Function at 0x547b9f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103aa259
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x5c], ebp
call fcn.0057fe9f
mov eax, 1
add dword [esp + 0x68], eax
add dword [esp + 0x6c], eax
add esi, 0x5c
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov dword [esp + 0x5c], ebp
sar eax, 2
test eax, eax
jbe 0x547f2e
mov ebx, dword [esp + 0x14]
add ebx, 0x58
push ebp
mov ecx, ebx
xor edi, edi
call fcn.0053613f
mov ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x14]
sar ecx, 2
test ecx, ecx
jbe 0x547f1c
jmp 0x547c2f
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov edx, dword [eax + 8]
push ebp
mov ecx, ebx
mov dword [esp + 0x2c], edx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x68], ecx
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
jg 0x547d01
mov edx, eax
cmp dword [esp + 0x6c], edx
jl 0x547e04
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x547c9d
xor eax, eax
jmp 0x547ca9
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 0x14]
sub eax, ecx
sar eax, 2
mov edx, dword [esp + 0x64]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x1c], edx
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x547cd6
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x64]
mov dword [eax], ecx
add eax, 4
mov dword [edx + 0x10], eax
jmp 0x547e04
cmp ecx, dword [esp + 0x1c]
jbe 0x547ce1
call fcn.00776e71
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0047928f
jmp 0x547e04
mov ecx, dword [esp + 0x68]
cmp ecx, dword [esp + 0x18]
jg 0x547e04
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x20]
push edx
mov ecx, eax
call fcn.0060679f
mov eax, dword [esp + 0x68]
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x68]
dec edx
push ebp
mov ecx, ebx
mov dword [esp + 0x24], edx
call fcn.0053613f
lea ecx, [esp + 0x20]
push ecx
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, eax
call fcn.0060575f
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x68]
cmp edx, dword [eax + 8]
jg 0x547dfb
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov ecx, dword [esp + 0x6c]
cmp ecx, dword [eax + 0x10]
jl 0x547dfb
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], edx
call fcn.0065557f
mov ecx, dword [esp + 0x68]
dec ecx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x28]
jl 0x547f02
cmp eax, dword [esp + 0x18]
jge 0x547f02
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x28]
push edx
mov ecx, eax
call fcn.0060679f
mov eax, dword [esp + 0x6c]
inc eax
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x6c]
push ebp
mov ecx, ebx
mov dword [esp + 0x2c], edx
call fcn.0053613f
lea ecx, [esp + 0x28]
push ecx
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, eax
call fcn.0060575f
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov edx, dword [esp + 0x68]
cmp edx, dword [eax + 8]
jg 0x547f02
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, dword [esp + 0x6c]
cmp ecx, dword [eax + 0x10]
jl 0x547f02
push ebp
mov ecx, ebx
call fcn.0053613f
push edi
lea ecx, [eax + 4]
call fcn.005357af
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
call fcn.0065557f
push ebp
mov ecx, ebx
inc edi
call fcn.0053613f
mov ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x14]
sar ecx, 2
cmp edi, ecx
jb 0x547c2f
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
inc ebp
sar edx, 2
cmp ebp, edx
jb 0x547c0f
mov ebx, dword [esp + 0x64]
mov edi, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov ecx, edi
sub ecx, eax
test ecx, 0xfffffffc
je 0x54852e
cmp eax, edi
jbe 0x547f51
call fcn.00776e71
mov ebp, dword [ebx]
mov ebx, dword [ebx + 0xc]
mov edx, dword [esp + 0x64]
cmp ebx, dword [edx + 0x10]
jbe 0x547f64
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
test ebp, ebp
je 0x547f72
cmp ebp, eax
je 0x547f77
call fcn.00776e71
mov ecx, edi
sub ecx, ebx
push 0x1011dd30
sar ecx, 2
push ecx
push edi
push ebx
call fcn.0052cd2f
xor ebx, ebx
push 4
mov dword [esp + 0x30], ebx
call fcn.00776c63
add esp, 0x14
cmp eax, ebx
je 0x547fa7
lea edx, [esp + 0x3c]
mov dword [eax], edx
jmp 0x547fa9
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov ebp, dword [esp + 0x64]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x5c], 2
cmp edi, dword [ebp + 0x10]
jbe 0x547fd2
call fcn.00776e71
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5480a9
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x547fee
call fcn.00776e71
mov eax, dword [edi]
mov edi, dword [esp + 0x68]
cmp dword [eax + 8], edi
jle 0x5480ed
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jbe 0x54803b
call fcn.00776e71
mov eax, dword [ebp]
cmp eax, ebx
jne 0x5480b0
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x548053
call fcn.00776e71
mov edx, dword [edi]
mov eax, dword [edx + 8]
dec eax
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
cmp eax, ebx
je 0x5480b4
cmp byte [eax + 0x18], 0
je 0x5480b4
mov ecx, dword [ecx + 0x1c8]
call fcn.004f63bf
mov ecx, eax
call fcn.004d8a2f
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
jmp 0x5480ba
mov eax, dword [eax]
jmp 0x547fe4
mov eax, dword [eax]
jmp 0x548049
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], ebx
jbe 0x5480fa
call fcn.00776e71
mov edx, dword [esp + 0x64]
mov edi, dword [edx]
mov ebp, edi
mov dword [esp + 0x38], ebx
test edi, edi
jne 0x548121
call fcn.00776e71
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
ja 0x54812c
test edi, edi
je 0x548125
mov edi, dword [edi]
jmp 0x548127
mov eax, dword [edi]
jmp 0x548111
xor edi, edi
cmp ecx, dword [edi + 0xc]
jae 0x548131
call fcn.00776e71
lea edi, [ebx - 4]
test ebp, ebp
jne 0x5481ec
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x54814d
call fcn.00776e71
mov eax, dword [edi]
mov edi, dword [esp + 0x6c]
cmp dword [eax + 0x10], edi
jge 0x548233
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
mov ecx, dword [esp + 0x64]
call fcn.0058411f
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
inc ecx
mov dword [esp + 0x6c], ecx
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea edx, [esp + 0x6c]
push edx
mov ecx, eax
call fcn.0066cf9f
mov ecx, esi
mov dword [esp + 0x6c], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x5481f4
cmp byte [eax + 0x18], 0
je 0x5481f4
mov ecx, dword [ecx + 0x1c8]
call fcn.004f63bf
mov ecx, eax
call fcn.004d8a2f
mov dword [esp + 0x6c], eax
fild dword [esp + 0x6c]
jmp 0x5481fa
mov eax, dword [ebp]
jmp 0x548143
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
mov edi, dword [eax + 0xc]
dec ebp
cmp edi, dword [eax + 0x10]
jbe 0x548249
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov ebx, dword [eax]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
jmp 0x54825f
mov eax, dword [esp + 0x64]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0xc], edi
jbe 0x548270
call fcn.00776e71
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
test ebx, ebx
je 0x54827e
cmp ebx, eax
je 0x548283
call fcn.00776e71
cmp dword [esp + 0x2c], edi
je 0x548466
test ebx, ebx
jne 0x54836c
call fcn.00776e71
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp edx, dword [eax + 0x10]
jb 0x5482aa
call fcn.00776e71
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [eax]
mov ebx, dword [ecx + 8]
test edi, edi
jne 0x548373
call fcn.00776e71
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp edx, dword [eax + 0x10]
jb 0x5482d4
call fcn.00776e71
test ebx, ebx
jle 0x548415
lea edi, [ebp + 1]
lea eax, [ebx - 1]
cmp eax, edi
jl 0x548411
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
mov ecx, esi
mov dword [esp + 0x68], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0066cf9f
dec ebx
mov ecx, esi
mov dword [esp + 0x68], ebx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea edx, [esp + 0x68]
push edx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x54837a
cmp byte [eax + 0x18], 0
je 0x54837a
mov ecx, dword [ecx + 0x1c8]
call fcn.004f63bf
mov ecx, eax
call fcn.004d8a2f
mov dword [esp + 0x68], eax
fild dword [esp + 0x68]
jmp 0x548380
mov eax, dword [ebx]
jmp 0x54829c
mov eax, dword [edi]
jmp 0x5482c6
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x20]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x20]
mov eax, dword [eax]
fstp qword [eax + 0x18]
add eax, 0x18
mov ecx, esi
mov byte [eax + 8], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov ecx, dword [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0x68], eax
test ecx, ecx
jne 0x5483c8
xor edi, edi
jmp 0x5483d1
mov edi, dword [esp + 0x50]
sub edi, ecx
sar edi, 2
mov edx, dword [esp + 0x4c]
mov ebx, edx
sub ebx, ecx
sar ebx, 2
cmp ebx, edi
jae 0x5483ed
mov ecx, edx
add ecx, 4
mov dword [edx], eax
mov dword [esp + 0x4c], ecx
jmp 0x548411
mov edi, edx
cmp ecx, edx
jbe 0x5483f8
call fcn.00776e71
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x68]
push ecx
push edi
push eax
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x4c]
call fcn.0047928f
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x54845e
call fcn.00776e71
xor eax, eax
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [eax + 0x10]
jb 0x54842e
call fcn.00776e71
mov edx, dword [esp + 0x2c]
mov eax, dword [edx]
mov ebp, dword [eax + 0x10]
test edi, edi
jne 0x548462
call fcn.00776e71
xor eax, eax
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [eax + 0x10]
jb 0x548450
call fcn.00776e71
add dword [esp + 0x2c], 4
mov ebx, dword [esp + 0x28]
jmp 0x54825f
mov eax, dword [edi]
jmp 0x548420
mov eax, dword [edi]
jmp 0x548442
mov edi, dword [esp + 0x4c]
cmp dword [esp + 0x48], edi
jbe 0x548475
call fcn.00776e71
mov esi, dword [esp + 0x48]
cmp esi, dword [esp + 0x4c]
jbe 0x548484
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x68], 0
mov edx, dword [esp + 0x68]
push edx
push eax
push ecx
push ebx
push edi
lea edx, [esp + 0x7c]
push esi
push edx
call fcn.0053571f
mov edx, dword [esp + 0x38]
xor edi, edi
add esp, 0x1c
cmp edx, edi
je 0x5484ff
mov ecx, dword [ebx + 0xc]
cmp ecx, edi
jne 0x5484c1
xor eax, eax
jmp 0x5484c9
mov eax, dword [ebx + 0x14]
sub eax, ecx
sar eax, 2
mov esi, dword [ebx + 0x10]
mov ebp, esi
sub ebp, ecx
sar ebp, 2
cmp ebp, eax
jae 0x5484e1
mov dword [esi], edx
add esi, 4
mov dword [ebx + 0x10], esi
jmp 0x5484ff
cmp ecx, esi
jbe 0x5484ea
call fcn.00776e71
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
push esi
push eax
lea edx, [esp + 0x40]
push edx
mov ecx, ebx
call fcn.0047928f
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x548510
push eax
call fcn.00776c58
add esp, 4
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
call fcn.00776c58
add esp, 4
jmp 0x548655
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x14]
test ecx, 0xfffffffc
jne 0x548548
lea ecx, [edi + 4]
call fcn.005440df
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.00543d3f
mov edx, dword [esp + 0x68]
mov ecx, esi
mov dword [esp + 0x68], edx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x6c]
mov ecx, esi
mov dword [esp + 0x68], edx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0060575f
mov eax, dword [edi + 0x54]
test eax, eax
je 0x5485cd
cmp byte [eax + 0x18], 0
je 0x5485cd
mov ecx, dword [edi + 0x1c8]
call fcn.004f63bf
mov ecx, eax
call fcn.004d8a2f
mov dword [esp + 0x68], eax
fild dword [esp + 0x68]
jmp 0x5485d3
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x68], edx
test eax, eax
jne 0x548617
xor ecx, ecx
jmp 0x54861f
mov ecx, dword [ebx + 0x14]
sub ecx, eax
sar ecx, 2
mov esi, dword [ebx + 0x10]
mov edi, esi
sub edi, eax
sar edi, 2
cmp edi, ecx
jae 0x548637
mov dword [esi], edx
add esi, 4
mov dword [ebx + 0x10], esi
jmp 0x548655
cmp eax, esi
jbe 0x548640
call fcn.00776e71
mov eax, dword [ebx]
lea edx, [esp + 0x68]
push edx
push esi
push eax
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.0047928f
mov eax, ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0xc