Function at 0x4130c0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x45a43b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push ebp
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
xor eax, eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], eax
push ecx
mov dword [esp + 0x20], eax
mov ecx, ebx
mov dword [esp + 0x234], 0
mov word [esp + 0x24], ax
call fcn.00417f30
mov edx, dword [eax]
lea eax, [esp + 0x18]
push edx
push 0x492244
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x28], 0x99
mov byte [esp + 0x29], 7
mov edx, dword [ecx + 0x178]
add ecx, 0x170
push ecx
mov eax, dword [edx - 8]
inc al
shl al, 1
mov byte [esp + 0x2e], al
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x14]
mov eax, dword [eax - 8]
mov byte [esp + 0x30], 0x12
inc al
mov byte [esp + 0x31], 1
shl al, 1
mov byte [esp + 0x2f], al
mov byte [esp + 0x32], 0x10
mov byte [esp + 0x33], 1
mov byte [esp + 0x34], 0
mov byte [esp + 0x35], 0
mov byte [esp + 0x36], 0
mov byte [esp + 0x37], 8
call fcn.004581c0
lea ecx, [esp + 0x10]
push ecx
call fcn.00417ce0
mov edx, dword [ebx + 8]
and eax, 0xffff
add esp, 4
mov byte [esp + 0x34], al
add edx, 0x16c
lea ecx, [esp + 0x10]
shr eax, 8
push edx
mov byte [esp + 0x39], al
call fcn.004581c0
lea eax, [esp + 0x10]
push eax
call fcn.00417ce0
mov cl, byte [ebx + 0x20]
and eax, 0xffff
add esp, 4
mov byte [esp + 0x36], al
shr eax, 8
mov byte [esp + 0x37], al
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], 1
mov esi, dword [ebx + 8]
mov byte [esp + 0x3a], 1
mov byte [esp + 0x3b], 2
mov byte [esp + 0x3c], 0
mov byte [esp + 0x3d], 1
mov edx, dword [esi + 0x178]
xor edi, edi
mov eax, dword [edx - 8]
mov byte [esp + 0x3f], 3
inc al
shl al, 1
mov byte [esp + 0x3e], al
mov ecx, dword [esi + 0x178]
mov eax, 0x18
mov edx, dword [ecx - 8]
test edx, edx
jle 0x41325f
xor edx, edx
mov cl, byte [edx + ecx]
mov byte [esp + eax + 0x28], cl
mov ecx, dword [esi + 0x178]
add eax, 2
inc edi
mov ebp, dword [ecx - 8]
mov edx, edi
and edx, 0xffff
cmp edx, ebp
jl 0x41323f
mov ecx, dword [esi + 0x17c]
xor edi, edi
mov ecx, dword [ecx - 8]
inc cl
shl cl, 1
mov byte [esp + eax + 0x28], cl
inc eax
mov byte [esp + eax + 0x28], 3
mov edx, dword [esi + 0x17c]
inc eax
mov ecx, dword [edx - 8]
test ecx, ecx
jle 0x4132a8
xor ecx, ecx
mov cl, byte [ecx + edx]
mov byte [esp + eax + 0x28], cl
mov edx, dword [esi + 0x17c]
add eax, 2
inc edi
mov ebp, dword [edx - 8]
mov ecx, edi
and ecx, 0xffff
cmp ecx, ebp
jl 0x413288
xor edx, edx
mov edi, 8
mov ecx, dword [esi + 0x180]
cmp edx, dword [ecx - 8]
jge 0x4132c3
mov cl, byte [ecx + edx]
mov byte [esp + eax + 0x28], cl
jmp 0x4132c8
mov byte [esp + eax + 0x28], 0x20
inc eax
inc edx
dec edi
jne 0x4132af
xor edx, edx
mov edi, 0x10
mov ecx, dword [esi + 0x184]
cmp edx, dword [ecx - 8]
jge 0x4132e8
mov cl, byte [ecx + edx]
mov byte [esp + eax + 0x28], cl
jmp 0x4132ed
mov byte [esp + eax + 0x28], 0x20
inc eax
inc edx
dec edi
jne 0x4132d4
lea edx, [esp + 0x18]
mov edi, 4
mov cl, byte [edx]
test cl, cl
jne 0x413308
mov byte [esp + eax + 0x28], 0x20
jmp 0x41330c
mov byte [esp + eax + 0x28], cl
inc eax
inc edx
dec edi
jne 0x4132fb
xor edx, edx
xor edi, edi
test eax, eax
jbe 0x413336
xor ecx, ecx
mov cl, byte [esp + ecx + 0x28]
add ecx, edx
and ecx, 0xff
inc edi
mov edx, ecx
mov ecx, edi
and ecx, 0xffff
cmp ecx, eax
jb 0x41331b
mov byte [esp + eax + 0x28], dl
inc eax
cmp word [ebx + 0x20], 0xbd02
mov byte [esp + eax + 0x28], 0xaa
mov byte [esp + eax + 0x29], 0x55
jb 0x41336d
mov al, byte [esi + 0x3d0]
test al, al
je 0x41336d
inc al
mov dl, 0x32
imul dl
mov byte [esp + 0xa4], al
not al
mov byte [esp + 0xa5], al
mov byte [esp + 0xa6], 0x3c
mov byte [esp + 0xa7], 0xc3
mov al, byte [esi + 0x189]
mov byte [esp + 0xa9], 3
inc al
xor edx, edx
shl al, 1
mov byte [esp + 0xa8], al
mov cl, byte [esi + 0x189]
test cl, cl
mov eax, 0x82
jbe 0x4133d7
mov ebp, dword [ebx + 0x10]
mov edi, dword [ebp - 8]
mov ecx, edx
and ecx, 0xffff
cmp ecx, edi
jge 0x4133c2
mov cl, byte [ecx + ebp]
mov byte [esp + eax + 0x28], cl
jmp 0x4133c7
mov byte [esp + eax + 0x28], 0x20
movzx cx, byte [esi + 0x189]
inc eax
inc eax
inc edx
cmp dx, cx
jb 0x4133aa
mov edi, 0x80
xor edx, edx
cmp eax, edi
jbe 0x4133ff
mov ecx, edi
mov cl, byte [esp + ecx + 0x28]
add ecx, edx
and ecx, 0xff
inc edi
mov edx, ecx
mov ecx, edi
and ecx, 0xffff
cmp ecx, eax
jb 0x4133e4
mov byte [esp + eax + 0x28], dl
mov eax, dword [esi + 0x148]
mov ebp, dword [esi + 0x15c]
shl eax, 0xb
add eax, ebp
mov edx, eax
mov ecx, eax
shr edx, 0x18
mov byte [esp + 0xe8], dl
mov edx, eax
shr ecx, 0x10
shr edx, 8
mov byte [esp + 0xe9], cl
mov byte [esp + 0xea], dl
mov byte [esp + 0xeb], al
mov eax, dword [esi + 0x15c]
mov ecx, eax
mov edx, eax
shr ecx, 0x18
mov byte [esp + 0xec], cl
mov ecx, eax
shr edx, 0x10
shr ecx, 8
mov byte [esp + 0xed], dl
mov byte [esp + 0xee], cl
mov byte [esp + 0xef], al
call dword [sym.imp.MSVCRT.dll_rand]
mov byte [esp + 0xfc], al
mov byte [esp + 0xfd], 0x50
mov byte [esp + 0xfe], 0x51
mov byte [esp + 0xff], 0x49
lea ecx, [esp + 0x1bd]
xor edi, edi
mov eax, dword [ebx + 8]
mov esi, dword [eax + 0x144]
mov eax, edi
cdq
mov ebp, dword [esi - 8]
sub eax, edx
sar eax, 1
cmp ebp, eax
jle 0x4134bd
mov al, byte [esi + eax]
mov byte [ecx - 1], al
jmp 0x4134c1
mov byte [ecx - 1], 0
add edi, 2
mov byte [ecx], 0
add ecx, 2
lea edx, [edi + 0x194]
cmp edx, 0x1d4
jl 0x41349e
lea eax, [esp + 0x28]
push 0xff
push eax
mov ecx, ebx
call fcn.00418150
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x413508
lea ecx, [esp + 4]
push 0x48d780
push ecx
mov dword [esp + 0xc], 0x90000
call sub.MSVCRT.dll__CxxThrowException
lea ecx, [esp]
mov dword [esp + 0x220], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x218]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x224
ret