Function at 0x4246f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x458a7d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push 0x66
mov dword [esp + 0x18], esi
call fcn.00408e10
xor ebx, ebx
lea ecx, [esi + 0x224]
mov dword [esp + 0x1c], ebx
call fcn.00406ea0
lea ecx, [esi + 0x260]
call fcn.004075c0
lea ecx, [esi + 0x2a8]
mov byte [esp + 0x1c], 1
call fcn.004075c0
lea ecx, [esi + 0x2f0]
mov byte [esp + 0x1c], 2
call fcn.004075c0
lea ecx, [esi + 0x338]
mov byte [esp + 0x1c], 3
call fcn.004075c0
lea ecx, [esi + 0x380]
mov byte [esp + 0x1c], 4
call fcn.004075c0
push fcn.00402ab0
push 0x42d110
push 4
lea ecx, [esi + 0x3ec]
push 0x5c
push ecx
mov byte [esp + 0x30], 5
call fcn.004394db
lea ecx, [esi + 0x55c]
mov byte [esp + 0x1c], 6
call fcn.0040cb60
lea ecx, [esi + 0x580]
mov byte [esp + 0x1c], 7
call fcn.0040cb60
lea ecx, [esi + 0x5a4]
mov byte [esp + 0x1c], 8
call fcn.0040cb60
lea ecx, [esi + 0x5c8]
mov byte [esp + 0x1c], 9
call fcn.0040cb60
lea ecx, [esi + 0x5ec]
mov byte [esp + 0x1c], 0xa
call fcn.0040cb60
lea ecx, [esi + 0x610]
mov byte [esp + 0x1c], 0xb
call fcn.0040cb60
lea ecx, [esi + 0x634]
mov byte [esp + 0x1c], 0xc
call fcn.00401000
lea ecx, [esi + 0x6bc]
mov byte [esp + 0x1c], 0xd
call fcn.00406dd0
mov edx, dword [0x46e430]
mov dword [esi + 0x6e4], edx
mov eax, dword [0x46e430]
lea ebp, [esi + 0x6f0]
mov dword [ebp], eax
lea edi, [esi + 0x804]
mov dword [edi], vtable.CMenu.0
mov dword [edi + 4], ebx
lea ecx, [esi + 0x80c]
mov byte [esp + 0x1c], 0x11
call fcn.0040a8b0
mov edx, dword [esi + 0x208]
mov byte [esp + 0x1c], 0x12
or edx, 0x4b
mov dword [esi], 0x45e5d0
mov dword [esi + 0x208], edx
call fcn.00450e99
mov eax, dword [eax + 0xc]
push 0x116
push eax
call dword [sym.imp.USER32.dll_LoadMenuA]
push eax
mov ecx, edi
call fcn.0044c2f2
mov ecx, dword [esi + 0x808]
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.0044c2bf
cmp eax, ebx
je 0x4248b6
mov edx, dword [eax + 4]
lea edi, [esi + 0x80c]
push edx
mov ecx, edi
call fcn.0044c2f2
mov ecx, edi
call fcn.0040a930
mov dword [esi + 0x818], ebx
mov byte [0x471804], 1
mov byte [esi + 0x3cc], bl
mov byte [esi + 0x6d4], bl
mov dword [esi + 0x6d8], ebx
mov byte [esi + 0x6e8], bl
mov dword [esi + 0x25c], ebx
mov byte [esi + 0x6dc], bl
mov dword [esi + 0x6e0], ebx
mov dword [esi + 0x258], ebx
mov dword [esi + 0x6ec], ebx
push 0x47020c
movsx eax, byte [0x46d618]
add eax, 0x127
mov ecx, ebp
cdq
sub eax, edx
sar eax, 1
mov byte [0x46d618], al
movsx eax, byte [0x46d204]
add eax, 0x27
cdq
sub eax, edx
sar eax, 1
mov byte [0x46d204], al
mov dword [esi + 0x3d4], 1
call fcn.0044be73
movsx eax, byte [0x46d61c]
add eax, 0x127
cdq
sub eax, edx
sar eax, 1
mov byte [0x46d61c], al
mov al, byte [0x46d204]
mov byte [0x470dbc], al
call fcn.00450e99
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x64
mov dword [esi + 0x1ec], eax
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x13
je 0x4249a9
push fcn.00406de0
push fcn.00406dd0
lea edi, [eax + 4]
push 4
push 0x18
push edi
mov dword [eax], 4
call fcn.004394db
jmp 0x4249ab
xor edi, edi
push 0x64
mov byte [esp + 0x20], 0x12
mov dword [esi + 0x6b4], edi
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x14
je 0x4249ec
push fcn.00406de0
push fcn.00406dd0
lea edi, [eax + 4]
push 4
push 0x18
push edi
mov dword [eax], 4
call fcn.004394db
jmp 0x4249ee
xor edi, edi
mov dword [esi + 0x6b8], edi
mov cl, byte [0x46d61d]
xor ebp, ebp
mov byte [esp + 0x1c], 0x12
mov byte [0x470dbb], cl
xor edi, edi
call fcn.00450e99
mov eax, dword [eax + 0xc]
lea edx, [ebp + 0xda]
and edx, 0xffff
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 4
push 0x2ac
push ebx
push eax
mov eax, dword [esi + 0x6b4]
mov ecx, edi
add ecx, eax
call fcn.00406e20
call fcn.00450e99
mov eax, dword [eax + 0xc]
lea ecx, [ebp + 0x12a]
and ecx, 0xffff
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [esi + 0x6b8]
push 4
push 0x2d6
push ebx
push eax
add ecx, edi
call fcn.00406e20
add edi, 0x18
inc ebp
cmp edi, 0x60
jl 0x424a09
mov al, byte [0x46d0f1]
push 0x24bc
mov byte [0x470d9f], al
mov byte [0x470d9d], al
mov byte [str.002010120623], al
mov dword [esi + 0x3c8], ebx
mov byte [esi + 0x7f8], bl
mov byte [esi + 0x7f9], bl
mov dl, byte [0x46d5e8]
mov byte [0x470dba], dl
mov byte [esi + 0x7fa], bl
mov al, byte [0x46d0fc]
mov cl, byte [0x46d6b4]
mov byte [0x470d9e], al
mov byte [0x470db9], cl
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x15
je 0x424ae9
mov ecx, eax
call fcn.0040d190
jmp 0x424aeb
xor eax, eax
push ecx
mov byte [esp + 0x20], 0x12
mov ecx, esp
mov dword [esp + 0x28], esp
push 0x46d26c
mov dword [0x471a10], eax
call fcn.0044bd58
mov ecx, dword [0x471a10]
call fcn.0040a400
push 0x10
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x16
je 0x424b32
push esi
mov ecx, eax
call fcn.00410fc0
jmp 0x424b34
xor eax, eax
push 0x10c
mov byte [esp + 0x20], 0x12
mov dword [0x471a14], eax
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x17
je 0x424b62
push esi
mov ecx, eax
call fcn.00401fd0
jmp 0x424b64
xor eax, eax
push 0x2b8
mov byte [esp + 0x20], 0x12
mov dword [esi + 0x7fc], eax
call fcn.0044b0fb
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 0x18
je 0x424b99
push ebx
mov ecx, eax
call fcn.004207e0
mov dword [esi + 0x800], eax
jmp 0x424b9f
mov dword [esi + 0x800], ebx
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4