Function at 0x40dee0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x2c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x38]
mov dword [ecx], 0
mov ecx, dword [eax]
xor eax, eax
cmp ecx, 2
je 0x40dfeb
cmp ecx, 4
je 0x40e0a9
cmp ecx, 6
jne 0x40e181
mov ecx, dword fs:[0x30]
mov ecx, dword [ecx + 0x38]
cmp dword [ecx + 0xc], 0
je 0x40e181
lea eax, [ecx + 0x1c]
mov dword [esp + 4], eax
lea eax, [ecx - 8]
mov dword [esp + 0xc], eax
sub edx, edx
mov dword [esp], ecx
jmp 0x40df65
mov edx, dword [esp + 8]
add edx, 1
sub eax, eax
mov ecx, dword [esp]
cmp edx, dword [ecx + 0xc]
jae 0x40e181
mov dword [esp + 8], edx
lea esi, [edx + edx*2]
mov edx, dword [esp + 4]
mov eax, dword [edx + esi*8 + 4]
add eax, ecx
mov ecx, dword [edx + esi*8 + 0xc]
shr ecx, 1
push ecx
push dword [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40df50
mov eax, dword [esp + 4]
mov edi, dword [eax + esi*8 + 0x14]
lea ebx, [edi + edi*4]
shl ebx, 2
add ebx, dword [eax + esi*8 + 0x10]
add ebx, dword [esp + 0xc]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edi, 0xffffffff
js 0x40df50
mov ebp, ebx
mov eax, dword [ebx - 4]
mov esi, dword [ebx]
test eax, eax
je 0x40dfde
lea ebx, [ebp - 0x14]
mov ecx, dword [ebp - 8]
add ecx, dword [esp]
shr eax, 1
push eax
push dword [esp + 0x28]
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40dfb0
mov eax, dword [esp]
add eax, esi
add ebp, 4
jmp 0x40e176
mov ecx, dword fs:[0x30]
mov edx, dword [ecx + 0x38]
cmp dword [edx + 4], 0
je 0x40e181
lea eax, [edx + 8]
mov dword [esp + 4], eax
xor ecx, ecx
mov dword [esp], edx
jmp 0x40e022
mov ecx, dword [esp + 8]
add ecx, 1
xor eax, eax
cmp ecx, dword [edx + 4]
jae 0x40e181
mov dword [esp + 8], ecx
lea esi, [ecx + ecx*2]
mov ecx, dword [esp + 4]
mov eax, dword [ecx + esi*4]
add eax, edx
mov ecx, dword [ecx + esi*4 + 4]
shr ecx, 1
push ecx
push dword [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x40e010
mov eax, dword [esp + 4]
mov eax, dword [eax + esi*4 + 8]
mov edi, dword [edx + eax]
mov ebx, edi
shl ebx, 4
add ebx, eax
add ebx, edx
push eax
pop eax
nop
nop
nop
nop
nop
jmp 0x40e06d
push esi
pop esi
nop
add edi, 0xffffffff
js 0x40e010
mov ebp, ebx
mov eax, dword [ebx - 8]
mov esi, dword [ebx - 4]
or eax, eax
je 0x40e0a2
lea ebx, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
add ecx, edx
shr eax, 1
push eax
push dword [esp + 0x28]
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov edx, dword [esp + 0xc]
add esp, 0xc
or eax, eax
jne 0x40e070
add edx, esi
jmp 0x40e174
mov ecx, dword fs:[0x30]
mov edx, dword [ecx + 0x38]
cmp dword [edx + 0xc], 0
je 0x40e181
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
lea eax, [edx + 4]
mov dword [esp + 0xc], eax
sub ecx, ecx
mov dword [esp], edx
jmp 0x40e0f2
mov ecx, dword [esp + 8]
add ecx, 1
xor eax, eax
cmp ecx, dword [edx + 0xc]
jae 0x40e181
mov dword [esp + 8], ecx
lea esi, [ecx + ecx*2]
mov ecx, dword [esp + 4]
mov eax, dword [ecx + esi*8 + 4]
add eax, edx
mov ecx, dword [ecx + esi*8 + 8]
shr ecx, 1
push ecx
push dword [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov edx, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x40e0e0
mov eax, dword [esp + 4]
mov eax, dword [eax + esi*8 + 0x14]
mov edi, dword [edx + eax + 4]
lea ecx, [edi + edi*4]
lea esi, [eax + ecx*4]
add esi, dword [esp + 0xc]
nop
nop
nop
nop
pushal
popal
jmp 0x40e13f
nop
add edi, 0xffffffff
js 0x40e0e0
mov ebp, esi
mov eax, dword [esi - 8]
mov ebx, dword [esi - 4]
test eax, eax
je 0x40e172
lea esi, [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, edx
shr eax, 1
push eax
push dword [esp + 0x28]
push ecx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov edx, dword [esp + 0xc]
add esp, 0xc
or eax, eax
jne 0x40e140
add edx, ebx
push edx
pop eax
mov ecx, dword [ebp]
shr ecx, 1
mov edx, dword [esp + 0x2c]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret