Function at 0x423221
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45b67c
call fcn.00431c64
sub esp, 0x30
mov eax, dword [0x476b9c]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [esi + 0x28]
call fcn.00431e50
cmp dword [esi + 0x40], ebx
pop ecx
pop ecx
je 0x423259
mov ecx, esi
call fcn.00423ae9
push 1
lea ecx, [ebp - 0x10]
pop edi
mov dword [esi + 0x44], ebx
push 0xa73a
mov dword [esi + 0x40], edi
call fcn.00449826
push 0x47683c
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
push 0x476838
push edi
call fcn.00449693
push eax
mov eax, dword [esi + 0x2c]
push dword [eax + 0x10]
call fcn.00431e50
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004496e2
mov eax, dword [esi + 0x2c]
mov edi, 0xffff0000
mov ecx, dword [esi + 0x34]
push 0xffff0002
mov eax, dword [eax + 0x10]
push edi
push ebx
push ebx
push ebx
push 1
push ebx
push eax
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x2c]
push 0xa724
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x10]
mov dword [eax], ebx
call fcn.00449826
push 0x47683c
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
push 0x476838
push 1
call fcn.00449693
push eax
mov eax, dword [esi + 0x30]
push dword [eax + 0x10]
call fcn.00431e50
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push eax
call fcn.00431e60
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004496e2
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0xffff0002
push edi
mov eax, dword [eax + 0x10]
push ebx
push ebx
push ebx
push 1
push ebx
push eax
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x400
push 0x40
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x30]
mov dword [eax], ebx
call edi
push 0x400
push 0x40
mov dword [ebp - 0x28], eax
call edi
push dword [esi + 0x28]
mov dword [ebp - 0x38], eax
call fcn.004341a3
mov eax, dword [esi + 4]
pop ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
cmp dword [eax], ebx
jbe 0x42360e
push 0x10
mov dword [ebp + 8], 0x14
pop ebx
mov dword [ebp - 0x1c], 0x18
add dword [ebp - 0x1c], 4
mov eax, dword [esi + 0x2c]
push dword [ebp - 0x1c]
inc dword [ebp - 0x24]
add ebx, 4
mov dword [ebp - 0x20], eax
push 0x40
call edi
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 0x2c], eax
add ecx, 0xfffffffc
push ecx
push dword [ebp - 0x20]
push eax
call fcn.00432ab0
add esp, 0xc
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x18
push 0x40
call edi
mov ecx, dword [esi + 0x2c]
mov dword [ebx + ecx], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
mov eax, dword [eax + 0x10]
push eax
push eax
call fcn.00431f60
inc eax
pop ecx
inc eax
push eax
push 0x40
call edi
push eax
call fcn.00431e50
pop ecx
pop ecx
mov ecx, dword [esi + 0x2c]
push 0xffff0002
mov ecx, dword [ebx + ecx]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x34]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + ebx]
push edx
xor edx, edx
mov eax, dword [eax + 0x10]
push edx
push edx
push edx
push 1
push edx
push eax
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x2c]
mov edx, dword [ebp + 8]
mov ecx, dword [ebx + ecx]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 4]
xor ecx, ecx
mov edx, dword [eax + edx]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
cmp dword [edx], ecx
jbe 0x4235ad
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x2c], 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax + ecx]
push dword [eax + 0x10]
push dword [ebp - 0x28]
call fcn.00431e50
push 0x3d
push dword [ebp - 0x28]
call fcn.0043410c
add esp, 0x10
test eax, eax
je 0x423495
and byte [eax], 0
push dword [ebp - 0x28]
push dword [ebp - 0x38]
call fcn.00431e50
push eax
call fcn.004341a3
push dword [esi + 0x28]
push dword [ebp - 0x38]
call fcn.004338a0
add esp, 0x14
test eax, eax
je 0x423581
mov eax, dword [esi + 0x2c]
add dword [ebp - 0x18], 4
inc dword [ebp - 0x34]
mov eax, dword [ebx + eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
add eax, 8
push eax
push 0x40
mov dword [ebp - 0x3c], eax
call edi
mov ecx, dword [esi + 0x2c]
mov dword [ebx + ecx], eax
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffffc
push eax
mov eax, dword [esi + 0x2c]
push dword [ebp - 0x20]
push dword [ebx + eax]
call fcn.00432ab0
add esp, 0xc
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0x18
push 0x40
call edi
mov ecx, dword [esi + 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + ecx]
mov dword [ecx + edx], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax + ecx]
mov eax, dword [eax + 0x10]
push eax
push eax
call fcn.00431f60
inc eax
pop ecx
inc eax
push eax
push 0x40
call edi
push eax
call fcn.00431e50
mov edx, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [esi + 0x2c]
push 0xffff0002
mov ecx, dword [ebx + ecx]
mov ecx, dword [ecx + edx]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x34]
mov eax, dword [ebx + eax]
mov eax, dword [eax + 0xc]
push eax
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push dword [ebp - 0x28]
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + ecx]
mov ecx, dword [ecx + edx]
mov dword [ecx + 0xc], eax
inc dword [esi + 0x44]
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
inc dword [ebp - 0x30]
add dword [ebp - 0x2c], 4
mov ecx, dword [eax + ecx]
mov edx, dword [ebp - 0x30]
cmp edx, dword [ecx]
jb 0x42346a
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x4235ad
mov ecx, dword [esi + 0x2c]
mov ecx, dword [ebx + ecx]
mov dword [ecx], eax
jmp 0x4235ee
mov eax, dword [esi + 0x2c]
mov eax, dword [ebx + eax]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4235ce
mov eax, dword [esi + 0x34]
push ecx
push 0
push 0x1101
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x2c]
mov eax, dword [ebx + eax]
and dword [eax + 0xc], 0
mov eax, dword [esi + 0x2c]
push dword [ebx + eax]
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec dword [ebp - 0x24]
sub dword [ebp - 0x1c], 4
sub ebx, 4
inc dword [ebp - 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x14]
add dword [ebp + 8], 4
cmp ecx, dword [eax]
jb 0x4233a7
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x42374b
mov eax, dword [esi + 4]
mov ebx, 0x1102
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
push ecx
push 1
push ebx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x18
push 0x40
call edi
mov ecx, dword [esi + 0x2c]
push 0xa721
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x2c]
lea ecx, [ebp - 0x10]
mov dword [eax], 1
call fcn.00449826
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
add eax, 2
push eax
push 0x40
call edi
mov ecx, dword [esi + 0x2c]
push 1
mov ecx, dword [ecx + 0x14]
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x10]
call fcn.00449693
push eax
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431e50
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004496e2
mov eax, dword [esi + 0x2c]
push 0xffff0002
mov ecx, dword [esi + 0x34]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push edx
xor edx, edx
mov eax, dword [eax + 0x10]
push edx
push edx
push edx
push 1
push edx
push eax
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x2c]
mov ecx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
push ecx
push 2
push ebx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x18
push 0x40
call edi
mov ecx, dword [esi + 0x30]
push 0xa725
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x30]
lea ecx, [ebp - 0x10]
mov dword [eax], 1
call fcn.00449826
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
add eax, 2
push eax
push 0x40
call edi
mov ecx, dword [esi + 0x30]
push 1
mov ecx, dword [ecx + 0x14]
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x10]
call fcn.00449693
push eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431e50
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004496e2
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0xffff0002
xor edi, edi
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push edx
push edi
mov eax, dword [eax + 0x10]
push edi
push edi
push 1
push edi
jmp 0x42383a
mov ecx, dword [esi + 0x2c]
mov ebx, 0x1102
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
push ecx
push 1
push ebx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
push ecx
push 2
push ebx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x2c]
and dword [ebp - 0x14], 0
cmp dword [eax], 0
jbe 0x4237be
mov dword [ebp + 8], 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
push ecx
push 2
push ebx
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
inc dword [ebp - 0x14]
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0x14]
add dword [ebp + 8], 4
cmp ecx, dword [eax]
jb 0x423794
push 0x18
push 0x40
call edi
mov ecx, dword [esi + 0x30]
push 0xa725
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x30]
lea ecx, [ebp - 0x10]
mov dword [eax], 1
call fcn.00449826
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
add eax, 2
push eax
push 0x40
call edi
mov ecx, dword [esi + 0x30]
push 1
pop edi
mov ecx, dword [ecx + 0x14]
push edi
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0x10]
call fcn.00449693
push eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00431e50
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004496e2
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
push 0xffff0002
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push edx
xor edx, edx
mov eax, dword [eax + 0x10]
push edx
push edx
push edx
push edi
push edx
push eax
push 0x23
call fcn.00442eaf
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x30]
mov esi, dword [esi + 0x34]
mov eax, dword [eax + 0xc]
push eax
push 2
push ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push dword [ebp - 0x38]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00449263
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4