Function at 0x43f6e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bebbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0xc], ecx
push edi
mov ecx, ebp
call fcn.00476fe0
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, ebp
mov ebx, edx
call fcn.00476ff0
mov esi, dword [esp + 0x15c]
mov ecx, eax
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ecx, dword [esi]
xor eax, eax
mov edi, edx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
call fcn.0043f430
mov ecx, dword [esi]
lea eax, [ebx + ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esi + 8]
sub ecx, ebx
add ecx, eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
call fcn.0043f430
mov ecx, dword [esi]
lea eax, [edi + edi]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esi + 4]
sub eax, edi
add eax, edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
mov dword [esp + 0x2c], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edi
call fcn.0043f430
lea eax, [ebx + ebx]
mov dword [esp + 0x1c], eax
lea eax, [edi + edi]
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
push edx
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov ecx, dword [esi]
sub eax, edi
add eax, edx
push eax
mov eax, dword [esi + 8]
sub ecx, ebx
add ecx, eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
call fcn.0043f430
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0xa0]
call fcn.0043f090
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ecx
mov ecx, dword [esi]
mov edx, eax
lea eax, [ebx + ebx]
sub edx, eax
mov eax, dword [esi + 4]
push edx
add ecx, ebx
push eax
push ecx
lea ecx, [esp + 0xac]
mov dword [esp + 0x164], 0
call fcn.0043f660
mov eax, dword [esi + 8]
sub eax, ebx
xor ecx, ecx
dec eax
cdq
idiv ebx
mov dword [esp + 0x14], ecx
test eax, eax
jle 0x43f8f1
lea eax, [edi + edi]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x18], ebx
jmp 0x43f890
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [esp + 0x1c]
push edx
push eax
add ecx, dword [esp + 0x20]
push ecx
push ebp
lea ecx, [esp + 0xac]
call fcn.0043f430
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esi + 4]
sub eax, edi
add eax, edx
push eax
add ecx, dword [esp + 0x20]
push ecx
push ebp
lea ecx, [esp + 0xac]
call fcn.0043f430
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
sub eax, ebx
inc ecx
dec eax
cdq
idiv ebx
mov dword [esp + 0x14], ecx
cmp ecx, eax
jl 0x43f890
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x48]
call fcn.0043f090
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
lea eax, [edi + edi]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
push edx
add eax, edi
push eax
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x164], 1
call fcn.0043f660
mov eax, dword [esi + 0xc]
sub eax, edi
xor ecx, ecx
dec eax
cdq
idiv edi
mov dword [esp + 0x18], ecx
test eax, eax
jle 0x43f9bf
lea eax, [ebx + ebx]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
add eax, dword [esp + 0x18]
push eax
push ecx
push ebp
lea ecx, [esp + 0x54]
call fcn.0043f430
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [esp + 0x1c]
push edx
add eax, dword [esp + 0x18]
push eax
mov eax, dword [esi + 8]
sub ecx, ebx
add ecx, eax
push ecx
push ebp
lea ecx, [esp + 0x54]
call fcn.0043f430
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xc]
sub eax, edi
inc ecx
dec eax
cdq
idiv edi
mov dword [esp + 0x18], ecx
cmp ecx, eax
jl 0x43f964
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0xf8]
call fcn.0043f090
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, eax
lea eax, [edi + edi]
sub edx, eax
push edx
lea eax, [ebx + ebx]
sub ecx, eax
mov eax, dword [esi + 4]
push ecx
mov ecx, dword [esi]
add eax, edi
add ecx, ebx
push eax
push ecx
lea ecx, [esp + 0x104]
mov byte [esp + 0x164], 2
call fcn.0043f660
mov eax, dword [esi + 8]
sub eax, ebx
dec eax
cdq
idiv ebx
mov dword [esp + 0x14], 0
test eax, eax
jle 0x43fabd
mov eax, dword [esi + 0xc]
sub eax, edi
dec eax
cdq
idiv edi
mov dword [esp + 0x2c], ebx
mov ecx, eax
jmp 0x43fa30
test ecx, ecx
mov dword [esp + 0x18], 0
jle 0x43fa97
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x10], edi
mov eax, dword [esi + 4]
mov ecx, dword [esi]
lea edx, [esp + 0x30]
push edx
add eax, dword [esp + 0x14]
push eax
add ecx, dword [esp + 0x34]
push ecx
push ebp
lea ecx, [esp + 0x104]
call fcn.0043f430
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add eax, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xc]
sub eax, edi
inc ecx
dec eax
cdq
idiv edi
mov dword [esp + 0x18], ecx
cmp ecx, eax
mov dword [esp + 0x40], eax
jl 0x43fa50
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
add eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 8]
inc edx
sub eax, ebx
dec eax
mov dword [esp + 0x14], edx
cdq
idiv ebx
cmp dword [esp + 0x14], eax
jl 0x43fa30
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret 8