Function at 0x40d220
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42d605
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], al
call fcn.00408520
mov ebx, dword [esp + 0x34]
mov edi, 1
cmp ebx, 0x7f
mov dword [esp + 0x28], edi
ja 0x40d2b7
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40d283
mov ecx, dword [0x42f350]
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.00409650
jmp 0x40d293
mov edx, edi
push 0
sub edx, eax
lea ecx, [esp + 0x14]
push edx
call fcn.0040ee20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d2ad
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov eax, dword [esp + 0x14]
jmp 0x40d527
mov eax, 0x42f344
jmp 0x40d527
cmp ebx, 0x7ff
ja 0x40d357
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40d2df
mov eax, dword [0x42f350]
lea ecx, [esp + 0x10]
push eax
push 2
call fcn.00409650
jmp 0x40d2f2
mov ecx, 2
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ee20
cmp dword [esp + 0x18], edi
jb 0x40d312
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d312
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d317
mov eax, 0x42f344
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d344
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov eax, dword [esp + 0x14]
shr ebx, 6
and bl, 0x1f
or bl, 0xc0
jmp 0x40d527
shr ebx, 6
and bl, 0x1f
mov eax, 0x42f344
or bl, 0xc0
jmp 0x40d527
cmp ebx, 0xffff
ja 0x40d42d
mov eax, dword [esp + 0x18]
cmp eax, 3
jb 0x40d380
mov edx, dword [0x42f350]
lea ecx, [esp + 0x10]
push edx
push 3
call fcn.00409650
jmp 0x40d393
mov ecx, 3
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ee20
cmp dword [esp + 0x18], 2
jb 0x40d3b4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d3b4
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40d3b9
mov eax, 0x42f344
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40d3e5
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d3e5
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d3ea
mov eax, 0x42f344
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d41a
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov eax, dword [esp + 0x14]
shr ebx, 0xc
and bl, 0xf
or bl, 0xe0
jmp 0x40d527
shr ebx, 0xc
and bl, 0xf
mov eax, 0x42f344
or bl, 0xe0
jmp 0x40d527
cmp ebx, 0x10ffff
ja 0x40d529
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x40d456
mov edx, dword [0x42f350]
lea ecx, [esp + 0x10]
push edx
push 4
call fcn.00409650
jmp 0x40d469
mov ecx, 4
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040ee20
cmp dword [esp + 0x18], 3
jb 0x40d48a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d48a
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 3]
jmp 0x40d48f
mov eax, 0x42f344
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40d4bc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d4bc
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40d4c1
mov eax, 0x42f344
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40d4f0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d4f0
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40d4f5
mov eax, 0x42f344
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40d519
lea ecx, [esp + 0x10]
call fcn.0040eef0
mov eax, dword [esp + 0x14]
jmp 0x40d51e
mov eax, 0x42f344
shr ebx, 0x12
and bl, 7
or bl, 0xf0
mov byte [eax], bl
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004092c0
mov dword [esp + 0xc], edi
push edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.00408520
mov eax, esi
pop edi
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8