Function at 0x429960
Capabilities:
Contain obfuscated stackstrings
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x461d69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x4661c4
mov dword [esi + 4], 0x466224
mov byte [esi + 0x18], al
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov cl, byte [esp + 0x13]
mov dword [esp + 0x20], ebx
mov byte [esi + 0x28], cl
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
lea ecx, [esi + 0x38]
mov byte [esp + 0x20], 1
call fcn.00442e80
mov dl, byte [esp + 0x13]
mov dword [esi + 0x60], ebx
mov byte [esi + 0x5c], dl
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
lea ecx, [esi + 0x6c]
mov byte [esp + 0x20], 3
call fcn.00442e80
lea ecx, [esi + 0x90]
mov byte [esp + 0x20], 4
call fcn.00442e80
mov al, byte [esp + 0x13]
mov dword [esi + 0xbc], ebx
mov byte [esi + 0xb8], al
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
push fcn.00435fc0
push 0x435f40
push 2
lea ecx, [esi + 0xc8]
push 0x5c
push ecx
mov byte [esp + 0x34], 6
call fcn.00441b40
push fcn.00435fc0
push 0x435f40
push 2
lea edx, [esi + 0x180]
push 0x5c
push edx
mov byte [esp + 0x34], 7
call fcn.00441b40
push fcn.00442f00
push fcn.00442e80
push 0xa
lea eax, [esi + 0x238]
push 0x24
push eax
mov byte [esp + 0x34], 8
call fcn.00441b40
push fcn.00442f00
push fcn.00442e80
push 8
lea ecx, [esi + 0x3a0]
push 0x24
push ecx
mov byte [esp + 0x34], 9
call fcn.00441b40
lea ecx, [esi + 0x4c4]
mov byte [esp + 0x20], 0xa
call fcn.00442e80
lea ecx, [esi + 0x4ec]
mov byte [esp + 0x20], 0xb
call fcn.00442e80
lea ecx, [esi + 0x510]
mov byte [esp + 0x20], 0xc
call fcn.00442e80
lea ecx, [esi + 0x574]
mov byte [esp + 0x20], 0xd
call fcn.00442e80
lea ecx, [esi + 0x598]
mov byte [esp + 0x20], 0xe
call fcn.00442e80
lea ecx, [esi + 0x5bc]
mov byte [esp + 0x20], 0xf
call fcn.00442e80
mov dl, byte [esp + 0x13]
mov dword [esi + 0x5e4], ebx
mov byte [esi + 0x5e0], dl
mov dword [esi + 0x5e8], ebx
mov dword [esi + 0x5ec], ebx
push fcn.00442f00
push fcn.00442e80
push 4
lea eax, [esi + 0x5f0]
push 0x24
push eax
mov byte [esp + 0x34], 0x11
call fcn.00441b40
mov cl, byte [esp + 0x13]
push 0x2c
mov byte [esp + 0x24], 0x12
mov byte [esi + 0x684], cl
call sub.MFC42.DLL_operatornew
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [esi + 0x688], eax
mov dword [esi + 0x68c], ebx
add esp, 4
mov dword [esi + 0x680], ebx
push fcn.00442f00
push fcn.00442e80
push 5
lea edx, [esi + 0x69c]
push 0x24
push edx
mov byte [esp + 0x34], 0x13
call fcn.00441b40
push fcn.00442f00
push fcn.00442e80
push 8
lea eax, [esi + 0x750]
push 0x24
push eax
mov byte [esp + 0x34], 0x14
call fcn.00441b40
lea ecx, [esi + 0x870]
mov byte [esp + 0x20], 0x15
call fcn.00442e80
push fcn.00442f00
push fcn.00442e80
push 0xb
lea ecx, [esi + 0x894]
push 0x24
mov byte [esp + 0x30], 0x16
push ecx
call fcn.00441b40
lea ecx, [esi + 0xa24]
mov byte [esp + 0x20], 0x17
call fcn.00442e80
lea ecx, [esi + 0xa48]
mov byte [esp + 0x20], 0x18
call fcn.00442e80
lea ecx, [esi + 0xa6c]
mov byte [esp + 0x20], 0x19
call fcn.00442e80
lea ecx, [esi + 0xa90]
mov byte [esp + 0x20], 0x1a
call fcn.00442e80
lea ecx, [esi + 0xac8]
mov byte [esp + 0x20], 0x1b
call fcn.00442e80
mov dl, byte [esp + 0x13]
mov dword [esi + 0xb38], ebx
mov byte [esi + 0xb34], dl
mov dword [esi + 0xb3c], ebx
mov dword [esi + 0xb40], ebx
mov al, byte [esp + 0x13]
mov dword [esi + 0xb48], ebx
mov byte [esi + 0xb44], al
mov dword [esi + 0xb4c], ebx
mov dword [esi + 0xb50], ebx
lea ecx, [esi + 0xb60]
mov byte [esp + 0x20], 0x1e
call fcn.0040a180
lea edi, [esi + 0xb68]
mov ebp, 4
mov ecx, edi
call fcn.0040a180
add edi, 8
dec ebp
jne 0x429c62
push 0x409810
push 0x409800
push 4
lea ecx, [esi + 0xb88]
push 0x14
push ecx
call fcn.00441b40
push 0x409810
push 0x409800
push 4
lea edx, [esi + 0xbd8]
push 0x14
push edx
mov byte [esp + 0x34], 0x1f
call fcn.00441b40
push 0x409810
push 0x409800
push 0xb
lea eax, [esi + 0xc28]
push 0x14
push eax
mov byte [esp + 0x34], 0x20
call fcn.00441b40
lea ecx, [esi + 0xd04]
mov byte [esp + 0x20], 0x21
call fcn.00442e80
push fcn.00442f00
push fcn.00442e80
push 4
lea ecx, [esi + 0xd28]
push 0x24
push ecx
mov byte [esp + 0x34], 0x22
call fcn.00441b40
lea ecx, [esi + 0xdb8]
mov byte [esp + 0x20], 0x23
call fcn.00442e80
lea ecx, [esi + 0xddc]
mov byte [esp + 0x20], 0x24
call fcn.00442e80
push fcn.00442f00
push fcn.00442e80
push 3
lea edx, [esi + 0xe00]
push 0x24
push edx
mov byte [esp + 0x34], 0x25
call fcn.00441b40
push fcn.00442f00
push fcn.00442e80
push 3
lea eax, [esi + 0xe6c]
push 0x24
push eax
mov byte [esp + 0x34], 0x26
call fcn.00441b40
lea ecx, [esi + 0xed8]
mov byte [esp + 0x20], 0x27
call fcn.00442e80
lea ecx, [esi + 0xefc]
mov byte [esp + 0x20], 0x28
call fcn.00442e80
lea ecx, [esi + 0xf20]
mov byte [esp + 0x20], 0x29
call fcn.00442e80
lea ecx, [esi + 0xf44]
mov byte [esp + 0x20], 0x2a
call fcn.00442e80
lea ecx, [esi + 0xf68]
mov byte [esp + 0x20], 0x2b
call fcn.00442e80
lea ecx, [esi + 0xf8c]
mov byte [esp + 0x20], 0x2c
call fcn.00442e80
lea ecx, [esi + 0xfb0]
mov byte [esp + 0x20], 0x2d
call fcn.00442e80
lea ecx, [esi + 0xfd4]
mov byte [esp + 0x20], 0x2e
call fcn.00442e80
lea ecx, [esi + 0xff8]
mov byte [esp + 0x20], 0x2f
call fcn.00442e80
lea ecx, [esi + 0x101c]
mov byte [esp + 0x20], 0x30
call fcn.00442e80
push fcn.00442f00
push fcn.00442e80
push 0xb
lea ecx, [esi + 0x1040]
push 0x24
push ecx
mov byte [esp + 0x34], 0x31
call fcn.00441b40
lea ecx, [esi + 0x11cc]
mov byte [esp + 0x20], 0x32
call fcn.00442e80
lea ecx, [esi + 0x11f0]
mov byte [esp + 0x20], 0x33
call fcn.00442e80
lea ecx, [esi + 0x1218]
mov byte [esp + 0x20], 0x34
call fcn.00442e80
lea ecx, [esi + 0x123c]
mov byte [esp + 0x20], 0x35
call fcn.00442e80
lea ecx, [esi + 0x1260]
mov byte [esp + 0x20], 0x36
call fcn.00442e80
mov dl, byte [esp + 0x13]
mov byte [esi + 0x1284], bl
mov byte [esi + 0x1285], bl
mov dword [esi + 0x1288], ebx
mov byte [esi + 0x128c], dl
mov dword [esi + 0x1290], ebx
mov dword [esi + 0x1294], ebx
mov dword [esi + 0x1298], ebx
mov dword [esi], 0x466210
mov edi, 1
mov dword [esi + 4], 0x466204
mov dword [esi + 8], edi
mov dword [esi + 0x10], ebx
call dword [sym.imp.WINMM.dll_timeGetTime]
or ecx, 0xffffffff
mov dword [esi + 0x14], eax
mov word [esi + 0xa20], cx
mov dword [esi + 0xab4], ebx
mov dword [esi + 0x698], ebx
mov eax, 0x20
mov dword [esi + 0xaf4], 9
mov dword [esi + 0xaf8], eax
mov dword [esi + 0xafc], 0x9a
mov dword [esi + 0xb00], eax
mov dword [esi + 0xb04], 0x1fc
mov dword [esi + 0xb08], eax
mov dword [esi + 0xb0c], 0x28e
mov dword [esi + 0xb10], eax
mov dword [esi + 0xb14], 0xfa
mov eax, 0x1a
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb18], eax
mov dword [esi + 0xb20], eax
mov dword [esi + 0xb28], eax
mov dword [esi + 0xb30], eax
mov eax, 0x5a
mov dword [esi + 0xb1c], 0x1c5
mov dword [esi + 0x538], eax
mov dword [esi + 0x540], eax
mov dword [esi + 0x548], eax
mov dword [esi + 0x550], eax
mov eax, 0xcd
mov dword [esi + 0xb24], 0x28f
mov dword [esi + 0x558], eax
mov dword [esi + 0x560], eax
mov dword [esi + 0x568], eax
mov dword [esi + 0x570], eax
mov dword [esi + 0xb2c], 0x359
mov dword [esi + 0x534], 0x5f
mov dword [esi + 0x53c], 0xe1
mov dword [esi + 0x544], 0x1c7
mov dword [esi + 0x54c], 0x24e
mov dword [esi + 0x554], 0xa4
mov dword [esi + 0x55c], 0x134
mov dword [esi + 0x564], 0x273
mov dword [esi + 0x56c], 0x30e
mov word [esi + 0xac4], cx
mov ecx, dword [esp + 0x18]
mov dword [esi + 0xabc], ebx
mov dword [esi + 0xaec], ebx
mov dword [esi + 0x4e8], ebx
mov dword [esi + 0x690], ebx
mov dword [esi + 0x694], ebx
mov dword [esi + 0x1214], ebx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret