Function at 0x4e71e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x663c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
xor ebx, ebx
xor ebp, ebp
lea ecx, [esp + 0x78]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x28], ebx
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x20], edi
call fcn.004c50a0
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x9c], edi
mov dword [esp + 0x38], edi
mov eax, dword [ecx + 0x4c]
cmp eax, edi
mov dword [esp + 0x70], eax
jle 0x4e7745
xor ecx, ecx
cmp eax, edi
mov dword [esp + 0x1c], ecx
jle 0x4e760b
mov eax, dword [esi + 0xc]
add eax, 0x48
cmp ecx, edi
jl 0x4e73d5
cmp ecx, dword [eax + 4]
jge 0x4e73d5
mov eax, dword [eax]
mov ebx, dword [eax + ecx*4]
cmp ebx, edi
mov dword [esp + 0x34], ebx
je 0x4e7479
mov eax, dword [esp + 0xa4]
lea ecx, [ebx + 0xc]
push ecx
mov dword [ebx + 0x14], edi
lea edx, [eax + 0x14]
lea ecx, [eax + 0x20]
push edx
lea edx, [eax + 0x18]
push ecx
mov ecx, dword [esi + 8]
add eax, 8
push edx
lea edi, [ebx + 0x10]
push eax
push ebx
push edi
call fcn.004ea530
mov ecx, dword [esi + 8]
push edi
fstp dword [esp + 0x40]
call fcn.004ea4f0
cmp dword [esp + 0x10], eax
jg 0x4e72fe
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 8]
push edi
call fcn.004ea510
cmp ebp, eax
jl 0x4e730d
mov ebp, eax
mov ax, word [ebx]
cmp ax, 0x61
jb 0x4e7320
cmp ax, 0x7a
jbe 0x4e7405
cmp ax, 0x41
jb 0x4e7330
cmp ax, 0x5a
jbe 0x4e7405
cmp ax, 0x2d
je 0x4e7405
cmp ax, 0x27
je 0x4e7405
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
inc ecx
mov dword [esp + 0x30], 0
test eax, eax
mov dword [esp + 0x14], ecx
je 0x4e746a
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x54]
test eax, eax
je 0x4e746a
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4e73f2
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4e73f2
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x7c]
call fcn.004c5340
mov ecx, dword [esi + 8]
push eax
add ecx, 0x34
mov byte [esp + 0xa0], 1
mov edx, dword [ecx]
call dword [edx + 0x18]
test eax, eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x9c], 0
sete bl
call fcn.00499a60
test bl, bl
je 0x4e73ee
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
cmp eax, ecx
jne 0x4e73e0
mov dword [eax + 0x14], 3
jmp 0x4e73ee
mov dword [esp + 0x34], edi
mov ebx, edi
jmp 0x4e7479
mov dword [eax + 0x14], 1
mov dword [ecx + 0x14], 2
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x78]
call fcn.004c50d0
mov dword [esp + 0x20], 0
jmp 0x4e746a
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4e743a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x64], ebp
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x4e746a
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x54]
test eax, eax
je 0x4e746a
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4e745d
mov dword [esp + 0x20], ebx
mov cx, word [ebx]
push ecx
lea ecx, [esp + 0x7c]
call fcn.004c5230
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
inc eax
xor edi, edi
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0xa4]
cmp dword [edx], edi
je 0x4e75e6
fld dword [edx + 4]
fcomp dword [0x675254]
fnstsw ax
test ah, 0x41
jne 0x4e75e6
fld dword [esp + 0x3c]
fadd dword [esp + 0x18]
fcomp dword [edx + 4]
fnstsw ax
test ah, 0x41
jne 0x4e75e6
cmp dword [esp + 0x30], edi
je 0x4e750a
cmp dword [esp + 0x14], 1
je 0x4e750a
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x68]
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa8]
cmp eax, edi
je 0x4e7506
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
call dword [edx + 0x54]
test eax, eax
je 0x4e74ff
lea ecx, [esp + 0x78]
call fcn.004c50d0
mov dword [esp + 0x20], edi
mov edx, dword [esp + 0xa4]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x2c], 1
jne 0x4e751e
mov eax, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x10]
neg ebp
mov dword [esp + 0x2c], ebp
lea eax, [ecx - 1]
fmul dword [edx + 0x14]
fmul dword [0x673cd4]
fstp dword [esp + 0x10]
fild dword [esp + 0x2c]
fmul dword [edx + 0x14]
cmp dword [esp + 0xa8], edi
fmul dword [0x673cd4]
fstp dword [esp + 0x14]
je 0x4e7596
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
sub eax, ecx
mov ecx, dword [esp + 0x18]
inc eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x88]
push ecx
mov ecx, dword [esi + 0xc]
push edx
mov dword [esp + 0x68], eax
call fcn.004e7b40
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
fld dword [esp + 0x10]
fadd dword [eax + 0x24]
fadd dword [esp + 0x28]
fadd dword [esp + 0x14]
fstp dword [esp + 0x28]
fld dword [esp + 0x18]
fcomp dword [esi + 4]
fnstsw ax
test ah, 0x41
jne 0x4e75c0
fld dword [esp + 0x18]
jmp 0x4e75c3
fld dword [esi + 4]
fstp dword [esi + 4]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], edi
xor ebp, ebp
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x30], edi
jmp 0x4e75fb
fld dword [esp + 0x3c]
fadd dword [esp + 0x18]
inc ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ecx
fstp dword [esp + 0x18]
mov eax, dword [esp + 0x70]
cmp ecx, eax
jl 0x4e7294
mov ebx, dword [esp + 0x40]
dec eax
cmp ebx, eax
jg 0x4e77ca
fild dword [esp + 0x10]
mov ecx, dword [esp + 0xa4]
neg ebp
fmul dword [ecx + 0x14]
mov dword [esp + 0x24], ebp
fmul dword [0x673cd4]
fstp dword [esp + 0x10]
fild dword [esp + 0x24]
fmul dword [ecx + 0x14]
cmp dword [esp + 0xa8], edi
fmul dword [0x673cd4]
fstp dword [esp + 0x14]
je 0x4e770a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x4c], eax
sub eax, ebx
inc eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x88]
push ecx
mov ecx, dword [esi + 0xc]
push edx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x68], eax
call fcn.004e7b40
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
call dword [eax + 0x54]
test eax, eax
je 0x4e770a
cmp dword [esp + 0x20], edi
je 0x4e7701
mov ebp, dword [esp + 0x38]
cmp ebp, edi
je 0x4e7701
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x7c]
call fcn.004c5340
mov ecx, dword [esi + 8]
push eax
add ecx, 0x34
mov byte [esp + 0xa0], 2
mov edx, dword [ecx]
call dword [edx + 0x18]
test eax, eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x9c], 0
sete bl
call fcn.00499a60
test bl, bl
je 0x4e7701
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x4e76f3
mov dword [eax + 0x14], 3
jmp 0x4e7701
mov dword [eax + 0x14], 1
mov dword [ebp + 0x14], 2
lea ecx, [esp + 0x78]
call fcn.004c50d0
mov eax, dword [esi + 0xc]
fld dword [esp + 0x10]
fadd dword [eax + 0x24]
fadd dword [esp + 0x28]
fadd dword [esp + 0x14]
fstp dword [esp + 0x28]
fld dword [esp + 0x18]
fcomp dword [esi + 4]
fnstsw ax
test ah, 0x41
jne 0x4e773a
fld dword [esp + 0x18]
fstp dword [esi + 4]
jmp 0x4e77ca
fld dword [esi + 4]
fstp dword [esi + 4]
jmp 0x4e77ca
mov eax, dword [esp + 0xa4]
fild dword [eax + 0xc]
mov edx, dword [eax + 0x10]
neg edx
fmul dword [eax + 0x14]
mov dword [esp + 0x24], edx
fmul dword [0x673cd4]
fstp dword [esp + 0x10]
fild dword [esp + 0x24]
fmul dword [eax + 0x14]
cmp dword [esp + 0xa8], edi
fmul dword [0x673cd4]
fstp dword [esp + 0x14]
je 0x4e77b8
mov edx, dword [esp + 0x14]
or eax, 0xffffffff
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x60], edx
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x44]
lea edx, [esp + 0x88]
push eax
push edx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x60], 0
call fcn.004e7b40
mov eax, dword [esi + 0xc]
fld dword [esp + 0x14]
fadd dword [eax + 0x24]
fadd dword [esp + 0x10]
fstp dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x9c], 0xffffffff
mov dword [esi], ecx
lea ecx, [esp + 0x78]
call fcn.004c50c0
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x90
ret 8