Function at 0x10039ec0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100a122a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0xa
lea ecx, [esi + 0xc]
mov dword [esp + 0xb4], esi
call sub.mfc42.dll_CPtrList::CPtrList
lea ebp, [esi + 0x40]
xor edi, edi
mov ecx, ebp
mov dword [esp + 0xbc], edi
call dword [sym.imp.exstage.dll_public:_void___thiscall_CxDDSurface::constructor_void_]
mov ebx, dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::constructor_void_]
lea ecx, [esi + 0x5c]
mov byte [esp + 0xbc], 1
call ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0xbc], 2
call ebx
lea ecx, [esi + 0x74]
mov byte [esp + 0xbc], 3
call ebx
mov ebx, 4
lea ecx, [esi + 0x80]
mov byte [esp + 0xbc], bl
call dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::constructor_void_]
mov ecx, dword [esp + 0xc4]
mov eax, dword [ebp]
push ecx
mov ecx, ebp
mov byte [esp + 0xc0], 5
mov dword [esi], 0x100acf5c
call dword [eax + 4]
mov edx, dword [ebp]
push 0x2c
push 0x37
mov ecx, ebp
call dword [edx]
push edi
push 0xff00ff
mov ecx, ebp
call dword [sym.imp.exstage.dll_public:_void___thiscall_CxDDSurface::SetColorKey_unsigned_long_int__int_]
mov eax, 1
mov ebp, 3
mov word [esp + 0x74], ax
mov word [esp + 0x76], ax
mov eax, 2
mov dword [esi + 0x28], edi
mov word [esp + 0x78], ax
mov word [esp + 0x7a], ax
mov eax, 5
mov dword [esi + 0x2c], edi
mov word [esp + 0x84], ax
mov word [esp + 0x86], ax
mov eax, 6
mov dword [esi + 0x30], edi
mov word [esp + 0x88], ax
mov word [esp + 0x8a], ax
mov eax, 7
mov dword [esi + 0x34], edi
mov word [esp + 0x8c], ax
mov word [esp + 0x8e], ax
mov eax, 8
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov word [esp + 0x70], di
mov word [esp + 0x72], di
mov word [esp + 0x7c], bp
mov word [esp + 0x7e], bp
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov word [esp + 0x90], ax
mov word [esp + 0x92], ax
mov eax, 9
lea ecx, [esi + 0x5c]
mov word [esp + 0x94], ax
mov word [esp + 0x96], ax
mov eax, 0xa
mov word [esp + 0x98], ax
mov word [esp + 0x9a], ax
mov eax, 0xb
mov word [esp + 0x9c], ax
mov word [esp + 0x9e], ax
mov eax, 0xc
mov word [esp + 0xa0], ax
mov word [esp + 0xa2], ax
mov eax, 0xd
mov word [esp + 0xa4], ax
mov word [esp + 0xa6], ax
mov eax, 0xe
mov word [esp + 0xa8], ax
mov word [esp + 0xaa], ax
mov eax, 0xf
mov word [esp + 0xac], ax
mov word [esp + 0xae], ax
lea eax, [esp + 0x70]
push eax
push 0x20
call dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::Init_unsigned_char__short_int__const_]
mov eax, 1
lea ecx, [esp + 0x44]
mov word [esp + 0x4a], ax
mov word [esp + 0x4c], ax
mov word [esp + 0x4e], ax
mov eax, 2
mov word [esp + 0x50], ax
mov word [esp + 0x52], ax
mov word [esp + 0x54], ax
mov eax, 5
mov word [esp + 0x62], ax
mov word [esp + 0x64], ax
mov word [esp + 0x66], ax
mov eax, 6
push ecx
push 0x15
lea ecx, [esi + 0x68]
mov word [esp + 0x4c], di
mov word [esp + 0x4e], di
mov word [esp + 0x50], di
mov word [esp + 0x5e], bp
mov word [esp + 0x60], bp
mov word [esp + 0x62], bp
mov word [esp + 0x64], bx
mov word [esp + 0x66], bx
mov word [esp + 0x68], bx
mov word [esp + 0x70], ax
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
call dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::Init_unsigned_char__short_int__const_]
mov eax, 1
lea edx, [esp + 0x24]
mov word [esp + 0x28], ax
mov word [esp + 0x2a], ax
mov eax, 2
push edx
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov eax, 5
mov word [esp + 0x28], di
mov word [esp + 0x3c], ax
mov word [esp + 0x3e], ax
mov eax, 6
mov word [esp + 0x2a], di
mov word [esp + 0x40], ax
mov word [esp + 0x42], ax
mov eax, 7
mov word [esp + 0x34], bp
mov word [esp + 0x36], bp
mov word [esp + 0x38], bx
mov word [esp + 0x3a], bx
mov word [esp + 0x44], ax
mov word [esp + 0x46], ax
push 0x10
lea ecx, [esi + 0x74]
call dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::Init_unsigned_char__short_int__const_]
mov eax, 1
lea ecx, [esi + 0x80]
mov word [esp + 0x14], ax
mov word [esp + 0x16], ax
mov eax, 2
mov word [esp + 0x10], di
mov word [esp + 0x18], ax
mov word [esp + 0x1a], ax
lea eax, [esp + 0x10]
mov word [esp + 0x12], di
push eax
push 0xa
mov word [esp + 0x24], bp
mov word [esp + 0x26], bp
mov word [esp + 0x28], bx
mov word [esp + 0x2a], bx
call dword [sym.imp.staff.dll_public:_void___thiscall_CtPump::Init_unsigned_char__short_int__const_]
mov ecx, dword [esp + 0xb4]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb0
ret 4