Function at 0x406da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x489fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4e4394]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
mov eax, dword [0x4e4394]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov dword [esp + 0x30], eax
cmp dword [edi + 0x1d8], eax
je 0x406e19
mov ecx, dword [edi + 0x11c]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], eax
je 0x406e19
push 0xe
mov eax, 0x4b46d0
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1e0], 0
je 0x406e4d
mov eax, dword [edi + 0x124]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x406e4d
push 0x88
mov eax, 0x4b46f0
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1dc], 0
je 0x406e7e
mov edx, dword [edi + 0x120]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x406e7e
push 0x5c
mov eax, 0x4b4808
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1e4], 0
je 0x406eaf
mov ecx, dword [edi + 0x128]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x406eaf
push 0x51
mov eax, 0x4b48c8
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1ec], 0
je 0x406ee0
mov eax, dword [edi + 0x12c]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x406ee0
push 0x48
mov eax, 0x4b4970
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1e8], 0
je 0x406f11
mov edx, dword [edi + 0x130]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x406f11
push 0x45
mov eax, 0x4b4a08
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1f4], 0
je 0x406f42
mov ecx, dword [edi + 0x138]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x406f42
push 0x54
mov eax, 0x4b4a98
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1f0], 0
je 0x406f73
mov eax, dword [edi + 0x134]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x406f73
push 0x54
mov eax, 0x4b4b48
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1f8], 0
je 0x406fa4
mov edx, dword [edi + 0x13c]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x406fa4
push 0x59
mov eax, 0x4b4bf8
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x1fc], 0
je 0x406fd5
mov ecx, dword [edi + 0x140]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x406fd5
push 0x78
mov eax, 0x4b4cb0
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x200], 0
je 0x407006
mov eax, dword [edi + 0x144]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x407006
push 0x58
mov eax, 0x4b4da8
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x204], 0
je 0x40703a
mov edx, dword [edi + 0x148]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x40703a
push 0x8f
mov eax, 0x4b4e60
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x208], 0
je 0x40706e
mov ecx, dword [edi + 0x14c]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x40706e
push 0x83
mov eax, 0x4b4f80
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x210], 0
je 0x40709f
mov eax, dword [edi + 0x150]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x40709f
push 0x4c
mov eax, 0x4b5088
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x214], 0
je 0x4070d0
mov edx, dword [edi + 0x158]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x4070d0
push 0x4a
mov eax, 0x4b5128
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x218], 0
je 0x407101
mov ecx, dword [edi + 0x15c]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407101
push 0x4a
mov eax, 0x4b51c0
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x21c], 0
je 0x407132
mov eax, dword [edi + 0x160]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x407132
push 0x5a
mov eax, 0x4b5258
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x224], 0
je 0x407163
mov edx, dword [edi + 0x168]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407163
push 0x66
mov eax, 0x4b5310
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x22c], 0
je 0x407194
mov ecx, dword [edi + 0x170]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407194
push 0x55
mov eax, 0x4b53e0
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x234], 0
je 0x4071b3
push 0x67
mov eax, 0x4b5490
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x230], 0
je 0x4071e4
mov eax, dword [edi + 0x174]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x4071e4
push 0x59
mov eax, 0x4b5560
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x238], 0
je 0x407215
mov edx, dword [edi + 0x178]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x407215
push 0x45
mov eax, 0x4b5618
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x228], 0
je 0x407246
mov ecx, dword [edi + 0x16c]
mov edx, dword [ecx + 0x94]
cmp dword [edx + 4], 0
je 0x407246
push 0x70
mov eax, 0x4b56a8
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x220], 0
je 0x407277
mov eax, dword [edi + 0x164]
mov ecx, dword [eax + 0x94]
cmp dword [ecx + 4], 0
je 0x407277
push 0x3f
mov eax, 0x4b5790
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [edi + 0x20c], 0
je 0x4072a8
mov edx, dword [edi + 0x154]
mov eax, dword [edx + 0x94]
cmp dword [eax + 4], 0
je 0x4072a8
push 0x6a
mov eax, 0x4b5810
lea esi, [esp + 0xc]
call fcn.0040bf50
push edi
call fcn.00408830
cmp dword [esp + 0x20], 8
jb 0x4072bc
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00475571
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0047557c
add esp, 0x2c
ret