Function at 0x409910
Capabilities:
Access peb ldr_data
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44c4f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
mov eax, dword [0x460640]
mov edx, dword [esp + 0x6c]
xor eax, esp
push ebx
mov ebx, dword [esp + 0x64]
push ebp
push esi
push edi
push 0xa
push 0x40100000
mov edi, ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x7c]
push 0x3e800000
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x8c]
push 0x3f400000
mov dword [esp + 0x64], ecx
lea ecx, [edi + 0x18]
push 0x11
mov dword [esp + 0x5c], edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x54], eax
mov dword [edi], 0x44f150
call fcn.00408c00
mov dword [esp + 0x68], 0
call fcn.00444ae0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi + 0x48], eax
mov dword [edi + 0x50], 0
mov eax, dword [0x45ecd4]
mov esi, dword [0x45eccc]
cdq
mov ebp, eax
push 2
mov dword [esp + 0x34], edx
mov eax, esi
cdq
push 0xb57eb16
push edx
push eax
mov byte [esp + 0x78], 2
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
call fcn.004319f0
mov ecx, dword [esp + 0x30]
push 2
push 0xb57eb16
push ecx
push ebp
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
push 1
push 0xeae0c6d3
sub ecx, eax
push edx
mov eax, ebp
push eax
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
push 1
push 0x86050f76
add ecx, eax
mov eax, dword [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x20], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [0x45ece8]
imul esi, esi, 0x140cef57
sub ecx, eax
imul edx, edx, 0x6b66a94
mov eax, dword [0x45ecdc]
imul eax, eax, 0x5295f78d
sub ecx, esi
add ecx, edx
mov edx, dword [esp + 0x54]
add ecx, eax
mov dword [str._r_____r____], ecx
mov ecx, dword [esp + 0x50]
lea eax, [edi + 8]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 8], edx
mov dword [eax + 0xc], ecx
mov dword [edi + 4], 1
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov ebp, edx
mov esi, eax
push ebp
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push ebp
push esi
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
add ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [esp + 0x10]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece0]
imul edx, edx, 0x140cef57
shr ecx, 0x1f
add eax, ecx
mov ecx, dword [0x45ece8]
sub eax, edx
imul ecx, ecx, 0x6b66a94
mov edx, dword [0x45ece4]
imul edx, edx, 0x6181b446
sub eax, ecx
mov ecx, dword [str._r_____r____]
add eax, edx
sub eax, ecx
sub eax, 0x4f64023c
mov dword [0x45eccc], eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x5c]
sub esp, 0x10
mov edx, esp
mov dword [edx], ebx
mov dword [edx + 4], eax
mov eax, dword [esp + 0x70]
mov dword [edx + 8], ecx
mov byte [esp + 0x2f], 0
mov dword [edx + 0xc], eax
call fcn.00405a70
mov esi, dword [0x45ecdc]
add esp, 0x18
mov ebp, eax
mov eax, esi
push 1
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ecx, dword [str._r_____r____]
mov edx, dword [0x45ecd8]
add edx, ecx
imul ecx, ecx, 0x151f392d
imul edx, edx, 0x5295f78d
add eax, edx
mov dword [esp + 0x10], eax
mov eax, 0x2a215c6f
mul esi
mov ebx, dword [0x45ece0]
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, dword [esp + 0x10]
shr eax, 0x1f
sub edx, eax
mov eax, esi
imul eax, eax, 0x140cef57
sub edx, eax
sub edx, ecx
test ebp, ebp
lea ecx, [edx + ebx - 0x6181b446]
mov dword [0x45ecd4], ecx
jl 0x40a19d
mov eax, dword [0x45ece4]
mov ebp, dword [0x45eccc]
cdq
mov dword [esp + 0x4c], eax
push 0xfffffffffffffffe
mov dword [esp + 0x54], edx
mov eax, ebp
cdq
push 0xad6a0873
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd0]
mov ecx, dword [esp + 0x50]
add edx, ebp
imul edx, edx, 0x79faf08a
push 2
push 0xb57eb16
sub eax, edx
mov edx, dword [esp + 0x54]
push ecx
push edx
mov dword [esp + 0x20], eax
call fcn.004319f0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x4c]
push 1
add ecx, eax
mov eax, dword [esp + 0x54]
push 0xeae0c6d3
push eax
push edx
mov dword [esp + 0x20], ecx
call fcn.004319f0
imul ebx, ebx, 0x2c857103
imul esi, esi, 0x6181b446
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x24]
sub ecx, ebx
add ecx, esi
lea edx, [esp + 0x44]
push edx
mov dword [0x45ecdc], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x409cfa
mov eax, dword [0x45ecd8]
cdq
mov ebx, eax
mov eax, dword [0x45ece4]
push 0xfffffffffffffffd
mov dword [esp + 0x54], edx
cdq
push 0xf4a814ea
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecc8]
mov esi, dword [str._r_____r____]
mov ebp, eax
mov eax, dword [0x45ecd4]
add ecx, eax
imul ecx, ecx, 0x242d3a05
push 1
mov eax, esi
cdq
push 0xb09bfdc4
push edx
push eax
sub ebp, ecx
call fcn.004319f0
mov edx, dword [esp + 0x50]
push 1
push 0xeae0c6d3
push edx
push ebx
add ebp, eax
call fcn.004319f0
push 1
sub ebp, eax
mov eax, dword [esp + 0x54]
push 0x86050f76
push eax
push ebx
call fcn.004319f0
imul esi, esi, 0x151f392d
sub ebp, eax
mov eax, dword [esp + 0x44]
sub ebp, esi
mov dword [0x45ece4], ebp
cmp dword [eax + 0x28], 4
jne 0x409cef
mov byte [esp + 0x17], 1
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x4c]
mov esi, dword [0x45ecc8]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov ebx, dword [0x45ecd0]
mov ebp, eax
mov eax, dword [0x45ecd8]
lea ecx, [ebx + eax]
imul ecx, ecx, 0x140cef57
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
sub ebp, ecx
mov ecx, dword [0x45ece4]
shr edx, 0x1e
imul ecx, ecx, 0x6181b446
sub ebp, edx
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebx
imul edx, edx, 0x151f392d
shr eax, 0x1f
add ebp, eax
mov al, byte [esp + 0x17]
sub ebp, ecx
add ebp, edx
test al, al
mov dword [0x45ece8], ebp
je 0x40a126
push 1
mov eax, ebx
cdq
push 0xebf310a9
push edx
push eax
mov dword [esp + 0x4c], 0
call fcn.004319f0
mov dword [esp + 0x28], eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
imul esi, esi, 0x397e8324
mov dword [esp + 0x10], eax
mov eax, 0x4d7937c3
mul ebx
mov ecx, edx
mov eax, 0x2a01e433
imul ebx
mov ebx, dword [esp + 0x28]
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add eax, edx
shr ecx, 0x1e
lea edx, [eax + ecx]
add edx, ebx
mov ebx, dword [0x45ece0]
imul edx, edx, 0x6181b446
mov dword [esp + 0x20], ecx
mov ecx, ebx
imul ecx, ecx, 0x52a0a2ae
sub edx, ecx
mov ecx, dword [esp + 0x10]
imul ecx, ecx, 0x6181b447
sub edx, ecx
add edx, eax
mov eax, dword [esp + 0x20]
add esi, edx
mov edx, dword [esp + 0x28]
add esi, eax
add esi, edx
mov eax, ebp
cdq
mov dword [0x45ecc8], esi
mov esi, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [esp + 0x54], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x5c], esi
call fcn.004319f0
mov ecx, eax
mov eax, 0x2a215c6f
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
push 1
shr eax, 0x1f
sub eax, ecx
mov ecx, dword [esp + 0x54]
push 0xebf310a9
push ecx
push esi
mov dword [esp + 0x30], eax
call fcn.004319f0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x50]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, esi
push eax
mov dword [esp + 0x30], ecx
call fcn.004319f0
imul ebp, ebp, 0x6181b446
imul ebx, ebx, 0x242d3a05
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [0x45ecc8]
imul eax, eax, 0x151f392d
sub ecx, ebp
sub ecx, eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
sub ecx, ebx
push 0
mov dword [0x45ecd8], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x40a11a
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
lea edx, [esp + 0x20]
push edx
push 1
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x34]
mov edx, dword [edx]
push edx
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x409fec
cmp dword [esp + 0x20], 1
jb 0x409fec
mov ebx, dword [0x45ece8]
mov eax, ebx
cdq
mov ebp, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [esp + 0x54], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [esp + 0x5c], ebp
call fcn.004319f0
mov esi, dword [0x45ece0]
mov ecx, eax
mov eax, 0x2a215c6f
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
push 1
shr eax, 0x1f
sub eax, ecx
mov ecx, dword [esp + 0x54]
push 0xebf310a9
push ecx
push ebp
mov dword [esp + 0x2c], eax
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x50]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, ebp
push eax
mov dword [esp + 0x2c], ecx
call fcn.004319f0
imul ebx, ebx, 0x6181b446
imul esi, esi, 0x242d3a05
mov edx, dword [0x45ecc8]
mov ecx, dword [esp + 0x1c]
imul edx, edx, 0x151f392d
add ecx, eax
mov eax, dword [esp + 0x10]
sub ecx, ebx
sub ecx, edx
sub ecx, esi
mov dword [0x45ecd8], ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00409850
mov esi, eax
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push edx
lea ecx, [edi + 0x18]
mov byte [esp + 0x6c], 3
call fcn.00409240
push esi
mov ecx, eax
call fcn.00408d90
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x68], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409fe1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [esp + 0x3c]
mov esi, dword [0x45ecd0]
inc edx
push 1
mov dword [esp + 0x40], edx
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebx, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
mov ebp, dword [0x45ece0]
sub ebx, eax
mov eax, 0x4d7937c3
mul esi
shr edx, 0x1e
add ebx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
mov ecx, ebp
imul ecx, ecx, 0x7f4ea4e2
sub ebx, ecx
add ebx, edx
mov eax, 0x2a01e433
imul esi
mov eax, dword [0x45ece8]
sar edx, 0x1c
mov esi, edx
add ebx, edx
cdq
shr esi, 0x1f
add esi, ebx
mov ebx, eax
mov eax, dword [0x45ecd4]
push 1
mov dword [esp + 0x54], edx
cdq
push 0xeae0c6d3
push edx
push eax
mov dword [0x45ecc8], esi
mov dword [esp + 0x5c], ebx
call fcn.004319f0
mov ecx, eax
mov eax, 0x2a215c6f
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
push 1
shr eax, 0x1f
sub eax, ecx
mov ecx, dword [esp + 0x54]
push 0xebf310a9
push ecx
push ebx
mov dword [esp + 0x2c], eax
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x50]
push 2
push 0x6b66a94
sub ecx, eax
push edx
mov eax, ebx
push eax
mov dword [esp + 0x2c], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6181b446
imul esi, esi, 0x151f392d
imul ebp, ebp, 0x242d3a05
sub ecx, eax
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x40]
sub ecx, esi
sub ecx, ebp
push edx
mov dword [0x45ecd8], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
jge 0x409ec1
mov ebx, dword [0x45ecd0]
mov esi, dword [0x45ecc8]
push 1
mov eax, esi
cdq
push 0xeae0c6d3
push edx
push eax
call fcn.004319f0
mov edx, dword [0x45ecd8]
mov ecx, eax
lea eax, [ebx + edx]
imul ebx, ebx, 0x151f392d
imul eax, eax, 0x140cef57
sub ecx, eax
mov eax, 0x4d7937c3
mul dword [str._r_____r____]
shr edx, 0x1e
sub ecx, edx
mov eax, 0x2a215c6f
mul esi
mov eax, dword [0x45ece4]
sub esi, edx
imul eax, eax, 0x6181b446
shr esi, 1
add esi, edx
shr esi, 0x1f
add ecx, esi
sub ecx, eax
mov eax, dword [esp + 0x24]
add ecx, ebx
mov dword [0x45ece8], ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [0x45ecdc]
mov ebx, dword [0x45ece0]
mov eax, dword [0x45ecd4]
cdq
mov ebp, eax
mov eax, dword [0x45eccc]
push 2
mov dword [esp + 0x34], edx
cdq
push 0xb57eb16
push edx
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
call fcn.004319f0
mov edx, dword [esp + 0x30]
push 2
push 0xb57eb16
push edx
push ebp
mov dword [esp + 0x28], eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
push 1
sub ecx, eax
mov eax, dword [esp + 0x34]
push 0xeae0c6d3
push eax
mov edx, ebp
push edx
mov dword [esp + 0x28], ecx
call fcn.004319f0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
push 1
add ecx, eax
mov eax, dword [esp + 0x3c]
push 0x86050f76
push eax
push edx
mov dword [esp + 0x28], ecx
call fcn.004319f0
imul esi, esi, 0x5295f78d
mov ecx, dword [esp + 0x18]
sub ecx, eax
mov eax, dword [0x45eccc]
imul eax, eax, 0x140cef57
sub ecx, eax
mov eax, dword [0x45ece8]
imul eax, eax, 0x6b66a94
add ecx, eax
mov al, byte [esp + 0x17]
add ecx, esi
test al, al
mov dword [str._r_____r____], ecx
jne 0x40a27c
mov ecx, dword [0x453ad0]
mov dword [edi + 8], ecx
mov edx, dword [0x453ad4]
mov dword [edi + 0xc], edx
mov eax, dword [0x453ad8]
mov dword [edi + 0x10], eax
mov ecx, dword [0x453adc]
mov dword [edi + 0x14], ecx
mov ebx, dword [0x45ece0]
mov esi, dword [0x45ecd0]
push 1
mov eax, esi
cdq
push 0xebf310a9
push edx
push eax
call fcn.004319f0
mov ebp, eax
mov eax, dword [0x45ece4]
push 1
cdq
push 0x5295f78d
push edx
push eax
call fcn.004319f0
imul ebx, ebx, 0x7f4ea4e2
sub ebp, eax
mov eax, 0x4d7937c3
mul esi
shr edx, 0x1e
add ebp, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x6181b446
sub ebp, ebx
add ebp, edx
mov eax, 0x2a01e433
imul esi
sar edx, 0x1c
mov eax, edx
shr eax, 0x1f
add ebp, edx
add eax, ebp
mov dword [0x45ecc8], eax
lea eax, [edi + 0x50]
xor ebp, ebp
cmp eax, ebp
je 0x40a30f
mov ecx, dword [esp + 0x40]
cmp ecx, ebp
mov esi, dword [eax]
mov dword [eax], ebp
je 0x40a305
mov edx, dword [ecx]
push eax
push 0x44f3f8
push ecx
call dword [edx]
cmp esi, ebp
je 0x40a30f
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov dword [edi + 0x54], ebp
mov eax, dword [0x45ecd4]
cdq
push 1
push 0xeae0c6d3
mov ebx, edx
mov esi, eax
push ebx
push esi
call fcn.004319f0
push 1
push 0x5295f78d
push ebx
push esi
mov dword [esp + 0x28], eax
call fcn.004319f0
mov ecx, dword [esp + 0x18]
add ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [0x45eccc]
mov eax, 0x2a215c6f
mul ecx
mov eax, dword [esp + 0x18]
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, dword [0x45ece8]
shr ecx, 0x1f
imul edx, edx, 0x6b66a94
add eax, ecx
mov ecx, dword [0x45ece0]
imul ecx, ecx, 0x140cef57
sub eax, ecx
mov ecx, dword [0x45ece4]
imul ecx, ecx, 0x6181b446
sub eax, edx
mov edx, dword [str._r_____r____]
add eax, ecx
sub eax, edx
sub eax, 0x4f64023c
mov dword [0x45eccc], eax
push 2
mov dword [edi + 0x58], ebp
mov dword [edi + 0x5c], ebp
mov eax, dword [0x45ecdc]
cdq
push 0xb57eb16
push edx
push eax
call fcn.004319f0
mov esi, eax
mov eax, dword [0x45ecd0]
push 0xfffffffffffffffe
cdq
push 0x4f64023c
push edx
push eax
call fcn.004319f0
mov ecx, dword [0x45ecd8]
mov edx, dword [0x45ece8]
imul edx, edx, 0x6b66a94
mov ebx, eax
mov eax, ecx
imul eax, eax, 0xb57eb16
sub ebx, esi
add ebx, edx
add ebx, eax
mov eax, 0x2a01e433
imul ecx
sar edx, 0x1c
add ebx, edx
mov ecx, edx
mov edx, dword [0x45ecc8]
imul edx, edx, 0x5295f78d
shr ecx, 0x1f
add ecx, ebx
add ecx, edx
sub ecx, dword [0x45ece4]
sub ecx, 0x6181b446
mov dword [0x45ecd0], ecx
mov ecx, dword [esp + 0x60]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x54]
pop ebp
pop ebx
xor ecx, esp
call fcn.0043180d
add esp, 0x5c
ret 0x14