Function at 0x408600
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x412db2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebp
push esi
xor ebp, ebp
lea eax, [esp + 0x30]
push edi
push 1
mov ecx, eax
mov dword [esp + 0xec], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebp
mov dword [esp + 0x40], ebp
call fcn.00407350
mov ecx, dword [esp + 0x34]
mov dword [ecx], 1
mov dword [esp + 0x3c], 1
lea edx, [esp + 0x48]
mov dword [esp + 0x108], ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x50], ebp
mov eax, dword [esp + 0x118]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x5c]
mov dword [esp + 0x6c], ecx
push eax
mov ecx, edx
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], edx
call fcn.00407870
mov eax, dword [esp + 0x114]
mov ecx, dword [eax + 0x10]
lea edx, [esp + 0x20]
mov dword [esp + 0x30], ecx
push eax
mov ecx, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], edx
call fcn.00407870
lea eax, [esp + 0x70]
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], ebp
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ebp
mov dword [esp + 0x78], ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
lea edx, [esp + 0x84]
mov byte [esp + 0x108], 5
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ebp
mov dword [esp + 0x8c], ebp
cmp dword [esp + 0x30], ebp
mov ecx, dword [esp + 0x2c]
je 0x408741
cmp dword [ecx + 8], ebp
jne 0x408750
lea eax, [esp + 0x84]
push eax
call fcn.00407680
jmp 0x408753
or eax, 0xffffffff
xor ecx, ecx
cmp eax, ebp
setne cl
mov eax, ecx
cmp eax, ebp
je 0x408ad0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0xc8]
push ecx
call fcn.00407f80
lea edx, [esp + 0x7c]
mov edi, eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x84], ebp
mov esi, dword [edi + 8]
add esp, 0xc
cmp esi, ebp
je 0x4087c0
lea esp, [esp]
mov eax, dword [edi + 8]
dec esi
cmp esi, eax
jae 0x4087af
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
jmp 0x4087b1
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x78]
call fcn.004073e0
cmp esi, ebp
jne 0x4087a0
mov eax, dword [esp + 0xc4]
cmp eax, ebp
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x80], ecx
je 0x4087e2
mov edx, dword [esp + 0xc0]
dec eax
mov dword [edx + eax*4], ebp
jne 0x4087d5
mov eax, dword [esp + 0xc0]
cmp eax, ebp
je 0x4087fd
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0xc0], ebp
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.00407ec0
push eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0xac]
push ecx
mov byte [esp + 0x120], 6
call fcn.00407e00
lea edx, [esp + 0x24]
mov edi, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ebp
mov esi, dword [edi + 8]
add esp, 0x18
cmp esi, ebp
je 0x408867
mov eax, dword [edi + 8]
dec esi
cmp esi, eax
jae 0x408856
mov eax, dword [edi]
mov eax, dword [eax + esi*4]
jmp 0x408858
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.004073e0
cmp esi, ebp
jne 0x408847
mov eax, dword [esp + 0x9c]
cmp eax, ebp
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x1c], ecx
je 0x40888d
lea esp, [esp]
mov edx, dword [esp + 0x98]
dec eax
mov dword [edx + eax*4], ebp
jne 0x408880
mov eax, dword [esp + 0x98]
cmp eax, ebp
je 0x4088a8
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0x98], ebp
mov eax, dword [esp + 0xb0]
cmp eax, ebp
je 0x4088c0
mov ecx, dword [esp + 0xac]
dec eax
mov dword [ecx + eax*4], ebp
jne 0x4088b3
mov eax, dword [esp + 0xac]
cmp eax, ebp
je 0x4088db
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0xac], ebp
mov eax, dword [esp + 0x28]
cmp eax, ebp
lea edx, [esp + 0x5c]
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], ebp
mov esi, eax
je 0x408916
jmp 0x4088f7
mov eax, dword [esp + 0x28]
dec esi
cmp esi, eax
jae 0x408905
mov eax, dword [esp + 0x20]
mov eax, dword [eax + esi*4]
jmp 0x408907
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x64]
call fcn.004073e0
cmp esi, ebp
jne 0x4088f3
mov esi, dword [esp + 0x14]
cmp esi, ebp
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x20]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ebp
je 0x408955
mov eax, dword [esp + 0x14]
dec esi
cmp esi, eax
jae 0x408944
mov eax, dword [esp + 0xc]
mov eax, dword [eax + esi*4]
jmp 0x408946
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.004073e0
cmp esi, ebp
jne 0x408932
mov eax, dword [esp + 0x3c]
cmp eax, ebp
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0xc]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebp
mov esi, eax
je 0x40899f
jmp 0x408980
mov eax, dword [esp + 0x3c]
lea esp, [esp]
dec esi
cmp esi, eax
jae 0x40898e
mov eax, dword [esp + 0x34]
mov eax, dword [eax + esi*4]
jmp 0x408990
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.004073e0
cmp esi, ebp
jne 0x408975
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x38]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.00407ec0
push eax
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0xe8]
push eax
mov byte [esp + 0x120], 7
call fcn.00407e00
lea ecx, [esp + 0x4c]
mov edi, eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], ebp
mov esi, dword [edi + 8]
add esp, 0x18
cmp esi, ebp
je 0x408a11
mov eax, dword [edi + 8]
dec esi
cmp esi, eax
jae 0x408a00
mov edx, dword [edi]
mov eax, dword [edx + esi*4]
jmp 0x408a02
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x3c]
call fcn.004073e0
cmp esi, ebp
jne 0x4089f1
mov eax, dword [edi + 0x10]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xd8]
cmp eax, ebp
je 0x408a30
mov ecx, dword [esp + 0xd4]
dec eax
mov dword [ecx + eax*4], ebp
jne 0x408a23
mov eax, dword [esp + 0xd4]
cmp eax, ebp
je 0x408a4b
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0xd4], ebp
mov eax, dword [esp + 0xf0]
cmp eax, ebp
mov byte [esp + 0x108], 5
je 0x408a6d
mov edi, edi
mov edx, dword [esp + 0xec]
dec eax
mov dword [edx + eax*4], ebp
jne 0x408a60
mov eax, dword [esp + 0xec]
cmp eax, ebp
je 0x408a88
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0xec], ebp
lea eax, [esp + 0x48]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x50], ebp
mov esi, eax
je 0x408ac3
jmp 0x408aa4
mov eax, dword [esp + 0x14]
dec esi
cmp esi, eax
jae 0x408ab2
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + esi*4]
jmp 0x408ab4
xor eax, eax
push eax
push esi
lea ecx, [esp + 0x50]
call fcn.004073e0
cmp esi, ebp
jne 0x408aa0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x58], edx
jmp 0x408732
lea eax, [esp + 0x84]
mov ecx, eax
push ecx
lea ecx, [esp + 0x4c]
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebp
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], ebp
mov dword [esp + 0x90], ebp
call fcn.00407ae0
xor edx, edx
test eax, eax
setl dl
mov eax, edx
cmp eax, ebp
je 0x408b24
mov eax, dword [esp + 0x118]
push eax
lea ecx, [esp + 0x4c]
call fcn.00407bd0
mov esi, dword [esp + 0x110]
mov ecx, dword [esp + 0x58]
lea edx, [esp + 0x48]
mov dword [esi + 0x10], ecx
push edx
mov ecx, esi
mov dword [esi + 4], ebp
mov dword [esi], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], esi
call fcn.00407870
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x408b5b
mov ecx, dword [esp + 0xc]
dec eax
mov dword [ecx + eax*4], ebp
jne 0x408b51
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x408b70
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0xc], ebp
mov eax, dword [esp + 0x74]
cmp eax, ebp
je 0x408b82
mov edx, dword [esp + 0x70]
dec eax
mov dword [edx + eax*4], ebp
jne 0x408b78
mov eax, dword [esp + 0x70]
cmp eax, ebp
je 0x408b97
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0x70], ebp
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x408baa
nop
mov ecx, dword [esp + 0x20]
dec eax
mov dword [ecx + eax*4], ebp
jne 0x408ba0
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x408bbf
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x60]
cmp eax, ebp
je 0x408bd1
mov edx, dword [esp + 0x5c]
dec eax
mov dword [edx + eax*4], ebp
jne 0x408bc7
mov eax, dword [esp + 0x5c]
cmp eax, ebp
je 0x408be6
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0x5c], ebp
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x408bfa
mov edi, edi
mov ecx, dword [esp + 0x48]
dec eax
mov dword [ecx + eax*4], ebp
jne 0x408bf0
mov eax, dword [esp + 0x48]
cmp eax, ebp
je 0x408c0f
push eax
call fcn.00409615
add esp, 4
mov dword [esp + 0x48], ebp
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x408c21
mov edx, dword [esp + 0x34]
dec eax
mov dword [edx + eax*4], ebp
jne 0x408c17
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x408c32
push eax
call fcn.00409615
add esp, 4
mov ecx, dword [esp + 0x100]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x100
ret