Function at 0x409940
Capabilities:
Access peb ldr_data
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44cb29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov eax, dword [0x460640]
mov edx, dword [esp + 0x7c]
xor eax, esp
push ebx
push ebp
mov ebp, dword [esp + 0x78]
push esi
push edi
push 0xa
push 0x40100000
mov edi, ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x8c]
push 0x3e800000
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x9c]
push 0x3f400000
mov dword [esp + 0x74], ecx
lea ecx, [edi + 0x18]
push 0x11
mov dword [esp + 0x6c], edi
mov dword [esp + 0x7c], edx
mov dword [esp + 0x60], eax
mov dword [edi], 0x44f150
call fcn.00408c50
mov dword [esp + 0x78], 0
call fcn.00445110
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi + 0x48], eax
mov dword [edi + 0x50], 0
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov ebx, eax
push 0x14
mov dword [esp + 0x40], edx
mov eax, esi
cdq
push 0x76aab896
push edx
push eax
mov byte [esp + 0x88], 2
mov dword [esp + 0x48], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
call fcn.00432020
mov ecx, dword [esp + 0x3c]
push 0x14
push 0x76aab896
push ecx
push ebx
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x48]
push 0xf
push 0x3c2325f6
sub ecx, eax
mov eax, dword [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x3c]
push 0x13
push 0x2c2da253
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ecdc]
imul esi, esi, 0x392bae29
add ecx, eax
imul edx, edx, 0x3dbf610d
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
add ecx, edx
mov edx, dword [esp + 0x64]
add ecx, eax
add ecx, esi
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0x60]
lea eax, [edi + 8]
mov dword [eax], ebp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x68]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov dword [edi + 4], 1
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov ebx, edx
cdq
push 0x974b287b
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.00432020
push 0xd
push 0x3dbf610d
push ebx
push esi
mov dword [esp + 0x20], eax
call fcn.00432020
mov ecx, dword [esp + 0x10]
push 0x13
push 0x2c2da253
mov edx, ebx
push edx
add ecx, eax
push esi
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece8]
add ecx, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ece4]
mov ebx, dword [str._r_____r____]
imul eax, eax, 0x31b5823a
sub ecx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub ecx, edx
add ecx, eax
sub ecx, ebx
sub ecx, 0x1bcdabbc
mov dword [0x45eccc], ecx
mov ecx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x6c]
sub esp, 0x10
mov eax, esp
mov dword [eax], ebp
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x80]
mov dword [eax + 8], edx
mov byte [esp + 0x2f], 0
mov dword [eax + 0xc], ecx
call fcn.00405ae0
mov ebp, dword [0x45ecdc]
mov dword [esp + 0x48], eax
mov eax, ebp
add esp, 0x18
cdq
mov esi, dword [str._r_____r____]
mov ecx, dword [0x45ecd8]
add ecx, esi
imul ecx, ecx, 0x3dbf610d
push 8
push 0x974b287b
push edx
push eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
mov dword [esp + 0x20], ecx
call fcn.00432020
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x60]
push 0x13
push 0x2c2da253
sub ecx, eax
mov eax, dword [esp + 0x64]
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [esp + 0x10]
mov ebx, dword [0x45ece0]
mov edx, ebp
imul edx, edx, 0x392bae29
add ecx, eax
add edx, ebx
add edx, ecx
lea eax, [esi + edx + 0x31b5823a]
mov dword [0x45ecd4], eax
mov eax, dword [esp + 0x30]
test eax, eax
jl 0x40a207
mov eax, dword [0x45ece4]
mov esi, dword [0x45eccc]
cdq
mov dword [esp + 0x24], eax
push 0xd
mov dword [esp + 0x2c], edx
mov eax, esi
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd0]
mov edx, dword [esp + 0x28]
add esi, ecx
imul esi, esi, 0x3c2325f6
push 0x14
push 0x76aab896
sub esi, eax
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0x13
push 0x2c2da253
push ecx
push edx
add esi, eax
call fcn.00432020
imul ebx, ebx, 0x42a7b17d
imul ebp, ebp, 0x31b5823a
add esi, eax
mov eax, dword [esp + 0x2c]
add esi, ebx
lea edx, [esp + 0x54]
sub esi, ebp
push edx
mov dword [0x45ecdc], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x409d40
mov eax, dword [0x45ecd8]
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xffffffffffffffeb
mov dword [esp + 0x64], edx
cdq
push 0x8955476a
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebp, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x68b4d785
push 0x10
mov eax, esi
cdq
push 0xe4325444
push edx
push eax
sub ebp, ecx
call fcn.00432020
mov edx, dword [esp + 0x60]
push 0xf
push 0x3c2325f6
push edx
push ebx
add ebp, eax
call fcn.00432020
push 0x13
sub ebp, eax
mov eax, dword [esp + 0x64]
push 0x2c2da253
push eax
push ebx
call fcn.00432020
imul esi, esi, 0x2c2da253
sub ebp, eax
mov eax, dword [esp + 0x54]
add ebp, esi
mov dword [0x45ece4], ebp
cmp dword [eax + 0x28], 4
jne 0x409d35
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x4c]
mov ebx, dword [0x45ecc8]
mov eax, ebx
cdq
mov dword [esp + 0x24], eax
mov eax, dword [str._r_____r____]
push 8
mov dword [esp + 0x2c], edx
cdq
push 0x42a7b17d
push edx
push eax
call fcn.00432020
mov ecx, dword [0x45ecd8]
mov esi, dword [0x45ecd0]
mov edx, dword [esp + 0x28]
lea ebp, [esi + ecx]
imul ebp, ebp, 0x392bae29
push 8
push 0x974b287b
sub ebp, eax
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 0x13
push 0x2c2da253
push ecx
push edx
add ebp, eax
call fcn.00432020
add ebp, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
mov ecx, esi
imul ecx, ecx, 0x2c2da253
add ebp, eax
mov al, byte [esp + 0x17]
sub ebp, ecx
test al, al
mov dword [0x45ece8], ebp
je 0x40a175
push 8
mov eax, esi
cdq
push 0x42a7b17d
mov esi, eax
push edx
push esi
mov dword [esp + 0x40], 0
mov dword [esp + 0x70], edx
call fcn.00432020
mov edx, dword [esp + 0x60]
push 3
push 0xce4a7dc6
push edx
push esi
mov dword [esp + 0x20], eax
call fcn.00432020
push 0x13
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x64]
push 0x392bae29
push eax
push esi
call fcn.00432020
mov dword [esp + 0x34], eax
mov eax, dword [0x45ece4]
push 0xd
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
imul ebx, ebx, 0x63bd0adc
mov edx, dword [esp + 0x10]
mov esi, eax
mov eax, dword [esp + 0x40]
sub esi, edx
mov edx, dword [esp + 0x34]
imul esi, esi, 0x31b58239
lea ecx, [edx + eax]
imul ecx, ecx, 0x31b5823a
sub esi, ecx
mov ecx, dword [0x45ece0]
sub esi, ebx
mov ebx, ecx
imul ebx, ebx, 0x71ce90ae
sub esi, ebx
add esi, edx
add esi, eax
mov eax, ebp
cdq
mov dword [esp + 0x1c], eax
push 8
mov eax, ecx
mov dword [esp + 0x24], edx
cdq
push 0x974b287b
push edx
push eax
mov dword [0x45ecc8], esi
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov edx, dword [esp + 0x20]
push 0x14
push 0x471ee414
sub ebx, eax
mov eax, dword [esp + 0x24]
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x20]
push 0x13
add ebx, eax
push 0x392bae29
mov edx, dword [esp + 0x24]
push ecx
push edx
call fcn.00432020
imul ebp, ebp, 0x31b5823a
imul esi, esi, 0x2c2da253
sub ebx, eax
mov eax, dword [0x45ece0]
imul eax, eax, 0x68b4d785
sub ebx, eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x34]
push edx
add ebx, ebp
add ebx, esi
push 0
mov dword [0x45ecd8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x40a169
jmp 0x409f20
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
lea edx, [esp + 0x40]
push edx
push 1
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
mov edx, dword [edx]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x40a03e
cmp dword [esp + 0x40], 1
jb 0x40a03e
mov esi, dword [0x45ece8]
mov ebx, dword [0x45ece0]
mov eax, esi
cdq
mov dword [esp + 0x1c], eax
push 8
mov dword [esp + 0x24], edx
mov eax, ebx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
mov ebp, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x1c]
push 0x14
sub ebp, eax
mov eax, dword [esp + 0x24]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [esp + 0x20]
push 0x13
push 0x392bae29
add ebp, eax
mov eax, dword [esp + 0x24]
push edx
push eax
call fcn.00432020
imul ebx, ebx, 0x68b4d785
imul esi, esi, 0x31b5823a
mov ecx, dword [0x45ecc8]
mov edx, dword [esp + 0x10]
imul ecx, ecx, 0x2c2da253
sub ebp, eax
sub ebp, ebx
add ebp, esi
add ebp, ecx
push edx
lea ecx, [esp + 0x54]
mov dword [0x45ecd8], ebp
call fcn.00409880
mov esi, eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push ecx
lea ecx, [edi + 0x18]
mov byte [esp + 0x7c], 3
call fcn.00409270
push esi
mov ecx, eax
call fcn.00408de0
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x78], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a033
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [esp + 0x30]
mov eax, dword [0x45ecd0]
inc edx
mov dword [esp + 0x30], edx
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xd
mov ebp, edx
cdq
push 0x3dbf610d
push edx
push eax
call fcn.00432020
push 3
push 0xce4a7dc6
push ebp
push ebx
mov dword [esp + 0x28], eax
call fcn.00432020
push 0x13
push 0x392bae29
mov esi, eax
mov eax, dword [esp + 0x20]
push ebp
push ebx
sub esi, eax
call fcn.00432020
push 8
push 0x42a7b17d
push ebp
push ebx
add esi, eax
call fcn.00432020
mov ebp, dword [0x45ece0]
mov edx, dword [0x45ecc8]
mov ecx, ebp
imul edx, edx, 0x31b5823a
imul ecx, ecx, 0xafbbe1e
add esi, eax
mov eax, dword [0x45ece8]
add esi, ecx
sub esi, edx
cdq
mov dword [esp + 0x1c], eax
push 8
mov dword [esp + 0x24], edx
mov eax, ebp
cdq
push 0x974b287b
push edx
push eax
mov dword [0x45ecc8], esi
call fcn.00432020
mov ebx, eax
mov eax, dword [0x45ecd4]
push 0x13
cdq
push 0x2c2da253
push edx
push eax
call fcn.00432020
mov ecx, dword [esp + 0x1c]
push 0x14
sub ebx, eax
mov eax, dword [esp + 0x24]
push 0x471ee414
push eax
push ecx
call fcn.00432020
mov edx, dword [esp + 0x20]
push 0x13
push 0x392bae29
add ebx, eax
mov eax, dword [esp + 0x24]
push edx
push eax
call fcn.00432020
imul ebp, ebp, 0x68b4d785
sub ebx, eax
sub ebx, ebp
mov eax, dword [0x45ece8]
imul esi, esi, 0x2c2da253
imul eax, eax, 0x31b5823a
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
add ebx, eax
mov eax, dword [esp + 0x30]
add ebx, esi
push edx
mov dword [0x45ecd8], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x409f20
mov esi, dword [0x45ecd0]
mov ebx, dword [0x45ecc8]
mov eax, ebx
cdq
mov ebx, eax
mov eax, dword [str._r_____r____]
push 8
mov ebp, edx
cdq
push 0x42a7b17d
push edx
push eax
mov dword [esp + 0x38], ebp
call fcn.00432020
mov ecx, dword [0x45ecd8]
add ecx, esi
imul ecx, ecx, 0x392bae29
push 8
push 0x974b287b
push ebp
sub ecx, eax
push ebx
mov dword [esp + 0x28], ecx
call fcn.00432020
mov ecx, dword [esp + 0x18]
push 0x13
push 0x2c2da253
mov edx, ebp
push edx
add ecx, eax
push ebx
mov dword [esp + 0x28], ecx
call fcn.00432020
imul esi, esi, 0x2c2da253
mov ecx, dword [esp + 0x18]
add ecx, eax
mov eax, dword [0x45ece4]
imul eax, eax, 0x31b5823a
add ecx, eax
mov eax, dword [esp + 0x2c]
sub ecx, esi
mov dword [0x45ece8], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebp, dword [0x45ecdc]
mov ebx, dword [0x45ece0]
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 0x14
mov dword [esp + 0x40], edx
cdq
push 0x76aab896
push edx
push eax
mov dword [esp + 0x48], esi
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
call fcn.00432020
mov edx, dword [esp + 0x3c]
push 0x14
push 0x76aab896
push edx
push esi
mov dword [esp + 0x28], eax
call fcn.00432020
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x44]
push 0xf
sub ecx, eax
mov eax, dword [esp + 0x4c]
push 0x3c2325f6
push eax
push edx
mov dword [esp + 0x28], ecx
call fcn.00432020
mov ecx, dword [esp + 0x18]
push 0x13
sub ecx, eax
mov eax, dword [esp + 0x40]
push 0x2c2da253
push eax
mov edx, esi
push edx
mov dword [esp + 0x28], ecx
call fcn.00432020
imul ebp, ebp, 0x3dbf610d
mov ecx, dword [esp + 0x18]
add ecx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x471ee414
add ecx, ebp
add ecx, eax
mov eax, dword [0x45eccc]
imul eax, eax, 0x392bae29
add ecx, eax
mov al, byte [esp + 0x17]
test al, al
mov dword [str._r_____r____], ecx
jne 0x40a2e6
mov ecx, dword [0x453ad0]
mov dword [edi + 8], ecx
mov edx, dword [0x453ad4]
mov dword [edi + 0xc], edx
mov eax, dword [0x453ad8]
mov dword [edi + 0x10], eax
mov ecx, dword [0x453adc]
mov dword [edi + 0x14], ecx
mov ebx, dword [0x45ece0]
mov eax, dword [0x45ecd0]
cdq
mov esi, eax
mov eax, dword [0x45ece4]
push 0xd
mov ebp, edx
cdq
push 0x3dbf610d
push edx
push eax
mov dword [esp + 0x70], ebp
call fcn.00432020
push 3
push 0xce4a7dc6
push ebp
push esi
mov dword [esp + 0x28], eax
call fcn.00432020
mov edx, dword [esp + 0x60]
push 0x13
push 0x392bae29
mov ebp, eax
mov eax, dword [esp + 0x20]
push edx
push esi
sub ebp, eax
call fcn.00432020
push 8
add ebp, eax
mov eax, dword [esp + 0x64]
push 0x42a7b17d
push eax
push esi
call fcn.00432020
imul ebx, ebx, 0xafbbe1e
mov ecx, dword [0x45ecc8]
imul ecx, ecx, 0x31b5823a
add ebp, eax
add ebp, ebx
sub ebp, ecx
lea eax, [edi + 0x50]
test eax, eax
mov dword [0x45ecc8], ebp
je 0x40a392
mov ecx, dword [esp + 0x4c]
test ecx, ecx
mov esi, dword [eax]
mov dword [eax], 0
je 0x40a388
mov edx, dword [ecx]
push eax
push 0x44f3f8
push ecx
call dword [edx]
test esi, esi
je 0x40a392
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [edi + 0x54], 0
mov eax, dword [0x45ecd4]
cdq
mov esi, eax
mov eax, dword [0x45eccc]
push 8
mov ebx, edx
cdq
push 0x974b287b
push edx
push eax
call fcn.00432020
push 0xd
push 0x3dbf610d
push ebx
push esi
mov ebp, eax
call fcn.00432020
push 0x13
push 0x2c2da253
push ebx
push esi
add ebp, eax
call fcn.00432020
mov ecx, dword [0x45ece4]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x31b5823a
add ebp, eax
imul edx, edx, 0x471ee414
mov eax, dword [0x45ece0]
imul eax, eax, 0x392bae29
sub ebp, ecx
mov ecx, dword [str._r_____r____]
sub ebp, edx
add ebp, eax
sub ebp, ecx
xor eax, eax
sub ebp, 0x1bcdabbc
mov dword [0x45eccc], ebp
mov dword [edi + 0x58], eax
mov dword [edi + 0x5c], eax
mov eax, dword [0x45ecdc]
push 0x14
cdq
push 0x76aab896
push edx
push eax
call fcn.00432020
mov esi, dword [0x45ecd8]
mov ebx, eax
push 3
mov eax, esi
cdq
push 0xce4a7dc6
push edx
push eax
call fcn.00432020
mov ebp, eax
mov eax, dword [0x45ecd0]
push 0x10
cdq
push 0xe4325444
push edx
push eax
sub ebp, ebx
call fcn.00432020
imul esi, esi, 0x76aab896
mov ecx, dword [0x45ecc8]
mov edx, dword [0x45ece8]
imul ecx, ecx, 0x3dbf610d
imul edx, edx, 0x471ee414
sub ebp, eax
add ebp, ecx
mov ecx, dword [0x45ece4]
add ebp, esi
add ebp, edx
sub ebp, ecx
mov ecx, dword [esp + 0x70]
add ebp, 0x31b5823a
mov dword [0x45ecd0], ebp
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x64]
pop ebp
pop ebx
xor ecx, esp
call fcn.00431e3d
add esp, 0x6c
ret 0x14