Function at 0x40ed10
Capabilities:
Create thread
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x436506
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449030]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov ebx, dword [esp + 0x78]
xor edi, edi
lea eax, [esp + 0x34]
mov dword [esp + 0x70], edi
mov ecx, dword [ebx + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [esp + 0x7c], 1
jne 0x40ef66
mov edx, dword [0x44a498]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x44a48c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x44a498]
push ecx
mov dword [0x44a48c], edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0xffffffffffffffff
lea ebp, [ebx + 0x7c]
push edi
lea ecx, [ebp + 0x34]
call sub.MFC80U.DLL_Ordinal_6002
lea esi, [ebp + 0x48]
call fcn.004128a0
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x2c], edi
mov ecx, dword [0x44a4d0]
mov eax, dword [ecx + 0x1c]
sub eax, edi
je 0x40ee98
sub eax, 1
jne 0x40ef46
add ecx, 0x28
push ecx
lea edx, [esp + 0x80]
push edx
mov edi, str..txt
call fcn.004027a0
add esp, 8
push 0
mov ecx, eax
mov byte [esp + 0x74], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_2460]
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push ecx
mov edi, eax
call fcn.00402e10
push 0x44a424
call fcn.00418d60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x70], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
fild dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
fstp dword [esp + 0x20]
fild dword [esp + 0x34]
sub edx, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edx
fstp dword [esp + 0x44]
mov ecx, dword [esp + 0x44]
fld dword [esp + 0x20]
sub esp, 0x10
fstp dword [esp + 0x58]
mov edx, dword [esp + 0x58]
fild dword [esp + 0x28]
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
fstp dword [esp + 0x5c]
mov ecx, dword [esp + 0x5c]
fild dword [esp + 0x34]
mov dword [eax + 8], ecx
fstp dword [esp + 0x60]
mov edx, dword [esp + 0x60]
mov dword [eax + 0xc], edx
mov eax, dword [ebx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, eax
mov eax, ebp
mov edi, 0x44a424
call fcn.00418f80
xor edi, edi
jmp 0x40ef46
push ecx
lea edx, [ecx + 0x2c]
mov ecx, esp
mov dword [esp + 0x80], esp
push edx
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
push 0x44a41c
call fcn.004164e0
lea eax, [esp + 0x1c]
push eax
push 0x44a41c
call fcn.00416900
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], edi
jne 0x40eedd
push 0x43ab38
lea ecx, [esp + 0x20]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
fild dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x34]
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x38]
fstp dword [esp + 0x24]
fild dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
mov edx, dword [ebx + 0x20]
fstp dword [esp + 0x44]
lea ecx, [esp + 0x44]
fld dword [esp + 0x24]
push ecx
fstp dword [esp + 0x4c]
push edx
fild dword [esp + 0x28]
fstp dword [esp + 0x54]
fild dword [esp + 0x20]
fstp dword [esp + 0x58]
call dword [sym.imp.USER32.dll_GetDC]
push eax
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov ecx, ebp
call fcn.00410d30
push 0x44a490
push edi
push 0x44a424
push 0x4190c0
push edi
push edi
call dword [sym.imp.MSVCR80.dll__beginthreadex]
add esp, 0x18
mov dword [0x44a48c], eax
mov ecx, dword [0x44a4d0]
mov eax, dword [ecx + 8]
lea ebp, [ebx + 0x7c]
mov dword [ebp], eax
mov eax, dword [0x44a4d0]
mov ecx, dword [eax + 8]
cmp ecx, 3
mov dword [esp + 0x18], ebp
ja case.default.0x40ef8a
jmp dword [ecx*4 + 0x40f540]
add eax, 0x34
push eax
lea ecx, [esp + 0x80]
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov dword [esp + 0x54], vtable.CArray_unsigned_long_int__unsigned_long_int_const__.0
mov dword [esp + 0x58], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], edi
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 3
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jge 0x40efe4
call fcn.00431d0e
mov edi, edi
mov edi, dword [esp + 0x5c]
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
mov byte [esp + 0x70], 4
mov eax, dword [esp + 0x7c]
mov eax, dword [eax - 0xc]
sub eax, esi
sub eax, 1
push eax
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_5558]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x74], 5
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [esp + 0x24]
mov byte [esp + 0x70], 4
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.MSVCR80.dll__wtol]
add esp, 4
test edi, edi
mov ebp, eax
mov ebx, edi
jl 0x40efd9
add edi, 1
lea esi, [esp + 0x54]
call fcn.00406cf0
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x20]
mov dword [edi + ebx*4], ebp
mov byte [esp + 0x70], 3
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jge 0x40efe0
cmp dword [esp + 0x5c], 0
jle 0x40efd9
mov eax, dword [edi]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], eax
call fcn.0040f9d0
mov edx, dword [esp + 0x58]
push edx
call sub.MFC80U.DLL_Ordinal_266
add esp, 4
lea ecx, [esp + 0x7c]
mov byte [esp + 0x70], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, dword [0x44a4d0]
mov ebx, dword [esp + 0x78]
mov eax, dword [eax + 0xc]
mov edi, dword [esp + 0x18]
mov dword [ebx + 0x90], eax
mov ebx, dword [0x44a4d0]
add ebx, 0x14
call fcn.0040fb20
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8
add eax, 0x34
push eax
lea ecx, [esp + 0x80]
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov dword [esp + 0x54], vtable.CArray_unsigned_long_int__unsigned_long_int_const__.0
mov dword [esp + 0x58], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], edi
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 7
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jl 0x40efd9
jmp 0x40f164
mov edi, dword [esp + 0x5c]
push esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
mov byte [esp + 0x70], 8
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx - 0xc]
sub eax, esi
sub eax, 1
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_5558]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x74], 9
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [esp + 0x28]
mov byte [esp + 0x70], 8
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR80.dll__wtol]
add esp, 4
test edi, edi
mov ebp, eax
mov ebx, edi
jl 0x40efd9
add edi, 1
lea esi, [esp + 0x54]
call fcn.00406cf0
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x20]
mov dword [edi + ebx*4], ebp
mov byte [esp + 0x70], 7
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jge 0x40f160
mov eax, dword [esp + 0x5c]
cmp eax, 1
jle 0x40efd9
test eax, eax
mov edx, dword [edi + 4]
jle 0x40efd9
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
push edi
jmp 0x40f0b7
mov ecx, dword [eax]
cmp dword [ecx - 0xc], edi
je 0x40f280
push ecx
lea esi, [esp + 0x48]
call fcn.0040f680
push ebp
mov edi, eax
mov byte [esp + 0x74], 0xa
call fcn.0040f950
mov byte [esp + 0x70], 0
mov ecx, dword [esp + 0x48]
push ecx
mov dword [esp + 0x48], vtable.Gdiplus::Image.0
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [0x44a4d0]
jmp case.default.0x40ef8a
add eax, 0x34
push eax
lea ecx, [esp + 0x80]
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
mov dword [esp + 0x54], vtable.CArray_unsigned_long_int__unsigned_long_int_const__.0
mov dword [esp + 0x58], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], edi
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 0xc
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jl 0x40efd9
jmp 0x40f2d4
mov edi, dword [esp + 0x5c]
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
mov byte [esp + 0x70], 0xd
mov eax, dword [esp + 0x7c]
mov eax, dword [eax - 0xc]
sub eax, esi
sub eax, 1
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_5558]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x74], 0xe
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 0xd
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.MSVCR80.dll__wtol]
add esp, 4
test edi, edi
mov ebp, eax
mov ebx, edi
jl 0x40efd9
add edi, 1
lea esi, [esp + 0x54]
call fcn.00406cf0
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x20]
mov dword [edi + ebx*4], ebp
mov byte [esp + 0x70], 0xc
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, eax
test esi, esi
jge 0x40f2d0
cmp dword [esp + 0x5c], 0
jle 0x40efd9
mov eax, dword [edi]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], eax
call fcn.0040f9d0
mov dword [edi], 0
jmp 0x40f0b2
add eax, 0x34
push eax
lea ecx, [esp + 0x80]
call dword [sym.imp.MFC80U.DLL_Ordinal_280]
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x54], vtable.CArray_long_int__long_int_const__.0
mov dword [esp + 0x58], ebp
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], esi
push edi
push 0x439fd0
lea ecx, [esp + 0x84]
mov byte [esp + 0x78], 0x10
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov edi, eax
test edi, edi
jl 0x40f4bb
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
mov byte [esp + 0x70], 0x11
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx - 0xc]
sub eax, edi
sub eax, 1
push eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_5558]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x74], 0x12
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [esp + 0x30]
mov byte [esp + 0x70], 0x11
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.MSVCR80.dll__wtol]
add esp, 4
test esi, esi
mov ebx, eax
mov ebp, esi
jl 0x40efd9
lea edi, [esi + 1]
lea esi, [esp + 0x54]
call fcn.00406cf0
mov ecx, dword [esp + 0x58]
mov dword [ecx + ebp*4], ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x70], 0x10
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
push 0
push 0x439fd0
lea ecx, [esp + 0x84]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov esi, dword [esp + 0x5c]
mov edi, eax
test edi, edi
jge 0x40f400
mov ebp, dword [esp + 0x58]
xor ecx, ecx
mov eax, esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MFC80U.DLL_Ordinal_265
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40f4f1
lea eax, [esi - 1]
test eax, eax
jl 0x40f4f3
lea ecx, [eax + 1]
mov eax, 0xff000000
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x40f4f3
xor ebx, ebx
xor ecx, ecx
test esi, esi
jle 0x40f51f
mov edx, ebp
mov eax, ebx
sub edx, ebx
nop
test ecx, ecx
jl 0x40efd9
cmp ecx, esi
jge 0x40efd9
mov edi, dword [edx + eax]
mov dword [eax], edi
add ecx, 1
add eax, 4
cmp ecx, esi
jl 0x40f500
push esi
mov esi, dword [esp + 0x1c]
call fcn.00410c20
push ebx
call sub.MFC80U.DLL_Ordinal_266
add esp, 4
test ebp, ebp
je 0x40f0bf
push ebp
jmp 0x40f0b7