Function at 0x40ae50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b79f7
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4e88d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
xor ebp, ebp
mov dword [esi + 4], ebp
mov dword [esi], vtable.Event.0
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40ae9d
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 8], ebp
mov dword [esi + 0x10], 0x3e8
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esi], vtable.SearchPicEvent.0
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x28], ebp
mov byte [esp + 0x1c], 1
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40aef1
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x30], eax
mov byte [esp + 0x1c], 2
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40af1f
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x38], eax
mov byte [esp + 0x1c], 3
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40af4d
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x3c], eax
mov byte [esp + 0x1c], 4
lea ebx, [esi + 0x48]
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40af7e
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0x1c], 5
call fcn.0047b116
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40afab
push 0x80004005
call fcn.00402120
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x4c], eax
push 0x43b7b0
push 0x43b7a0
push 4
push 0x10
lea ecx, [esi + 0x60]
push ecx
mov byte [esp + 0x30], 6
call fcn.004922c9
push fcn.00401fa0
push fcn.00401f70
push 4
push 4
lea edx, [esi + 0xb0]
push edx
mov byte [esp + 0x30], 7
call fcn.004922c9
lea edi, [esi + 0xc0]
push edi
mov byte [esp + 0x20], 8
call fcn.00429ff0
mov dword [edi + 0x18], ebp
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], ebp
mov dword [edi + 0x24], ebp
mov byte [esp + 0x1c], 9
push 0xa
push 0x4c6808
lea ecx, [esi + 0x38]
mov dword [esi + 8], 2
mov dword [esi + 0x2c], 0x5f
mov dword [esi + 0x34], 0xa
call fcn.00401cf0
push 8
push 0x4c6820
lea ecx, [esi + 0x3c]
call fcn.00401cf0
push 3
push 0x4c6834
mov ecx, ebx
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], 1
call fcn.00401cf0
push ebp
push ebp
push ebp
push ebp
lea eax, [esi + 0x50]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, 0x5f
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4