Function at 0x401b70
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0x436364]
xor eax, esp
mov dword [esp + 0x30], eax
mov byte [esp + 0x2c], 0
mov dword [esp + 0x28], 0x6c6c642e
mov dword [esp + 0x24], 0x32336c65
mov dword [esp + 0x20], 0x6e72656b
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
push 0x401b50
push 0
push 0
call eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
call fcn.00407f00
mov esi, eax
mov edi, edx
call fcn.00407ee9
mov ebp, eax
mov ebx, edx
mov eax, esi
xor eax, 0x989680
or eax, edi
jne 0x401c0e
mov ecx, 0x64
mov eax, ebp
mul ecx
mov dword [esp], eax
imul ebp, ebx, 0x64
add ebp, edx
jmp 0x401c7b
push edi
push esi
push ebx
push ebp
call fcn.00406030
mov dword [esp + 8], ebx
mov ebx, eax
mov dword [esp + 4], edi
mov edi, edx
mov ecx, 0x3b9aca00
mul ecx
mov dword [esp], eax
imul eax, edi, 0x3b9aca00
add eax, edx
mov dword [esp + 0xc], eax
mov ecx, ebx
mov eax, ebx
mul esi
mov ebx, dword [esp + 4]
imul ecx, ebx
add edx, ecx
imul edi, esi
add edi, edx
sub ebp, eax
mov eax, dword [esp + 8]
sbb eax, edi
imul ecx, eax, 0x3b9aca00
mov eax, ebp
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push ebx
push esi
push edx
push eax
call fcn.00406030
mov ebp, edx
add eax, dword [esp]
mov dword [esp], eax
adc ebp, dword [esp + 0xc]
mov dword [esp + 0x10], ebp
jmp 0x401ca3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [0x436f0c], ecx
mov dword [0x436f08], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x436f08]
mov eax, dword [0x436f0c]
mov edx, eax
or edx, ecx
je 0x401c90
mov edx, dword [esp + 0x18]
sub edx, ecx
mov ecx, edx
neg ecx
cmovl ecx, edx
cmp ecx, 5
ja 0x401da8
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov eax, ecx
neg eax
cmovl eax, ecx
cmp eax, 6
jae 0x401da8
call fcn.00407f00
mov ebx, eax
mov esi, edx
call fcn.00407ee9
mov edi, eax
mov eax, ebx
xor eax, 0x989680
or eax, esi
jne 0x401d20
mov eax, edi
mov ecx, 0x64
mov esi, edx
mul ecx
mov ecx, edx
imul edx, esi, 0x64
add edx, ecx
jmp 0x401d8e
mov dword [esp + 0x14], esi
push esi
push ebx
push edx
push edi
mov dword [esp + 0x14], edx
call fcn.00406030
mov esi, eax
mov ebp, edx
mov ecx, 0x3b9aca00
mul ecx
mov dword [esp + 0xc], eax
imul eax, ebp, 0x3b9aca00
add eax, edx
mov dword [esp + 8], eax
mov ecx, esi
mov eax, esi
mul ebx
mov esi, dword [esp + 0x14]
imul ecx, esi
add edx, ecx
imul ebp, ebx
add ebp, edx
sub edi, eax
mov eax, dword [esp + 4]
sbb eax, ebp
mov ebp, dword [esp + 0x10]
imul ecx, eax, 0x3b9aca00
mov eax, edi
mov edx, 0x3b9aca00
mul edx
add edx, ecx
push esi
push ebx
push edx
push eax
call fcn.00406030
add eax, dword [esp + 0xc]
adc edx, dword [esp + 8]
sub eax, dword [esp]
sbb edx, ebp
cmp eax, 0x2a05f200
sbb edx, 1
jl 0x401ca3
push 1
call fcn.0040be37
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [0x436f0c], ecx
mov dword [0x436f08], eax
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00405e30
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret