Function at 0x433a40
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x433fa3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x218]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebx + 0x30]
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 8]
add eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 8]
add edx, dword [ebx + 0x14]
add edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
add eax, dword [ebx + 0x10]
add eax, dword [ebx + 0xc]
call fcn.0040a0c8
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
mov eax, dword [esi + 0x1e4]
lea edx, [eax + 0x18]
mov eax, dword [edi + 4]
call fcn.0044498c
test al, al
je 0x433f4c
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x14c]
mov eax, dword [edi + 4]
call fcn.00406780
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004061d0
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov ecx, 0xff
call fcn.00403b18
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x2f]
mov cl, 4
call fcn.00402a30
lea eax, [ebp - 0x2f]
mov edx, 0x433fb4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402a60
je 0x433b48
lea eax, [ebp - 0x2f]
mov edx, 0x433fbc
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402a60
je 0x433b48
xor eax, eax
jmp 0x433b4a
mov al, 1
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
jne 0x433b7d
mov eax, ebx
mov edx, 0x419960
call fcn.00402d2c
test al, al
je 0x433d88
cmp byte [edi], 0
je 0x433d88
cmp byte [edi + 1], 0
je 0x433cc4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
mov dword [ebp - 0x150], eax
fild dword [ebp - 0x150]
fstp xword [ebp - 0x15c]
wait
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
mov dword [ebp - 0x160], eax
fild dword [ebp - 0x160]
fld xword [ebp - 0x15c]
fdivrp st(1)
lea eax, [ebp - 0x2a]
call fcn.00404fb0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
cmp ebx, dword [ebp - 0x18]
jg 0x433c33
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jle 0x433c5b
jmp 0x433c33
dec ebx
cmp ebx, dword [ebp - 0x18]
jg 0x433c32
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jg 0x433c32
jmp 0x433c80
inc ebx
cmp ebx, dword [ebp - 0x18]
jge 0x433c80
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jl 0x433c5a
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
push eax
lea eax, [ebp - 0x170]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0040a0e4
push esi
push edi
lea esi, [ebp - 0x170]
lea edi, [ebp - 0x44]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.00433188
mov ebx, eax
push ebx
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
cmp dword [esi + 0x21c], 0
jne 0x433d53
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
je 0x433d53
cmp dword [0x44bf40], 0x100
jne 0x433d53
cmp byte [ebp - 0x12], 0
jne 0x433d53
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
push eax
push 0xcc0020
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
push eax
mov eax, dword [esi + 0x218]
call fcn.0041b260
mov ecx, dword [ebp - 0x44]
pop edx
call fcn.0042b708
jmp 0x433d6a
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
call fcn.0041afec
push 0
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
push ebx
call sub.gdi32.dll_DeleteObject
jmp 0x433f4c
cmp byte [ebp + 8], 0
je 0x433dd1
lea eax, [edi + 0x10]
push eax
mov al, byte [edi + 8]
push eax
mov al, byte [edi + 9]
push eax
mov al, byte [edi + 0xa]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
push eax
push 8
push 8
push 1
push 1
lea ecx, [edi + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, esi
call fcn.004336b0
mov eax, dword [edi + 0xc]
test eax, eax
je 0x433e13
cmp byte [ebp + 8], 0
je 0x433df0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x218]
call fcn.00447554
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x24], eax
cmp byte [edi + 9], 1
jne 0x433e09
mov eax, dword [0x44bf34]
add dword [ebp - 0x44], eax
jmp 0x433e18
mov eax, dword [0x44bf34]
sub dword [ebp - 0x3c], eax
jmp 0x433e18
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x433e5a
cmp byte [ebp + 8], 0
je 0x433e37
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x218]
call fcn.00447554
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x20], eax
cmp byte [edi + 0xa], 8
jne 0x433e50
mov eax, dword [0x44bf34]
add dword [ebp - 0x40], eax
jmp 0x433e5f
mov eax, dword [0x44bf34]
sub dword [ebp - 0x38], eax
jmp 0x433e5f
xor eax, eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.00433188
mov ebx, eax
push ebx
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
cmp dword [esi + 0x21c], 0
jne 0x433f12
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
je 0x433f12
cmp dword [0x44bf40], 0x100
jne 0x433f12
cmp byte [ebp - 0x12], 0
jne 0x433f12
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
push 0xcc0020
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
push eax
mov eax, dword [esi + 0x218]
call fcn.0041b260
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x20]
pop edx
call fcn.0042b708
jmp 0x433f33
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
call fcn.0041acf0
push 0
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
push ebx
call sub.gdi32.dll_DeleteObject
cmp byte [ebp - 0x11], 0
jne 0x433f85
cmp byte [ebp + 8], 0
je 0x433f85
lea edx, [edi + 0xc]
mov eax, esi
call fcn.00433884
lea edx, [edi + 0x10]
mov eax, esi
call fcn.00433884
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [esi + 0x218]
call fcn.00432dc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433faa
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00403630
ret