Function at 0x40a4e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a6230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x61aa74]
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
mov byte [esp + 0x34], 1
call fcn.005864f2
call fcn.00409620
add esp, 8
cmp eax, ebx
je 0x40a82b
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call fcn.005864f2
call fcn.00409620
add esp, 8
cmp eax, ebx
je 0x40a82b
mov eax, dword [esp + 8]
cmp eax, ebx
mov eax, dword [esp + 0x14]
je 0x40a59d
cmp eax, ebx
jne 0x40a5f3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 4
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
mov dword [esp + 0x28], 5
jmp 0x40a84e
cmp eax, ebx
je 0x40a5f3
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 6
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 7
call int.0058677d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.0058677d
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
lea eax, [esp + 0x18]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0040a8a0
add esp, 8
sub eax, ebx
je 0x40a72a
dec eax
je 0x40a6aa
dec eax
je 0x40a647
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.00409860
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00409860
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
mov eax, dword [esp + 8]
mov byte [esp + 0x28], bl
cmp eax, ebx
lea ecx, [esp + 0x14]
je 0x40a67f
call fcn.00409860
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00409860
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
call fcn.00409860
lea ecx, [esp + 8]
mov dword [esp + 0x28], 0xffffffff
call fcn.00409860
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
cmp dword [esp + 8], ebx
je 0x40a702
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 8
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 9
call int.0058677d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.0058677d
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 0xa
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
mov dword [esp + 0x28], 0xb
jmp 0x40a84e
cmp dword [esp + 8], ebx
je 0x40a79d
lea edx, [esp + 0x1c]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.0040aac0
add esp, 8
cmp eax, 1
jne 0x40a806
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 0xc
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xd
call int.0058677d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.0058677d
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.0040aac0
add esp, 8
cmp eax, 2
jne 0x40a806
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 0xe
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xf
call int.0058677d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.0058677d
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 0x10
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
mov dword [esp + 0x28], 0x11
jmp 0x40a84e
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 2
call int.0058677d
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call int.0058677d
mov dword [esp + 0x28], 3
lea ecx, [esp + 0x10]
call int.0058677d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call int.0058677d
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x28
ret