Function at 0x4356c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x69a93b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 1
mov dword [esi + 0x24], ebx
lea ebp, [esi + 0x38]
mov dword [esi], 0x6ab4ec
mov dword [esp + 0x1c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
lea edi, [esi + 0x58]
mov dword [edi + 4], ebx
mov dword [edi], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
lea ecx, [esi + 0x68]
mov byte [esp + 0x1c], 3
call fcn.00511260
push fcn.005113d0
push fcn.00511260
push 2
lea eax, [esi + 0x53c]
push 0x4d4
push eax
mov byte [esp + 0x30], 4
call fcn.005bbc4b
lea ecx, [esi + 0xee4]
mov byte [esp + 0x1c], 5
call fcn.00517610
lea ecx, [esi + 0xf54]
mov byte [esp + 0x1c], 6
call fcn.00514f30
mov dword [esi + 0xc], pe_nt_image_headers32
mov dword [esi + 0x10], 0x1a9
mov ecx, dword [0x6f355c]
mov eax, 0x2aaaaaab
imul ecx
mov ecx, dword [esp + 0x24]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esi + 4], eax
mov eax, dword [0x6f3560]
cdq
and edx, 7
push ebx
add eax, edx
sar eax, 3
push ebx
mov byte [esp + 0x24], 7
mov dword [esi + 8], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
push str.tuto.tga
push str.data_interface
mov ecx, edi
call fcn.00533680
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0xff
push 0xff
push 0xff
push 0x11
push 0xc8
push 0x3b
push 0x19
push edx
push eax
lea ecx, [esi + 0xee4]
call fcn.005171a0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x3f800000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f800000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f800000
push ebx
push 0x3e800000
push ebx
mov ecx, dword [esi + 8]
push 1
mov edx, dword [esi + 4]
push 0x20
push 0x80
push str.talk1_close_button.tga
push ebx
push 0x16
push 0x16
push 0x20
push 0x20
push 1
push 0xe4
push ecx
push edx
lea ecx, [esi + 0x68]
call fcn.00512a00
push 0x3f000000
push ebx
push 0x3f800000
push 0x3f400000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f400000
push 0x3f000000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push str.talk_blank_button.tga
push 0xfa0
call fcn.0041b840
add esp, 4
push eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x20
push eax
push ecx
lea edi, [esi + 0x53c]
mov ecx, edi
call fcn.00512a00
push 0x3f800000
push 0x3f000000
push 0x3f800000
push 0x3f400000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f400000
push 0x3f000000
push 0x3f800000
push 0x3f000000
push 0x3f000000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push ebx
push 1
push 0x40
push 0x200
push str.talk_blank_button.tga
push 0xfa1
call fcn.0041b840
mov edx, dword [esi + 8]
add esp, 4
push eax
mov eax, dword [esi + 4]
push 0x1b
push 0x41
push 0x20
push 0x80
push 0x17c
push 0x9c
push edx
push eax
lea ecx, [esi + 0xa10]
call fcn.00512a00
push 2
push 2
mov ecx, edi
call fcn.00511490
push 2
push 2
lea ecx, [esi + 0xa10]
call fcn.00511490
push 1
push 0x40800000
push 0x40800000
push 0x3f000000
push ebx
push 0x3f200000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3f000000
push 0x3ec00000
push 0x3f000000
push ebx
push 0x3f000000
push 0x3ec00000
push 0x3f800000
push 0x3f000000
push 0x3ec00000
push 0x3e800000
push 0x3f800000
push 0x3f000000
push 0x3e800000
push 0x3e000000
push 0x3f800000
push 0x3f000000
push 0x3e000000
push ebx
push 0x3f000000
push ebx
push 0x3ec00000
push 0x3e800000
push 0x3f000000
push ebx
push 0x3e800000
push 0x3e000000
push 0x3f000000
push ebx
push 0x3e000000
push ebx
push 0x40
push 0x80
push str.scrollbar.tga
push 0x438a8000
push 0x41500000
mov ecx, dword [esi + 8]
push 0x41980000
mov edx, dword [esi + 4]
push ebx
push 1
push 0x13
push 0xd
push 0x20
push 0x10
push 0x13b
push 0xd
push 0x31
push 0xe4
push ecx
lea edi, [esi + 0xf54]
push edx
mov ecx, edi
call fcn.005166b0
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push 0x42f00000
push ebx
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov ecx, edi
call fcn.005152b0
xor eax, eax
lea edi, [esi + 0x1ea4]
mov ecx, 0x5000
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x28]
cmp eax, 5
ja case.default.0x435ae1
jmp dword [eax*4 + 0x4360c4]
push ebx
push ebx
push str.mouse.tga
push str.data_interface
mov ecx, ebp
call fcn.00533680
push 0xfa9
mov dword [esi + 0x30], 5
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b15
push 0xfaa
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b32
push 0xfab
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
nop
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b50
push 0xfac
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b70
push 0xfad
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435b90
jmp case.default.0x435ae1
push ebx
push ebx
push str.Tuto_keyboard.tga
push str.data_interface
mov ecx, ebp
call fcn.00533680
push ebx
push ebx
push str.keyboardRed.tga
push str.data_interface
lea ecx, [esi + 0x48]
call fcn.00533680
push 0xfae
mov dword [esi + 0x30], 0xb
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435be0
push 0xfaf
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435c00
push 0xfb0
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435c20
push 0xfb1
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435c40
push 0xfb2
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435c60
push 0xfb3
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435c80
push 0xfb4
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x7ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ca0
push 0xfb5
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x8ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435cc0
push 0xfb6
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x9ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ce0
push 0xfb7
call fcn.0041b840
add esp, 4
lea edx, [esi + 0xaea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435d00
push 0xfb8
call fcn.0041b840
add esp, 4
lea edx, [esi + 0xbea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435d20
jmp case.default.0x435ae1
push 0xfb9
mov dword [esi + 0x30], 6
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435d50
push 0xfba
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435d70
push 0xfbb
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435d90
push 0xfbc
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435db0
push 0xfbd
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435dd0
push 0xfbe
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435df0
jmp case.default.0x435ae1
push 0xfbf
mov dword [esi + 0x30], 7
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435e20
push 0xfc0
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435e40
push 0xfc1
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435e60
push 0xfc2
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435e80
push 0xfc3
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ea0
push 0xfc4
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ec0
push 0xfc5
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x7ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435ee0
jmp case.default.0x435ae1
push 0xfc6
mov dword [esi + 0x30], 5
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435f10
push 0xfc7
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435f30
push 0xfc8
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435f50
push 0xfc9
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435f70
push 0xfca
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435f90
jmp case.default.0x435ae1
push 0xfcb
mov dword [esi + 0x30], 6
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x1ea4]
lea esp, [esp]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435fc0
push 0xfcc
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x2ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x435fe0
push 0xfcd
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x3ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436000
push 0xfce
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x4ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436020
push 0xfcf
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x5ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436040
push 0xfd0
call fcn.0041b840
add esp, 4
lea edx, [esi + 0x6ea4]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
cmp cl, bl
jne 0x436060
mov ecx, dword [esi + 0x2c]
shl ecx, 0xc
lea edx, [ecx + esi + 0x1ea4]
push edx
lea ecx, [esi + 0xee4]
call fcn.00517d60
mov ecx, esi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x15ea4], ebx
call fcn.004354a0
push ebx
push 0x447a0000
push 0x21f4060
push str.ui_news001.wav
mov ecx, 0x21f1d78
call fcn.00524960
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4