Function at 0x40aa50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42ace5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
push esi
push edi
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], al
call fcn.00405be0
mov ebx, dword [esp + 0x34]
mov edi, 1
cmp ebx, 0x7f
mov dword [esp + 0x28], edi
ja 0x40aae7
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40aab3
mov ecx, dword [0x42c2b8]
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.00406c70
jmp 0x40aac3
mov edx, edi
push 0
sub edx, eax
lea ecx, [esp + 0x14]
push edx
call fcn.0040c650
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40aadd
lea ecx, [esp + 0x10]
call fcn.0040c720
mov eax, dword [esp + 0x14]
jmp 0x40ad57
mov eax, 0x42c2ac
jmp 0x40ad57
cmp ebx, 0x7ff
ja 0x40ab87
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40ab0f
mov eax, dword [0x42c2b8]
lea ecx, [esp + 0x10]
push eax
push 2
call fcn.00406c70
jmp 0x40ab22
mov ecx, 2
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040c650
cmp dword [esp + 0x18], edi
jb 0x40ab42
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ab42
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40ab47
mov eax, 0x42c2ac
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ab74
lea ecx, [esp + 0x10]
call fcn.0040c720
mov eax, dword [esp + 0x14]
shr ebx, 6
and bl, 0x1f
or bl, 0xc0
jmp 0x40ad57
shr ebx, 6
and bl, 0x1f
mov eax, 0x42c2ac
or bl, 0xc0
jmp 0x40ad57
cmp ebx, 0xffff
ja 0x40ac5d
mov eax, dword [esp + 0x18]
cmp eax, 3
jb 0x40abb0
mov edx, dword [0x42c2b8]
lea ecx, [esp + 0x10]
push edx
push 3
call fcn.00406c70
jmp 0x40abc3
mov ecx, 3
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040c650
cmp dword [esp + 0x18], 2
jb 0x40abe4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40abe4
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40abe9
mov eax, 0x42c2ac
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40ac15
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ac15
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40ac1a
mov eax, 0x42c2ac
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ac4a
lea ecx, [esp + 0x10]
call fcn.0040c720
mov eax, dword [esp + 0x14]
shr ebx, 0xc
and bl, 0xf
or bl, 0xe0
jmp 0x40ad57
shr ebx, 0xc
and bl, 0xf
mov eax, 0x42c2ac
or bl, 0xe0
jmp 0x40ad57
cmp ebx, 0x10ffff
ja 0x40ad59
mov eax, dword [esp + 0x18]
cmp eax, 4
jb 0x40ac86
mov edx, dword [0x42c2b8]
lea ecx, [esp + 0x10]
push edx
push 4
call fcn.00406c70
jmp 0x40ac99
mov ecx, 4
push 0
sub ecx, eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040c650
cmp dword [esp + 0x18], 3
jb 0x40acba
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40acba
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 3]
jmp 0x40acbf
mov eax, 0x42c2ac
mov cl, bl
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x40acec
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40acec
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 2]
jmp 0x40acf1
mov eax, 0x42c2ac
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x18]
cmp eax, edi
jb 0x40ad20
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ad20
lea ecx, [esp + 0x10]
call fcn.0040c720
mov edx, dword [esp + 0x14]
lea eax, [edx + 1]
jmp 0x40ad25
mov eax, 0x42c2ac
mov ecx, ebx
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [eax], cl
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ad49
lea ecx, [esp + 0x10]
call fcn.0040c720
mov eax, dword [esp + 0x14]
jmp 0x40ad4e
mov eax, 0x42c2ac
shr ebx, 0x12
and bl, 7
or bl, 0xf0
mov byte [eax], bl
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004068e0
mov dword [esp + 0xc], edi
push edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 0
call fcn.00405be0
mov eax, esi
pop edi
mov ecx, dword [esp + 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8