Function at 0x4c5340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c58a1
push dword fs:[eax]
mov dword fs:[eax], esp
fild dword [ebp - 4]
fild dword [ebx + 0xc]
fdivp st(1)
fstp dword [ebp - 0x10]
wait
fild dword [ebx + 0xc]
fild dword [ebp - 4]
fdivp st(1)
fstp dword [ebp - 0x14]
wait
fild dword [ebx + 8]
fmul dword [ebp - 0x10]
call fcn.00403000
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
mov ecx, 2
mov edx, dword [0x4bbf9c]
call fcn.004067f8
add esp, 8
fld dword [ebp - 0x10]
fcomp dword [0x4c58b0]
fnstsw ax
sahf
jbe 0x4c56ab
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
dec eax
test eax, eax
jl 0x4c57ea
inc eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 0
fld dword [ebp - 0x1c]
call fcn.00403000
mov dword [ebp - 0x3c], eax
fild dword [ebp - 0x3c]
fsubr dword [ebp - 0x1c]
fstp dword [ebp - 0x24]
wait
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
dec eax
test eax, eax
jl 0x4c5684
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x40], 0
fld dword [ebp - 0x18]
call fcn.00403000
mov dword [ebp - 0x38], eax
fild dword [ebp - 0x38]
fsubr dword [ebp - 0x18]
fstp dword [ebp - 0x20]
wait
fld dword [ebp - 0x18]
fadd dword [ebp - 0x14]
fstp dword [ebp - 0x18]
wait
mov esi, dword [ebx + 0xc]
dec esi
cmp esi, dword [ebp - 0x38]
jl 0x4c5678
mov eax, dword [ebx + 8]
dec eax
cmp eax, dword [ebp - 0x3c]
jl 0x4c5678
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 0x38]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0x3c]
mov al, byte [eax + edx]
mov edx, eax
cmp esi, dword [ebp - 0x38]
jle 0x4c5468
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [ebp - 0x51], cl
jmp 0x4c547f
mov ecx, eax
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x38]
mov esi, dword [esi + edi*4 - 4]
mov edi, dword [ebp - 0x3c]
sub cl, byte [esi + edi]
mov byte [ebp - 0x51], cl
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x3c]
jle 0x4c549a
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x38]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x3c]
mov al, byte [eax + ecx + 1]
jmp 0x4c54ac
add eax, eax
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x3c]
sub al, byte [ecx + esi - 1]
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x38]
jle 0x4c54d7
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x3c]
jle 0x4c54d7
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi + 1]
mov byte [ebp - 0x52], cl
jmp 0x4c555a
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x38]
jne 0x4c5511
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x3c]
jle 0x4c5511
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ecx + esi*4]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi + 1]
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x38]
mov esi, dword [esi + edi*4 - 4]
mov edi, dword [ebp - 0x3c]
sub cl, byte [esi + edi + 1]
mov byte [ebp - 0x52], cl
jmp 0x4c555a
mov ecx, dword [ebx + 0xc]
dec ecx
cmp ecx, dword [ebp - 0x38]
jle 0x4c554b
mov ecx, dword [ebx + 8]
dec ecx
cmp ecx, dword [ebp - 0x3c]
jne 0x4c554b
mov ecx, dword [ebx + 4]
mov esi, dword [ebp - 0x38]
mov ecx, dword [ecx + esi*4 + 4]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
add ecx, ecx
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x38]
mov esi, dword [esi + edi*4 + 4]
mov edi, dword [ebp - 0x3c]
sub cl, byte [esi + edi - 1]
mov byte [ebp - 0x52], cl
jmp 0x4c555a
xor ecx, ecx
mov cl, al
movzx esi, byte [ebp - 0x51]
add ecx, esi
shr ecx, 1
mov byte [ebp - 0x52], cl
cmp dl, byte [ebp - 0x51]
jne 0x4c5571
and edx, 0xff
mov dword [ebp - 0x64], edx
fild dword [ebp - 0x64]
fstp dword [ebp - 0x2c]
wait
jmp 0x4c559c
fld dword [0x4c58b0]
fsub dword [ebp - 0x20]
and edx, 0xff
mov dword [ebp - 0x64], edx
fild dword [ebp - 0x64]
fmulp st(1)
xor edx, edx
mov dl, byte [ebp - 0x51]
mov dword [ebp - 0x68], edx
fild dword [ebp - 0x68]
fmul dword [ebp - 0x20]
faddp st(1)
fstp dword [ebp - 0x2c]
wait
cmp al, byte [ebp - 0x52]
jne 0x4c55b2
and eax, 0xff
mov dword [ebp - 0x64], eax
fild dword [ebp - 0x64]
fstp dword [ebp - 0x30]
wait
jmp 0x4c55dc
fld dword [0x4c58b0]
fsub dword [ebp - 0x20]
and eax, 0xff
mov dword [ebp - 0x64], eax
fild dword [ebp - 0x64]
fmulp st(1)
xor eax, eax
mov al, byte [ebp - 0x52]
mov dword [ebp - 0x68], eax
fild dword [ebp - 0x68]
fmul dword [ebp - 0x20]
faddp st(1)
fstp dword [ebp - 0x30]
wait
fld dword [ebp - 0x2c]
fcomp dword [0x4c58b4]
fnstsw ax
sahf
jae 0x4c55ef
xor eax, eax
mov dword [ebp - 0x2c], eax
fld dword [ebp - 0x30]
fcomp dword [0x4c58b4]
fnstsw ax
sahf
jae 0x4c5602
xor eax, eax
mov dword [ebp - 0x30], eax
fld dword [ebp - 0x2c]
fcomp dword [0x4c58b8]
fnstsw ax
sahf
jbe 0x4c5617
mov dword [ebp - 0x2c], 0x437f0000
fld dword [ebp - 0x30]
fcomp dword [0x4c58b8]
fnstsw ax
sahf
jbe 0x4c562c
mov dword [ebp - 0x30], 0x437f0000
fld dword [ebp - 0x2c]
fcomp dword [ebp - 0x30]
fnstsw ax
sahf
jne 0x4c5650
fld dword [ebp - 0x2c]
call fcn.00402ff4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x40]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x44]
mov byte [edx + ecx], al
jmp 0x4c5678
fld dword [0x4c58b0]
fsub dword [ebp - 0x24]
fmul dword [ebp - 0x2c]
fld dword [ebp - 0x30]
fmul dword [ebp - 0x24]
faddp st(1)
call fcn.00402ff4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x40]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x44]
mov byte [edx + ecx], al
inc dword [ebp - 0x40]
dec dword [ebp - 0x5c]
jne 0x4c5404
fld dword [ebp - 0x1c]
fadd dword [ebp - 0x14]
fstp dword [ebp - 0x1c]
wait
mov eax, dword [0x7a8aec]
mov eax, dword [eax]
call fcn.004b7ac4
inc dword [ebp - 0x44]
dec dword [ebp - 0x58]
jne 0x4c53d3
jmp 0x4c57ea
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
dec eax
test eax, eax
jl 0x4c57ea
inc eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x44], 0
fld dword [ebp - 0x1c]
call fcn.00403000
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
dec eax
test eax, eax
jl 0x4c57c8
inc eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x40], 0
fld dword [ebp - 0x18]
call fcn.00403000
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x28], 0x437f0000
xor eax, eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x64], eax
fild dword [ebp - 0x64]
fmul dword [ebp - 0x14]
call fcn.00403000
fld dword [ebp - 0x18]
fadd dword [ebp - 0x14]
call fcn.00403000
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x64], eax
fild dword [ebp - 0x64]
fmul dword [ebp - 0x14]
call fcn.00402ff4
dec eax
pop edx
sub eax, edx
jl 0x4c5789
inc eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], edx
mov edi, dword [ebp - 0x38]
fld dword [ebp - 0x18]
fadd dword [ebp - 0x14]
call fcn.00402ff4
mov esi, eax
dec esi
sub esi, edi
jl 0x4c5781
inc esi
mov ecx, dword [ebp - 0x48]
add ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
add edx, edi
mov eax, ebx
call fcn.004c5164
and eax, 0xff
add dword [ebp - 0x4c], eax
inc dword [ebp - 0x50]
inc edi
dec esi
jne 0x4c5760
inc dword [ebp - 0x48]
dec dword [ebp - 0x60]
jne 0x4c574a
cmp dword [ebp - 0x50], 0
je 0x4c579b
fild dword [ebp - 0x4c]
fild dword [ebp - 0x50]
fdivp st(1)
fstp dword [ebp - 0x28]
wait
fld dword [ebp - 0x28]
call fcn.00402ff4
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x40]
mov edx, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x44]
mov byte [edx + ecx], al
fld dword [ebp - 0x18]
fadd dword [ebp - 0x14]
fstp dword [ebp - 0x18]
wait
inc dword [ebp - 0x40]
dec dword [ebp - 0x5c]
jne 0x4c56ee
fld dword [ebp - 0x1c]
fadd dword [ebp - 0x14]
fstp dword [ebp - 0x1c]
wait
mov eax, dword [0x7a8aec]
mov eax, dword [eax]
call fcn.004b7ac4
inc dword [ebp - 0x44]
dec dword [ebp - 0x58]
jne 0x4c56c7
mov eax, dword [ebp - 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 8], eax
fild dword [ebx + 0x18]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x18], eax
fild dword [ebx + 0x1c]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x1c], eax
fild dword [ebx + 0x20]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x20], eax
fild dword [ebx + 0x24]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x24], eax
fild dword [ebx + 0x28]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x28], eax
fild dword [ebx + 0x2c]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x2c], eax
fild dword [ebx + 0x30]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x30], eax
fild dword [ebx + 0x34]
fmul dword [ebp - 0x10]
call fcn.00402ff4
mov dword [ebx + 0x34], eax
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
mov ecx, dword [0x4bbf9c]
call fcn.00406840
lea eax, [ebp - 8]
mov edx, dword [0x4bbf9c]
call fcn.00406804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c58a8
lea eax, [ebp - 8]
mov edx, dword [0x4bbf9c]
call fcn.00406804
ret