Function at 0x40cf80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d455
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], al
call fcn.00408280
mov ebx, dword [esp + 0x34]
mov edi, 1
cmp ebx, 0x7f
mov dword [esp + 0x28], edi
ja 0x40d017
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40cfe3
mov ecx, dword [0x42f328]
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.004093b0
jmp 0x40cff3
mov edx, edi
push 0
sub edx, eax
lea ecx, [esp + 0x14]
push edx
call fcn.0040eb80
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d00d
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov eax, dword [esp + 0x14]
jmp 0x40d287
mov eax, 0x42f31c
jmp 0x40d287
cmp ebx, 0x7ff
ja 0x40d0b7
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40d03f
mov eax, dword [0x42f328]
lea ecx, [esp + 0x10]
push eax
push 2
call fcn.004093b0
jmp 0x40d052
mov ecx, 2
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040eb80
cmp dword [esp + 0x18], edi
jb 0x40d072
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d072
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d077
mov eax, 0x42f31c
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d0a4
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov eax, dword [esp + 0x14]
shr ebx, 6
and bl, 0x1f
or bl, 0xc0
jmp 0x40d287
shr ebx, 6
and bl, 0x1f
mov eax, 0x42f31c
or bl, 0xc0
jmp 0x40d287
cmp ebx, 0xffff
ja 0x40d18d
mov eax, dword [esp + 0x18]
cmp eax, 3
jb 0x40d0e0
mov edx, dword [0x42f328]
lea ecx, [esp + 0x10]
push edx
push 3
call fcn.004093b0
jmp 0x40d0f3
mov ecx, 3
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040eb80
cmp dword [esp + 0x18], 2
jb 0x40d114
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d114
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40d119
mov eax, 0x42f31c
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40d145
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d145
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d14a
mov eax, 0x42f31c
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d17a
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov eax, dword [esp + 0x14]
shr ebx, 0xc
and bl, 0xf
or bl, 0xe0
jmp 0x40d287
shr ebx, 0xc
and bl, 0xf
mov eax, 0x42f31c
or bl, 0xe0
jmp 0x40d287
cmp ebx, 0x10ffff
ja 0x40d289
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x40d1b6
mov edx, dword [0x42f328]
lea ecx, [esp + 0x10]
push edx
push 4
call fcn.004093b0
jmp 0x40d1c9
mov ecx, 4
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040eb80
cmp dword [esp + 0x18], 3
jb 0x40d1ea
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d1ea
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 3]
jmp 0x40d1ef
mov eax, 0x42f31c
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40d21c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d21c
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40d221
mov eax, 0x42f31c
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40d250
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d250
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d255
mov eax, 0x42f31c
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d279
lea ecx, [esp + 0x10]
call fcn.0040ec50
mov eax, dword [esp + 0x14]
jmp 0x40d27e
mov eax, 0x42f31c
shr ebx, 0x12
and bl, 7
or bl, 0xf0
mov byte [eax], bl
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00409020
mov dword [esp + 0xc], edi
push edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.00408280
mov eax, esi
pop edi
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8