Function at 0x436430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6ac78b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea ebp, [esi + 0x3c]
mov dword [esi], 0x6be8b0
mov dword [esp + 0x1c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
lea edi, [esi + 0x5c]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esi + 0x6c]
mov byte [esp + 0x1c], 3
call fcn.00527000
push fcn.00527170
push fcn.00527000
push 2
lea eax, [esi + 0x644]
push 0x5d8
push eax
mov byte [esp + 0x30], 4
call fcn.005ce6bb
lea ecx, [esi + 0x11f4]
mov byte [esp + 0x1c], 5
call fcn.0052d480
lea ecx, [esi + 0x1264]
mov byte [esp + 0x1c], 6
call fcn.0052b880
mov dword [esi + 0xc], 0x100
mov dword [esi + 0x10], 0x1a9
mov ecx, dword [0x70859c]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 4], eax
mov eax, dword [0x7085a0]
cdq
and edx, 7
add eax, edx
sar eax, 3
push ebx
mov byte [esp + 0x20], 7
mov dword [esi + 8], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
push ebx
push str.tuto.tga
push str.data_interface
mov ecx, edi
call fcn.005497a0
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0xff
push 0xff
push 0xff
push 0x11
push 0xc8
push 0x3b
push 0x19
push edx
push eax
lea ecx, [esi + 0x11f4]
call fcn.0052cf20
fld dword [0x708c08]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
push 1
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
call fcn.005cd414
fld dword [0x708c04]
push eax
call fcn.005cd414
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
lea ecx, [esi + 0x6c]
call fcn.00528830
push ebx
push 0x3f000000
push ebx
push 0x3f800000
push 0x3f400000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push 0x6be88c
push 0xfa0
call fcn.0041d4a0
mov ecx, dword [esi + 4]
add esp, 4
push eax
mov eax, dword [esi + 8]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x20
push eax
push ecx
lea edi, [esi + 0x644]
mov ecx, edi
call fcn.00528830
push ebx
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push 0x6be88c
push 0xfa1
call fcn.0041d4a0
mov edx, dword [esi + 8]
add esp, 4
push eax
mov eax, dword [esi + 4]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x9c
push edx
push eax
lea ecx, [esi + 0xc1c]
call fcn.00528830
push 2
push 2
mov ecx, edi
call fcn.00527230
push 2
push 2
lea ecx, [esi + 0xc1c]
call fcn.00527230
push 1
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
fld dword [0x6be888]
push 0x3f000000
fsub dword [0x708c18]
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
push ecx
mov ecx, dword [0x708c14]
fstp dword [esp]
fld dword [0x708c14]
push 0x41500000
push ecx
push ebx
push 1
call fcn.005cd414
fld dword [0x708c10]
push eax
push 0xd
push 0x20
push 0x10
push 0x13b
push 0xd
call fcn.005cd414
fld dword [0x708c0c]
push eax
call fcn.005cd414
mov edx, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
push edx
lea edi, [esi + 0x1264]
push eax
mov ecx, edi
call fcn.0052c430
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 8]
push 0x42f00000
push ebx
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
mov ecx, edi
call fcn.0052af30
xor eax, eax
lea edi, [esi + 0x24c0]
mov ecx, 0x5000
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x2c]
cmp eax, 5
ja case.default.0x436890
jmp dword [eax*4 + 0x436e74]
push ebx
push ebx
push str.mouse.tga
push str.data_interface
mov ecx, ebp
call fcn.005497a0
push 0xfa9
mov dword [esi + 0x34], 5
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4368c4
push 0xfaa
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4368e1
push 0xfab
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
mov edi, edi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436900
push 0xfac
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436920
push 0xfad
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436940
jmp case.default.0x436890
push ebx
push ebx
push str.Tuto_keyboard.tga
push str.data_interface
mov ecx, ebp
call fcn.005497a0
push ebx
push ebx
push str.keyboardRed.tga
push str.data_interface
lea ecx, [esi + 0x4c]
call fcn.005497a0
push 0xfae
mov dword [esi + 0x34], 0xb
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436990
push 0xfaf
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4369b0
push 0xfb0
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4369d0
push 0xfb1
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4369f0
push 0xfb2
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436a10
push 0xfb3
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x74c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436a30
push 0xfb4
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x84c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436a50
push 0xfb5
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x94c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436a70
push 0xfb6
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0xa4c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436a90
push 0xfb7
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0xb4c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436ab0
push 0xfb8
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0xc4c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436ad0
jmp case.default.0x436890
push 0xfb9
mov dword [esi + 0x34], 6
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436b00
push 0xfba
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436b20
push 0xfbb
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436b40
push 0xfbc
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436b60
push 0xfbd
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436b80
push 0xfbe
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x74c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436ba0
jmp case.default.0x436890
push 0xfbf
mov dword [esi + 0x34], 7
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436bd0
push 0xfc0
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436bf0
push 0xfc1
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436c10
push 0xfc2
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436c30
push 0xfc3
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436c50
push 0xfc4
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x74c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436c70
push 0xfc5
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x84c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436c90
jmp case.default.0x436890
push 0xfc6
mov dword [esi + 0x34], 5
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436cc0
push 0xfc7
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436ce0
push 0xfc8
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436d00
push 0xfc9
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436d20
push 0xfca
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436d40
jmp case.default.0x436890
push 0xfcb
mov dword [esi + 0x34], 6
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x24c0]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436d70
push 0xfcc
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x34c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436d90
push 0xfcd
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x44c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436db0
push 0xfce
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x54c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436dd0
push 0xfcf
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x64c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436df0
push 0xfd0
call fcn.0041d4a0
add esp, 4
lea edx, [esi + 0x74c0]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436e10
mov edx, dword [esi + 0x30]
shl edx, 0xc
lea eax, [edx + esi + 0x24c0]
push eax
lea ecx, [esi + 0x11f4]
call fcn.0052dbd0
mov ecx, esi
mov dword [esi + 0x38], ebx
mov dword [esi + 0x164c0], ebx
call fcn.00436210
push ebx
push 0x447a0000
push 0x22094c8
push 0x6be838
mov ecx, 0x22071e0
call fcn.0053a850
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4