Function at 0x469100
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4aaf80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 9
mov edi, dword [ebp + 0xc]
or eax, 0xffffffff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call fcn.00441900
mov ecx, dword [eax + 0x151c]
mov esi, dword [eax + 0x1518]
add eax, 0x1518
sub ecx, esi
mov eax, dword [esp + 0x38]
sar ecx, 2
test eax, eax
mov dword [esp + 0x24], ecx
je 0x46915a
mov dword [esp + 0x10], ecx
jmp 0x469162
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 8
jl 0x46917c
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov cl, byte [eax + 0x25]
and cl, 0xef
jmp 0x469185
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 0x25]
or cl, 0x10
mov byte [eax + 0x25], cl
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x46919a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x46919c
xor eax, eax
mov ecx, eax
call fcn.00439140
and eax, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edi, [eax + eax*4]
lea edi, [edi + edi*4]
shl edi, 5
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x4691cc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x4691ce
xor eax, eax
mov ecx, eax
call fcn.00439180
and eax, 0xffff
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea esi, [eax + eax*4]
mov eax, 0xcccccccd
lea esi, [esi + esi*4]
shl esi, 5
mov ecx, esi
sub ecx, edi
mul ecx
mov ebx, edx
lea ecx, [esi + esi*2]
lea edx, [edi + edi*2]
mov eax, 0xd41d41d5
sub ecx, edx
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
xor edx, edx
shr ecx, 5
imul ecx, dword [esp + 0x10]
shr ebx, 2
add ecx, ebx
add ecx, edi
mov edi, 0x271
mov eax, ecx
mov dword [esp + 0x14], ecx
div edi
test edx, edx
je 0x46924a
mov eax, 0xd1b71759
mul ecx
shr edx, 9
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ecx, [eax + eax*4]
mov dword [esp + 0x14], ecx
mov eax, 0xd1b71759
mov ebx, 1
mul ecx
shr edx, 9
test bl, dl
jne 0x469267
add ecx, 0x271
mov dword [esp + 0x14], ecx
cmp ecx, esi
jbe 0x46929a
mov eax, dword [0x4d9f40]
test eax, eax
je 0x469287
mov eax, dword [esp + 0x10]
mov dword [0x4d9f40], 0
mov dword [0x4d9f3c], eax
mov eax, dword [0x4d9f3c]
test eax, eax
jne 0x46929a
mov dword [esp + 0x10], ebx
mov dword [0x4d9f3c], ebx
mov edi, ecx
lea ecx, [esp + 0x1c]
mov esi, ebx
call sub.MFC42.DLL_CString::CString_4
push edi
lea ecx, [esp + 0x20]
push str._08ld
push ecx
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x28]
add esp, 0xc
xor ecx, ecx
mov edi, 6
movsx eax, byte [edi + edx]
sub eax, 0x30
shl esi, 4
imul eax, esi
add ecx, eax
dec edi
jns 0x4692cd
movsx edx, byte [edx + 7]
mov dword [esp + 0x30], 0xffffffff
lea esi, [edx + ecx - 0x30]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x14]
push ebx
push ecx
mov dword [eax + 4], esi
call fcn.00499b10
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dl, byte [ecx + 0x20]
mov bl, dl
xor bl, al
mov eax, dword [esp + 0x10]
and bl, 0xf
xor bl, dl
mov byte [ecx + 0x20], bl
mov ecx, 0x14
cdq
idiv ecx
mov esi, dword [ebp + 0xc]
mov di, word [esi + 0xc]
shl edx, 4
fld qword [edx + 0x4bb778]
fmul qword [0x4b4038]
lea ebx, [edx + 0x4bb778]
call sub.MSVCRT.dll__ftol
xor eax, edi
lea ecx, [esp + 0x10]
and eax, 0xfff
xor eax, edi
mov word [esi + 0xc], ax
mov eax, dword [ebp + 0xc]
mov esi, 1
and word [eax + 0xc], 0xdfff
mov eax, dword [ebp + 0xc]
mov dx, word [eax + 0xc]
and edx, 0x3fff
or dh, 0x40
mov word [eax + 0xc], dx
mov edi, dword [esp + 0x14]
call sub.MFC42.DLL_CString::CString_4
push edi
lea eax, [esp + 0x14]
push str._08ld
push eax
mov dword [esp + 0x3c], esi
call sub.MFC42.DLL_CString::Format
mov edi, dword [esp + 0x1c]
add esp, 0xc
xor ecx, ecx
mov edx, 6
movsx eax, byte [edx + edi]
sub eax, 0x30
shl esi, 4
imul eax, esi
add ecx, eax
dec edx
jns 0x4693a9
movsx edx, byte [edi + 7]
mov dword [esp + 0x30], 0xffffffff
lea esi, [edx + ecx - 0x30]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x14]
push 1
push ecx
mov dword [eax + 8], esi
call fcn.00499b10
mov esi, dword [ebp + 0xc]
add esp, 8
shl al, 4
mov dl, byte [esi + 0x20]
and dl, 0xf
or al, dl
mov byte [esi + 0x20], al
mov esi, dword [ebp + 0xc]
fld qword [ebx]
fmul qword [0x4b4038]
mov di, word [esi + 0xe]
call sub.MSVCRT.dll__ftol
xor eax, edi
and eax, 0xfff
xor eax, edi
mov word [esi + 0xe], ax
mov eax, dword [ebp + 0xc]
and word [eax + 0xe], 0xdfff
mov eax, dword [ebp + 0xc]
mov cx, word [eax + 0xe]
and ecx, 0x3fff
or ch, 0x40
mov word [eax + 0xe], cx
mov eax, dword [ebp + 0xc]
mov dl, byte [eax + 0x21]
and dl, 0xf2
or dl, 2
mov byte [eax + 0x21], dl
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 0x21]
and cl, 0xf
or cl, 0x20
mov byte [eax + 0x21], cl
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_4
lea edx, [esp + 0x20]
push 0xe6a
push edx
mov ecx, 0x4dc390
mov dword [esp + 0x38], 2
call fcn.004984a0
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], 3
test eax, eax
mov eax, dword [esp + 0x24]
jne 0x469490
mov eax, dword [esp + 0x3c]
inc eax
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push eax
push str._s__d
push ecx
call sub.MFC42.DLL_CString::Format
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x28]
add ecx, 0x10
xor eax, eax
mov ebx, dword [edx - 8]
add esp, 0x10
mov dword [ecx], eax
push ebx
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov edx, ecx
mov esi, eax
add edi, 0x10
push 0xffffffffffffffff
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [ebp + 0xc]
mov dl, 0xfe
mov byte [eax + 0x22], 0
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 0x23], 1
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 0x24]
and cl, dl
mov byte [eax + 0x24], cl
mov eax, dword [ebp + 0xc]
mov cl, 0xfd
mov bl, byte [eax + 0x24]
and bl, cl
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0xfb
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0xf7
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0xef
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0xdf
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0xbf
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x24]
and bl, 0x7f
mov byte [eax + 0x24], bl
mov eax, dword [ebp + 0xc]
mov bl, byte [eax + 0x25]
and bl, dl
mov byte [eax + 0x25], bl
mov eax, dword [ebp + 0xc]
mov dl, byte [eax + 0x25]
and dl, cl
mov byte [eax + 0x25], dl
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + 0x25]
mov byte [esp + 0x30], 2
or cl, 4
mov byte [eax + 0x25], cl
mov ebp, dword [ebp + 0xc]
lea ecx, [esp + 0x20]
or byte [ebp + 0x25], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8