Function at 0x40ad80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c208
mov eax, dword fs:[0]
push eax
sub esp, 0x164
push ebx
push ebp
push esi
push edi
mov eax, dword [0x438020]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x188]
mov eax, dword [0x439134]
mov edx, dword [eax + 0xc]
mov ecx, 0x439134
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
lea eax, [esp + 0x2c]
xor ebx, ebx
push eax
mov dword [esp + 0x184], ebx
call fcn.00424a00
mov byte [esp + 0x180], 1
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [ebp + 0x24]
push ebx
mov dword [ebp + 0x2b0], ebx
mov dword [ebp + 0x294], 0x80090000
mov dword [ebp + 0x298], 0x10000
mov edx, dword [ecx]
mov edx, dword [edx + 0x34]
push 2
push ebx
lea edi, [ebx + 1]
mov dword [esp + 0x30], ebx
mov dword [ecx + 0x98], ebx
call edx
mov eax, dword [ebp + 0xe0]
mov eax, dword [eax + 0x34]
lea edx, [esp + 0x1c]
push edx
push ebx
lea ecx, [ebp + 0xe0]
push ebx
push 2
push ebx
mov dword [esp + 0x30], ebx
mov dword [ecx + 0x98], ebx
call eax
mov edx, dword [ebp + 0x19c]
mov edx, dword [edx + 0x34]
lea eax, [esp + 0x1c]
push eax
push ebx
lea ecx, [ebp + 0x19c]
push ebx
push 2
push ebx
mov dword [esp + 0x30], ebx
mov dword [ecx + 0x98], ebx
call edx
mov eax, dword [esp + 0x18c]
push edi
push ebx
push eax
lea ecx, [esp + 0x38]
mov dword [ebp + 0x29c], ebx
mov dword [ebp + 0x2a0], ebx
mov dword [ebp + 0x2a4], ebx
call fcn.00425de0
cmp byte [esp + 0x58], bl
je 0x40af2a
cmp dword [ebp + 0x2c0], ebx
mov dword [ebp + 0x2b8], edi
mov dword [ebp + 0x2b4], edi
je 0x40aec4
mov ecx, dword [ebp + 0x2c0]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, ebx
je 0x40aec4
mov dword [ebp + 0x2c0], ebx
mov edx, dword [ebp + 4]
push ebx
push ebx
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esp + 0x180], bl
mov eax, dword [esp + 0x60]
cmp eax, 0x4395ec
mov dword [esp + 0x2c], 0x42f3ec
je 0x40aef3
push eax
call int.0042aa12
add esp, 4
lea ecx, [esp + 0x2c]
call int.00424190
lea eax, [esi - 0x10]
mov dword [esp + 0x180], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40af23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40b608
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x40af46
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
test eax, eax
jne 0x40af58
mov esi, dword [esi + 0x28]
cmp esi, ebx
jne 0x40af32
xor esi, esi
mov dword [esp + 0x20], esi
mov edi, dword [esi + 0x20]
add edi, 8
jne 0x40af69
xor eax, eax
jmp 0x40af7b
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
mov esi, eax
mov dword [esp + 0x20], eax
jmp 0x40af4c
mov eax, edi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x40af70
sub eax, edx
push edi
mov edi, eax
lea eax, [esp + 0x28]
call fcn.0040a3d0
mov edi, dword [esp + 0x24]
push 0x42f25c
push edi
call dword [sym.imp.MSVCR80.dll__mbscmp]
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x40afde
mov esi, ebp
call fcn.0040b660
mov byte [esp + 0x180], bl
mov eax, dword [esp + 0x60]
cmp eax, 0x4395ec
mov dword [esp + 0x2c], 0x42f3ec
je 0x40afcd
push eax
call int.0042aa12
add esp, 4
lea ecx, [esp + 0x2c]
call int.00424190
lea eax, [edi - 0x10]
jmp 0x40aeff
lea edi, [esi + 0x2c]
mov esi, 0x42f264
mov dword [esp + 0x18], edi
call int.00425400
cmp eax, ebx
je 0x40affb
mov esi, dword [eax + 0x18]
add esi, 8
jmp 0x40affd
xor esi, esi
cmp esi, ebx
lea eax, [ebp + 0x2c4]
jne 0x40b00b
xor ecx, ecx
jmp 0x40b01b
mov ecx, esi
lea edi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x40b010
sub ecx, edi
push esi
mov edi, ecx
call fcn.0040a3d0
mov edi, dword [esp + 0x18]
mov esi, 0x42ebcc
call int.00425400
cmp eax, ebx
je 0x40b03d
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x40b03f
xor eax, eax
push 0xfde9
lea ecx, [esp + 0x7c]
push eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], ecx
call fcn.00409f40
mov byte [esp + 0x180], 2
mov edx, dword [esp + 0x74]
lea edi, [ebp + 0x280]
call fcn.00409960
mov byte [esp + 0x180], 1
mov eax, dword [esp + 0x74]
lea edx, [esp + 0x78]
cmp eax, edx
je 0x40b08b
push eax
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
mov edi, dword [esp + 0x18]
mov esi, 0x42eb44
mov dword [ebp + 0x284], ebx
mov dword [ebp + 0x288], ebx
call int.00425400
cmp eax, ebx
je 0x40b0b1
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x40b0b3
xor eax, eax
lea esi, [ebp + 0x284]
cmp esi, ebx
je 0x40b0d1
cmp eax, ebx
je 0x40b0cf
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
mov dword [esi], eax
jmp 0x40b0d1
mov dword [esi], ebx
mov edi, dword [esp + 0x18]
mov esi, 0x42eb4c
call int.00425400
cmp eax, ebx
je 0x40b0eb
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x40b0ed
xor eax, eax
lea esi, [ebp + 0x288]
cmp esi, ebx
je 0x40b10b
cmp eax, ebx
je 0x40b109
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
mov dword [esi], eax
jmp 0x40b10b
mov dword [esi], ebx
mov edi, dword [esp + 0x18]
mov esi, 0x42f26c
mov dword [ebp + 0x28c], ebx
mov dword [ebp + 0x290], ebx
call int.00425400
cmp eax, ebx
je 0x40b131
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x40b133
xor eax, eax
lea esi, [ebp + 0x28c]
cmp esi, ebx
je 0x40b151
cmp eax, ebx
je 0x40b14f
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
mov dword [esi], eax
jmp 0x40b151
mov dword [esi], ebx
mov edi, dword [esp + 0x18]
mov esi, 0x42f278
call int.00425400
cmp eax, ebx
je 0x40b16b
mov eax, dword [eax + 0x18]
add eax, 8
jmp 0x40b16d
xor eax, eax
lea esi, [ebp + 0x290]
cmp esi, ebx
je 0x40b18b
cmp eax, ebx
je 0x40b189
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
mov dword [esi], eax
jmp 0x40b18b
mov dword [esi], ebx
mov edi, dword [esp + 0x18]
mov esi, 0x42f284
call int.00425400
cmp eax, ebx
je 0x40b1bf
mov eax, dword [eax + 0x18]
add eax, 8
cmp eax, ebx
je 0x40b1bf
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
cmp eax, ebx
je 0x40b1bf
or dword [ebp + 0x298], 0x40000
mov edi, dword [esp + 0x18]
mov esi, 0x42f28c
call int.00425400
cmp eax, ebx
je 0x40b208
mov eax, dword [eax + 0x18]
add eax, 8
cmp eax, ebx
je 0x40b208
push eax
call dword [sym.imp.MSVCR80.dll_atoi]
add esp, 4
cmp eax, ebx
je 0x40b208
mov eax, dword [ebp + 0x294]
mov edi, dword [esp + 0x20]
and eax, 0x39f7ffff
or eax, 0x46000000
mov dword [ebp + 0x294], eax
jmp 0x40b2c8
mov edi, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
lea ebx, [esp + 0x18]
mov ecx, 0x42f294
mov eax, edi
call fcn.004245b0
xor ecx, ecx
cmp dword [esp + 0x18], ecx
mov eax, edi
setne cl
mov dword [esp + 0x18], 0
mov dword [ebp + 0x2ac], ecx
mov ecx, 0x42f2a0
call fcn.004245b0
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x40b261
or dword [ebp + 0x294], 0x70000
mov dword [ebp + 0x2a8], 1
jmp 0x40b271
or dword [ebp + 0x294], 0x20000
mov dword [ebp + 0x2a8], eax
mov dword [esp + 0x18], eax
lea ebx, [esp + 0x18]
mov ecx, 0x42f2a8
mov eax, edi
call fcn.004245b0
cmp dword [esp + 0x18], 0
je 0x40b298
or dword [ebp + 0x298], 0x88
jmp 0x40b2a2
or dword [ebp + 0x298], 0x300
lea ebx, [esp + 0x18]
mov ecx, 0x42f2b4
mov eax, edi
mov dword [esp + 0x18], 0
call fcn.004245b0
xor ebx, ebx
cmp dword [esp + 0x18], ebx
je 0x40b2c8
mov dword [ebp + 0x27c], ebx
mov esi, 0x42f2bc
mov eax, edi
call fcn.004242f0
mov edi, eax
cmp edi, ebx
je 0x40b303
lea ebx, [ebx]
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
test eax, eax
jne 0x40b624
mov esi, 0x42f2bc
mov eax, edi
call fcn.00424340
mov edi, eax
cmp edi, ebx
jne 0x40b2e0
xor esi, esi
mov edx, dword [ebp + 0x24]
mov eax, dword [edx + 0xc]
lea ecx, [ebp + 0x24]
push esi
call eax
cmp eax, ebx
mov dword [ebp + 0x29c], eax
je 0x40b3d6
mov edx, dword [0x439134]
mov eax, dword [edx + 0xc]
mov ecx, 0x439134
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x180], 3
mov dword [esp + 0x18], ebx
lea ebx, [esp + 0x18]
mov ecx, 0x42eb4c
mov eax, esi
call fcn.004245b0
mov ecx, dword [esp + 0x18]
push ecx
push 0x42f2c4
lea edi, [esp + 0x24]
call fcn.0040b950
mov esi, dword [esp + 0x24]
add esp, 8
push 1
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.0040a4b0
add eax, 0x10
mov dword [edi], eax
push ecx
mov byte [esp + 0x18c], 4
mov edx, esp
mov dword [esp + 0x34], esp
push edx
mov ecx, 0x42eb54
call fcn.004096f0
mov eax, dword [ebp + 0x24]
lea ecx, [ebp + 0x24]
add eax, 0x10
mov eax, dword [eax]
mov byte [esp + 0x18c], 3
call eax
mov byte [esp + 0x180], 1
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b3d4
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
xor ebx, ebx
mov eax, dword [esp + 0x20]
mov esi, 0x42f2d0
call fcn.004242f0
mov edi, eax
cmp edi, ebx
je 0x40b413
lea ebx, [ebx]
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
test eax, eax
jne 0x40b634
mov esi, 0x42f2d0
mov eax, edi
call fcn.00424340
mov edi, eax
cmp edi, ebx
jne 0x40b3f0
xor esi, esi
mov eax, dword [ebp + 0x19c]
mov edx, dword [eax + 0xc]
lea ecx, [ebp + 0x19c]
push esi
call edx
cmp eax, ebx
mov dword [ebp + 0x2a4], eax
je 0x40b4f2
mov eax, dword [0x439134]
mov edx, dword [eax + 0xc]
mov ecx, 0x439134
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x180], 5
mov dword [esp + 0x1c], ebx
lea ebx, [esp + 0x1c]
mov ecx, 0x42eb4c
mov eax, esi
call fcn.004245b0
mov eax, dword [esp + 0x1c]
push eax
push 0x42f2d8
lea edi, [esp + 0x20]
call fcn.0040b950
mov esi, dword [esp + 0x20]
add esp, 8
push 1
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x30], esp
mov edi, esp
call fcn.0040a4b0
add eax, 0x10
mov dword [edi], eax
push ecx
mov ecx, esp
mov byte [esp + 0x18c], 6
mov dword [esp + 0x28], esp
push ecx
mov ecx, 0x42eb54
call fcn.004096f0
mov eax, dword [ebp + 0x19c]
mov edx, dword [eax + 0x10]
lea ecx, [ebp + 0x19c]
add eax, 0x10
mov byte [esp + 0x18c], 5
call edx
mov byte [esp + 0x180], 1
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b4f0
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
xor ebx, ebx
mov eax, dword [esp + 0x20]
mov esi, 0x42f2e4
call fcn.004242f0
mov edi, eax
cmp edi, ebx
je 0x40b529
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
test eax, eax
jne 0x40b644
mov esi, 0x42f2e4
mov eax, edi
call fcn.00424340
mov edi, eax
cmp edi, ebx
jne 0x40b506
xor eax, eax
mov edx, dword [ebp + 0xe0]
lea esi, [ebp + 0xe0]
push eax
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
cmp eax, ebx
mov dword [ebp + 0x2a0], eax
je 0x40b58a
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push ecx
mov ecx, 0x42ebdc
call fcn.004096f0
push ecx
mov byte [esp + 0x18c], 7
mov edx, esp
mov dword [esp + 0x28], esp
push edx
mov ecx, 0x42eb54
call fcn.004096f0
mov eax, dword [esi]
add eax, 0x10
mov eax, dword [eax]
mov ecx, esi
mov byte [esp + 0x18c], 1
call eax
cmp dword [ebp + 4], ebx
mov dword [ebp + 0x2b0], 1
je 0x40b5ac
mov eax, ebp
call fcn.0040abb0
mov dword [ebp + 0x268], ebx
mov dword [ebp + 0x26c], ebx
mov byte [esp + 0x180], bl
mov eax, dword [esp + 0x60]
cmp eax, 0x4395ec
mov dword [esp + 0x2c], 0x42f3ec
je 0x40b5cf
push eax
call int.0042aa12
add esp, 4
lea ecx, [esp + 0x2c]
call int.00424190
mov dword [esp + 0x180], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x170
ret 8
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
mov esi, eax
jmp 0x40b305
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
mov esi, eax
jmp 0x40b415
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
jmp 0x40b52b