Function at 0x40ba50
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x431926
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43ce70]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov ebx, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi], vtable.WTL::CVistaStyleListImpl_class_WTL::CVistaStyleListCtrlT_class_CSoftListCtrl__unsigned_long_int__.0
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
mov dword [esp + 0x34], edi
call edx
add eax, 0x10
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], edi
mov dword [esi + 0x148], edi
mov dword [esi + 0x1bc], edi
mov dword [esi + 0x1c0], edi
mov dword [esi + 0x1c4], edi
mov dword [esi + 0x1c8], edi
mov dword [esi + 0x1cc], edi
mov dword [esi + 0x1d0], edi
mov dword [esi + 0x1d4], edi
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x1dc], edi
mov dword [esi + method.WTL::CDragDrop_class_WTL::CVistaStyleListImpl_class_WTL::CVistaStyleListCtrlT_class_CSoftListCtrl__unsigned_long_int___.virtual_0], vtable.WTL::CDragDrop_class_WTL::CVistaStyleListImpl_class_WTL::CVistaStyleListCtrlT_class_CSoftListCtrl__unsigned_long_int___.0
mov dword [esi + 0x1e4], edi
mov dword [esi + 0x1e8], edi
mov dword [esi + 0x1ec], edi
mov dword [esi + 0x1f0], edi
mov dword [esi + 0x1f4], edi
mov dword [esi + 0x1fc], edi
mov dword [esi + 0x20c], edi
mov dword [esi + 0x210], edi
mov dword [esi + 0x214], edi
mov dword [esi + 0x218], ebx
mov dword [esi + method.WTL::CDropArrows.virtual_0], vtable.WTL::CDropArrows.0
mov dword [esi + 0x21c], edi
mov dword [esi + 0x220], edi
mov dword [esi + 0x224], edi
mov dword [esi + 0x228], edi
lea ebp, [esi + 0x230]
mov dword [ebp + 4], edi
mov dword [ebp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], ebx
mov dword [ebp], vtable.WTL::CTitleTip.0
mov eax, dword [0x43e3bc]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e3bc
mov byte [esp + 0x34], 0xa
call edx
add eax, 0x10
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x48], edi
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x28], 1
mov dword [esi + 0x288], edi
mov dword [esi + 0x298], edi
mov dword [esi + 0x29c], edi
mov dword [esi + 0x2a0], edi
mov dword [esi + 0x2a4], ebx
mov dword [esi + method.WTL::CListEdit.virtual_0], vtable.WTL::CListEdit.0
mov dword [esi + 0x2b8], edi
or ebp, 0xffffffff
mov dword [esi + 0x2a8], ebp
mov dword [esi + 0x2ac], ebp
mov dword [esi + 0x2b0], edi
mov word [esi + 0x2b4], di
mov dword [esi + 0x2c4], edi
mov dword [esi + 0x2d4], edi
mov dword [esi + 0x2d8], edi
mov dword [esi + 0x2dc], edi
mov dword [esi + 0x2e0], ebx
mov dword [esi + method.WTL::CListDate.virtual_0], vtable.WTL::CListDate.0
mov dword [esi + 0x2f4], edi
mov dword [esi + 0x2e4], ebp
mov dword [esi + 0x2e8], ebp
mov dword [esi + 0x2ec], edi
mov word [esi + 0x2f0], di
mov dword [esi + 0x2fc], edi
mov dword [esi + 0x300], edi
mov dword [esi + 0x304], edi
mov dword [esi + 0x308], edi
mov dword [esi + 0x30c], edi
mov dword [esi + 0x310], edi
mov dword [esi + 0x314], edi
mov dword [esi + 0x318], edi
mov dword [esi + 0x31c], edi
lea ebx, [esi + 0x320]
mov ecx, ebx
mov byte [esp + 0x34], 0x14
call fcn.00406210
mov dword [ebx + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [ebx + 4]
mov dword [eax + 4], eax
mov eax, dword [ebx + 4]
mov dword [eax], eax
mov eax, dword [ebx + 4]
mov dword [eax + 8], eax
mov dword [ebx + 8], edi
mov dword [esi + 0x330], edi
mov dword [esi + 0x334], edi
mov dword [esi + 0x338], edi
mov eax, 1
mov byte [esp + 0x34], 0x16
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
xor eax, eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xb0], eax
push edi
lea eax, [esp + 0x20]
push eax
mov dword [esi + 0xf8], 3
mov dword [esi + 0xfc], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], 0x28
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xe4], ebp
mov dword [esi + 0xe8], ebp
mov dword [esi + 0xec], ebp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], ebp
mov dword [esi + 0x100], ebp
mov dword [esi + 0x108], ebp
mov dword [esi + 0x104], ebp
mov dword [esi + 0x10c], ebp
mov dword [esi + 0x110], ebp
mov dword [esi + 0x114], ebp
mov dword [esi + 0x118], edi
mov dword [esi + 0x11c], edi
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x134], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xb4], edi
call dword [sym.imp.USER32.dll_CopyRect]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0xc0], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0xc4], edx
mov dword [esi + 0xc8], eax
push edi
mov dword [esi + 0xcc], ecx
push 0x433830
lea ecx, [esi + 0x140]
mov dword [esi + 0x138], edi
mov dword [esi + 0x13c], edi
call fcn.004039a0
mov dword [esi + 0x130], 0x3e8
mov dword [esi + 0x17c], 0xfdfdfd
mov dword [esi + 0x180], 0xcecbca
mov dword [esi + 0x184], 0xb6a69b
mov dword [esi + 0x188], 0x785d45
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret