Function at 0x409250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4111a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
add esi, 0x8c
xor ebx, ebx
push 0x418424
mov ecx, esi
mov dword [esp + 0x24], ebx
call fcn.0040ae80
push 1
mov ecx, esi
call fcn.0040aec0
lea eax, [esp + 0x14]
push eax
call fcn.0040c1b0
mov ecx, eax
call fcn.00409540
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.00410076
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0040ff32
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0040ad20
lea edx, [esp + 0x14]
push edx
call fcn.0040c1b0
mov ecx, eax
add ecx, 4
call fcn.004094e0
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x24], 2
call fcn.0040af60
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0040ff32
lea eax, [esp + 0x14]
push eax
call fcn.0040c1b0
mov ecx, eax
add ecx, 4
call fcn.00409500
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x24], 3
call fcn.0040af80
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0040ff32
lea ecx, [esp + 0x14]
push ecx
call fcn.0040c1b0
mov ecx, eax
add ecx, 4
call fcn.00409520
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x24], 4
call fcn.0040afa0
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], bl
call fcn.0040ff32
mov ecx, esi
call fcn.0040b030
call fcn.0040c1b0
add eax, 0x30
mov ecx, eax
call fcn.0040a9a0
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x4093c7
mov edx, dword [eax]
lea ecx, [esp + 0x14]
push ecx
push 0x4189c0
push eax
call dword [edx]
mov edi, eax
cmp edi, ebx
jge 0x4093a2
lea ecx, [esp + 0xc]
call fcn.00409e20
mov dword [esp + 0xc], ebx
jmp 0x4093b5
push ebp
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x10]
call fcn.00409e20
mov dword [esp + 0x10], ebp
pop ebp
cmp edi, ebx
jge 0x4093c7
cmp edi, 0x80004002
je 0x4093c7
push edi
call fcn.004106a0
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], 5
cmp eax, ebx
mov dword [esp + 0xc], ebx
je 0x4093e0
push eax
mov ecx, esi
call fcn.0040b390
push 1
mov ecx, esi
call fcn.0040b000
test eax, eax
jne 0x409424
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], bl
cmp eax, ebx
je 0x4093ff
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040ff32
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
call fcn.0040c3c0
mov ecx, eax
call fcn.0040a550
push eax
call fcn.0040c3c0
mov ecx, eax
call fcn.0040a950
cmp eax, ebx
jle 0x409498
push ebx
push str.NoMsgBox
push ebx
push eax
mov ecx, esi
call fcn.0040b2f0
test eax, eax
jne 0x409498
push 1
mov ecx, esi
call fcn.0040b000
test eax, eax
jne 0x409498
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], bl
cmp eax, ebx
je 0x409473
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040ff32
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], bl
cmp eax, ebx
je 0x4094aa
mov edx, dword [eax]
push eax
call dword [edx + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.0040ff32
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret