Function at 0x47bd90
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a66bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
mov ecx, 0x7fff
mov eax, 0xffff8001
mov dword [esp + 0x88], 0
mov word [esp + 4], cx
mov word [esp + 6], cx
mov word [esp + 8], ax
mov word [esp + 0xa], ax
mov word [esp + 0xc], cx
mov word [esp + 0xe], cx
mov word [esp + 0x10], ax
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x48]
add eax, 0x5c
mov byte [esp + 0x88], 2
push eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x68], 0
call fcn.00426120
fld dword [esp + 0x98]
mov eax, dword [esp + 0x50]
mov dword [esp], 2
fstp dword [esp + 0x14]
fld dword [esp + 0x9c]
fchs
fstp dword [esp + 0x18]
test eax, eax
je 0x47be42
mov dword [esp + 0x5c], eax
jmp 0x47be47
mov byte [esp + 0x59], 1
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x70], 0
mov ecx, dword [esp + 0x58]
cmp dword [ecx], 0
je 0x47c1c7
cmp eax, dword [esp + 0x6c]
jne 0x47be6f
mov cl, byte [esp + 0x70]
test cl, cl
jne 0x47c1c7
add eax, 0x70
mov dword [esp + 0x3c], eax
mov edx, dword [eax]
mov dword [esp + 0x40], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x47be86
mov ecx, dword [ecx]
jmp 0x47be88
xor ecx, ecx
mov edx, ecx
test edx, edx
mov dword [esp + 0x44], edx
je 0x47be96
mov ecx, dword [edx]
jmp 0x47be98
xor ecx, ecx
test edx, edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], 0
mov byte [esp + 0x4c], 0
mov byte [esp + 0x4d], 0
je 0x47beb8
mov dword [esp + 0x50], edx
jmp 0x47bebd
mov byte [esp + 0x4d], 1
mov byte [esp + 0x54], 0
cmp dword [eax], 0
je 0x47c04c
cmp edx, dword [esp + 0x50]
jne 0x47bedd
mov cl, byte [esp + 0x54]
test cl, cl
jne 0x47c04c
mov ebx, edx
lea esi, [esp + 0x3c]
lea edi, [esp + 0x74]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
jmp 0x47bf06
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
mov eax, dword [eax]
test eax, eax
je 0x47bffe
cmp edx, eax
je 0x47bffe
test edx, edx
jne 0x47bf2e
cmp dword [esp + 0x40], eax
jne 0x47bf2e
mov al, byte [esp + 0x4c]
test al, al
jne 0x47bffe
push 1
lea ecx, [esp + 0x40]
call fcn.00440430
mov ebp, eax
lea ecx, [esp + 0x1c]
mov edx, dword [ebp + 8]
mov dword [esp + 0x1c], edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], eax
call fcn.00402110
mov ecx, dword [esp + 0x20]
test al, al
mov eax, dword [esp + 0x1c]
jne 0x47bf64
mov esi, ecx
sub esi, eax
jmp 0x47bf66
xor esi, esi
mov dx, word [esp + 0x14]
cmp dx, word [esp + 0x1c]
jle 0x47bf78
sub eax, dword [esp + 0x14]
add esi, eax
mov eax, dword [esp + 0x18]
cmp ax, cx
jge 0x47bf85
sub eax, ecx
add esi, eax
lea ecx, [esp + 0x1c]
call fcn.00402110
test al, al
jne 0x47bf9e
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub eax, ecx
jmp 0x47bfa0
xor eax, eax
movsx eax, ax
cdq
movsx edi, si
sub eax, edx
sar eax, 1
cmp edi, eax
jge 0x47bfd6
lea ecx, [esp + 0x14]
call fcn.00402110
test al, al
jne 0x47bfc8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
sub eax, ecx
jmp 0x47bfca
xor eax, eax
movsx eax, ax
cdq
sub eax, edx
sar eax, 1
cmp edi, eax
jl 0x47bffe
push ebp
mov ecx, ebx
call fcn.004273c0
mov eax, dword [ebx + 8]
mov dword [esp + 0x14], eax
mov ecx, dword [ebx + 0xc]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x3c]
call fcn.004403e0
test si, si
jge 0x47befe
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
fld dword [edx + 0x24]
fmul qword [0x4dc658]
lea edx, [esp + 0x40]
fmul qword [0x4dc638]
fstp dword [esp]
push eax
push ecx
lea eax, [esp + 0x80]
push edx
push eax
mov ecx, ebx
call fcn.004273f0
lea ecx, [esp + 0x3c]
call fcn.004403e0
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
jmp 0x47bec2
mov al, byte [esp + 0xb0]
test al, al
je 0x47c1b5
mov al, byte [0x4dc828]
test al, al
je 0x47c1b5
mov ecx, dword [0x4dc33c]
test ecx, ecx
jne 0x47c088
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.0046eee0
mov ecx, dword [0x4dc33c]
add esp, 4
mov edi, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
call dword [edx + 8]
mov ecx, dword [0x4dc33c]
push 1
push 0
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov esi, dword [esp + 0x44]
test esi, esi
je 0x47c0af
mov dword [esp + 0x50], esi
jmp 0x47c0b4
mov byte [esp + 0x4d], 1
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x3c]
cmp dword [ecx], 0
je 0x47c1a3
cmp esi, dword [esp + 0x50]
jne 0x47c0d8
mov al, byte [esp + 0x54]
test al, al
jne 0x47c1a3
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0xac]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], edx
call fcn.004796e0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004796e0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
lea ecx, [esp + 0x3c]
call fcn.004383d0
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov eax, dword [esi + 4]
shr eax, 0x1e
test al, 1
jne 0x47c191
movsx eax, word [esp + 0x1a]
mov ecx, dword [0x4dc33c]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
movsx eax, word [esp + 0x18]
push ecx
mov dword [esp + 0x14], eax
movsx eax, word [esp + 0x1a]
fstp dword [esp]
fild dword [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
movsx eax, word [esp + 0x1c]
fstp dword [esp]
fild dword [esp + 0x18]
mov edx, dword [ecx]
push ecx
mov dword [esp + 0x1c], eax
fstp dword [esp]
fild dword [esp + 0x1c]
push ecx
fstp dword [esp]
call dword [edx + 0x3c]
lea ecx, [esp + 0x3c]
call fcn.004403e0
mov esi, dword [esp + 0x44]
jmp 0x47c0b9
inc edi
cmp edi, 7
mov dword [esp + 0x10], edi
jle 0x47c1b5
mov dword [esp + 0x10], 2
lea ecx, [esp + 0x58]
call fcn.00440e40
mov eax, dword [esp + 0x60]
jmp 0x47be50
mov ecx, dword [esp + 0x90]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8c
ret