Function at 0x401726
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x449b00
push 0xffffffffffffffff
push 0x5266ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebp, ebp
mov dword [esi], 0x529438
mov dword [0x546fcc], 1
mov dword [esi + 0x90], 0x3dcccccd
mov dword [esi + 0x18], ebp
push 0x1f
mov ecx, 0x5538e8
mov dword [esp + 0x1c], ebp
mov dword [0x546fbc], 1
call fcn.004035e4
push 0x20
mov ecx, 0x5538e8
call fcn.004035e4
mov ecx, 0x550f58
call fcn.00403a3f
lea edi, [esi + 0xfc]
mov ecx, 8
or eax, 0xffffffff
mov dword [0x54cd1c], ebp
rep stosd dword es:[edi], eax
mov ecx, 0x54c1a0
call fcn.00403521
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov dword [0x549544], ecx
mov ecx, 0x548e80
mov dword [0x549540], eax
call fcn.00402e32
mov edx, dword [esp + 0x20]
mov ecx, esi
mov dword [0x548ea4], edx
call fcn.004018a2
mov eax, dword [0x546ed0]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fld dword [esi + 0x2c]
fdiv dword [0x52904c]
fsubr dword [esp + 0x2c]
fstp dword [esi + 8]
mov eax, dword [0x546ed4]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fld dword [esi + 0x30]
fdiv dword [0x52904c]
fsubr dword [esp + 0x2c]
fstp dword [esi + 0xc]
mov eax, dword [0x549544]
cmp eax, ebp
je 0x449c3f
cmp eax, 3
je 0x449c3f
push 0x94
call fcn.0050ef5f
mov edi, eax
add esp, 4
mov dword [esp + 0x2c], edi
cmp edi, ebp
mov byte [esp + 0x18], 1
je 0x449c84
fld dword [esi + 0xc]
call fcn.0050ef70
sub eax, 0x26
jmp 0x449c66
push 0x94
call fcn.0050ef5f
mov edi, eax
add esp, 4
mov dword [esp + 0x2c], edi
cmp edi, ebp
mov byte [esp + 0x18], 2
je 0x449c84
fld dword [esi + 0xc]
call fcn.0050ef70
sub eax, 0x60
push eax
push 0x138
push esi
push 2
push 4
push 0x1f
push ebp
push 0x5e
push str.VLESH
mov ecx, edi
call fcn.00402b71
jmp 0x449c86
xor eax, eax
mov dword [esi + 0xf8], eax
mov eax, dword [0x55380c]
cmp eax, ebp
mov byte [esp + 0x18], 0
je 0x449ca5
mov ecx, dword [esi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [esp + 0x24]
sub eax, ebp
je 0x449ccb
dec eax
je 0x449cc6
dec eax
jne 0x449cf1
fild dword [0x546ed0]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fsub dword [esi + 0x2c]
jmp 0x449cee
mov dword [esi + 8], ebp
jmp 0x449cf1
mov eax, dword [0x546ed0]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp dword [esp + 0x2c]
fld dword [esi + 0x2c]
fdiv dword [0x52904c]
fsubr dword [esp + 0x2c]
fstp dword [esi + 8]
mov eax, dword [esp + 0x28]
sub eax, ebp
je 0x449d1d
sub eax, 3
je 0x449d14
dec eax
jne 0x449d3f
fild dword [0x546ed4]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fsub dword [esi + 0x30]
jmp 0x449d3c
mov dword [esi + 0xc], 0x42100000
jmp 0x449d3f
mov eax, dword [0x54958c]
lea ecx, [eax + eax*8]
mov eax, dword [0x546ed4]
shl ecx, 2
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp dword [esi + 0xc]
cmp dword [0x55380c], ebp
je 0x449d7a
cmp dword [0x551de0], ebp
jne 0x449d7a
push 8
call fcn.0050ef5f
add esp, 4
cmp eax, ebp
je 0x449d6c
mov dword [eax + 4], 0x40d
mov dword [eax], 0x529128
jmp 0x449d6e
xor eax, eax
push ebp
push eax
mov ecx, 0x551a28
call fcn.00401dde
cmp dword [0x546f90], ebp
je 0x449d94
push 0x648
push 0x54c4e8
call fcn.0040312f
add esp, 8
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14