Function at 0x40d850
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ca51e
mov eax, dword fs:[0]
push eax
sub esp, 0xcd4
mov eax, dword [0x53856c]
xor eax, esp
mov dword [esp + 0xcd0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53856c]
xor eax, esp
push eax
lea eax, [esp + 0xce8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xcfc]
mov ebp, dword [esp + 0xcf8]
mov edi, edx
mov dword [esp + 0x24], 0
mov edx, dword [edi]
mov ebx, ecx
mov dword [esp + 0x40], eax
mov eax, dword [edx + 0xc]
mov ecx, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
call eax
cmp byte [ebx + 0x2f28], 0
mov esi, eax
mov dword [esp + 0x2c], esi
je 0x40d8d8
mov ecx, dword [ebx + 0x2f08]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x1c], edx
jmp 0x40d8e5
mov eax, dword [ebx + 0x2f08]
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x2b4]
call fcn.00439140
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2b4]
mov dword [esp + 0xcf0], 0
call fcn.00439300
test esi, esi
je 0x40d981
push 0
push 0
push 0
push 0
push 0
push esi
lea ecx, [esp + 0x5c]
call fcn.004346c0
cmp byte [esp + 0x160], 0
lea eax, [esp + 0x50]
jne 0x40d936
mov eax, dword [esp + 0x4c]
cmp word [eax + 4], 0x2e
lea ecx, [esp + 0x2b4]
jne 0x40d950
lea edx, [esp + 0x44]
push edx
call fcn.004358e0
jmp 0x40d95a
lea eax, [esp + 0x44]
push eax
call fcn.00434d40
cmp byte [esp + 0x160], 0
mov dword [esp + 0x44], 0x51f564
jne 0x40d981
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x50]
cmp eax, ecx
je 0x40d981
push eax
call fcn.004aacc5
add esp, 4
lea ecx, [esp + 0x3dc]
mov dword [esp + 0xcf0], 1
call fcn.00434660
mov byte [esp + 0xcf0], 2
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
mov ecx, edi
call eax
cmp byte [ebx + 0x2f28], 0
mov esi, eax
mov dword [esp + 0x1c], esi
je 0x40d9c7
mov ecx, dword [ebx + 0x2f08]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x24], edx
jmp 0x40d9d4
mov eax, dword [ebx + 0x2f08]
mov ecx, dword [eax + 0x20]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x44]
call fcn.00439140
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x44]
call fcn.00439300
push 0x4df01c
push esi
push ebp
lea ecx, [esp + 0x50]
lea edx, [esp + 0x3e8]
mov byte [esp + 0xcfc], 4
call fcn.00437a10
test al, al
mov byte [esp + 0xcf0], 2
sete byte [esp + 0x17]
cmp byte [esp + 0x160], 0
mov dword [esp + 0x44], 0x51f564
jne 0x40da3f
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x50]
cmp eax, edx
je 0x40da3f
push eax
call fcn.004aacc5
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40dae9
mov ecx, ebp
call fcn.004384d0
mov edi, eax
push 0x4dee6c
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
push esi
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
push 0x4df270
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
add esp, 0x18
cmp byte [esp + 0x4f8], 0
mov esi, 0x51f564
mov dword [esp + 0x3dc], esi
jne 0x40dab6
mov eax, dword [esp + 0x3e4]
lea ecx, [esp + 0x3e8]
cmp eax, ecx
je 0x40dab6
push eax
call fcn.004aacc5
add esp, 4
cmp byte [esp + 0x3d0], 0
mov dword [esp + 0x2b4], esi
jne 0x40dae2
mov eax, dword [esp + 0x2bc]
lea edx, [esp + 0x2c0]
cmp eax, edx
je 0x40dae2
push eax
call fcn.004aacc5
add esp, 4
xor al, al
jmp 0x40e504
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ecx, edi
call edx
cmp byte [ebx + 0x2f28], 0
mov dword [esp + 0x20], eax
je 0x40db0e
mov eax, dword [ebx + 0x2f08]
mov ecx, dword [eax + 0x1c]
mov dword [esp + 0x24], ecx
jmp 0x40db1b
mov edx, dword [ebx + 0x2f08]
mov eax, dword [edx + 0x20]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x62c]
call fcn.00439140
mov byte [esp + 0xcf0], 5
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x62c]
call fcn.00439300
cmp dword [esp + 0x20], 0
je 0x40dbbb
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
push 0
push 0
push ecx
lea ecx, [esp + 0x5c]
call fcn.004346c0
cmp byte [esp + 0x160], 0
lea eax, [esp + 0x50]
jne 0x40db70
mov eax, dword [esp + 0x4c]
cmp word [eax + 4], 0x2e
lea ecx, [esp + 0x62c]
jne 0x40db8a
lea edx, [esp + 0x44]
push edx
call fcn.004358e0
jmp 0x40db94
lea eax, [esp + 0x44]
push eax
call fcn.00434d40
cmp byte [esp + 0x160], 0
mov dword [esp + 0x44], 0x51f564
jne 0x40dbbb
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x50]
cmp eax, ecx
je 0x40dbbb
push eax
call fcn.004aacc5
add esp, 4
lea ecx, [esp + 0x504]
call fcn.00434660
cmp byte [ebx + 0x2f28], 0
je 0x40dbdf
mov edx, dword [ebx + 0x2f08]
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x20], eax
jmp 0x40dbec
mov ecx, dword [ebx + 0x2f08]
mov edx, dword [ecx + 0x20]
mov dword [esp + 0x20], edx
lea ecx, [esp + 0x44]
call fcn.00439140
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x44]
call fcn.00439300
push 0
push esi
push ebp
lea ecx, [esp + 0x50]
lea edx, [esp + 0x510]
mov byte [esp + 0xcfc], 9
call fcn.00437a10
test al, al
mov byte [esp + 0xcf0], 7
sete byte [esp + 0x17]
cmp byte [esp + 0x160], 0
mov dword [esp + 0x44], 0x51f564
jne 0x40dc54
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x50]
cmp eax, ecx
je 0x40dc54
push eax
call fcn.004aacc5
add esp, 4
cmp byte [esp + 0x17], 0
je 0x40dd47
mov ecx, ebp
call fcn.004384d0
mov edi, eax
push 0x4dee6c
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
push esi
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
push 0x4dee74
push case.0x44a944.0
mov edx, edi
call fcn.004397d0
add esp, 0x18
cmp byte [esp + 0x620], 0
mov esi, 0x51f564
mov dword [esp + 0x504], esi
jne 0x40dccb
mov eax, dword [esp + 0x50c]
lea edx, [esp + 0x510]
cmp eax, edx
je 0x40dccb
push eax
call fcn.004aacc5
add esp, 4
lea eax, [esp + 0x62c]
push eax
mov byte [esp + 0xcf4], 2
call fcn.0043a770
cmp byte [esp + 0x4f8], 0
mov dword [esp + 0x3dc], esi
jne 0x40dd0c
mov eax, dword [esp + 0x3e4]
lea ecx, [esp + 0x3e8]
cmp eax, ecx
je 0x40dd0c
push eax
call fcn.004aacc5
add esp, 4
cmp byte [esp + 0x3d0], 0
mov dword [esp + 0x2b4], esi
jne 0x40dae2
mov eax, dword [esp + 0x2bc]
lea edx, [esp + 0x2c0]
cmp eax, edx
je 0x40dae2
push eax
call fcn.004aacc5
add esp, 4
xor al, al
jmp 0x40e504
lea ecx, [esp + 0x754]
call fcn.00439140
cmp byte [esp + 0x748], 0
lea eax, [esp + 0x638]
jne 0x40dd6b
mov eax, dword [esp + 0x634]
add eax, 4
lea edx, [esp + 0x754]
call fcn.00439300
cmp dword [esp + 0x2c], 0
je 0x40ddfb
lea ecx, [esp + 0x44]
call fcn.00439140
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x44]
call fcn.00439300
cmp byte [esp + 0x160], 0
lea eax, [esp + 0x50]
jne 0x40dda9
mov eax, dword [esp + 0x4c]
cmp word [eax + 4], 0x2e
jne 0x40ddc3
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x758]
call fcn.004358e0
jmp 0x40ddd4
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x758]
call fcn.00434d40
cmp byte [esp + 0x160], 0
mov dword [esp + 0x44], 0x51f564
jne 0x40ddfb
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x50]
cmp eax, edx
je 0x40ddfb
push eax
call fcn.004aacc5
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 0x51f6c8
mov dword [esp + 0x3c], eax
xor ecx, ecx
mov dword [esp + 0x87c], 0x51f6ac
mov dword [esp + 0x880], eax
mov dword [esp + 0xa8c], 3
mov word [esp + 0x884], cx
push eax
push ebp
lea ecx, [esp + 0x634]
mov byte [esp + 0xcf8], 0xf
call fcn.004359e0
test al, al
jne 0x40ded7
push 0x4df280
push esi
push 0x4dee6c
mov ecx, ebp
call fcn.00408400
mov ecx, eax
call fcn.00438920
mov ecx, eax
call fcn.00438920
lea ecx, [esp + 0x87c]
call fcn.00434470
lea ecx, [esp + 0x38]
mov byte [esp + 0xcf0], 0xd
call fcn.0040a7d0
lea ecx, [esp + 0x754]
call fcn.00434c50
lea ecx, [esp + 0x504]
call fcn.00434c50
lea edx, [esp + 0x62c]
push edx
mov byte [esp + 0xcf4], 2
call fcn.0043a770
lea ecx, [esp + 0x3dc]
call fcn.00434c50
lea ecx, [esp + 0x2b4]
call fcn.00434c50
xor al, al
jmp 0x40e504
mov edx, edi
lea eax, [esp + 0xa94]
call fcn.00470e10
mov byte [esp + 0xcf0], 0x10
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
mov byte [esp + 0x15], 1
call edx
mov dword [esp + 0x20], eax
push 0
lea eax, [esp + 0x16c]
push eax
call fcn.0043a820
mov byte [esp + 0xcf0], 0x11
cmp dword [ebx], 2
mov byte [esp + 0x1a], 0
jne 0x40df2a
mov byte [esp + 0x16], 0
jmp 0x40e031
push 0x4df294
lea ecx, [esp + 0x194]
call fcn.00439280
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x194]
push ecx
lea edx, [esp + 0x3e4]
mov byte [esp + 0xcf8], 0x12
push edx
add esi, 4
xor ecx, ecx
mov edi, ebp
mov dword [esp + 0x30], 1
call fcn.004275d0
test al, al
jne 0x40df86
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x13d4], 5
je 0x40df86
mov bl, 1
jmp 0x40df88
xor bl, bl
lea ecx, [esp + 0x190]
mov dword [esp + 0xcf0], 0x11
call fcn.00434c50
test bl, bl
je 0x40dfb7
mov ecx, dword [esp + 0x1c]
push 0x4df2b4
push ecx
push 0x4df2ac
jmp 0x40e430
mov byte [esp + 0x28], 0
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x62c]
mov byte [esp + 0xcf0], 0x13
call fcn.00439760
lea ecx, [esp + 0x3dc]
mov ebx, eax
call fcn.00439760
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x16c]
push ecx
mov edi, eax
call fcn.0043aaf0
test al, al
jne 0x40e013
lea ecx, [esp + 0x24]
call fcn.00438520
mov byte [esp + 0x16], 0
mov byte [esp + 0x1a], 1
jmp 0x40e018
mov byte [esp + 0x16], 1
lea ecx, [esp + 0x24]
mov byte [esp + 0xcf0], 0x11
call fcn.00438470
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x3dc]
call fcn.00434f70
test al, al
je 0x40e04f
push 0
lea ecx, [esp + 0x3e0]
call fcn.004353b0
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
lea ecx, [eax + 4]
call fcn.00472280
test al, al
jne 0x40e0c7
push 0x4dee94
push esi
push 0x4dee8c
mov ecx, ebp
call fcn.00408400
mov ecx, eax
call fcn.00438920
mov ecx, eax
call fcn.00438920
push 0
push 0
push ebp
lea ecx, [esp + 0x2c0]
mov byte [esp + 0x21], 0
call fcn.00435480
test al, al
jne 0x40e44a
push 0x4deeb8
push esi
push 0x4deeac
mov ecx, ebp
call fcn.00408400
mov ecx, eax
call fcn.00438920
mov ecx, eax
call fcn.00438920
jmp 0x40e44a
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
push ebp
lea ecx, [eax + 4]
call fcn.004713b0
test al, al
jne 0x40e110
push 0x4deeb8
push esi
push 0x4deec4
mov ecx, ebp
call fcn.00408400
mov ecx, eax
call fcn.00438920
mov ecx, eax
call fcn.00438920
mov ecx, ebp
mov byte [esp + 0x15], 0
call fcn.00438770
mov ecx, ebp
call fcn.00438520
lea ecx, [esp + 0x2b4]
call fcn.00434f70
mov edx, dword [edi]
mov byte [esp + 0x17], al
mov eax, dword [edx]
mov ecx, edi
call eax
push eax
push ebp
lea ecx, [esp + 0x884]
call fcn.00439fe0
test al, al
jne 0x40e14a
push 0x4deedc
push esi
push 0x4deed4
jmp 0x40e430
lea ecx, [esp + 0x87c]
push ecx
push ebp
lea ecx, [esp + 0x40]
call fcn.00439eb0
test al, al
jne 0x40e170
push 0x4deefc
push esi
push 0x4deed4
jmp 0x40e430
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
lea ecx, [esp + 0x2b4]
call fcn.004155f0
test al, al
sete byte [esp + 0x19]
xor ebx, ebx
mov byte [esp + 0x18], bl
cmp byte [esp + 0x16], bl
je 0x40e38e
mov byte [esp + 0x1b], bl
mov byte [esp + 0x16], bl
cmp byte [esp + 0x17], bl
je 0x40e26e
lea edx, [esp + 0x1b]
push edx
lea ecx, [esp + 0x758]
call fcn.00439760
push eax
lea ecx, [esp + 0x2bc]
call fcn.00439760
push eax
lea ecx, [esp + 0x510]
call fcn.00439760
push ebp
lea ecx, [esp + 0x26]
mov edx, eax
call fcn.00471080
test al, al
jne 0x40e22c
mov ecx, ebp
call fcn.00438770
cmp byte [esp + 0x1b], bl
pop esp
and al, 0x1b
lea ecx, [esp + 0x504]
call fcn.00439760
lea ecx, [esp + 0x2b4]
mov edi, eax
call fcn.00439760
push ebp
mov esi, eax
call fcn.00470f90
test al, al
jne 0x40e25b
mov ecx, ebp
call fcn.00438520
jmp 0x40e260
mov byte [esp + 0x18], 1
lea ebx, [esp + 0x504]
cmp byte [esp + 0x17], bl
je 0x40e2ca
lea ebx, [esp + 0x2b4]
jmp 0x40e2ca
mov ecx, dword [esp + 0xce8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xcd0]
xor ecx, esp
call fcn.004aac2b
add esp, 0xce0
ret 8