Function at 0x51ad70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x51ad70
push 0xffffffffffffffff
push 0x6b0e7a
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x774458]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x28]
lea ecx, [eax + 0x44]
call fcn.00616ee0
fadd qword [0x6dfc38]
mov edi, dword [esi + 0x28]
fstp dword [esp + 0x20]
fld dword [edi + 8]
fstp dword [esp + 0x24]
fld dword [edi + 0xc]
fstp dword [esp + 0x28]
fld dword [edi + 0x10]
fstp dword [esp + 0x2c]
fld dword [esp + 0x20]
fmul qword [0x6dd478]
fst qword [esp + 0x18]
call fcn.00651ec0
fmul qword [0x6dfc38]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fadd dword [esp + 0x24]
fstp dword [esp + 0x24]
fld qword [esp + 0x18]
call fcn.00651d90
fmul qword [0x6dfc38]
mov eax, dword [esi + 0x1c]
add eax, 8
fstp dword [esp + 0x20]
mov ebx, 1
fld dword [esp + 0x20]
fadd dword [esp + 0x28]
fstp dword [esp + 0x28]
mov ebp, dword [edi + 0x228]
fld dword [esp + 0x24]
shr ebp, 0xc
and ebp, ebx
fsub dword [eax]
fstp dword [esp + 0x18]
fld dword [esp + 0x28]
fsub dword [eax + 4]
fstp dword [esp + 0x20]
fld dword [esp + 0x20]
fld dword [esp + 0x18]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esp + 0x20]
je 0x51ae53
fldz
jmp 0x51aea0
mov edi, dword [edi + 0x208]
mov eax, dword [edi + 0x10]
mov eax, dword [eax]
fld dword [eax + 8]
add eax, 8
fsub dword [edi + 0x24]
fstp dword [esp + 0x14]
fld dword [eax + 4]
fsub dword [edi + 0x28]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fld dword [esp + 0x14]
fmul st(0), st(0)
fld st(1)
fmulp st(2)
faddp st(1)
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
call fcn.00651160
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
fmul qword [0x6de3c8]
fstp dword [esp + 0x14]
fld dword [0x6de024]
fld dword [esp + 0x20]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x51af36
fld dword [esp + 0x14]
fcom qword [0x6dcc38]
fnstsw ax
test ah, 5
jp 0x51aed2
fstp st(0)
fld dword [0x6de5f0]
cmp dword [esi + 0xa0], ebx
fstp dword [esp + 0x18]
je 0x51af29
push str.CORRER
fstp st(0)
lea ecx, [esi + 0xfc]
push 0x6e0544
push ecx
call fcn.00651689
mov edi, 2
mov dword [esi + 0xf8], edi
mov dword [esi + 0xec], ebx
mov eax, dword [esi + 0xe0]
add esp, 0xc
test eax, eax
je 0x51af17
mov dword [eax + 8], ebx
fld dword [esp + 0x20]
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xa0], ebx
jmp 0x51af78
mov edi, 2
mov dword [esi + 0xa0], ebx
jmp 0x51af78
xor ecx, ecx
cmp ebp, ecx
je 0x51af44
fld dword [0x6e0da4]
jmp 0x51af48
fld dword [esp + 0x14]
cmp dword [esi + 0xa0], ecx
fstp dword [esp + 0x18]
je 0x51af6d
mov dword [esi + 0xec], ecx
mov eax, dword [esi + 0xe0]
cmp eax, ecx
je 0x51af67
mov dword [eax + 8], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xa0], ecx
mov edi, 2
fcom qword [0x6eb460]
fnstsw ax
test ah, 5
jnp 0x51b033
fcomp qword [0x6ee4b8]
fnstsw ax
test ah, 5
jp 0x51afb5
mov edx, dword [esi + 0x1c]
mov ecx, dword [edx + 0x208]
call fcn.00405088
fcomp dword [0x6dc058]
fnstsw ax
test ah, 0x44
jnp 0x51b035
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0040b424
mov eax, 4
test byte [0x78001c], al
jne 0x51aff2
or dword [0x78001c], eax
push str.MSGO_MOTOR_SETVEL
mov dword [esp + 0x3c], edi
call fcn.0040cb0d
add esp, 4
mov dword [0x780018], eax
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x208], 0
je 0x51b01f
mov ecx, dword [eax + 0x208]
fld dword [esp + 0x18]
mov eax, dword [esi + 0x20]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [0x780018]
push ecx
fstp dword [esp]
push 0
push eax
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
fstp st(0)
fldz
fcomp dword [esp + 0x14]
fnstsw ax
test ah, 0x44
jp 0x51afb5
mov eax, dword [esi + 0x28]
test dword [eax + 0x228], 0x1000
je 0x51b0a2
mov ebp, 3
cmp dword [esi + 0xa0], ebp
je 0x51b09a
push str.SENTADO
lea ecx, [esi + 0xfc]
push 0x6e0544
push ecx
call fcn.00651689
mov dword [esi + 0xf8], edi
mov dword [esi + 0xec], ebx
mov eax, dword [esi + 0xe0]
add esp, 0xc
test eax, eax
je 0x51b094
mov dword [eax + 8], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xa0], ebp
jmp 0x51b0e8
cmp dword [esi + 0xa0], edi
je 0x51b0e2
push str.SENTADO
lea edx, [esi + 0xfc]
push 0x6e0544
push edx
call fcn.00651689
mov dword [esi + 0xf8], edi
mov dword [esi + 0xec], ebx
mov eax, dword [esi + 0xe0]
add esp, 0xc
test eax, eax
je 0x51b0dc
mov dword [eax + 8], ebx
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xa0], edi
or ebp, 0xffffffff
test byte [0x78001c], bl
jne 0x51b117
or dword [0x78001c], ebx
push str.MSGO_MOTOR_SETANG
mov dword [esp + 0x3c], 0
call fcn.0040cb0d
add esp, 4
mov dword [0x780014], eax
mov dword [esp + 0x38], ebp
mov eax, dword [esi + 0x28]
lea ecx, [eax + 0x44]
call fcn.00616ee0
fstp dword [esp + 0x20]
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x208], 0
mov ecx, dword [esi + 0x20]
je 0x51b156
mov eax, dword [eax + 0x208]
fld dword [esp + 0x20]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push ecx
push ecx
mov ecx, dword [0x780014]
fstp dword [esp]
push 0
push ecx
mov ecx, eax
call edx
test byte [0x78001c], 2
jne 0x51b17f
or dword [0x78001c], edi
push 0x6dd5c0
mov dword [esp + 0x3c], ebx
call fcn.0040cb0d
add esp, 4
mov dword [0x780010], eax
mov dword [esp + 0x38], ebp
mov eax, dword [esi + 0x1c]
cmp dword [eax + 0x208], 0
je 0x51b01f
mov edx, dword [esi + 0x20]
fldz
mov ecx, dword [eax + 0x208]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
mov edx, dword [0x780010]
push ecx
fstp dword [esp]
push 0
push edx
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret