Function at 0x874b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x9b1e9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8e4
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x2c]
call fcn.00911f0c
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x8f8], esi
call fcn.00911f0c
push esi
lea ecx, [esp + 0x34]
mov byte [esp + 0x8fc], 1
call fcn.00735050
mov ecx, ebx
mov byte [esp + 0x8f8], 2
mov dword [esp + 0xc], esi
call fcn.007ffb00
mov edi, dword [ebp + 8]
mov ax, word [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov word [ebx + 0xcaf4], di
mov word [ebx + 0xcaf6], ax
mov dword [ebx + 0xcaf8], ecx
mov dword [ebx + 0xcafc], edx
mov ax, word [0xa8e768]
mov word [ebx + 0xcaf2], ax
movsx eax, word [ebx + 0xcaf4]
cmp eax, esi
mov dword [ebx + 0x1a2c], eax
jle 0x875291
cmp eax, dword [ebx + 0x1a30]
jg 0x875291
cmp eax, esi
je 0x874c16
mov ecx, ebx
call fcn.0080bee0
mov dword [ebx + 0x1ab8], esi
mov dword [ebx + 0x1abc], 0x3ff00000
movsx ecx, word [ebx + 0xcaf6]
mov dword [ebx + 0x2bb2c], ecx
mov edx, dword [ebx + 0xcafc]
mov eax, dword [ebx + 0xcaf8]
push edx
push eax
mov ecx, ebx
call fcn.0080bfc0
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jle 0x875291
push esi
mov ecx, ebx
call fcn.0080b900
mov ecx, dword [ebx + 0x7c]
push ecx
mov ecx, ebx
call fcn.0080b720
mov edx, dword [ebx + 0x7c]
mov ecx, ebx
push edx
call fcn.0080b950
push esi
mov ecx, ebx
call fcn.0080c0d0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov ax, word [ebp + 0xc]
mov word [ebx + 0xcaf4], di
mov word [ebx + 0xcaf6], ax
mov dword [ebx + 0xcaf8], ecx
mov dword [ebx + 0xcafc], edx
mov ax, word [0xa8e768]
lea edx, [ebx + 0xcb10]
mov word [ebx + 0xcaf2], ax
mov ecx, 0xf
xor eax, eax
mov edi, edx
mov dword [ebx + 0xcb60], 0
mov byte [ebx + 0xcb58], 0
rep stosd dword es:[edi], eax
lea esi, [ebx + 0xcb4d]
xor ecx, ecx
stosb byte es:[edi], al
mov dword [esi], ecx
lea eax, [ebx + 0x2a4ec]
push 0x3c
push eax
mov dword [esi + 4], ecx
push edx
mov word [esi + 8], cx
mov byte [esi + 0xa], cl
nop
call fcn.00b1bf3a
lea edi, [ebx + 0x2a551]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebx + 0xcb4d]
mov edx, ecx
mov esi, edi
mov edi, eax
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x2b438]
mov edx, dword [ebx + 0x2b43c]
mov dword [ebx + 0xcb80], ecx
mov ecx, dword [ebx + 0x2b440]
mov dword [ebx + 0xcb84], edx
mov edx, dword [ebx + 0x2b444]
mov dword [ebx + 0xcb88], ecx
mov ecx, dword [ebx + 0x2b448]
mov dword [ebx + 0xcb8c], edx
mov edx, dword [ebx + 0x2b44c]
mov dword [ebx + 0xcb90], ecx
mov ecx, dword [ebx + 0x2b450]
mov dword [ebx + 0xcb94], edx
mov edx, dword [ebx + 0x2b454]
mov dword [ebx + 0xcb98], ecx
mov cx, word [ebx + 0x2a4ca]
mov dword [ebx + 0xcb9c], edx
mov edx, dword [ebx + 0x2a4e4]
mov word [ebx + 0xcaf4], cx
mov dword [ebx + 0xcb64], edx
nop
call fcn.00b1bf43
add esp, 0x10
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fst qword [ebx + 0xcae8]
fcomp qword [0x9cb960]
fnstsw ax
test ah, 1
je 0x874dd4
mov dword [ebx + 0xcae8], 0
mov dword [ebx + 0xcaec], 0x3ff00000
fld qword [ebp + 0x18]
fdiv qword [ebx + 0xcae8]
mov ax, word [ebx + 0x2a566]
mov edi, 2
cmp ax, di
fstp qword [ebx + 0xcb78]
jne 0x874dff
mov word [ebx + 0xcaf0], 9
jmp 0x874e4a
cmp ax, 4
jne 0x874e10
mov word [ebx + 0xcaf0], 0xa
jmp 0x874e4a
cmp ax, 5
jne 0x874e21
mov word [ebx + 0xcaf0], 0xb
jmp 0x874e4a
cmp ax, 6
jne 0x874e32
mov word [ebx + 0xcaf0], 0xc
jmp 0x874e4a
cmp ax, 7
jne 0x874e43
mov word [ebx + 0xcaf0], 0xd
jmp 0x874e4a
mov word [ebx + 0xcaf0], di
mov eax, dword [ebx + 0x2b470]
mov ecx, dword [ebx + 0x2b474]
mov edx, dword [ebx + 0x2b478]
mov dword [ebx + 0xcba8], eax
mov eax, dword [ebx + 0x2b47c]
mov dword [ebx + 0xcbac], ecx
mov ecx, dword [ebx + 0x2b480]
mov dword [ebx + 0xcbb0], edx
mov edx, dword [ebx + 0x2b484]
mov dword [ebx + 0xcbb4], eax
mov eax, dword [ebx + 0x2b488]
mov dword [ebx + 0xcbb8], ecx
mov ecx, dword [ebx + 0x2b48c]
mov dword [ebx + 0xcbbc], edx
mov edx, dword [ebx + 0xcb84]
mov dword [ebx + 0xcbc0], eax
mov eax, dword [ebx + 0xcb80]
push edi
mov dword [ebx + 0xcbc4], ecx
push edx
push eax
mov ecx, ebx
call fcn.00800680
mov ecx, dword [ebx + 0xcb8c]
mov edx, dword [ebx + 0xcb88]
fstp qword [ebx + 0xcb80]
push edi
push ecx
push edx
mov ecx, ebx
call fcn.00800680
mov eax, dword [ebx + 0xcb94]
mov ecx, dword [ebx + 0xcb90]
fstp qword [ebx + 0xcb88]
push edi
push eax
push ecx
mov ecx, ebx
call fcn.00800680
mov edx, dword [ebx + 0xcb9c]
mov eax, dword [ebx + 0xcb98]
fstp qword [ebx + 0xcb90]
push edi
push edx
push eax
mov ecx, ebx
call fcn.00800680
mov ecx, dword [ebx + 0xcbac]
mov edx, dword [ebx + 0xcba8]
fstp qword [ebx + 0xcb98]
push edi
push ecx
push edx
mov ecx, ebx
call fcn.00800680
mov eax, dword [ebx + 0xcbb4]
mov ecx, dword [ebx + 0xcbb0]
fstp qword [ebx + 0xcba8]
push edi
push eax
push ecx
mov ecx, ebx
call fcn.00800680
mov edx, dword [ebx + 0xcbbc]
mov eax, dword [ebx + 0xcbb8]
fstp qword [ebx + 0xcbb0]
push edi
push edx
push eax
mov ecx, ebx
call fcn.00800680
mov ecx, dword [ebx + 0xcbc4]
mov edx, dword [ebx + 0xcbc0]
fstp qword [ebx + 0xcbb8]
push edi
push ecx
push edx
mov ecx, ebx
call fcn.00800680
fstp qword [ebx + 0xcbc0]
push 1
mov ecx, ebx
call fcn.00844cd0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], 0
test eax, eax
jle 0x8750fc
mov ecx, ebx
call fcn.007ffb00
mov eax, dword [esp + 0x14]
lea ecx, [eax + edi - 1]
push ecx
mov ecx, ebx
call fcn.0080b900
fld qword [ebx + 0x2a4d0]
call fcn.00912a20
mov esi, eax
mov eax, dword [0xa8e7a0]
cmp esi, eax
mov dword [esp + 0x10], esi
jle 0x874ff8
mov edx, esi
mov ecx, ebx
sub edx, eax
push edx
call fcn.008083d0
mov edx, dword [0xa8e7a0]
mov eax, esi
sub eax, edx
mov ecx, ebx
push eax
call fcn.00808410
jmp 0x875008
push esi
mov ecx, ebx
call fcn.00808350
push esi
mov ecx, ebx
call fcn.00808390
mov eax, dword [0xa8e7a0]
cmp esi, eax
jle 0x87501d
sub esi, eax
mov ecx, ebx
push esi
call fcn.00850ec0
jmp 0x875025
push esi
mov ecx, ebx
call fcn.00850b20
mov ecx, dword [ebx + 0x2bc20]
mov edx, dword [ebx + 0x2bc24]
lea eax, [ebx + 0x2b590]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], edx
call fcn.00911f06
movsx eax, word [ebx + 0x2b58c]
cmp eax, 3
mov dword [esp + 0x20], eax
jne 0x87505d
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
fild dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov esi, dword [0xb210cc]
mov dword [ebx + 0xcba8], eax
push 0x3c
fstp qword [ebx + 0xcaf8]
lea eax, [ebx + 0xcb10]
push edx
push eax
mov dword [ebx + 0xcbac], ecx
call esi
lea eax, [ebx + 0x2b5d8]
push 0xa
push eax
lea eax, [ebx + 0xcb4d]
push eax
call esi
mov eax, dword [ebx + 0x2a4d8]
mov ecx, dword [ebx + 0x2a4dc]
mov edx, dword [ebx + 0x2bc18]
mov dword [ebx + 0xcb78], eax
mov eax, dword [ebx + 0x2bc1c]
mov dword [ebx + 0xcb7c], ecx
mov ecx, dword [esp + 0x38]
add esp, 0x18
add ecx, 0x11
mov dword [ebx + 0xcb80], edx
mov word [ebx + 0xcaf0], cx
push edi
mov ecx, ebx
mov dword [ebx + 0xcb84], eax
call fcn.00844cd0
mov eax, dword [esp + 0xc]
inc edi
lea edx, [edi - 2]
cmp edx, eax
jl 0x874fa7
lea ecx, [eax + 1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x875291
xor edi, edi
test eax, eax
jle 0x875283
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
inc edx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov ecx, ebx
push eax
call fcn.0080b900
fld qword [ebx + 0x2a4d0]
call fcn.00912a20
mov esi, eax
mov eax, dword [0xa8e7a0]
cmp esi, eax
mov dword [esp + 0x20], esi
jle 0x87516c
mov ecx, esi
sub ecx, eax
push ecx
mov ecx, ebx
call fcn.008083d0
mov ecx, dword [0xa8e7a0]
mov edx, esi
sub edx, ecx
mov ecx, ebx
push edx
call fcn.00808410
jmp 0x87517c
push esi
mov ecx, ebx
call fcn.00808350
push esi
mov ecx, ebx
call fcn.00808390
movsx eax, word [ebx + 0x2b58c]
cmp eax, 3
jne 0x87526b
mov eax, dword [0xa8e7a0]
cmp esi, eax
jle 0x8751a1
sub esi, eax
mov ecx, ebx
push esi
call fcn.00850ec0
jmp 0x8751a9
push esi
mov ecx, ebx
call fcn.00850b20
mov ecx, dword [ebx + 0x2bc24]
mov eax, dword [ebx + 0x2bc20]
mov dword [esp + 0x28], ecx
mov ecx, ebx
mov dword [esp + 0x24], eax
call fcn.007ffb00
mov ecx, ebx
call fcn.007ff7b0
lea edx, [ebx + 0x2b590]
lea ecx, [esp + 0x18]
push edx
call fcn.00911f06
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
fild dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov esi, dword [0xb210d0]
mov dword [ebx + 0xcba8], eax
push 0x3c
fstp qword [ebx + 0xcaf8]
lea eax, [ebx + 0xcb10]
push edx
push eax
mov dword [ebx + 0xcbac], ecx
call esi
lea eax, [ebx + 0x2b5d8]
push 0xa
push eax
lea eax, [ebx + 0xcb4d]
push eax
call esi
fld qword [ebp + 0x18]
fmul qword [ebx + 0x2a4d8]
mov ecx, dword [ebx + 0x2bc18]
mov eax, dword [esp + 0x24]
mov edx, dword [ebx + 0x2bc1c]
add esp, 0x18
fdiv qword [ebx + 0xcae8]
mov dword [ebx + 0xcb80], ecx
lea ecx, [edi + eax + 1]
push ecx
mov ecx, ebx
mov dword [ebx + 0xcb84], edx
mov word [ebx + 0xcaf0], 3
fstp qword [ebx + 0xcb78]
call fcn.00844cd0
inc edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
inc ecx
dec eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x875126
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
add eax, edx
mov dword [esp + 0xc], eax
push fcn.00911ee2
push 0x12d
lea eax, [esp + 0x9c]
push 4
push eax
mov byte [esp + 0x908], 3
call fcn.009128f2
lea ecx, [esp + 0x30]
mov byte [esp + 0x8f8], 1
call fcn.00911f36
lea ecx, [esp + 0x18]
mov byte [esp + 0x8f8], 0
call fcn.00911ee2
lea ecx, [esp + 0x2c]
mov dword [esp + 0x8f8], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x8f0]
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x18