eax, ecx
je 0x42752f
sub eax, ecx
je 0x427523
sub eax, ecx
je 0x427517
sub eax, ecx
jne 0x42758a
push eax
push 0x8083
jmp 0x4275ce
push 0
push 0x8082
jmp 0x4275ce
push 0
push 0x8081
jmp 0x4275ce
push 0
push 0x8080
jmp 0x4275ce
push 0
push 0x807f
jmp 0x4275ce
push 0
push 0x807e
jmp 0x4275ce
push 0
mov eax, 0x807d
push eax
push 0x808b
push eax
jmp 0x4275d8
push 0
push 0x8084
jmp 0x4275ce
sub eax, 0x384
je 0x4275c7
sub eax, 0x64
je 0x4275be
mov ecx, 0x3e8
sub eax, ecx
je 0x4275b5
sub eax, ecx
je 0x4275ac
sub eax, ecx
je 0x4275a3
sub eax, ecx
je 0x42759a
and dword [ebx + 0x1040], 0
push 0
push 0x808b
jmp 0x4275ce
push 0
push 0x808a
jmp 0x4275ce
push 0
push 0x8089
jmp 0x4275ce
push 0
push 0x8088
jmp 0x4275ce
push 0
push 0x8087
jmp 0x4275ce
push 0
push 0x8086
jmp 0x4275ce
push 0
push 0x8085
push 0x808b
push 0x807d
push dword [edi + 4]
call esi
mov eax, dword [ebx + 0x1044]
cmp eax, 0x2f
ja case.default.0x4275ec
jmp dword [eax*4 + 0x427871]
push 0
push 0x80ea
push 0x8119
push 0x80e9
jmp 0x427822
push 0
push 0x80ec
jmp 0x4275fa
push 0
push 0x80eb
jmp 0x4275fa
push 0
push 0x80ed
jmp 0x4275fa
push 0
push 0x80ee
jmp 0x4275fa
push 0
push 0x80ef
jmp 0x4275fa
push 0
push 0x80f0
jmp 0x4275fa
push 0
push 0x80f1
jmp 0x4275fa
push 0
push 0x80f2
jmp 0x4275fa
push 0
push 0x80f3
jmp 0x4275fa
push 0
push 0x80f4
jmp 0x4275fa
push 0
push 0x80f5
jmp 0x4275fa
push 0
push 0x80f6
jmp 0x4275fa
push 0
push 0x80f7
jmp 0x4275fa
push 0
push 0x80f8
jmp 0x4275fa
push 0
push 0x80f9
jmp 0x4275fa
push 0
push 0x80fa
jmp 0x4275fa
push 0
push 0x80fb
jmp 0x4275fa
push 0
push 0x80fc
jmp 0x4275fa
push 0
push 0x80fd
jmp 0x4275fa
push 0
push 0x80fe
jmp 0x4275fa
push 0
push 0x80ff
jmp 0x4275fa
push 0
push 0x8100
jmp 0x4275fa
push 0
push 0x8101
jmp 0x4275fa
push 0
push 0x8102
jmp 0x4275fa
push 0
push 0x8103
jmp 0x4275fa
push 0
push 0x8104
jmp 0x4275fa
push 0
push 0x8105
jmp 0x4275fa
push 0
push 0x8106
jmp 0x4275fa
push 0
push 0x8107
jmp 0x4275fa
push 0
push 0x8108
jmp 0x4275fa
push 0
push 0x8109
jmp 0x4275fa
push 0
push 0x810a
jmp 0x4275fa
push 0
push 0x810b
jmp 0x4275fa
push 0
push 0x810c
jmp 0x4275fa
push 0
push 0x810d
jmp 0x4275fa
push 0
push 0x810e
jmp 0x4275fa
push 0
push 0x810f
jmp 0x4275fa
push 0
push 0x8110
jmp 0x4275fa
push 0
push 0x8111
jmp 0x4275fa
push 0
push 0x8112
jmp 0x4275fa
push 0
push 0x8113
jmp 0x4275fa
push 0
push 0x8114
jmp 0x4275fa
push 0
push 0x8115
jmp 0x4275fa
push 0
push 0x8116
jmp 0x4275fa
push 0
push 0x8117
jmp 0x4275fa
push 0
push 0x8118
jmp 0x4275fa
and dword [ebx + 0x1044], 0
push 0
mov eax, 0x80e9
push eax
push 0x8119
push eax
push dword [edi + 4]
call esi
mov eax, dword [ebx]
mov ecx, ebx
push edi
call dword [eax + 0x70]
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], vtable.CMenu.0
call fcn.00470b55
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00401fe9
call fcn.0048f6a1
ret