Function at 0x40ab80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4788f0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push esi
push edi
mov eax, dword [0x498550]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov ebx, ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x50], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x4c], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x48], ecx
movzx ecx, byte [eax + 0x10]
mov dword [ebp - 0x44], edx
mov edx, dword [eax + 0x14]
mov byte [ebp - 0x40], cl
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3c], edx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x38], ecx
movzx ecx, byte [eax + 0x20]
mov dword [ebp - 0x34], edx
mov edx, dword [eax + 0x24]
mov byte [ebp - 0x30], cl
mov ecx, dword [eax + 0x28]
mov dword [ebp - 0x2c], edx
mov dl, byte [eax + 0x2c]
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 0x30]
mov byte [ebp - 0x24], dl
mov edx, dword [eax + 0x34]
mov al, byte [eax + 0x38]
mov byte [ebp - 0x18], al
mov eax, dword [ebx + 4]
test eax, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
jne 0x40ac16
xor edi, edi
jmp 0x40ac2e
mov ecx, dword [ebx + 0xc]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
mov esi, dword [ebp + 8]
test esi, esi
je 0x40ae80
mov eax, dword [ebx + 4]
test eax, eax
je 0x40ac58
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, 0x4444444
sub ecx, eax
cmp ecx, esi
jae 0x40ac68
call fcn.0042ea20
mov eax, dword [ebx + 4]
test eax, eax
je 0x40ac87
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
cmp edi, eax
jae 0x40add5
mov eax, edi
shr eax, 1
mov edx, 0x4444444
sub edx, eax
cmp edx, edi
jae 0x40aca4
xor edi, edi
jmp 0x40aca6
add edi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x40acc5
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add eax, esi
cmp edi, eax
jae 0x40acd6
mov ecx, ebx
call fcn.0040a040
mov edi, eax
add edi, esi
test edi, edi
ja 0x40ace6
push 0
call fcn.0043f81a
add esp, 4
jmp 0x40aced
mov ecx, edi
call fcn.0040a530
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 4]
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov byte [ebp + 0xc], 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
call fcn.0040a8e0
mov edx, eax
mov eax, dword [ebp + 8]
add esp, 0xc
mov byte [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
push ecx
push eax
lea eax, [ebp - 0x50]
mov ecx, esi
mov dword [ebp - 0x14], edx
call fcn.0040b930
mov edx, dword [ebp - 0x14]
mov ecx, esi
shl ecx, 4
sub ecx, esi
lea eax, [edx + ecx*4]
mov ecx, dword [ebx + 8]
add esp, 8
mov byte [ebp + 0xc], 0
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.0040a8e0
mov eax, dword [ebx + 4]
add esp, 0xc
test eax, eax
je 0x40ad7a
mov ecx, dword [ebx + 8]
sub ecx, eax
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x40ad8c
push eax
call fcn.0043f84a
add esp, 4
mov eax, dword [ebp + 8]
mov ecx, edi
shl ecx, 4
sub ecx, edi
lea edx, [eax + ecx*4]
mov ecx, esi
shl ecx, 4
sub ecx, esi
mov dword [ebx + 0xc], edx
lea edx, [eax + ecx*4]
mov dword [ebx + 8], edx
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebx + 8]
mov ecx, edi
sub ecx, dword [ebp + 0x14]
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, esi
mov edx, edi
jae 0x40ae4d
mov ecx, dword [ebp + 0x14]
mov eax, esi
shl eax, 4
sub eax, esi
add eax, eax
add eax, eax
mov dword [ebp + 8], eax
add eax, ecx
push eax
push ecx
call fcn.0040b040
mov dword [ebp - 4], 2
mov edi, dword [ebx + 8]
mov ecx, edi
sub ecx, dword [ebp + 0x14]
lea edx, [ebp - 0x50]
push edx
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
sub esi, eax
call fcn.0040ab50
mov eax, dword [ebp + 8]
add dword [ebx + 8], eax
mov edi, dword [ebx + 8]
mov ecx, dword [ebp + 0x14]
sub edi, eax
jmp 0x40ae78
shl esi, 4
sub esi, dword [ebp + 8]
mov eax, edi
add esi, esi
add esi, esi
sub eax, esi
push edi
push eax
mov dword [ebp + 8], eax
call fcn.0040b040
mov dword [ebx + 8], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
call fcn.0040b070
mov ecx, ebx
lea edi, [esi + ecx]
lea eax, [ebp - 0x50]
call fcn.0040b9b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10