Function at 0x433a28
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x433f8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x218]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebx + 0x30]
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 8]
add eax, dword [ebx + 0x1c]
sub eax, dword [ebx + 0xc]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebx + 0x18]
sub ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 8]
add edx, dword [ebx + 0x14]
add edx, dword [ebx + 0xc]
mov eax, dword [ebp - 4]
add eax, dword [ebx + 0x10]
add eax, dword [ebx + 0xc]
call fcn.0040a0c8
push 0
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xc]
mov eax, dword [esi + 0x1e4]
lea edx, [eax + 0x18]
mov eax, dword [edi + 4]
call fcn.00444d60
test al, al
je 0x433f34
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x14c]
mov eax, dword [edi + 4]
call fcn.00406780
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.004061d0
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov ecx, 0xff
call fcn.00403b18
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x2f]
mov cl, 4
call fcn.00402a30
lea eax, [ebp - 0x2f]
mov edx, 0x433f9c
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402a60
je 0x433b30
lea eax, [ebp - 0x2f]
mov edx, 0x433fa4
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.00402a60
je 0x433b30
xor eax, eax
jmp 0x433b32
mov al, 1
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
jne 0x433b65
mov eax, ebx
mov edx, 0x419960
call fcn.00402d2c
test al, al
je 0x433d70
cmp byte [edi], 0
je 0x433d70
cmp byte [edi + 1], 0
je 0x433cac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
mov dword [ebp - 0x150], eax
fild dword [ebp - 0x150]
fstp xword [ebp - 0x15c]
wait
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
mov dword [ebp - 0x160], eax
fild dword [ebp - 0x160]
fld xword [ebp - 0x15c]
fdivrp st(1)
lea eax, [ebp - 0x2a]
call fcn.00404fb0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
cmp ebx, dword [ebp - 0x18]
jg 0x433c1b
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jle 0x433c43
jmp 0x433c1b
dec ebx
cmp ebx, dword [ebp - 0x18]
jg 0x433c1a
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jg 0x433c1a
jmp 0x433c68
inc ebx
cmp ebx, dword [ebp - 0x18]
jge 0x433c68
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
cmp eax, dword [ebp - 0x1c]
jl 0x433c42
lea eax, [ebp - 0x2a]
call fcn.00404f80
mov dword [ebp - 0x150], ebx
fild dword [ebp - 0x150]
fdivrp st(1)
call fcn.004029b4
push eax
lea eax, [ebp - 0x170]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0040a0e4
push esi
push edi
lea esi, [ebp - 0x170]
lea edi, [ebp - 0x44]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.00433170
mov ebx, eax
push ebx
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
cmp dword [esi + 0x21c], 0
jne 0x433d3b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
je 0x433d3b
cmp dword [0x44bf40], 0x100
jne 0x433d3b
cmp byte [ebp - 0x12], 0
jne 0x433d3b
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
push eax
push 0xcc0020
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
push eax
mov eax, dword [esi + 0x218]
call fcn.0041b260
mov ecx, dword [ebp - 0x44]
pop edx
call fcn.0042b708
jmp 0x433d52
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x34]
call fcn.0041afec
push 0
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
push ebx
call sub.gdi32.dll_DeleteObject
jmp 0x433f34
cmp byte [ebp + 8], 0
je 0x433db9
lea eax, [edi + 0x10]
push eax
mov al, byte [edi + 8]
push eax
mov al, byte [edi + 9]
push eax
mov al, byte [edi + 0xa]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cedc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041cec4
push eax
push 8
push 8
push 1
push 1
lea ecx, [edi + 0xc]
mov edx, dword [ebp + 0xc]
mov eax, esi
call fcn.00433698
mov eax, dword [edi + 0xc]
test eax, eax
je 0x433dfb
cmp byte [ebp + 8], 0
je 0x433dd8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x218]
call fcn.00447928
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x24], eax
cmp byte [edi + 9], 1
jne 0x433df1
mov eax, dword [0x44bf34]
add dword [ebp - 0x44], eax
jmp 0x433e00
mov eax, dword [0x44bf34]
sub dword [ebp - 0x3c], eax
jmp 0x433e00
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x10]
test eax, eax
je 0x433e42
cmp byte [ebp + 8], 0
je 0x433e1f
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x218]
call fcn.00447928
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x20], eax
cmp byte [edi + 0xa], 8
jne 0x433e38
mov eax, dword [0x44bf34]
add dword [ebp - 0x40], eax
jmp 0x433e47
mov eax, dword [0x44bf34]
sub dword [ebp - 0x38], eax
jmp 0x433e47
xor eax, eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x44]
mov eax, esi
call fcn.00433170
mov ebx, eax
push ebx
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
cmp dword [esi + 0x21c], 0
jne 0x433efa
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
mov edx, 0x419aa4
call fcn.00402d2c
test al, al
je 0x433efa
cmp dword [0x44bf40], 0x100
jne 0x433efa
cmp byte [ebp - 0x12], 0
jne 0x433efa
mov eax, dword [ebp - 0x40]
sub eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
mov edx, dword [eax]
call dword [edx + 0x1c]
push eax
push 0xcc0020
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
call fcn.0041ca6c
push eax
mov eax, dword [esi + 0x218]
call fcn.0041b260
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x20]
pop edx
call fcn.0042b708
jmp 0x433f1b
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x110]
mov eax, dword [eax + 4]
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
call fcn.0041acf0
push 0
mov eax, dword [esi + 0x218]
call fcn.0041b260
push eax
call sub.gdi32.dll_SelectClipRgn
push ebx
call sub.gdi32.dll_DeleteObject
cmp byte [ebp - 0x11], 0
jne 0x433f6d
cmp byte [ebp + 8], 0
je 0x433f6d
lea edx, [edi + 0xc]
mov eax, esi
call fcn.0043386c
lea edx, [edi + 0x10]
mov eax, esi
call fcn.0043386c
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
mov eax, dword [esi + 0x218]
call fcn.00432db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x433f92
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00403630
ret