Function at 0x52f9b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e2ade
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x632da0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x632da0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x4c], edi
xor ebx, ebx
call fcn.004f7190
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.004effc0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.0045abd0
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x53013b
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x52fa94.18
movzx ecx, byte [eax + 0x5301b8]
jmp dword [ecx*4 + 0x5301a4]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x52facc
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x52fac1
mov dword [eax + 4], ecx
jmp 0x52fac4
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.0052e500
mov edi, eax
push edi
push ebp
mov ecx, esi
call fcn.0052b080
test eax, eax
je 0x5300bf
test edi, edi
jl 0x5300bf
jmp 0x530052
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ebx, dword [ecx + edx*4]
je 0x52fb20
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebx + 0x14]
je 0x52fb15
mov dword [eax + 4], ecx
jmp 0x52fb18
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x52fb5a
cmp eax, 0x16
je 0x52fb5a
cmp eax, 0x20
jne 0x52fb9c
mov ecx, dword [esi + 0xc]
mov eax, edi
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x52fb5a
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, ebx
call fcn.004f7ca0
test eax, eax
jne 0x530052
mov ecx, esi
call fcn.0052e500
mov ebp, eax
push ebp
lea edx, [ebx + 4]
push edx
mov ecx, esi
call fcn.0052aeb0
test eax, eax
je 0x5300bf
mov edi, ebp
test ebp, ebp
jl 0x5300bf
mov eax, dword [ebx + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x52fd0f
mov dword [ebp + 4], eax
jmp 0x530052
cmp eax, 0x31
je 0x52fbaa
cmp eax, 0x32
jne 0x52fc95
cmp dword [esp + 0x2c], 0
je 0x52fc95
push ebx
lea ecx, [esp + 0x70]
call fcn.004ff240
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.00584700
cmp dword [esp + 0x6c], 0
jne 0x52fbe5
cmp dword [esp + 0x70], 0
je 0x52fc23
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.004ff440
test eax, eax
jne 0x52fc23
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.0052f580
mov edi, eax
test edi, edi
jl 0x5300bf
mov eax, dword [ebx + 0x14]
mov ecx, edi
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00520f70
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004fbee0
add esp, 8
test eax, eax
jne 0x52fc41
lea eax, [ebx + 4]
push eax
jmp 0x52fcd1
mov edx, dword [ebx + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [ebx + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0052e2f0
add esp, 0x18
test eax, eax
je 0x530052
lea eax, [ebx + 4]
push eax
jmp 0x52fcd1
cmp eax, 0x11
jne 0x530052
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 0x28]
cmp eax, dword [ebx + 0x14]
je 0x530052
mov eax, edx
lea ebp, [ebx + 4]
add eax, 0xc
push ebp
push eax
call fcn.004fbee0
add esp, 8
test eax, eax
je 0x52fcd0
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0x24]
cmp ecx, dword [eax + 0x28]
je 0x52fcf8
push ebp
mov ecx, esi
call fcn.0052f580
mov edi, eax
test edi, edi
jl 0x5300bf
mov eax, dword [ebx + 0x14]
mov ecx, edi
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00520f70
jmp 0x530052
mov eax, dword [ebx + 0x14]
lea ecx, [edi + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00520f70
jmp 0x530052
mov dword [ebp + 0xc], eax
jmp 0x530052
cmp dword [esp + 0x14], 0x16
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov edi, dword [eax + ecx*4]
mov dword [esp + 0x2c], edi
jne 0x52fe2a
test ebx, ebx
je 0x52fe2a
push ebx
lea ecx, [esp + 0x60]
call fcn.004ff240
lea edx, [esp + 0x30]
push edx
mov ecx, edi
mov dword [esp + 0x5c], 0
call fcn.00584700
cmp dword [esp + 0x5c], 0
jne 0x52fd64
cmp dword [esp + 0x60], 0
je 0x52fd9f
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x64]
call fcn.004ff440
test eax, eax
jne 0x52fd9f
lea edx, [ebx + 0xc]
push edx
mov ecx, esi
call fcn.0052f580
test eax, eax
jl 0x5300bf
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00520f70
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004fbee0
add esp, 8
test eax, eax
jne 0x52fdbb
lea edx, [esp + 0x34]
push edx
jmp 0x52fe0a
mov ecx, dword [edi + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edi + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [ebx + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0052e2f0
add esp, 0x18
test eax, eax
je 0x52fe2a
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0052f580
test eax, eax
jl 0x5300bf
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00520f70
cmp dword [esp + 0x18], 0
jne 0x52fe96
lea ecx, [esp + 0x84]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 1
call fcn.00584720
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x20]
call fcn.0056aae0
test dword [esp + 0x1c], 0x80000
mov edi, dword [edi + 0x20]
je 0x52fe6c
mov dword [esp + 0x20], edi
jmp 0x52fe70
mov dword [esp + 0x28], edi
mov ecx, esi
call fcn.0052e500
mov edi, eax
push edi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.0052ad60
test eax, eax
je 0x5300bf
test edi, edi
jl 0x5300bf
mov ecx, esi
call fcn.0052e500
mov ecx, dword [esp + 0x2c]
mov ebp, eax
add ecx, 4
push ebp
push ecx
mov ecx, esi
call fcn.0052aeb0
test eax, eax
je 0x5300bf
mov edi, ebp
test ebp, ebp
jl 0x5300bf
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.0056ae80
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x52fef7
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.0056aec0
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x530052
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x84]
push edx
mov ecx, edi
call fcn.00584720
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x20]
call fcn.0056aae0
test dword [esp + 0x1c], 0x80000
mov eax, dword [edi + 0x20]
je 0x52ff3f
mov dword [esp + 0x20], eax
jmp 0x52ff43
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0052f550
mov edi, eax
test edi, edi
jl 0x5300bf
jmp 0x530052
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x52ffd7
cmp dword [ebp + 0x14], 1
jne 0x52ff96
lea ecx, [ebx + 0xc]
push ecx
mov ecx, esi
call fcn.0052f580
test eax, eax
jl 0x5300bf
mov ecx, dword [ebx + 0x14]
jmp 0x52fff0
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.0058a5c0
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x530004
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x530004
lea eax, [ebx + 0xc]
push eax
mov ecx, esi
call fcn.0052f580
test eax, eax
jl 0x5300bf
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00520f70
jmp 0x530004
cmp ecx, 0x20
jne 0x530004
mov edi, dword [eax - 4]
lea ecx, [edi + 4]
push ecx
mov ecx, esi
call fcn.0052f580
mov edi, dword [edi + 0x1c]
lea ecx, [edi + edi]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x530001
mov dword [eax + 4], ecx
jmp 0x530004
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x530039
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x530019
lea edx, [ebp + 4]
push edx
jmp 0x53001d
lea eax, [ebp + 0xc]
push eax
call fcn.0052f580
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x530036
mov dword [eax + 4], ecx
jmp 0x530039
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.0052e500
mov edi, eax
push edi
push ebp
mov ecx, esi
call fcn.0052b1d0
test eax, eax
jne 0x530052
or edi, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x52fa70
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x530102
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.0052e500
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x5300fc
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.0052aeb0
test eax, eax
je 0x5300bf
test edi, edi
jl 0x5300bf
mov ebx, dword [ebx + 0x24]
jmp 0x530127
push 0x302
call fcn.005be2b0
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
call fcn.00481ef0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004f08d0
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f7220
xor eax, eax
jmp 0x530179
lea ecx, [ebx + 0xc]
push ecx
jmp 0x53009e
cmp eax, 0x16
jne 0x53013b
mov ecx, esi
call fcn.0052e500
mov edi, eax
push edi
lea edx, [ebx + 0xc]
push edx
mov ecx, esi
call fcn.0052aeb0
test eax, eax
je 0x5300bf
test edi, edi
jl 0x5300bf
mov ebx, dword [ebx + 0x14]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x530138
mov dword [edi + 4], ebx
jmp 0x53013b
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
call fcn.00481ef0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004f08d0
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f7220
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005bf276
add esp, 0xa4
ret 4