Function at 0x4c58bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c5e2a
push dword fs:[eax]
mov dword fs:[eax], esp
fild dword [ebp - 4]
fild dword [ebx + 0xc]
fdivp st(1)
fstp dword [ebp - 0x14]
wait
fild dword [ebx + 0xc]
fild dword [ebp - 4]
fdivp st(1)
fstp dword [ebp - 0x18]
wait
fild dword [ebp - 8]
fild dword [ebx + 8]
fdivp st(1)
fstp dword [ebp - 0x1c]
wait
fild dword [ebx + 8]
fild dword [ebp - 8]
fdivp st(1)
fstp dword [ebp - 0x20]
wait
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov ecx, 2
mov edx, dword [0x4bbf9c]
call fcn.004067f8
add esp, 8
fld dword [ebp - 0x14]
fcomp dword [0x4c5e38]
fnstsw ax
sahf
jbe 0x4c5c34
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4c5d73
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x4c], 0
fld dword [ebp - 0x28]
call fcn.00403000
mov dword [ebp - 0x44], eax
fild dword [ebp - 0x44]
fsubr dword [ebp - 0x28]
fstp dword [ebp - 0x30]
wait
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
dec eax
test eax, eax
jl 0x4c5c0d
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x48], 0
fld dword [ebp - 0x24]
call fcn.00403000
mov dword [ebp - 0x40], eax
fild dword [ebp - 0x40]
fsubr dword [ebp - 0x24]
fstp dword [ebp - 0x2c]
wait
fld dword [ebp - 0x24]
fadd dword [ebp - 0x18]
fstp dword [ebp - 0x24]
wait
mov esi, dword [ebx + 0xc]
dec esi
cmp esi, dword [ebp - 0x40]
jl 0x4c5c01
mov eax, dword [ebx + 8]
dec eax
cmp eax, dword [ebp - 0x44]
jl 0x4c5c01
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 0x40]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x44]
mov al, byte [eax + edx]
mov edx, eax
cmp esi, dword [ebp - 0x40]
jle 0x4c59f1
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi]
mov byte [ebp - 0x61], cl
jmp 0x4c5a08
mov ecx, eax
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x40]
mov esi, dword [esi + edi*4 - 4]
mov edi, dword [ebp - 0x44]
sub cl, byte [esi + edi]
mov byte [ebp - 0x61], cl
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x44]
jle 0x4c5a23
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x40]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x44]
mov al, byte [eax + ecx + 1]
jmp 0x4c5a35
add eax, eax
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x44]
sub al, byte [ecx + esi - 1]
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x40]
jle 0x4c5a60
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x44]
jle 0x4c5a60
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi + 1]
mov byte [ebp - 0x62], cl
jmp 0x4c5ae3
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x40]
jne 0x4c5a9a
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x44]
jle 0x4c5a9a
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi + 1]
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x40]
mov esi, dword [esi + edi*4 - 4]
mov edi, dword [ebp - 0x44]
sub cl, byte [esi + edi + 1]
mov byte [ebp - 0x62], cl
jmp 0x4c5ae3
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x40]
jle 0x4c5ad4
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x44]
jne 0x4c5ad4
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x40]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x44]
mov cl, byte [ecx + esi]
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x40]
mov esi, dword [esi + edi*4 + 4]
mov edi, dword [ebp - 0x44]
sub cl, byte [esi + edi - 1]
mov byte [ebp - 0x62], cl
jmp 0x4c5ae3
xor ecx, ecx
mov cl, al
movzx esi, byte [ebp - 0x61]
add ecx, esi
shr ecx, 1
mov byte [ebp - 0x62], cl
cmp dl, byte [ebp - 0x61]
jne 0x4c5afa
and edx, 0xff
mov dword [ebp - 0x74], edx
fild dword [ebp - 0x74]
fstp dword [ebp - 0x38]
wait
jmp 0x4c5b25
fld dword [0x4c5e38]
fsub dword [ebp - 0x2c]
and edx, 0xff
mov dword [ebp - 0x74], edx
fild dword [ebp - 0x74]
fmulp st(1)
xor edx, edx
mov dl, byte [ebp - 0x61]
mov dword [ebp - 0x78], edx
fild dword [ebp - 0x78]
fmul dword [ebp - 0x2c]
faddp st(1)
fstp dword [ebp - 0x38]
wait
cmp al, byte [ebp - 0x62]
jne 0x4c5b3b
and eax, 0xff
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
fstp dword [ebp - 0x3c]
wait
jmp 0x4c5b65
fld dword [0x4c5e38]
fsub dword [ebp - 0x2c]
and eax, 0xff
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
fmulp st(1)
xor eax, eax
mov al, byte [ebp - 0x62]
mov dword [ebp - 0x78], eax
fild dword [ebp - 0x78]
fmul dword [ebp - 0x2c]
faddp st(1)
fstp dword [ebp - 0x3c]
wait
fld dword [ebp - 0x38]
fcomp dword [0x4c5e3c]
fnstsw ax
sahf
jae 0x4c5b78
xor eax, eax
mov dword [ebp - 0x38], eax
fld dword [ebp - 0x3c]
fcomp dword [0x4c5e3c]
fnstsw ax
sahf
jae 0x4c5b8b
xor eax, eax
mov dword [ebp - 0x3c], eax
fld dword [ebp - 0x38]
fcomp dword [0x4c5e40]
fnstsw ax
sahf
jbe 0x4c5ba0
mov dword [ebp - 0x38], 0x437f0000
fld dword [ebp - 0x3c]
fcomp dword [0x4c5e40]
fnstsw ax
sahf
jbe 0x4c5bb5
mov dword [ebp - 0x3c], 0x437f0000
fld dword [ebp - 0x38]
fcomp dword [ebp - 0x3c]
fnstsw ax
sahf
jne 0x4c5bd9
fld dword [ebp - 0x38]
call fcn.00402ff4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x48]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x4c]
mov byte [edx + ecx], al
jmp 0x4c5c01
fld dword [0x4c5e38]
fsub dword [ebp - 0x30]
fmul dword [ebp - 0x38]
fld dword [ebp - 0x3c]
fmul dword [ebp - 0x30]
faddp st(1)
call fcn.00402ff4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x48]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x4c]
mov byte [edx + ecx], al
inc dword [ebp - 0x48]
dec dword [ebp - 0x6c]
jne 0x4c598d
fld dword [ebp - 0x28]
fadd dword [ebp - 0x20]
fstp dword [ebp - 0x28]
wait
mov eax, dword [0x7a8aec]
mov eax, dword [eax]
call fcn.004b7ac4
inc dword [ebp - 0x4c]
dec dword [ebp - 0x68]
jne 0x4c595c
jmp 0x4c5d73
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4c5d73
inc eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x4c], 0
fld dword [ebp - 0x28]
call fcn.00403000
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
dec eax
test eax, eax
jl 0x4c5d51
inc eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x48], 0
fld dword [ebp - 0x24]
call fcn.00403000
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x34], 0x437f0000
xor eax, eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
fmul dword [ebp - 0x20]
call fcn.00403000
fld dword [ebp - 0x24]
fadd dword [ebp - 0x18]
call fcn.00403000
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
fmul dword [ebp - 0x20]
call fcn.00402ff4
dec eax
pop edx
sub eax, edx
jl 0x4c5d12
inc eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x50], edx
mov edi, dword [ebp - 0x40]
fld dword [ebp - 0x24]
fadd dword [ebp - 0x18]
call fcn.00402ff4
mov esi, eax
dec esi
sub esi, edi
jl 0x4c5d0a
inc esi
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
add edx, edi
mov eax, ebx
call fcn.004c5164
and eax, 0xff
add dword [ebp - 0x54], eax
inc dword [ebp - 0x58]
inc edi
dec esi
jne 0x4c5ce9
inc dword [ebp - 0x50]
dec dword [ebp - 0x70]
jne 0x4c5cd3
cmp dword [ebp - 0x58], 0
je 0x4c5d24
fild dword [ebp - 0x54]
fild dword [ebp - 0x58]
fdivp st(1)
fstp dword [ebp - 0x34]
wait
fld dword [ebp - 0x34]
call fcn.00402ff4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x48]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x4c]
mov byte [edx + ecx], al
fld dword [ebp - 0x24]
fadd dword [ebp - 0x18]
fstp dword [ebp - 0x24]
wait
inc dword [ebp - 0x48]
dec dword [ebp - 0x6c]
jne 0x4c5c77
fld dword [ebp - 0x28]
fadd dword [ebp - 0x20]
fstp dword [ebp - 0x28]
wait
mov eax, dword [0x7a8aec]
mov eax, dword [eax]
call fcn.004b7ac4
inc dword [ebp - 0x4c]
dec dword [ebp - 0x68]
jne 0x4c5c50
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 8], eax
fild dword [ebx + 0x18]
fmul dword [ebp - 0x14]
call fcn.00402ff4
mov dword [ebx + 0x18], eax
fild dword [ebx + 0x1c]
fmul dword [ebp - 0x1c]
call fcn.00402ff4
mov dword [ebx + 0x1c], eax
fild dword [ebx + 0x20]
fmul dword [ebp - 0x14]
call fcn.00402ff4
mov dword [ebx + 0x20], eax
fild dword [ebx + 0x24]
fmul dword [ebp - 0x1c]
call fcn.00402ff4
mov dword [ebx + 0x24], eax
fild dword [ebx + 0x28]
fmul dword [ebp - 0x14]
call fcn.00402ff4
mov dword [ebx + 0x28], eax
fild dword [ebx + 0x2c]
fmul dword [ebp - 0x1c]
call fcn.00402ff4
mov dword [ebx + 0x2c], eax
fild dword [ebx + 0x30]
fmul dword [ebp - 0x14]
call fcn.00402ff4
mov dword [ebx + 0x30], eax
fild dword [ebx + 0x34]
fmul dword [ebp - 0x1c]
call fcn.00402ff4
mov dword [ebx + 0x34], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 0xc]
mov ecx, dword [0x4bbf9c]
call fcn.00406840
lea eax, [ebp - 0xc]
mov edx, dword [0x4bbf9c]
call fcn.00406804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5e31
lea eax, [ebp - 0xc]
mov edx, dword [0x4bbf9c]
call fcn.00406804
ret