Function at 0x40a700
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541615
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], 0x551d28
mov dword [esi + 0x2c], 0x551d30
mov dword [esi + 0xce6c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x1c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CAdvClientWnd.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov ecx, 0x48
lea eax, [esi + 0x70]
mov edi, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x40a7a0
lea eax, [esi + 0xb8]
push eax
mov byte [ebp - 4], 1
call fcn.00410e40
lea edi, [esi + 0x1a64]
call fcn.005053a0
mov dword [esi + 0x1ed4], ebx
mov dword [esi + 0x1ed8], ebx
mov dword [esi + 0x1edc], ebx
mov dword [esi + 0x1ee0], ebx
mov dword [esi + 0x1ee4], ebx
mov dword [esi + 0x1ee8], ebx
mov dword [esi + 0x1eec], ebx
mov dword [esi + 0x1ef0], ebx
mov dword [esi + 0x1ef4], ebx
mov dword [esi + 0x1ef8], ebx
mov dword [esi + 0x1efc], ebx
mov dword [esi + 0x1f00], ebx
mov dword [esi + 0x1f04], ebx
mov dword [esi + 0x1f08], ebx
mov dword [esi + 0x1f0c], ebx
mov dword [esi + 0x1f10], ebx
mov dword [esi + 0x1f14], ebx
mov dword [esi + 0x1f18], ebx
mov dword [esi + 0x1f1c], ebx
mov dword [esi + 0x1f20], ebx
mov dword [esi + 0x1f24], ebx
mov dword [esi + 0x1f28], ebx
mov dword [esi + 0x1f2c], ebx
mov dword [esi + 0x1f30], ebx
mov dword [esi + 0x1f38], ebx
mov dword [esi + 0x1f3c], ebx
mov dword [esi + 0x1f40], ebx
mov byte [esi + 0x1f44], bl
mov dword [esi + 0x1f48], ebx
mov dword [esi + 0x1f4c], ebx
mov byte [esi + 0x1f50], bl
mov eax, vtable.CMemDc.0
mov dword [esi + 0x1f34], eax
mov dword [esi + 0x1f58], ebx
mov dword [esi + 0x1f54], eax
mov dword [esi + 0x1f5c], ebx
mov dword [esi + 0x1f60], ebx
mov byte [esi + 0x1f64], bl
mov dword [esi + 0x1f68], ebx
mov dword [esi + 0x1f6c], ebx
mov byte [esi + 0x1f70], bl
mov dword [esi + 0x1f78], ebx
mov dword [esi + 0x1f74], eax
mov dword [esi + 0x1f7c], ebx
mov dword [esi + 0x1f80], ebx
mov byte [esi + 0x1f84], bl
mov dword [esi + 0x1f88], ebx
mov dword [esi + 0x1f8c], ebx
mov byte [esi + 0x1f90], bl
mov dword [esi + 0x1f98], ebx
mov dword [esi + 0x1fa4], ebx
mov dword [esi + 0x1fa0], 0x553af8
mov dword [esi + 0x1fa8], ebx
mov dword [esi + 0x1fac], ebx
mov dword [esi + 0x1fb0], ebx
mov dword [esi + 0x1f9c], ebx
mov dword [esi + 0x1fb4], ebx
mov dword [esi + 0x1fb8], ebx
mov dword [esi + 0x1fbc], ebx
mov dword [esi + 0x1fc0], ebx
mov dword [esi + 0x1f94], 0x554c44
mov dword [esi + 0x1fd4], 0x55e61c
mov dword [esi + 0x1fe4], ebx
mov dword [esi + 0x1fd8], ebx
mov dword [esi + 0x1fdc], ebx
mov byte [esi + 0x1fe0], bl
mov dword [esi + 0x1fc4], ebx
mov dword [esi + 0x1fc8], ebx
mov dword [esi + 0x1fcc], ebx
mov dword [esi + 0x1fd0], ebx
mov byte [esi + 0x1fe8], bl
mov dword [esi + 0x1fec], ebx
mov dword [esi + 0x1ff0], ebx
mov dword [esi + 0x1ff4], ebx
mov dword [esi + 0x1ff8], ebx
mov dword [esi + 0x1ffc], ebx
mov dword [esi + 0x2000], ebx
mov dword [esi + 0x2004], ebx
mov dword [esi + 0x2008], ebx
mov dword [esi + 0x2010], 0x5538a4
mov dword [esi + 0x2038], 0x5538ac
push ebx
lea ecx, [esi + 0x200c]
mov dword [esi + 0x22b4], ebx
call fcn.0043b2e0
mov dword [esi + 0x200c], 0x5538b8
mov dword [esi + 0x22bc], 0x5538a4
mov dword [esi + 0x22e4], 0x5538ac
push ebx
lea ecx, [esi + 0x22b8]
mov dword [esi + 0x2560], ebx
call fcn.0043b2e0
lea edx, [esi + 0x25c0]
mov dword [esi + 0x22b8], 0x5538b8
call fcn.004f4fb0
mov ecx, 0x10
lea eax, [esi + 0x2564]
lea esp, [esp]
mov byte [eax], bl
inc eax
dec ecx
jne 0x40aa20
mov ecx, 0x20
lea eax, [esi + 0x2574]
mov byte [eax], bl
inc eax
dec ecx
jne 0x40aa31
mov ecx, 0x20
lea eax, [esi + 0x2594]
mov byte [eax], bl
inc eax
dec ecx
jne 0x40aa42
mov dword [esi + 0x25b4], ebx
mov dword [esi + 0x25b8], ebx
mov byte [esi + 0x25bc], bl
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4