Function at 0x49cd08
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x49cd10
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x49d1a9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov eax, dword [0x4beecc]
mov eax, dword [eax]
call fcn.004513b0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00409784
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, 0x49d1c0
call fcn.00404020
mov eax, dword [ebp - 8]
call fcn.00409554
test al, al
jne 0x49cd76
mov ecx, 0x49d1d8
mov dl, 1
mov eax, dword [0x40841c]
call fcn.0040c760
call fcn.004037a0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4597a4]
call fcn.0045984c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49d17f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x24]
push eax
mov ecx, 0x49d1f0
mov edx, 0x49d204
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
fld dword [esi + 0x28]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov ecx, 0x49d214
mov edx, 0x49d204
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x30]
mov eax, dword [esi + 0x2c]
push eax
mov ecx, 0x49d224
mov edx, 0x49d204
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi + 0x34]
push eax
mov ecx, 0x49d238
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov al, byte [esi + 0x50]
push eax
mov ecx, 0x49d260
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov al, byte [esi + 0xb0]
push eax
mov ecx, 0x49d274
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov al, byte [esi + 0x44]
push eax
mov ecx, 0x49d288
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov al, byte [esi + 0x51]
push eax
mov ecx, 0x49d2a0
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi + 0x40]
push eax
mov ecx, 0x49d2b0
mov edx, 0x49d2c4
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [esi + 0x4c]
push dword [esi + 0x48]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0xa]
call fcn.0040a484
movzx eax, word [ebp - 0xa]
push eax
mov ecx, 0x49d2d4
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
movzx eax, word [ebp - 0xc]
push eax
mov ecx, 0x49d2ec
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi + 0xac]
push eax
mov ecx, 0x49d300
mov edx, 0x49d314
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 4]
mov al, byte [esi + 0x30]
sub al, 1
jb 0x49cecf
je 0x49cee5
jmp 0x49cef9
push 0
mov ecx, 0x49d324
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x49cef9
push 1
mov ecx, 0x49d324
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov al, byte [esi + 0x3c]
sub al, 1
jb 0x49cf32
je 0x49cf1c
dec al
jne 0x49cf46
push 0
mov ecx, 0x49d338
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x49cf46
push 1
mov ecx, 0x49d338
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp 0x49cf46
push 2
mov ecx, 0x49d338
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
mov edx, dword [eax]
call dword [edx + 0x14]
push eax
mov ecx, 0x49d350
mov edx, 0x49d360
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x49cfc7
mov eax, dword [esi + 0x54]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jb 0x49cfc7
inc eax
mov word [ebp - 0x12], ax
xor ebx, ebx
lea ecx, [ebp - 0x24]
movzx edx, bx
mov eax, dword [esi + 0x54]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
push eax
lea edx, [ebp - 0x2c]
movzx eax, bx
inc eax
call fcn.00409398
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x49d370
call fcn.00404020
mov ecx, dword [ebp - 0x28]
mov edx, 0x49d360
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
inc ebx
dec word [ebp - 0x12]
jne 0x49cf82
xor ebx, ebx
mov dword [ebp - 0x18], 0x4be914
lea ecx, [ebp - 0x30]
movzx edx, bx
mov eax, dword [esi + 0x38]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
inc ebx
add dword [ebp - 0x18], 4
cmp bx, 7
jne 0x49cfd0
mov eax, dword [esi + 0x60]
push eax
mov ecx, 0x49d380
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ax, word [esi + 0x60]
test ax, ax
jbe 0x49d0df
mov word [ebp - 0x12], ax
mov bx, 1
movzx eax, bx
lea eax, [eax + eax*2]
mov edx, dword [esi + 0x64]
mov eax, dword [edx + eax*4]
push eax
lea edx, [ebp - 0x38]
movzx eax, bx
call fcn.00409398
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x49d398
call fcn.00404020
mov edx, dword [ebp - 0x34]
mov ecx, 0x49d3a8
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, bx
lea eax, [eax + eax*2]
mov edx, dword [esi + 0x64]
mov eax, dword [edx + eax*4 + 4]
push eax
lea edx, [ebp - 0x40]
movzx eax, bx
call fcn.00409398
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0x49d398
call fcn.00404020
mov edx, dword [ebp - 0x3c]
mov ecx, 0x49d3b8
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0xc]
movzx eax, bx
lea eax, [eax + eax*2]
mov edx, dword [esi + 0x64]
mov eax, dword [edx + eax*4 + 8]
push eax
lea edx, [ebp - 0x48]
movzx eax, bx
call fcn.00409398
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 0x49d398
call fcn.00404020
mov edx, dword [ebp - 0x44]
mov ecx, 0x49d3c4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
inc ebx
dec word [ebp - 0x12]
jne 0x49d02a
mov eax, dword [esi + 0xa8]
push eax
mov ecx, 0x49d3d4
mov edx, 0x49d250
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov bx, 1
movzx eax, bx
mov eax, dword [esi + eax*8 + 0x60]
push eax
lea edx, [ebp - 0x50]
movzx eax, bx
call fcn.00409398
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x49d3e4
call fcn.00404020
mov edx, dword [ebp - 0x4c]
mov ecx, 0x49d3f4
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 4]
movzx eax, bx
mov al, byte [esi + eax*8 + 0x64]
push eax
lea edx, [ebp - 0x58]
movzx eax, bx
call fcn.00409398
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x49d3e4
call fcn.00404020
mov edx, dword [ebp - 0x54]
mov ecx, 0x49d408
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x14]
inc ebx
cmp bx, 9
jne 0x49d0fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d186
mov eax, dword [ebp - 4]
call fcn.00403008
ret