Function at 0x494380
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4da67e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x164
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x2f8]
xor edi, edi
cmp eax, edi
jne 0x4943cb
xor al, al
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.MFC42.DLL_CCmdTarget::BeginWaitCursor
mov ecx, ebx
call fcn.004941e0
mov eax, dword [ebx + 0x10]
cmp eax, edi
je 0x4943f3
mov ecx, dword [ebx + 0x14]
sub ecx, eax
sar ecx, 2
cmp ecx, 4
jae 0x49440c
xor al, al
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push fcn.004011f0
push fcn.00426a10
push 3
lea edx, [esp + 0x80]
push 0xc
push edx
call fcn.004ce784
mov dword [esp + 0x178], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov eax, dword [ebx + 0x10]
mov byte [esp + 0x178], 1
cmp eax, edi
jne 0x494459
xor esi, esi
jmp 0x494461
mov esi, dword [ebx + 0x14]
sub esi, eax
sar esi, 2
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], esi
cmp eax, edi
mov dword [esp + 0x30], eax
je 0x494958
cmp esi, 4
jl 0x494958
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0xa0]
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0x40], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x40]
lea ecx, [esp + 0x64]
push eax
lea edx, [esp + 0x60]
push ecx
push edx
lea ecx, [esp + 0x104]
call fcn.00405110
push eax
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x180], 2
call fcn.004051b0
mov edi, dword [esp + 0x30]
xor ecx, ecx
fld qword [0x4e00c0]
mov dword [esp + 0x4c], ecx
mov byte [esp + 0x178], 1
mov dword [esp + 0x50], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov ecx, edi
test esi, esi
jle 0x494534
fld qword [esp + 0x54]
fld qword [esp + 0x4c]
mov edx, esi
mov eax, dword [ecx]
add ecx, 4
dec edx
fld dword [eax]
faddp st(3)
fadd dword [eax + 4]
fld dword [eax + 8]
faddp st(2)
jne 0x494518
fstp qword [esp + 0x4c]
fstp qword [esp + 0x54]
fild dword [esp + 0x14]
lea edx, [esp + 0x30]
lea eax, [esp + 0x70]
push edx
lea ecx, [esp + 0x64]
fstp qword [esp + 0x28]
fdiv qword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0x128]
fld qword [esp + 0x58]
fdiv qword [esp + 0x30]
fld qword [esp + 0x60]
fdiv qword [esp + 0x30]
fstp dword [esp + 0x3c]
fstp dword [esp + 0x7c]
fstp dword [esp + 0x6c]
call fcn.00405110
lea edx, [esp + 0x104]
push eax
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x180], 3
call fcn.004051b0
test esi, esi
mov byte [esp + 0x178], 1
mov ecx, edi
jle 0x494657
mov eax, dword [ecx]
add ecx, 4
dec esi
fld dword [eax]
fsub dword [esp + 0x18]
fld st(0)
fmul st(1)
fadd qword [esp + 0x98]
fstp qword [esp + 0x98]
fstp st(0)
fld dword [eax + 4]
fsub dword [esp + 0x1c]
fld st(0)
fmul st(1)
fadd qword [esp + 0xb8]
fstp qword [esp + 0xb8]
fstp st(0)
fld dword [eax + 8]
fsub dword [esp + 0x20]
fld st(0)
fmul st(1)
fadd qword [esp + 0xd8]
fstp qword [esp + 0xd8]
fstp st(0)
fld dword [eax]
fsub dword [esp + 0x18]
fld dword [eax + 4]
fsub dword [esp + 0x1c]
fmulp st(1)
fadd qword [esp + 0xa0]
fstp qword [esp + 0xa0]
fld dword [eax]
fsub dword [esp + 0x18]
fld dword [eax + 8]
fsub dword [esp + 0x20]
fmulp st(1)
fadd qword [esp + 0xa8]
fstp qword [esp + 0xa8]
fld dword [eax + 8]
fsub dword [esp + 0x20]
fld dword [eax + 4]
fsub dword [esp + 0x1c]
fmulp st(1)
fadd qword [esp + 0xc0]
fstp qword [esp + 0xc0]
jne 0x4945a3
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xa8]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0xb4], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xcc], eax
lea eax, [esp + 0x128]
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xc8], edx
mov edx, dword [esp + 0xc4]
push eax
lea ecx, [esp + 0x9c]
push 3
push ecx
mov dword [esp + 0xe0], edx
call fcn.00475860
fstp st(0)
add esp, 0xc
lea edi, [esp + 0x74]
lea esi, [esp + 0x140]
mov dword [esp + 0x14], 3
fld qword [esi + 0x18]
lea edx, [esp + 0x6c]
lea eax, [esp + 0x68]
fstp dword [esp + 0x6c]
fld qword [esi]
push edx
lea ecx, [esp + 0x38]
fstp dword [esp + 0x6c]
fld qword [esi - 0x18]
push eax
push ecx
fstp dword [esp + 0x40]
lea ecx, [esp + 0xf8]
call fcn.00405110
lea edx, [esp + 0x44]
push eax
push edx
mov ecx, edi
mov byte [esp + 0x180], 4
call fcn.004051b0
mov ecx, edi
mov byte [esp + 0x178], 1
call fcn.00405150
mov eax, dword [esp + 0x14]
add esi, 8
add edi, 0xc
dec eax
mov dword [esp + 0x14], eax
jne 0x4946da
fld qword [esp + 0x98]
fdiv qword [esp + 0x24]
mov eax, dword [ebx + 0x10]
xor esi, esi
cmp eax, esi
fsqrt
fstp qword [esp + 0x24]
je 0x49476a
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
lea ecx, [esp + 0xe0]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.00446320
fld dword [esp + 0x74]
fmul dword [esp + 0xe0]
fld dword [esp + 0xe4]
fmul dword [esp + 0x78]
mov byte [esp + 0x178], 5
faddp st(1)
fld dword [esp + 0xe8]
fmul dword [esp + 0x7c]
faddp st(1)
fcomp qword [0x4e00c0]
fnstsw ax
test ah, 0x41
je 0x4947db
lea edx, [esp + 0x34]
lea eax, [esp + 0x74]
push edx
lea ecx, [esp + 0x48]
push eax
push ecx
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xbff00000
call fcn.00405920
add esp, 0xc
lea edx, [esp + 0x74]
lea eax, [esp + 0x44]
push edx
push eax
lea ecx, [esp + 0x88]
call fcn.00417d60
lea ecx, [esp + 0xec]
push eax
push ecx
lea ecx, [esp + 0x94]
mov byte [esp + 0x180], 6
call fcn.004051b0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x178], 5
call fcn.00405150
push 0x60
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, esi
mov byte [esp + 0x178], 7
je 0x494845
mov ecx, eax
call fcn.00417de0
mov esi, eax
lea edx, [esp + 0x18]
lea eax, [esp + 0x44]
push edx
push eax
lea ecx, [esi + 0x30]
mov byte [esp + 0x180], 5
call fcn.004051b0
lea ecx, [esp + 0x74]
lea edx, [esp + 0x44]
push ecx
push edx
lea ecx, [esi + 0x3c]
call fcn.004051b0
lea eax, [esp + 0x80]
lea ecx, [esp + 0x44]
push eax
push ecx
lea ecx, [esi + 0x48]
call fcn.004051b0
lea edx, [esp + 0x8c]
lea eax, [esp + 0x44]
push edx
push eax
lea ecx, [esi + 0x54]
call fcn.004051b0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0xc4]
lea ecx, [esp + 0x12]
dec esp
and al, 0x12
mov eax, dword [ebx + 0x10]
cmp eax, edi
je 0x494971
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
push fcn.004011f0
push 3
lea eax, [esp + 0x7c]
push 0xc
push eax
mov dword [esp + 0x188], 0xffffffff
call fcn.004ce690
mov ecx, dword [esp + 0x170]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4