Function at 0x4b91a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5824a2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1a8
mov eax, dword [0x5d4090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x194], edi
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x17c], eax
movsd qword [ebp - 0x160], xmm0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xf
mov byte [ebp - 0x118], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
movsd xmm0, qword [eax + 0x18]
sub esp, 8
mov esi, dword [ebx + 0xc]
movsd qword [ebp - 0x170], xmm0
movsd xmm0, qword [esi + 0x18]
movsd qword [ebp - 0x178], xmm0
fld qword [ebp - 0x178]
fstp qword [esp]
call fcn.00578690
movsd xmm0, qword [esi + 0x18]
fstp qword [ebp - 0x178]
movaps xmm1, xmm0
mov dword [ebp - 0x150], 0
subsd xmm1, qword [ebp - 0x178]
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0xf
mov byte [ebp - 0x150], 0
movsd qword [ebp - 0x178], xmm1
mov byte [ebp - 4], 3
lea eax, [ebp - 0x150]
movsd xmm3, qword [ebp - 0x170]
mov edx, dword [esi + 0x30]
subsd xmm3, xmm1
mov ecx, dword [esi + 0x20]
movsd qword [esp], xmm0
push eax
subsd xmm3, qword [0x5ba2b0]
call fcn.00406bc0
mov ecx, dword [ebp - 0xd4]
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0x140]
add esp, 0xc
cmp dword [ebp - 0x13c], 0x10
mov dword [ebp - 0x184], ecx
cmovae edx, dword [ebp - 0x150]
mov dword [ebp - 0x18c], edx
cmp eax, ecx
ja 0x4b9376
cmp ecx, 0x10
mov dword [ebp - 0xd8], eax
push eax
lea esi, [ebp - 0xe8]
cmovae esi, dword [ebp - 0xe8]
push edx
push esi
call fcn.005223f0
mov eax, dword [ebp - 0x140]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x4b946f
cmp eax, 0x7fffffff
ja 0x4bab0d
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4b93a3
mov eax, 0x80000000
mov esi, 0x7fffffff
push eax
call fcn.004025f0
add esp, 4
jmp 0x4b93f5
mov edx, ecx
mov eax, 0x7fffffff
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4b93c7
mov eax, 0x80000000
mov esi, 0x7fffffff
push eax
call fcn.004025f0
add esp, 4
jmp 0x4b93f5
lea eax, [ecx + edx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4b93e4
push eax
call fcn.004025f0
add esp, 4
jmp 0x4b93f5
test eax, eax
je 0x4b93f3
push eax
call fcn.0051fa77
add esp, 4
jmp 0x4b93f5
xor eax, eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x140]
push eax
push dword [ebp - 0x18c]
mov dword [ebp - 0xd4], esi
mov esi, dword [ebp - 0x164]
push esi
mov dword [ebp - 0xd8], eax
call fcn.00521e70
mov eax, dword [ebp - 0x140]
add esp, 0xc
mov byte [eax + esi], 0
mov eax, dword [ebp - 0x184]
cmp eax, 0x10
jb 0x4b9469
mov edx, dword [ebp - 0xe8]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4b945f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab21
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov dword [ebp - 0xe8], esi
mov esi, dword [ebp - 0x17c]
lea eax, [ebp - 0x118]
cmp eax, esi
je 0x4b9498
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x4b9489
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x118]
push eax
call fcn.00402080
movd xmm0, dword [esi + 0x28]
lea ecx, [ebp - 0xd0]
mov eax, dword [esi + 0x2c]
movsd xmm1, qword [esi + 0x20]
cvtdq2pd xmm0, xmm0
mov dword [ebp - 0x164], eax
movsd qword [ebp - 0x190], xmm0
call fcn.00407b60
mov esi, eax
lea eax, [ebp - 0x100]
cmp eax, esi
je 0x4b954b
mov ecx, dword [ebp - 0xec]
cmp ecx, 0x10
jb 0x4b9508
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4b94fe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab12
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x100], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xf0], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov ecx, dword [ebp - 0xbc]
cmp ecx, 0x10
jb 0x4b9585
mov edx, dword [ebp - 0xd0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4b957b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab12
push ecx
push edx
call fcn.0051faa7
add esp, 8
movsd xmm0, qword [ebp - 0x170]
ucomisd xmm0, qword [0x5b9b00]
lahf
test ah, 0x44
jnp 0x4ba9d1
mov edx, dword [ebx + 0xc]
cmp dword [edx + 0x2d0], 2
jne 0x4b95d5
mov eax, dword [edi + 0x198]
xor ecx, ecx
mov edx, 8
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051fae4
movsd xmm0, qword [ebp - 0x170]
add esp, 4
mov edx, dword [ebx + 0xc]
mov esi, dword [edi + 0xe4]
movsd xmm5, qword [0x5bae60]
movsd xmm4, qword [0x5ba138]
mov byte [ebp - 0x151], 0
cmp esi, 2
jne 0x4b9629
movsd xmm0, qword [ebp - 0x190]
movsd xmm1, qword [0x5ba2b0]
mov ecx, dword [ebp - 0x164]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x4b96e5
cmp ecx, 1
jne 0x4b96e5
jmp 0x4b975c
cmp esi, 1
jne 0x4b9651
movsd xmm0, qword [ebp - 0x190]
movsd xmm1, qword [0x5ba2b0]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x4b96df
jmp 0x4b975c
test esi, esi
jne 0x4b96cf
movsd xmm1, qword [ebp - 0x178]
sub esp, 8
addsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [ebp - 0x178], xmm1
addsd xmm0, qword [0x5b9bf0]
movsd qword [ebp - 0x188], xmm0
fld qword [ebp - 0x188]
fstp qword [esp]
call fcn.00578690
mov edx, dword [ebx + 0xc]
add esp, 8
movsd xmm4, qword [0x5ba138]
movsd xmm5, qword [0x5bae60]
fstp qword [ebp - 0x188]
movsd xmm1, qword [ebp - 0x188]
subsd xmm1, qword [ebp - 0x178]
movsd xmm0, qword [edx + 0x58]
mulsd xmm0, xmm4
andps xmm1, xmm5
comisd xmm0, xmm1
ja 0x4b975c
movsd xmm1, qword [0x5ba2b0]
movsd xmm0, qword [ebp - 0x190]
mov ecx, dword [ebp - 0x164]
cmp esi, 5
je 0x4b975c
cmp esi, 4
jne 0x4b9739
movsd xmm3, qword [ebp - 0x170]
movsd xmm1, qword [edx + 0x2d8]
movaps xmm2, xmm3
divsd xmm2, xmm1
movaps xmm0, xmm2
addsd xmm0, xmm4
cvttsd2si eax, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm2, xmm0
movsd xmm0, qword [edx + 0x58]
mulsd xmm0, xmm4
mulsd xmm2, xmm1
andps xmm2, xmm5
comisd xmm0, xmm2
jb case.default.0x4b99de
jmp 0x4b9764
cmp esi, 3
jne case.default.0x4b99de
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp case.default.0x4b99de
cmp ecx, dword [edx + 0x318]
jne case.default.0x4b99de
movsd xmm3, qword [ebp - 0x170]
mov eax, dword [edx + 0x2d0]
mov byte [ebp - 0x151], 1
test eax, eax
jne 0x4b99cc
cmp esi, 2
jne 0x4b9798
push dword [ebp - 0x120]
movaps xmm1, xmm3
mov ecx, edi
call fcn.00415570
mov edx, 0x598290
jmp 0x4b9b14
cmp esi, 1
jne 0x4b9943
mov esi, 7
mov dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd8], esi
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xc0], 0
cmovb esi, dword [ebp - 0xd8]
cmp dword [ebp - 0xd4], 0x10
mov dword [ebp - 0xbc], 0xf
cmovae eax, dword [ebp - 0xe8]
mov byte [ebp - 0xd0], 0
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x184], eax
cmp esi, 0xf
ja 0x4b981e
push esi
push eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xc0], esi
push eax
call fcn.005223f0
mov byte [ebp + esi - 0xd0], 0
jmp 0x4b98c1
cmp esi, 0x7fffffff
ja 0x4bab17
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4b984c
mov eax, 0x80000000
mov esi, 0x7fffffff
push eax
call fcn.004025f0
add esp, 4
mov ecx, eax
jmp 0x4b9886
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4b986d
push eax
call fcn.004025f0
add esp, 4
mov ecx, eax
jmp 0x4b9886
test eax, eax
je 0x4b9884
push eax
call fcn.0051fa77
add esp, 4
mov dword [ebp - 0x164], eax
mov ecx, eax
jmp 0x4b988c
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov eax, dword [ebp - 0x18c]
push eax
push dword [ebp - 0x184]
mov dword [ebp - 0xc0], eax
push ecx
mov dword [ebp - 0xbc], esi
call fcn.00521e70
mov ecx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x18c]
mov byte [ecx + eax], 0
mov dword [ebp - 0xd0], ecx
add esp, 0xc
mov byte [ebp - 4], 4
mov ecx, edi
movsd xmm1, qword [ebp - 0x170]
call fcn.00415570
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xbc]
cmp ecx, 0x10
jb case.default.0x4b99de
mov edx, dword [ebp - 0xd0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4b9934
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab1c
push ecx
push edx
call fcn.0051faa7
add esp, 8
jmp case.default.0x4b99de
test esi, esi
jne 0x4b996f
movaps xmm1, xmm3
mov ecx, edi
call fcn.00415570
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
lea edx, [ebp - 0xe8]
mov ecx, eax
call fcn.00411260
jmp 0x4b9b26
cmp esi, 5
jne 0x4b99b5
movaps xmm1, xmm3
mov ecx, edi
call fcn.00415570
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
lea edx, [ebp - 0x118]
mov ecx, eax
call fcn.00411260
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
lea edx, [ebp - 0x100]
mov ecx, eax
call fcn.00411260
jmp 0x4b9b26
cmp esi, 3
je case.0x4b99de.3
cmp esi, 4
jne case.default.0x4b99de
jmp 0x4b9947
cmp eax, 1
jne case.default.0x4b99de
cmp esi, 5
ja case.default.0x4b99de
jmp dword [esi*4 + 0x4bab28]
push dword [ebp - 0x120]
mov ecx, edi
call fcn.004156e0
mov edx, 0x597758
mov ecx, eax
call fcn.00411000
movsd xmm1, qword [ebp - 0x170]
mov ecx, eax
call fcn.00415570
mov edx, 0x597758
jmp 0x4b9b2b
push dword [ebp - 0x128]
mov ecx, edi
push dword [ebp - 0x124]
push dword [ebp - 0x120]
call fcn.004156e0
push ecx
mov edx, 0x5970cc
mov ecx, eax
call fcn.00411000
add esp, 4
mov ecx, eax
call fcn.004156e0
push ecx
mov edx, 0x5970cc
mov ecx, eax
call fcn.00411000
add esp, 4
mov ecx, eax
jmp 0x4b99ed
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0xd0]
movsd xmm1, qword [eax + 0x20]
call fcn.00407b60
mov esi, eax
mov dl, 0x22
mov byte [ebp - 4], 5
mov ecx, edi
call fcn.00424590
mov edx, dword [ebp - 0x17c]
mov ecx, eax
call fcn.00411260
mov edx, 0x597758
mov ecx, eax
call fcn.00411000
mov edx, esi
mov ecx, eax
call fcn.00411260
mov dl, 0x22
mov ecx, eax
call fcn.00424590
mov edx, 0x597758
mov ecx, eax
call fcn.00411000
movsd xmm1, qword [ebp - 0x170]
mov ecx, eax
call fcn.00415570
mov edx, 0x597758
mov ecx, eax
call fcn.00411000
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 3
call fcn.00402ec0
jmp case.default.0x4b99de
mov ecx, dword [ebp - 0x120]
movaps xmm1, xmm3
lea eax, [ecx + 1]
push eax
push ecx
mov ecx, edi
call fcn.00415570
push ecx
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x5970cc
push ecx
mov ecx, eax
call fcn.00411000
add esp, 4
mov ecx, eax
call fcn.004156e0
mov edx, 0x598290
mov ecx, eax
call fcn.00411000
cmp dword [edi + 0xb4], 0
jne 0x4b9b6b
mov ecx, dword [edi + 0x1ac]
lea esi, [edi + 0x1ac]
push dword [edi + 0xbc]
mov dword [ebp - 0x18c], esi
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
cmp eax, 0x2b
jne 0x4b9b63
mov al, 1
jmp 0x4b9b79
mov dword [ebp - 0x18c], esi
jmp 0x4b9b77
lea eax, [edi + 0x1ac]
mov dword [ebp - 0x18c], eax
xor al, al
xor esi, esi
mov byte [ebp - 0x165], al
mov dword [ebp - 0x164], esi
cmp dword [edi + 0x198], esi
jle 0x4ba986
test al, al
je 0x4b9cbb
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4b9bb1
push dword [edi + 0xbc]
push esi
jmp 0x4b9c99
cmp eax, 1
jne 0x4b9bdf
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd910
mov ecx, eax
call fcn.004897e0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4b9c12
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
fstp qword [ebp - 0x160]
movsd xmm2, qword [ebp - 0x160]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 3
jne 0x4b9c40
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd700
mov ecx, eax
call fcn.00452910
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4b9c6e
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f120
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
mov ecx, dword [edi + 0x1ac]
push esi
push dword [edi + 0x1a8]
call fcn.004bd700
mov ecx, eax
call fcn.00452800
push dword [edi + 0xbc]
push dword [eax + 8]
mov ecx, dword [edi + 0x1ac]
call fcn.004be6b0
mov ecx, eax
call fcn.0043da40
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
mov eax, dword [edi + 0xb4]
test eax, eax
jne 0x4b9dff
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4b9cfa
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd6a0
mov ecx, dword [edi + 0xbc]
mov eax, dword [eax + 0x48]
movsd xmm2, qword [eax + ecx*8]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 1
jne 0x4b9d28
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd910
mov ecx, eax
call fcn.00489760
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4b9d5b
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
fstp qword [ebp - 0x160]
movsd xmm2, qword [ebp - 0x160]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 3
jne 0x4b9d89
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd700
mov ecx, eax
call fcn.004528a0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4b9db7
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f0c0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
push dword [ebp - 0x164]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0x1a8]
mov esi, dword [edi + 0xbc]
call fcn.004bd700
mov ecx, eax
call fcn.00452800
mov eax, dword [eax + 0x48]
movsd xmm2, qword [eax + esi*8]
mov esi, dword [ebp - 0x164]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 1
jne 0x4b9f34
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4b9e3c
mov ecx, dword [edi + 0x1ac]
lea eax, [edi + 0xdc]
push eax
push esi
call fcn.004bd6a0
mov ecx, eax
call fcn.00488530
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 1
jne 0x4b9e6b
mov ecx, dword [edi + 0x1ac]
lea eax, [edi + 0xdc]
push eax
push esi
call fcn.004bd910
mov ecx, eax
call fcn.00489880
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4b9e92
mov ecx, dword [edi + 0x1ac]
lea eax, [edi + 0xdc]
push eax
call fcn.004becb0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 3
jne 0x4b9ec1
mov ecx, dword [edi + 0x1ac]
lea eax, [edi + 0xdc]
push eax
push esi
call fcn.004bd700
mov ecx, eax
call fcn.004529c0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4b9ef0
mov ecx, dword [edi + 0x1ac]
lea eax, [edi + 0xdc]
push eax
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f1a0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
lea eax, [edi + 0xdc]
push eax
push ecx
mov ecx, dword [edi + 0x1ac]
push esi
push dword [edi + 0x1a8]
call fcn.004bd700
mov ecx, eax
call fcn.00452800
add esp, 4
mov ecx, eax
call fcn.00488530
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4ba034
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4b9f60
push 1
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
call fcn.004bd6a0
jmp 0x4ba113
cmp eax, 1
jne 0x4b9f8f
mov ecx, dword [edi + 0x1ac]
push eax
push dword [edi + 0xbc]
push esi
call fcn.004bd910
mov ecx, eax
call fcn.00489920
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4b9fc4
push 1
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
call eax
fstp qword [ebp - 0x160]
movsd xmm2, qword [ebp - 0x160]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 3
jne 0x4b9ff4
mov ecx, dword [edi + 0x1ac]
push 1
push dword [edi + 0xbc]
push esi
call fcn.004bd700
mov ecx, eax
call fcn.00452a60
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4ba024
mov ecx, dword [edi + 0x1ac]
push 1
push dword [edi + 0xbc]
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f220
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
push 1
jmp 0x4ba0f4
cmp eax, 3
jne 0x4ba12a
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4ba04d
push eax
jmp 0x4b9f49
cmp eax, 1
jne 0x4ba07d
mov ecx, dword [edi + 0x1ac]
push 0
push dword [edi + 0xbc]
push esi
call fcn.004bd910
mov ecx, eax
call fcn.00489920
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4ba089
push 0
jmp 0x4b9f96
cmp eax, 3
jne 0x4ba0b9
mov ecx, dword [edi + 0x1ac]
push 0
push dword [edi + 0xbc]
push esi
call fcn.004bd700
mov ecx, eax
call fcn.00452a60
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4ba0e9
mov ecx, dword [edi + 0x1ac]
push 0
push dword [edi + 0xbc]
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f220
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
push 0
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x1ac]
push esi
push dword [edi + 0x1a8]
call fcn.004bd700
mov ecx, eax
call fcn.00452800
mov ecx, eax
call fcn.00488550
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
mov eax, dword [edi + 0xe8]
test eax, eax
jne 0x4ba16c
push dword [edi + 0xc0]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
push esi
call fcn.004bd6a0
mov ecx, eax
call fcn.00488580
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 1
jne 0x4ba1a0
push dword [edi + 0xc0]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
push esi
call fcn.004bd910
mov ecx, eax
call fcn.004899c0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 2
jne 0x4ba1d9
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xc0]
push dword [edi + 0xbc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
fstp qword [ebp - 0x160]
movsd xmm2, qword [ebp - 0x160]
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 3
jne 0x4ba20a
push dword [edi + 0xc0]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
push esi
call fcn.004bd700
mov ecx, eax
call fcn.00452b00
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 4
jne 0x4ba23b
push dword [edi + 0xc0]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
push esi
call fcn.004bddc0
mov ecx, eax
call fcn.0043f2a0
movaps xmm2, xmm0
movsd qword [ebp - 0x160], xmm2
jmp 0x4ba272
cmp eax, 5
jne 0x4ba26a
push dword [edi + 0xc0]
mov ecx, dword [edi + 0x1ac]
push dword [edi + 0xbc]
push esi
push dword [edi + 0x1a8]
call fcn.004bd700
mov ecx, eax
call fcn.00452800
jmp 0x4ba155
movsd xmm2, qword [ebp - 0x160]
test esi, esi
jne 0x4ba27c
inc dword [edi + 0x1a4]
mov eax, dword [edi + 0xe0]
test eax, eax
jne 0x4ba2cd
mov edx, dword [edi + 0x1a4]
movaps xmm0, xmm2
mov ecx, dword [edi + 0x194]
cmp dword [edi + 0xb4], 0
lea eax, [edx - 1]
movd xmm1, edx
movd xmm3, eax
cvtdq2pd xmm3, xmm3
mov eax, dword [ecx + esi*4]
mov ecx, eax
cvtdq2pd xmm1, xmm1
divsd xmm3, xmm1
divsd xmm0, xmm1
mulsd xmm3, qword [eax]
addsd xmm3, xmm0
movsd qword [ecx], xmm3
jmp 0x4ba3a1
cmp eax, 1
jne 0x4ba2ee
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
comisd xmm2, xmmword [eax]
jbe 0x4ba3a1
movsd qword [eax], xmm2
jmp 0x4ba3a1
cmp eax, 2
jne 0x4ba313
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
movsd xmm0, qword [eax]
comisd xmm0, xmm2
jbe 0x4ba3a1
movsd qword [eax], xmm2
jmp 0x4ba3a1
cmp eax, 4
jne 0x4ba336
mov eax, dword [edi + 0x194]
movaps xmm0, xmm2
mov ecx, dword [ebx + 0xc]
mov eax, dword [eax + esi*4]
mulsd xmm0, qword [ecx + 0x58]
addsd xmm0, qword [eax]
movsd qword [eax], xmm0
jmp 0x4ba3a1
cmp eax, 5
jne 0x4ba369
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
movsd xmm0, qword [eax]
comisd xmm0, xmm2
jbe 0x4ba352
movsd qword [eax], xmm2
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
comisd xmm2, xmmword [eax + 8]
jbe 0x4ba3a1
movsd qword [eax + 8], xmm2
jmp 0x4ba3a1
cmp eax, 3
je 0x4ba38c
cmp eax, 7
je 0x4ba38c
cmp eax, 6
je 0x4ba38c
cmp eax, 8
je 0x4ba38c
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
movsd qword [eax], xmm2
jmp 0x4ba3a1
mov eax, dword [edi + 0x194]
mov ecx, dword [edi + 0x1a4]
mov eax, dword [eax + esi*4]
movsd qword [eax + ecx*8 - 8], xmm2
cmp byte [ebp - 0x151], 0
je 0x4ba96c
mov ecx, dword [edi + 0x1ac]
call fcn.004be6d0
test eax, eax
je 0x4ba3d1
call fcn.004be6d0
mov ecx, eax
call fcn.00454780
test al, al
jne 0x4ba9d1
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 0x2d0]
test eax, eax
je 0x4ba3e7
cmp eax, 1
jne 0x4ba888
mov al, byte [0x598290]
mov edx, 0xf
mov dword [ebp - 0xd0], 0
mov word [ebp - 0xd0], 0
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xc0], 1
mov byte [ebp - 0xd0], al
mov byte [ebp - 4], 6
cmp dword [ecx + 0x2d0], 1
jne 0x4ba442
mov al, byte [0x597758]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xc0], 1
mov byte [ecx], al
mov byte [ecx + 1], 0
mov eax, dword [edi + 0xe0]
test eax, eax
jne 0x4ba45a
mov ecx, dword [edi + 0x194]
mov ecx, dword [ecx + esi*4]
jmp 0x4ba6f1
cmp eax, 1
jne 0x4ba46d
mov ecx, dword [edi + 0x194]
mov ecx, dword [ecx + esi*4]
jmp 0x4ba6f1
cmp eax, 2
jne 0x4ba480
mov ecx, dword [edi + 0x194]
mov ecx, dword [ecx + esi*4]
jmp 0x4ba6f1
cmp eax, 4
jne 0x4ba493
mov ecx, dword [edi + 0x194]
mov ecx, dword [ecx + esi*4]
jmp 0x4ba6f1
cmp eax, 5
jne 0x4ba4f0
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
lea ecx, [eax + 8]
call fcn.0040c660
mov ecx, eax
movsd qword [ebp - 0x178], xmm0
call fcn.0040c660
movaps xmm1, xmm0
mov ecx, edi
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
movsd xmm1, qword [ebp - 0x178]
mov ecx, eax
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
jmp 0x4ba84a
cmp eax, 3
jne 0x4ba547
mov ecx, dword [edi + 0x194]
xor edx, edx
mov eax, dword [edi + 0x1a4]
dec eax
push eax
mov ecx, dword [ecx + esi*4]
call fcn.0040d790
mov ecx, dword [edi + 0x194]
lea eax, [ebp - 0x178]
mov edx, dword [edi + 0x1a4]
add esp, 4
mov ecx, dword [ecx + esi*4]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x170]
push eax
call fcn.004b8e90
add esp, 0xc
lea ecx, [ebp - 0x1a0]
jmp 0x4ba6f1
cmp eax, 7
jne 0x4ba61c
mov ecx, dword [edi + 0x194]
xor edx, edx
mov eax, dword [edi + 0x1a4]
dec eax
push eax
mov ecx, dword [ecx + esi*4]
call fcn.0040d790
mov ecx, dword [edi + 0x194]
lea eax, [ebp - 0x1a8]
mov edx, dword [edi + 0x1a4]
add esp, 4
mov ecx, dword [ecx + esi*4]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.004b8e90
add esp, 0xc
lea ecx, [ebp - 0x1a8]
call fcn.0040c660
lea ecx, [ebp - 0x1b0]
movsd qword [ebp - 0x170], xmm0
call fcn.0040c660
lea ecx, [ebp - 0x1b8]
movsd qword [ebp - 0x178], xmm0
call fcn.0040c660
movaps xmm1, xmm0
mov ecx, edi
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
movsd xmm1, qword [ebp - 0x178]
mov ecx, eax
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
movsd xmm1, qword [ebp - 0x170]
mov ecx, eax
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
jmp 0x4ba84a
cmp eax, 6
jne 0x4ba712
mov ecx, dword [edi + 0x194]
xor edx, edx
mov eax, dword [edi + 0x1a4]
dec eax
push eax
mov ecx, dword [ecx + esi*4]
call fcn.0040d790
mov eax, dword [edi + 0x1a4]
dec eax
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x5b9e10]
movsd qword [ebp - 0x178], xmm0
fld qword [ebp - 0x178]
fstp qword [esp]
call fcn.00578690
mov eax, dword [edi + 0x194]
add esp, 8
fstp qword [ebp - 0x178]
cvttsd2si ecx, qword [ebp - 0x178]
mov eax, dword [eax + esi*4]
lea ecx, [eax + ecx*8]
call fcn.0040c660
movaps xmm1, xmm0
mov ecx, edi
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
mov eax, dword [edi + 0x1a4]
sub esp, 8
dec eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x5ba290]
movsd qword [ebp - 0x178], xmm0
fld qword [ebp - 0x178]
fstp qword [esp]
call fcn.00574040
mov eax, dword [edi + 0x194]
add esp, 8
fstp qword [ebp - 0x178]
cvttsd2si ecx, qword [ebp - 0x178]
mov eax, dword [eax + esi*4]
lea ecx, [eax + ecx*8]
call fcn.0040c660
movaps xmm1, xmm0
mov ecx, edi
call fcn.00415570
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
jmp 0x4ba84a
cmp eax, 8
jne 0x4ba84a
mov ecx, dword [edi + 0x194]
xor edx, edx
mov eax, dword [edi + 0x1a4]
dec eax
push eax
mov ecx, dword [ecx + esi*4]
call fcn.0040d790
mov edx, dword [edi + 0x100]
add esp, 4
movsd xmm3, qword [edi + 0xf8]
subsd xmm3, qword [edi + 0xf0]
movd xmm0, edx
cvtdq2pd xmm0, xmm0
divsd xmm3, xmm0
test edx, edx
jle 0x4ba76e
mov ecx, edx
lea edi, [ebp - 0xb8]
xor eax, eax
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x194]
xor eax, eax
mov dword [ebp - 0x184], eax
cmp dword [edi + 0x1a4], eax
jle 0x4ba800
xor ecx, ecx
test edx, edx
jle 0x4ba7f1
mov eax, dword [edi + 0x194]
movsd xmm1, qword [edi + 0xf0]
mov edi, dword [ebp - 0x184]
mov eax, dword [eax + esi*4]
movsd xmm2, qword [eax + edi*8]
mov edi, dword [ebp - 0x194]
nop word [eax + eax]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
addsd xmm0, xmm1
comisd xmm2, xmm0
jb 0x4ba7e6
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm3
addsd xmm0, xmm1
comisd xmm0, xmm2
jbe 0x4ba7e6
inc dword [ebp + ecx*4 - 0xb8]
inc ecx
cmp ecx, edx
jl 0x4ba7b0
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp eax, dword [edi + 0x1a4]
jl 0x4ba782
mov dword [ebp - 0x16c], 0
test edx, edx
jle 0x4ba84a
mov esi, dword [ebp - 0x16c]
nop dword [eax]
nop dword [eax + eax]
push dword [ebp + esi*4 - 0xb8]
mov ecx, edi
call fcn.004156e0
lea edx, [ebp - 0xd0]
mov ecx, eax
call fcn.00411260
inc esi
cmp esi, dword [edi + 0x100]
jl 0x4ba820
mov esi, dword [ebp - 0x164]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xbc]
cmp edx, 0x10
jb 0x4ba888
mov ecx, dword [ebp - 0xd0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4ba87e
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab12
push edx
push ecx
call fcn.0051faa7
add esp, 8
mov eax, dword [edi + 0xe0]
test eax, eax
je 0x4ba8d5
cmp eax, 1
jne 0x4ba8b1
mov eax, dword [edi + 0x194]
movsd xmm0, qword [0x5bad68]
mov eax, dword [eax + esi*4]
movsd qword [eax], xmm0
jmp 0x4ba957
cmp eax, 2
jne 0x4ba8d0
mov eax, dword [edi + 0x194]
movsd xmm0, qword [0x5babb8]
mov eax, dword [eax + esi*4]
movsd qword [eax], xmm0
jmp 0x4ba957
cmp eax, 4
jne 0x4ba8e7
mov eax, dword [edi + 0x194]
xorps xmm0, xmm0
mov eax, dword [eax + esi*4]
movsd qword [eax], xmm0
jmp 0x4ba957
cmp eax, 5
jne 0x4ba919
mov eax, dword [edi + 0x194]
movsd xmm0, qword [0x5babb8]
mov eax, dword [eax + esi*4]
movsd qword [eax], xmm0
mov eax, dword [edi + 0x194]
movsd xmm0, qword [0x5bad68]
mov eax, dword [eax + esi*4]
movsd qword [eax + 8], xmm0
jmp 0x4ba957
cmp eax, 3
je 0x4ba92d
cmp eax, 7
je 0x4ba92d
cmp eax, 6
je 0x4ba92d
cmp eax, 8
jne 0x4ba957
xor ecx, ecx
cmp dword [edi + 0x19c], ecx
jle 0x4ba957
xorps xmm0, xmm0
nop word [eax + eax]
mov eax, dword [edi + 0x194]
mov eax, dword [eax + esi*4]
movsd qword [eax + ecx*8], xmm0
inc ecx
cmp ecx, dword [edi + 0x19c]
jl 0x4ba940
mov eax, dword [edi + 0x198]
dec eax
cmp esi, eax
jne 0x4ba96c
mov dword [edi + 0x1a4], 0
inc esi
mov dword [ebp - 0x164], esi
cmp esi, dword [edi + 0x198]
jge 0x4ba986
mov al, byte [ebp - 0x165]
jmp 0x4b9b93
cmp byte [ebp - 0x151], 0
je 0x4ba9d1
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx]
call fcn.004be6d0
test eax, eax
je 0x4ba9b0
call fcn.004be6d0
mov ecx, eax
call fcn.00454780
test al, al
jne 0x4ba9d1
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x2d0]
test eax, eax
je 0x4ba9c2
cmp eax, 1
jne 0x4ba9cb
push edi
call fcn.00411280
add esp, 4
inc dword [edi + 0x1a0]
mov eax, dword [ebp - 0x13c]
cmp eax, 0x10
jb 0x4baa0d
mov edx, dword [ebp - 0x150]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4baa03
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab21
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov ecx, dword [ebp - 0xd4]
cmp ecx, 0x10
jb 0x4baa47
mov edx, dword [ebp - 0xe8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4baa3d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab21
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov ecx, dword [ebp - 0xec]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0xf
mov byte [ebp - 0xe8], 0
cmp ecx, 0x10
jb 0x4baa9c
mov edx, dword [ebp - 0x100]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4baa92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab21
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov ecx, dword [ebp - 0x104]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 0xf
mov byte [ebp - 0x100], 0
cmp ecx, 0x10
jb 0x4baaed
mov edx, dword [ebp - 0x118]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4baae3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4bab21
push ecx
push edx
call fcn.0051faa7
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051fa69
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.00401560
call fcn.0052eb21
call fcn.00401560
call fcn.0052eb21
call fcn.0052eb21
nop
pop ss
lcall 75, 0x9a17004b
in eax, 0x99
dec ebx
add bl, ah
lcall 0x4b, 0x9a17004b
pop ebx
lcall 61835, 0x5651004b
push ecx
push esi
mov esi, ecx