Function at 0x428d90
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a7070
mov eax, dword fs:[0]
push eax
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c97a0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x78]
mov ecx, dword [0x4d03a8]
sub ecx, dword [0x4d03a4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
xor edi, edi
push edi
add eax, edx
push edi
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xbb8]
push 0xb
push eax
call esi
mov ecx, dword [ebp + 0xbb8]
push edi
push edi
push 0x184
push ecx
mov dword [ebp + 0xc7c], edi
call esi
lea edx, [esp + 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x60], edx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
push edi
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
call fcn.0048e960
xor ecx, ecx
sub eax, 0x1a5e00
cdq
sbb ecx, edi
push edi
add eax, 0xb6109100
push 0x989680
adc edx, 2
push edx
push eax
mov dword [esp + 0x4c], ecx
call fcn.0048ea10
mov dword [esp + 0x38], eax
mov eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x3c], edx
push ecx
lea edx, [esp + 0x3c]
push edx
sar eax, 0x1f
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
add eax, 0x10
mov dword [esp + 0x24], eax
mov dword [esp + 0x70], edi
movzx eax, word [esp + 0x4e]
push eax
movzx ecx, word [esp + 0x4e]
movzx edx, word [esp + 0x4c]
push ecx
push edx
push 0x4b4544
lea edi, [esp + 0x34]
call fcn.0046afd0
mov eax, dword [0x4d2048]
mov ecx, dword [0x4d2898]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
add esp, 0x10
push eax
push ecx
call edi
lea edx, [esp + 0x40]
push edx
push 4
mov esi, eax
mov eax, dword [0x4d2898]
push str.test
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [0x4d2898]
push esi
push ecx
call edi
mov esi, dword [esp + 0x44]
push 0x4d22ac
call fcn.00470a70
mov ebx, dword [0x4d22bc]
mov ecx, dword [0x4d2898]
mov eax, ebx
sub eax, esi
cdq
sub eax, edx
sar eax, 1
xor edx, edx
cmp esi, 0xe
setne dl
lea edx, [edx + edx - 1]
add eax, edx
mov dword [esp + 0x34], eax
mov eax, dword [0x4d2054]
push eax
push ecx
call edi
lea edx, [esp + 0x40]
push edx
push 4
mov esi, eax
mov eax, dword [0x4d2898]
push str.test
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov ecx, dword [0x4d2898]
push esi
push ecx
call edi
mov eax, ebx
sub eax, dword [esp + 0x44]
push 0x4d2458
cdq
sub eax, edx
mov esi, eax
sar esi, 1
inc esi
mov dword [esp + 0x1c], esi
call fcn.00470a70
mov ecx, dword [ebp + 0xc8]
mov eax, ebx
sub eax, dword [0x4d2468]
mov dword [esp + 0x1c], 0
cdq
sub eax, edx
mov edx, dword [0x4d0d7c]
sar eax, 1
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0xd4]
mov dword [esp + 0x78], edx
add ecx, eax
je 0x42954b
test eax, eax
jne 0x428ff2
lea edx, [esp + 0x2c]
push edx
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x30], 1
call fcn.0043e5e0
mov dword [eax], 1
cmp dword [ebp + 0xc8], 0
jbe 0x42928f
mov eax, dword [0x4ce67c]
mov edx, dword [eax + 0xc]
mov ecx, 0x4ce67c
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x70], 1
mov eax, dword [ebp + 0xd0]
test eax, eax
jbe 0x429067
cmp dword [ebp + 0xcc], 0
jbe 0x4290c1
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x9cea
call fcn.0046c8c0
mov byte [esp + 0x70], 2
mov ecx, dword [ebp + 0xd0]
mov edx, dword [ebp + 0xcc]
mov eax, dword [eax]
push ecx
push edx
push eax
lea edi, [esp + 0x20]
call fcn.0046afd0
add esp, 0xc
jmp 0x4290ef
cmp dword [ebp + 0xcc], 0
jbe 0x4290c1
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x9db9
call fcn.0046c8c0
mov byte [esp + 0x70], 3
mov ecx, dword [ebp + 0xcc]
mov eax, dword [eax]
push ecx
push eax
lea edi, [esp + 0x1c]
call fcn.0046afd0
mov byte [esp + 0x78], 1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4290fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4290fd
test eax, eax
jbe 0x4290fd
lea ecx, [esp + 0x2c]
push ecx
mov ecx, 0x9dba
call fcn.0046c8c0
mov byte [esp + 0x70], 4
mov edx, dword [ebp + 0xd0]
mov eax, dword [eax]
push edx
push eax
lea edi, [esp + 0x1c]
call fcn.0046afd0
add esp, 8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], 1
call fcn.004710f0
mov eax, dword [esp + 0x14]
push esi
push eax
push 0x4d2780
mov ecx, ebp
call fcn.00428710
cmp dword [esp + 0x78], 0
mov dword [esp + 0x28], 0
je 0x429125
mov edi, dword [esp + 0x20]
dec edi
jmp 0x429127
xor edi, edi
cmp dword [esp + 0x78], 0
je 0x429137
xor eax, eax
test edi, edi
setge al
jmp 0x42913f
cmp edi, dword [esp + 0x20]
sbb eax, eax
neg eax
test eax, eax
je 0x42926a
mov esi, 0x4d02a0
call fcn.00466cd0
mov esi, eax
test esi, esi
je 0x4291f5
mov eax, 1
cmp dword [esi + 8], eax
jne 0x4291f5
cmp dword [esi + 0x10], 2
je 0x4291f5
cmp dword [esp + 0x28], 3
jne 0x42919c
cmp dword [ebp + 0xc8], 4
jbe 0x42919c
lea ecx, [esp + 0x2c]
push ecx
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x30], eax
call fcn.0043e5e0
cmp dword [eax], 0
je 0x42920c
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push esi
push ebp
call fcn.00428960
test eax, eax
je 0x4291f1
cmp dword [esp + 0x1c], 0
jne 0x4291f1
cmp dword [esp + 0x78], 0
jne 0x4291f1
lea edx, [esp + 0x2c]
push edx
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x30], 1
call fcn.0043e5e0
cmp dword [eax], 0
je 0x4291f1
lea eax, [ebp + 0xbb8]
call fcn.0045c4e0
dec eax
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x78], 0
mov esi, dword [esp + 0x18]
je 0x429206
dec edi
jmp 0x429127
inc edi
jmp 0x429127
lea esi, [esp + 0x28]
call fcn.0046f080
lea eax, [esp + 0x2c]
mov bl, 5
push eax
mov ecx, 0x9cf1
mov byte [esp + 0x74], bl
call fcn.0046c8c0
mov byte [esp + 0x70], 6
mov eax, dword [eax]
push 0x8030
push eax
mov edi, esi
call fcn.0046afd0
add esp, 8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x70], bl
call fcn.004710f0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
push ecx
push edx
mov esi, ebp
call fcn.00428880
mov ecx, edi
call fcn.004710f0
mov esi, dword [esp + 0x18]
mov byte [esp + 0x70], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42928f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0xd4], 0
jbe 0x42954b
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x70], 7
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x28], ebx
push 0x9ceb
mov byte [esp + 0x74], 8
call fcn.0046c4a0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4292fa
lea edx, [esp + 0x28]
push edx
mov eax, 0x9ceb
call fcn.0046c580
mov ebx, dword [esp + 0x28]
mov byte [esp + 0x70], 9
mov eax, dword [ebp + 0xd4]
push eax
push ebx
lea edi, [esp + 0x34]
call fcn.0046afd0
add ebx, 0xfffffff0
add esp, 8
mov byte [esp + 0x70], 7
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429334
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [esp + 0x2c]
push esi
push eax
push 0x4d2780
mov ecx, ebp
call fcn.00428710
cmp dword [ebp + 0xc8], 0
jne 0x42936d
lea ecx, [esp + 0x28]
push ecx
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x2c], 2
call fcn.0043e5e0
mov dword [eax], 1
mov ecx, dword [esp + 0x78]
xor eax, eax
mov dword [esp + 0x28], eax
cmp ecx, eax
je 0x429386
mov edx, dword [esp + 0x20]
dec edx
mov dword [esp + 0x14], edx
jmp 0x42938a
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x14]
mov ebx, dword [0x4d03a4]
mov eax, edi
imul eax, eax, 0x74
mov dword [esp + 0x18], eax
lea ecx, [ecx]
test ecx, ecx
je 0x4293ad
xor eax, eax
test edi, edi
setge al
jmp 0x4293b5
cmp edi, dword [esp + 0x20]
sbb eax, eax
neg eax
test eax, eax
je 0x429526
mov ecx, dword [0x4d03a8]
sub ecx, ebx
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x429493
mov ecx, dword [esp + 0x18]
lea edi, [ecx + ebx]
test edi, edi
je 0x429493
cmp dword [edi + 8], 1
jne 0x429493
mov eax, 2
cmp dword [edi + 0x10], eax
jne 0x429493
cmp dword [esp + 0x28], 3
jne 0x429434
cmp dword [ebp + 0xd4], 4
jbe 0x429434
lea edx, [esp + 0x38]
push edx
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x3c], eax
call fcn.0043e5e0
cmp dword [eax], 0
je 0x4294bd
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
push edi
push ebp
call fcn.00428960
test eax, eax
je 0x429489
cmp dword [esp + 0x1c], 0
jne 0x429489
cmp dword [esp + 0x78], 0
jne 0x429489
lea eax, [esp + 0x38]
push eax
lea ebx, [ebp + 0xcb0]
mov dword [esp + 0x3c], 2
call fcn.0043e5e0
cmp dword [eax], 0
je 0x429489
lea eax, [ebp + 0xbb8]
call fcn.0045c4e0
dec eax
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ebx, dword [0x4d03a4]
mov ecx, dword [esp + 0x78]
mov edi, dword [esp + 0x14]
test ecx, ecx
je 0x4294ae
dec edi
sub dword [esp + 0x18], 0x74
mov dword [esp + 0x14], edi
jmp 0x4293a0
inc edi
add dword [esp + 0x18], 0x74
mov dword [esp + 0x14], edi
jmp 0x4293a0
mov edx, dword [0x4ce67c]
mov eax, dword [edx + 0xc]
mov ecx, 0x4ce67c
call eax
add eax, 0x10
mov dword [esp + 0x78], eax
lea ecx, [esp + 0x38]
push ecx
mov bl, 0xa
mov ecx, 0x9cf1
mov byte [esp + 0x74], bl
call fcn.0046c8c0
mov byte [esp + 0x70], 0xb
mov eax, dword [eax]
push 0x8037
push eax
lea edi, [esp + 0x80]
call fcn.0046afd0
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], bl
call fcn.004710f0
mov edx, dword [esp + 0x78]
push esi
push edx
mov esi, ebp
call fcn.00428880
mov ecx, edi
call fcn.004710f0
mov byte [esp + 0x70], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42954b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 0xbb8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
lea esi, [ebp + 0xbb8]
push 0xb
push ecx
call edi
cmp dword [0x4cc77c], 0
je 0x429588
mov ebx, dword [esp + 0x1c]
mov edx, dword [esi]
push 0
push ebx
push 0x197
push edx
call edi
mov dword [ebp + 0xd2c], ebx
jmp 0x4295d1
cmp dword [esp + 0x7c], 0
je 0x4295be
cmp dword [0x4d0d7c], 0
je 0x4295a9
mov eax, dword [esi]
push 0
push 0
push 0x18b
push eax
call edi
dec eax
jmp 0x4295ab
xor eax, eax
mov ecx, dword [esi]
push 0
push eax
push 0x197
mov dword [ebp + 0xd2c], eax
push ecx
jmp 0x4295cf
mov eax, dword [ebp + 0xd2c]
mov edx, dword [esi]
push 0
push eax
push 0x197
push edx
call edi
cmp dword [0x4cc77c], 0
je 0x4295f2
mov eax, dword [ebp + 0xc8]
add eax, dword [ebp + 0xd4]
je 0x4295f2
mov dword [0x4cc77c], 0
mov ecx, dword [esi]
push 0x105
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_RedrawWindow]
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42962c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret 8