Function at 0x4351f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6989db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
lea ebp, [esi + 0x38]
mov dword [esi], 0x6aa404
mov dword [esp + 0x1c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
lea edi, [esi + 0x58]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0x1c], 3
call fcn.005167e0
push fcn.00516950
push fcn.005167e0
push 2
lea eax, [esi + 0x53c]
push 0x4d4
push eax
mov byte [esp + 0x30], 4
call fcn.005b9dbb
lea ecx, [esi + 0xee4]
mov byte [esp + 0x1c], 5
call fcn.0051c930
lea ecx, [esi + 0xf54]
mov byte [esp + 0x1c], 6
call fcn.0051a260
mov dword [esi + 0xc], pe_nt_image_headers32
mov dword [esi + 0x10], 0x1a9
mov ecx, dword [0x6f355c]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 4], eax
mov eax, dword [0x6f3560]
cdq
and edx, 7
push ebx
add eax, edx
sar eax, 3
push ebx
mov byte [esp + 0x24], 7
mov dword [esi + 8], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push str.tuto.tga
push str.data_interface
mov ecx, edi
call fcn.00538940
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0xff
push 0xff
push 0xff
push 0x11
push 0xc8
push 0x3b
push 0x19
push edx
push eax
lea ecx, [esi + 0xee4]
call fcn.0051c4c0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push 1
push 0xe4
push ecx
push edx
lea ecx, [esi + 0x68]
call fcn.00517f80
push 0x3f000000
push ebx
push 0x3f800000
push 0x3f400000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push str.talk_blank_button.tga
push 0xfa0
call fcn.0041b230
add esp, 4
push eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x20
push eax
push ecx
lea edi, [esi + 0x53c]
mov ecx, edi
call fcn.00517f80
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push str.talk_blank_button.tga
push 0xfa1
call fcn.0041b230
mov edx, dword [esi + 8]
add esp, 4
push eax
mov eax, dword [esi + 4]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x9c
push edx
push eax
lea ecx, [esi + 0xa10]
call fcn.00517f80
push 2
push 2
mov ecx, edi
call fcn.00516a10
push 2
push 2
lea ecx, [esi + 0xa10]
call fcn.00516a10
push 1
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
push 0x438a8000
push 0x41500000
mov ecx, dword [esi + 8]
push 0x41980000
mov edx, dword [esi + 4]
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push 0x13b
push 0xd
push 0x31
push 0xe4
push ecx
lea edi, [esi + 0xf54]
push edx
mov ecx, edi
call fcn.0051b9e0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push 0x42f00000
push ebx
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov ecx, edi
call fcn.0051a5e0
xor eax, eax
lea edi, [esi + 0x1ea4]
mov ecx, 0x5000
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
cmp eax, 5
ja case.default.0x435611
jmp dword [eax*4 + 0x435bf4]
push ebx
push ebx
push str.mouse.tga
push str.data_interface
mov ecx, ebp
call fcn.00538940
push 0xfa9
mov dword [esi + 0x30], 5
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435645
push 0xfaa
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435662
push 0xfab
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
nop
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435680
push 0xfac
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4356a0
push 0xfad
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4356c0
jmp case.default.0x435611
push ebx
push ebx
push str.Tuto_keyboard.tga
push str.data_interface
mov ecx, ebp
call fcn.00538940
push ebx
push ebx
push str.keyboardRed.tga
push str.data_interface
lea ecx, [esi + 0x48]
call fcn.00538940
push 0xfae
mov dword [esi + 0x30], 0xb
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435710
push 0xfaf
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435730
push 0xfb0
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435750
push 0xfb1
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435770
push 0xfb2
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435790
push 0xfb3
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4357b0
push 0xfb4
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x7ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4357d0
push 0xfb5
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x8ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4357f0
push 0xfb6
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x9ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435810
push 0xfb7
call fcn.0041b230
add esp, 4
lea edx, [esi + 0xaea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435830
push 0xfb8
call fcn.0041b230
add esp, 4
lea edx, [esi + 0xbea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435850
jmp case.default.0x435611
push 0xfb9
mov dword [esi + 0x30], 6
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435880
push 0xfba
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4358a0
push 0xfbb
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4358c0
push 0xfbc
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4358e0
push 0xfbd
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435900
push 0xfbe
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435920
jmp case.default.0x435611
push 0xfbf
mov dword [esi + 0x30], 7
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435950
push 0xfc0
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435970
push 0xfc1
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435990
push 0xfc2
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4359b0
push 0xfc3
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4359d0
push 0xfc4
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x4359f0
push 0xfc5
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x7ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435a10
jmp case.default.0x435611
push 0xfc6
mov dword [esi + 0x30], 5
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435a40
push 0xfc7
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435a60
push 0xfc8
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435a80
push 0xfc9
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435aa0
push 0xfca
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ac0
jmp case.default.0x435611
push 0xfcb
mov dword [esi + 0x30], 6
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435af0
push 0xfcc
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b10
push 0xfcd
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b30
push 0xfce
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b50
push 0xfcf
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b70
push 0xfd0
call fcn.0041b230
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b90
mov ecx, dword [esi + 0x2c]
shl ecx, 0xc
lea edx, [ecx + esi + 0x1ea4]
push edx
lea ecx, [esi + 0xee4]
call fcn.0051d080
mov ecx, esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x15ea4], ebx
call fcn.00434fd0
push ebx
push 0x447a0000
push 0x21f1d38
push str.ui_news001.wav
mov ecx, 0x21efa50
call fcn.00529cb0
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4