Function at 0xb1e474
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5c60f6
mov eax, dword fs:[0]
push eax
sub esp, 0xa1c
push ebx
push esi
push edi
mov eax, dword [0x669f00]
xor eax, esp
push eax
lea eax, [esp + 0xa2c]
mov dword fs:[0], eax
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0xa3c]
call fcn.00b2b034
mov ebx, eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], 0x12c
call 0xbdc1e4
lea ecx, [esp + 0x10]
mov dword [esp + 0xa34], 0
call 0xbdc1e4
lea ecx, [esp + 0x68]
mov byte [esp + 0xa34], 1
call 0xbfe6c4
call 0xbddf04
mov ecx, eax
call 0xbde004
push eax
lea ecx, [esp + 0x6c]
call 0xbfe4a4
call fcn.00b166d4
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0x18]
lea edi, [eax + 4]
mov ecx, edi
mov dword [esp + 0x64], edi
call 0xbdc294
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x58], eax
call fcn.00b1c8e4
mov ecx, dword [esi + 8]
push eax
call fcn.00b2d624
cmp eax, 2
jne 0xb1e53c
lea eax, [ebx + ebx]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x1c]
call 0xbdc1e4
lea ecx, [esp + 0x28]
mov byte [esp + 0xa34], 2
call 0xbdc1e4
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 3
call 0xbdc1e4
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa34], 4
call 0xbdc1e4
lea ecx, [esp + 0x24]
mov byte [esp + 0xa34], 5
call 0xbdc1e4
push 7
lea ecx, [esp + 0x18]
push 0x5ef4a4
mov bl, 6
push ecx
mov byte [esp + 0xa40], bl
mov dword [esp + 0x20], 0
call 0xc7621f
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
call 0xbdd384
push pe_nt_image_headers32
push 0x1f
lea eax, [esp + 0x1c]
push 0x5f14b8
push eax
call 0xc7621f
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x2c]
call 0xbdd384
push 0x41
push 0x1f
lea edx, [esp + 0x1c]
push 0x5f14b8
push edx
call 0xc7621f
add esp, 0x10
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
call 0xbdd384
push 0x29
push 0x1f
lea ecx, [esp + 0x1c]
push 0x5f14b8
push ecx
call 0xc7621f
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
call 0xbdd384
push 0x1f
lea eax, [esp + 0x18]
push 0x5ef4a4
push eax
call 0xc7621f
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
call 0xbdd384
jmp 0xb1e658
mov edi, dword [esp + 0x64]
mov eax, dword [esp + 0x48]
sub eax, 1
test eax, eax
mov dword [esp + 0x48], eax
jle 0xb1ea31
fild dword [esp + 0x58]
lea ecx, [esp + 0x68]
fsub qword [0x5ed620]
fadd qword [0x5ef108]
fstp qword [esp + 0x38]
call 0xbfe5c4
mov esi, eax
lea ecx, [esp + 0x68]
shr esi, 5
call 0xbfe5c4
shr eax, 6
test esi, esi
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
jge 0xb1e6ab
fadd qword [0x5efc38]
test eax, eax
fmul qword [0x5efc30]
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
jge 0xb1e6c3
fadd qword [0x5efc38]
faddp st(1)
fmul qword [0x5efc28]
fmul qword [esp + 0x38]
call 0xc76174
push 0xffffffffffffffff
push eax
lea edx, [esp + 0x68]
push edx
mov ecx, edi
call 0xbdd164
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xa38], 7
call 0xbdc754
lea ecx, [esp + 0x60]
mov byte [esp + 0xa34], bl
call 0xbdc714
push 0
push 0
push ecx
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call 0xbdc5b4
lea ecx, [esp + 0x2c]
call 0xbdcd94
cmp eax, 0xffffffff
je 0xb1e760
push 0xffffffffffffffff
add eax, 1
push eax
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x2c]
call 0xbdd164
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xa38], 8
call 0xbdc754
lea ecx, [esp + 0x54]
mov byte [esp + 0xa34], bl
call 0xbdc714
jmp 0xb1e773
lea ecx, [esp + 0x20]
call 0xbdc2b4
push eax
lea ecx, [esp + 0x14]
call 0xbdd384
push 0
push 0
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call 0xbdc5b4
lea ecx, [esp + 0x1c]
call 0xbdcd94
push 0
push 0
push ecx
mov dword [esp + 0x24], esp
mov edi, eax
mov eax, esp
push 0x19
push 1
push eax
lea ecx, [esp + 0x28]
call 0xbdd164
mov esi, dword [esp + 0x58]
add esi, 0xd0
mov ecx, esi
call 0xbdcd94
cmp edi, 0xffffffff
je 0xb1ea1b
cmp eax, 0xffffffff
jne 0xb1ea1b
push edi
push 0
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x1c]
call 0xbdd164
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xa38], 9
call 0xbdc754
lea ecx, [esp + 0x5c]
mov byte [esp + 0xa34], bl
call 0xbdc714
push 0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x5ee110
call 0xbdc1f4
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
mov byte [esp + 0xa48], 0xa
call 0xbdc5b4
lea ecx, [esp + 0x20]
mov byte [esp + 0xa44], bl
call 0xbdd7f4
push 0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x5ee118
call 0xbdc1f4
push ecx
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0xa48], 0xb
call 0xbdc5b4
lea ecx, [esp + 0x20]
mov byte [esp + 0xa44], bl
call 0xbdd7f4
push 0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x5ee118
call 0xbdc1f4
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0xa48], 0xc
call 0xbdc5b4
lea ecx, [esp + 0x20]
mov byte [esp + 0xa44], bl
call 0xbdd7f4
push 0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x5ed634
call 0xbdc1f4
push ecx
mov byte [esp + 0xa44], 0xd
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0x2c]
push eax
call 0xbdc5b4
lea ecx, [esp + 0x20]
mov byte [esp + 0xa44], bl
call 0xbdd7f4
push 0
push 2
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x5ed634
call 0xbdc1f4
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
mov byte [esp + 0xa48], 0xe
call 0xbdc5b4
lea ecx, [esp + 0x20]
mov byte [esp + 0xa44], bl
call 0xbdd7f4
lea ecx, [esp + 0x10]
call 0xbdc2b4
push eax
lea ecx, [esp + 0x44]
call 0xbdc1f4
lea eax, [esp + 0x40]
push eax
mov ecx, esi
mov byte [esp + 0xa38], 0xf
call 0xbdd6b4
lea ecx, [esp + 0x40]
mov byte [esp + 0xa34], bl
call 0xbdc714
mov ecx, esi
call 0xbdc294
mov edi, eax
sub edi, 1
push edi
mov ecx, esi
call 0xbdc624
cmp al, 0x20
je 0xb1e9b7
push edi
mov ecx, esi
call 0xbdc624
cmp al, 0xa
je 0xb1e9b7
push edi
mov ecx, esi
call 0xbdc624
cmp al, 9
je 0xb1e9b7
push edi
mov ecx, esi
call 0xbdc624
test al, al
je 0xb1e9b7
push edi
mov ecx, esi
call 0xbdc624
cmp al, 7
jne 0xb1e9dc
push edi
push 0
lea ecx, [esp + 0x58]
push ecx
mov ecx, esi
call 0xbdd164
push eax
mov ecx, esi
mov byte [esp + 0xa38], 0x10
call 0xbdc754
lea ecx, [esp + 0x50]
jmp 0xb1e963
mov ecx, esi
call 0xbdc294
cmp eax, dword [esp + 0x30]
jge 0xb1ea1b
push 0x5f09e0
lea ecx, [esp + 0x48]
call 0xbdc1f4
lea edx, [esp + 0x44]
push edx
mov ecx, esi
mov byte [esp + 0xa38], 0x11
call 0xbdd6b4
lea ecx, [esp + 0x44]
mov byte [esp + 0xa34], bl
call 0xbdc714
mov ecx, esi
call 0xbdc294
mov ecx, dword [esp + 0x30]
add ecx, 2
cmp eax, ecx
jl 0xb1e654
lea ecx, [esp + 0x24]
mov byte [esp + 0xa34], 5
call 0xbdc714
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa34], 4
call 0xbdc714
lea ecx, [esp + 0x34]
mov byte [esp + 0xa34], 3
call 0xbdc714
lea ecx, [esp + 0x28]
mov byte [esp + 0xa34], 2
call 0xbdc714
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa34], 1
call 0xbdc714
lea ecx, [esp + 0x10]
mov byte [esp + 0xa34], 0
call 0xbdc714
lea ecx, [esp + 0x20]
mov dword [esp + 0xa34], 0xffffffff
call 0xbdc714
mov ecx, dword [esp + 0xa2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xa28
ret 8