Function at 0x41dd10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45aa2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push edi
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.00440278
mov dword [esp + 0x14], 0x46110c
xor ebp, ebp
mov dword [esp + 0x30], ebp
call fcn.00440b08
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [edi + 0x10]
xor eax, eax
dec ecx
mov byte [esp + 0x30], 1
js 0x41dd88
cmp eax, ebp
jl 0x41de45
cmp eax, dword [edi + 0x10]
jge 0x41de45
mov edx, dword [edi + 0xc]
lea ecx, [edx + eax*4]
mov ecx, dword [ecx]
mov dword [ecx + 0x14], ebp
mov edx, dword [edi + 0x10]
inc eax
dec edx
cmp eax, edx
jle 0x41dd63
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jbe 0x41dfdf
push ebx
push esi
lea esp, [esp]
mov ecx, dword [edi + 4]
push 0x400
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetMenuState]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41dfdd
test bl, 4
je 0x41de60
mov edx, dword [edi + 4]
push ebp
push edx
call dword [sym.imp.USER32.dll_GetMenuItemID]
push eax
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00417360
mov esi, eax
test esi, esi
jne 0x41dfbb
push 0x24
call fcn.00440ad3
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
mov byte [esp + 0x38], 2
je 0x41de4a
mov dword [esi], 0x461540
call fcn.00440b08
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1c], 0xffffffff
mov byte [esp + 0x38], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
jmp 0x41dfb7
jmp fcn.0043ee0d
mov eax, dword [esp + 0x14]
xor esi, esi
mov byte [esp + 0x38], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
jmp 0x41dfb7
test bl, 0x10
je 0x41df07
mov ecx, dword [edi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call fcn.00444ed0
mov eax, dword [eax + 4]
push eax
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00417360
push 0x400
lea edx, [esp + 0x14]
push edx
push ebp
mov ecx, edi
mov esi, eax
call fcn.00444feb
test esi, esi
mov eax, dword [esp + 0x10]
jne 0x41dec4
mov ecx, dword [esp + 0x14]
push eax
and ebx, 0xfffff5ff
push ecx
or ebx, 0x510
push ebx
push ebp
mov ecx, edi
call fcn.0041db50
mov esi, eax
jmp 0x41ded3
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x41ded3
push eax
mov ecx, esi
call fcn.0041b9c0
mov edx, dword [esp + 0x14]
push edx
call fcn.00444ede
push eax
push 0x46105c
call fcn.00445f93
add esp, 8
test eax, eax
je 0x41dfb7
mov ecx, dword [edi + 4]
cmp dword [eax + 0x54], ecx
je 0x41dfb7
mov dword [eax + 0x54], ecx
jmp 0x41dfb7
test bh, 8
je 0x41df40
push 0
mov ecx, edi
call fcn.00417360
mov esi, eax
or ebx, 0x500
test esi, esi
jne 0x41df37
push 0x45d77d
push eax
push ebx
push ebp
mov ecx, edi
call fcn.0041db50
mov esi, eax
jmp 0x41dfb7
push esi
push 0
mov dword [esi + 0xc], ebx
push ebx
jmp 0x41dfac
mov ecx, dword [edi + 4]
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemID]
push eax
mov ecx, edi
mov dword [esp + 0x18], eax
call fcn.00417360
push 0x400
lea edx, [esp + 0x14]
push edx
push ebp
mov ecx, edi
mov esi, eax
call fcn.00444feb
or ebx, 0x500
test esi, esi
jne 0x41df8c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push ebx
push ebp
mov ecx, edi
call fcn.0041db50
mov esi, eax
jmp 0x41dfb7
mov dword [esi + 0xc], ebx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jle 0x41dfa2
push eax
mov ecx, esi
call fcn.0041b9c0
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0xc]
push esi
push edx
push eax
mov eax, dword [edi + 4]
push ebp
push eax
call dword [sym.imp.USER32.dll_ModifyMenuA]
test esi, esi
je 0x41dfca
mov ecx, dword [esp + 0x24]
push esi
push ecx
lea ecx, [esp + 0x24]
call fcn.0044016b
mov edx, dword [edi + 4]
push edx
inc ebp
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp ebp, eax
jb 0x41dda0
pop esi
pop ebx
mov ecx, edi
call fcn.004173b0
push 0xffffffffffffffff
add edi, 8
push 0
mov ecx, edi
call fcn.0044000c
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.00440126
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1c]
call fcn.0044000c
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov byte [esp + 0x30], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41e030
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.0044028f
mov ecx, dword [esp + 0x28]
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret