Function at 0x40fa60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x463e2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x74
mov eax, dword [ecx + 0xc]
push ebx
push esi
push edi
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x30], esi
xor ebx, ebx
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0x14]
mov dword [esp + 0x3c], edx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x34], edx
mov edx, dword [ebp + 0x14]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x40], esi
mov edi, dword [edx + 0xcc]
mov dword [esp + 0x18], ecx
imul edi, dword [ebp + 0xc]
xor esi, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], esi
jmp 0x40fae8
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
push esi
call fcn.0040f8e0
cmp eax, ebx
jge 0x40fca6
mov ecx, 0xfffffffe
mov dword [esp + 0x60], 0
sub ecx, eax
mov dword [esp + 0x64], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
lea eax, [ecx*8]
mov dword [esp + 0x50], 0
sub eax, ecx
mov ecx, dword [ebp + 0x14]
cmp esi, 3
mov dword [esp + 0x54], 0
mov edx, dword [ecx + 0x13c]
lea ecx, [esp + 0x44]
lea edi, [edx + eax*8]
lea eax, [esp + 0x1c]
push eax
push ecx
jge 0x40fb66
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
jmp 0x40fb79
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x48]
push eax
push ecx
push edx
mov ecx, edi
call fcn.0040f910
cmp esi, 5
ja case.default.0x40fb86
jmp dword [esi*4 + 0x40fd08]
mov eax, dword [ebp + 0x10]
fld qword [eax]
jmp 0x40fbaa
mov ecx, dword [ebp + 0x10]
fld qword [ecx + 8]
jmp 0x40fbc3
mov edx, dword [ebp + 0x10]
fld qword [edx + 0x10]
jmp 0x40fbdc
mov eax, dword [ebp + 0x10]
fld qword [eax + 0x18]
fchs
fstp qword [esp + 0x50]
fld qword [edi + 0x20]
fmul qword [esp + 0x1c]
fmul qword [esp + 0x50]
jmp 0x40fbde
mov ecx, dword [ebp + 0x10]
fld qword [ecx + 0x20]
fchs
fstp qword [esp + 0x58]
fld qword [edi + 0x28]
fmul qword [esp + 0x1c]
fmul qword [esp + 0x58]
jmp 0x40fbde
mov edx, dword [ebp + 0x10]
fld qword [edx + 0x28]
fchs
fstp qword [esp + 0x60]
push 0x80
call fcn.00436ca8
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov dword [esp + 0x88], ebx
je 0x40fc0d
mov ecx, eax
call fcn.0040fd20
mov ebx, eax
mov dword [esp + 0xc], ebx
jmp 0x40fc11
mov dword [esp + 0xc], ebx
test ebx, ebx
mov dword [esp + 0x88], 0xffffffff
je 0x40fce3
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0x50]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push 2
push eax
push edi
mov ecx, ebx
call fcn.0040fde0
mov eax, dword [ebp + 0x18]
test eax, eax
jne 0x40fc90
lea ecx, [esp + 0x50]
push eax
push ecx
mov ecx, ebx
call fcn.0040fd90
xor esi, esi
lea ebx, [esp + 0x50]
push esi
mov ecx, edi
call fcn.0040f8e0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 8]
add eax, ecx
inc esi
add ebx, 8
cmp esi, 6
fld qword [edx + eax*8]
fsub qword [ebx - 8]
lea eax, [edx + eax*8]
fstp qword [eax]
jl 0x40fc5b
mov ecx, dword [esp + 0xc]
push 1
mov eax, dword [ecx]
call dword [eax]
mov esi, dword [esp + 0x14]
jmp 0x40fcbe
cmp eax, 1
jne 0x40fcbe
mov ecx, dword [ebp + 0x14]
push ebx
add ecx, 0x144
call fcn.0043560d
jmp 0x40fcbe
cmp dword [ebp + 0x18], ebx
jne 0x40fcbe
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
add eax, edi
fld qword [ecx + esi*8]
fadd qword [edx + eax*8]
lea eax, [edx + eax*8]
fstp qword [eax]
inc esi
cmp esi, 6
mov dword [esp + 0x14], esi
jl 0x40fade
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
push 0
push 0x47f818
call fcn.00442aa3
mov ecx, dword [esp + 0x80]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14