Function at 0x40b620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c4d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, ecx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x2c], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
call fcn.0040a390
mov ebp, dword [esp + 0x30]
mov cx, word [esp + 0x38]
xor eax, eax
cmp cx, 0xffff
mov ax, word [ebp]
mov dword [esp + 0x18], eax
je 0x40b68b
cmp cx, ax
je 0x40b68b
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
movzx eax, word [ebp + 2]
mov ecx, dword [esp + 0x34]
push edi
push eax
call fcn.00424cb0
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x20], edi
jne 0x40b6bb
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
mov dword [esi + 0x18], edi
mov ecx, dword [edi + 0x210]
cmp ecx, ebx
jne 0x40b6cc
xor eax, eax
jmp 0x40b6d7
mov eax, dword [edi + 0x214]
sub eax, ecx
sar eax, 2
lea ecx, [esi + 0x1c]
push eax
mov dword [esp + 0x14], ecx
call fcn.0040ae80
mov cl, byte [ebp + 4]
mov byte [esi + 0x2c], cl
mov eax, dword [edi + 0x210]
cmp eax, ebx
mov ebp, 5
jne 0x40b6fd
xor edi, edi
jmp 0x40b708
mov edi, dword [edi + 0x214]
sub edi, eax
sar edi, 2
cmp edi, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jle 0x40bb23
or edi, 0xffffffff
jmp 0x40b720
mov esi, dword [esp + 0x14]
cmp esi, ebx
jl case.default.0x40b766
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0x210]
cmp ecx, ebx
jne 0x40b73e
xor eax, eax
jmp 0x40b749
mov eax, dword [edx + 0x214]
sub eax, ecx
sar eax, 2
cmp esi, eax
jge case.default.0x40b766
mov eax, dword [edx + 0x210]
mov edx, dword [eax + esi*4]
mov eax, dword [edx + 4]
cmp eax, 0x11
ja case.default.0x40b766
jmp dword [eax*4 + 0x40bb40]
push 0x10
call fcn.00404c60
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], ebx
je 0x40ba90
mov ecx, eax
call fcn.00422e60
jmp 0x40ba92
push 0x10
call fcn.00404cf0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 1
je 0x40ba90
mov ecx, eax
call fcn.00422f00
jmp 0x40ba92
push 0x10
call fcn.00409310
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 2
je 0x40ba90
mov ecx, eax
call fcn.00422fa0
jmp 0x40ba92
push 0xc
call fcn.004509e6
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 3
je 0x40b80a
mov ecx, eax
call fcn.00423050
jmp 0x40b80c
xor eax, eax
mov ecx, dword [esp + 0x34]
mov esi, eax
movzx eax, bp
mov ax, word [eax + ecx]
cmp ax, word [esp + 0x3c]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], esi
ja case.default.0x40b766
cmp ax, bx
je case.default.0x40b766
jmp 0x40ba9c
push 0x14
call fcn.004509e6
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 4
je 0x40ba90
mov ecx, eax
call fcn.004231f0
jmp 0x40ba92
push 0x18
call fcn.00409850
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 5
je 0x40ba90
mov ecx, eax
call fcn.00409a50
jmp 0x40ba92
push 0x18
call fcn.004098e0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 6
je 0x40ba90
mov ecx, eax
call fcn.00409b90
jmp 0x40ba92
push 0x10
call fcn.004092b0
add esp, 4
cmp eax, ebx
je 0x40b8d8
mov dword [eax + 4], 3
mov dword [eax], 0x485098
jmp 0x40ba96
xor eax, eax
jmp 0x40ba96
push 0x18
call fcn.00409970
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 7
je 0x40ba90
mov ecx, eax
call fcn.00409c80
jmp 0x40ba92
push 0x14
call fcn.00404d80
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 8
je 0x40ba90
mov ecx, eax
call fcn.004239b0
jmp 0x40ba92
push 0x10
call fcn.004509e6
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 9
je 0x40b956
mov ecx, eax
call fcn.004232c0
jmp 0x40b958
xor eax, eax
movzx ecx, word [esp + 0x3c]
mov esi, eax
mov eax, dword [esp + 0x34]
movzx edx, bp
mov eax, dword [edx + eax]
cmp eax, ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], esi
ja case.default.0x40b766
cmp eax, ebx
je case.default.0x40b766
jmp 0x40ba9c
push 0x10
call fcn.004093a0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xa
je 0x40ba90
mov ecx, eax
call fcn.00423470
jmp 0x40ba92
push 0x10
call fcn.00409430
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xb
je 0x40ba90
mov ecx, eax
call fcn.004234f0
jmp 0x40ba92
push 0x10
call fcn.004094c0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xc
je 0x40ba90
mov ecx, eax
call fcn.00423580
jmp 0x40ba92
push 0x10
call fcn.00409550
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xd
je 0x40ba90
mov ecx, eax
call fcn.00423600
jmp 0x40ba92
push 0x18
call fcn.004095e0
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xe
je 0x40ba90
mov ecx, eax
call fcn.00423690
jmp 0x40ba92
push 0x18
call fcn.00409670
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0xf
je 0x40ba90
mov ecx, eax
call fcn.00423720
jmp 0x40ba92
push 0x14
call fcn.00409700
add esp, 4
mov dword [esp + 0x38], eax
cmp eax, ebx
mov dword [esp + 0x2c], 0x10
je 0x40ba90
mov ecx, eax
call fcn.004237a0
jmp 0x40ba92
xor eax, eax
mov dword [esp + 0x2c], edi
mov esi, eax
mov dword [esp + 0x38], esi
mov ecx, dword [esp + 0x34]
mov edx, dword [esi]
movzx eax, bp
add eax, ecx
push eax
mov ecx, esi
call dword [edx + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 4]
add ebp, eax
cmp ecx, ebx
jne 0x40babe
xor edx, edx
jmp 0x40baca
mov edx, dword [esp + 0x10]
mov edx, dword [edx + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x40baef
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x40baef
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
mov dword [eax], esi
add eax, 4
mov dword [ecx + 8], eax
jmp 0x40bb03
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
lea edx, [esp + 0x38]
push edx
push 1
push eax
call fcn.0040b110
cmp bp, word [esp + 0x1c]
ja case.default.0x40b766
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x40b720
cmp bp, word [esp + 0x1c]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
sete al
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc