Function at 0x541158
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10185d23
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x20], esi
mov dword [esi], 0x10198ea8
mov dword [esi + 8], 0x10198f70
mov dword [esi + 0x30], 0x10198e9c
mov dword [esi + 0x34], 0x10198e94
mov dword [esi + 0x38], 0x10198e6c
mov dword [esi + 0x3c], 0x10198e58
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
push 1
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x44], 0x6c
call fcn.0053d288
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x5411e0
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esi + 0x272c]
cmp ecx, ebx
je 0x5411f2
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esi + 0x26dc]
cmp eax, ebx
je 0x541208
mov edx, dword [eax + 4]
lea ecx, [eax + 4]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esi + 0x2730]
cmp ecx, ebx
je 0x54121a
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x54122b
push eax
call fcn.005f2b23
add esp, 4
mov eax, dword [esi + 0x33d4]
cmp eax, ebx
lea edi, [esi + 0x33d0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x541263
mov edx, dword [esp + 0x20]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.00528068
mov eax, dword [edi + 4]
push eax
call fcn.005f2b23
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x33c0]
mov ecx, dword [eax]
lea edi, [esi + 0x33bc]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x28]
push eax
mov ecx, edi
mov byte [esp + 0x50], 0x69
call fcn.004a65b8
mov eax, dword [edi + 4]
push eax
call fcn.005f2b23
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x33a4], 0x10
jb 0x5412b9
mov eax, dword [esi + 0x3390]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x33a0], ebx
lea edi, [esi + 0x3380]
mov ebp, 0xf
mov dword [esi + 0x33a4], ebp
mov byte [esi + 0x3390], 0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov byte [esp + 0x50], 0x67
call fcn.004a65b8
mov eax, dword [edi + 4]
push eax
call fcn.005f2b23
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x3370]
lea edi, [esi + 0x336c]
add esp, 4
cmp eax, ebx
je 0x54132f
mov edx, dword [esp + 0x20]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.00528068
mov eax, dword [edi + 4]
push eax
call fcn.005f2b23
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [esi + 0x3368], 0x10
jb 0x541350
mov eax, dword [esi + 0x3354]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x3368], ebp
mov dword [esi + 0x3364], ebx
lea ecx, [esi + 0x32e0]
mov byte [esi + 0x3354], 0
call fcn.004d22b8
lea ecx, [esi + 0x32b0]
call fcn.004d22b8
lea ecx, [esi + 0x3280]
call fcn.004d22b8
lea ecx, [esi + 0x3178]
mov byte [esp + 0x3c], 0x61
call fcn.004de9d8
mov edi, dword [0x10197070]
lea eax, [esi + 0x30bc]
mov ebx, 0x101975e4
push eax
mov dword [esi + 0x30b8], ebx
call edi
lea ecx, [esi + 0x30a0]
mov ebp, 0x101975e0
mov dword [esi + 0x30b8], ebp
push ecx
mov dword [esi + 0x309c], ebx
call edi
mov dword [esi + 0x309c], ebp
lea edx, [esi + 0x3080]
mov dword [esi + 0x3078], 0x10198870
push edx
mov dword [esi + 0x307c], ebx
call edi
mov dword [esi + 0x307c], ebp
lea eax, [esi + 0x305c]
mov dword [esi + 0x3054], 0x10198870
push eax
mov dword [esi + 0x3058], ebx
call edi
mov dword [esi + 0x3058], ebp
lea ecx, [esi + 0x3038]
mov dword [esi + 0x3030], 0x10198870
push ecx
mov dword [esi + 0x3034], ebx
call edi
mov dword [esi + 0x3034], ebp
lea edx, [esi + 0x3004]
mov dword [esi + 0x2ffc], 0x10198870
push edx
mov dword [esi + 0x3000], ebx
call edi
mov dword [esi + 0x3000], ebp
lea eax, [esi + 0x2fe0]
mov dword [esi + 0x2fd8], 0x10198870
push eax
mov dword [esi + 0x2fdc], ebx
call edi
mov dword [esi + 0x2fdc], ebp
mov dword [esi + 0x2f94], 0x10198da0
cmp dword [esi + 0x2fcc], 0x10
jb 0x54148b
mov eax, dword [esi + 0x2fb8]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x2fcc], 0xf
mov dword [esi + 0x2fc8], 0
lea ecx, [esi + 0x2f9c]
mov byte [esi + 0x2fb8], 0
push ecx
mov dword [esi + 0x2f98], ebx
call edi
mov dword [esi + 0x2f98], ebp
cmp dword [esi + 0x2f90], 0x10
jb 0x5414d3
mov eax, dword [esi + 0x2f7c]
push eax
call fcn.005f2b23
add esp, 4
xor ecx, ecx
mov dword [esi + 0x2f90], 0xf
mov dword [esi + 0x2f8c], ecx
lea eax, [esi + 0x2f48]
mov byte [esi + 0x2f7c], cl
mov edx, dword [eax + 4]
cmp edx, ecx
je 0x541521
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
push ecx
push eax
mov eax, dword [esp + 0x20]
push eax
push edx
call fcn.00528068
mov eax, dword [esi + 0x2f4c]
push eax
call fcn.005f2b23
add esp, 0x14
xor ecx, ecx
mov dword [esi + 0x2f4c], ecx
mov dword [esi + 0x2f50], ecx
mov dword [esi + 0x2f54], ecx
lea ecx, [esi + 0x2ef0]
push ecx
mov dword [esi + 0x2eec], ebx
call edi
lea edx, [esi + 0x2ed4]
mov dword [esi + 0x2eec], ebp
push edx
mov dword [esi + 0x2ed0], ebx
call edi
mov dword [esi + 0x2ed0], ebp
lea eax, [esi + 0x2eb0]
mov dword [esi + 0x2ea8], 0x10198870
push eax
mov dword [esi + 0x2eac], ebx
call edi
mov dword [esi + 0x2eac], ebp
lea ecx, [esi + 0x2e8c]
mov dword [esi + 0x2e84], 0x10198870
push ecx
mov dword [esi + 0x2e88], ebx
call edi
mov dword [esi + 0x2e88], ebp
lea edx, [esi + 0x2e68]
mov dword [esi + 0x2e60], 0x10198870
push edx
mov dword [esi + 0x2e64], ebx
call edi
mov dword [esi + 0x2e64], ebp
lea eax, [esi + 0x2e44]
mov dword [esi + 0x2e3c], 0x10198870
push eax
mov dword [esi + 0x2e40], ebx
call edi
mov dword [esi + 0x2e40], ebp
lea ecx, [esi + 0x2e20]
mov dword [esi + 0x2e18], 0x10198870
push ecx
mov dword [esi + 0x2e1c], ebx
call edi
mov dword [esi + 0x2e1c], ebp
lea edx, [esi + 0x2dfc]
mov dword [esi + 0x2df4], 0x10198870
push edx
mov dword [esi + 0x2df8], ebx
call edi
mov dword [esi + 0x2df8], ebp
lea eax, [esi + 0x2dd8]
mov dword [esi + 0x2dd0], 0x10198870
push eax
mov dword [esi + 0x2dd4], ebx
call edi
mov dword [esi + 0x2dd4], ebp
lea ecx, [esi + 0x2db4]
mov dword [esi + 0x2dac], 0x10198870
push ecx
mov dword [esi + 0x2db0], ebx
call edi
mov dword [esi + 0x2db0], ebp
lea edx, [esi + 0x2d90]
mov dword [esi + 0x2d88], 0x10198870
push edx
mov dword [esi + 0x2d8c], ebx
call edi
mov dword [esi + 0x2d8c], ebp
lea eax, [esi + 0x2d6c]
mov dword [esi + 0x2d64], 0x10198870
push eax
mov dword [esi + 0x2d68], ebx
call edi
mov dword [esi + 0x2d68], ebp
lea ecx, [esi + 0x2d48]
mov dword [esi + 0x2d40], 0x10198870
push ecx
mov dword [esi + 0x2d44], ebx
call edi
mov dword [esi + 0x2d44], ebp
mov dword [esi + 0x2d1c], 0x10198870
mov dword [esi + 0x2d20], ebx
lea edx, [esi + 0x2d24]
push edx
call edi
mov dword [esi + 0x2d20], ebp
lea eax, [esi + 0x2d00]
mov dword [esi + 0x2cf8], 0x10198870
push eax
mov dword [esi + 0x2cfc], ebx
call edi
mov dword [esi + 0x2cfc], ebp
lea ecx, [esi + 0x2cdc]
mov dword [esi + 0x2cd4], 0x10198870
push ecx
mov dword [esi + 0x2cd8], ebx
call edi
mov dword [esi + 0x2cd8], ebp
lea edx, [esi + 0x2cb8]
mov dword [esi + 0x2cb0], 0x10198870
push edx
mov dword [esi + 0x2cb4], ebx
call edi
mov dword [esi + 0x2cb4], ebp
lea eax, [esi + 0x2c94]
mov dword [esi + 0x2c8c], 0x10198870
push eax
mov dword [esi + 0x2c90], ebx
call edi
mov dword [esi + 0x2c90], ebp
lea ecx, [esi + 0x2c70]
mov dword [esi + 0x2c68], 0x10198870
push ecx
mov dword [esi + 0x2c6c], ebx
call edi
mov dword [esi + 0x2c6c], ebp
lea edx, [esi + 0x2c4c]
mov dword [esi + 0x2c44], 0x10198870
push edx
mov dword [esi + 0x2c48], ebx
call edi
mov dword [esi + 0x2c48], ebp
lea eax, [esi + 0x2c28]
mov dword [esi + 0x2c20], 0x10198870
push eax
mov dword [esi + 0x2c24], ebx
call edi
mov dword [esi + 0x2c24], ebp
lea ecx, [esi + 0x2c04]
mov dword [esi + 0x2bfc], 0x10198870
push ecx
mov dword [esi + 0x2c00], ebx
call edi
mov dword [esi + 0x2c00], ebp
lea edx, [esi + 0x2be0]
mov dword [esi + 0x2bd8], 0x10198870
push edx
mov dword [esi + 0x2bdc], ebx
call edi
mov dword [esi + 0x2bdc], ebp
lea eax, [esi + 0x2bbc]
mov dword [esi + 0x2bb4], 0x10198870
push eax
mov dword [esi + 0x2bb8], ebx
call edi
mov dword [esi + 0x2bb8], ebp
lea ecx, [esi + 0x2b98]
mov dword [esi + 0x2b90], 0x10198870
push ecx
mov dword [esi + 0x2b94], ebx
call edi
mov dword [esi + 0x2b94], ebp
lea edx, [esi + 0x2b74]
mov dword [esi + 0x2b6c], 0x10198870
push edx
mov dword [esi + 0x2b70], ebx
call edi
mov dword [esi + 0x2b70], ebp
lea eax, [esi + 0x2b50]
mov dword [esi + 0x2b48], 0x10198870
push eax
mov dword [esi + 0x2b4c], ebx
call edi
mov dword [esi + 0x2b4c], ebp
lea ecx, [esi + 0x2b2c]
mov dword [esi + 0x2b24], 0x10198870
push ecx
mov dword [esi + 0x2b28], ebx
call edi
mov dword [esi + 0x2b28], ebp
lea edx, [esi + 0x2b08]
mov dword [esi + 0x2b00], 0x10198870
push edx
mov dword [esi + 0x2b04], ebx
call edi
mov dword [esi + 0x2b04], ebp
lea eax, [esi + 0x2ae4]
mov dword [esi + 0x2adc], 0x10198870
push eax
mov dword [esi + 0x2ae0], ebx
call edi
mov dword [esi + 0x2ae0], ebp
lea ecx, [esi + 0x2ac0]
mov dword [esi + 0x2ab8], 0x10198870
push ecx
mov dword [esi + 0x2abc], ebx
call edi
mov dword [esi + 0x2abc], ebp
lea edx, [esi + 0x2a9c]
mov dword [esi + 0x2a94], 0x10198870
push edx
mov dword [esi + 0x2a98], ebx
call edi
mov dword [esi + 0x2a98], ebp
lea eax, [esi + 0x2a78]
mov dword [esi + 0x2a70], 0x10198870
push eax
mov dword [esi + 0x2a74], ebx
call edi
mov dword [esi + 0x2a74], ebp
lea ecx, [esi + 0x2a54]
mov dword [esi + 0x2a4c], 0x10198870
push ecx
mov dword [esi + 0x2a50], ebx
call edi
mov dword [esi + 0x2a50], ebp
lea edx, [esi + 0x2a30]
mov dword [esi + 0x2a28], 0x10198870
push edx
mov dword [esi + 0x2a2c], ebx
call edi
mov dword [esi + 0x2a2c], ebp
lea eax, [esi + 0x2a0c]
mov dword [esi + 0x2a04], 0x10198870
push eax
mov dword [esi + 0x2a08], ebx
call edi
mov dword [esi + 0x2a08], ebp
lea ecx, [esi + 0x29e8]
mov dword [esi + 0x29e0], 0x10198870
push ecx
mov dword [esi + 0x29e4], ebx
call edi
mov dword [esi + 0x29e4], ebp
lea edx, [esi + 0x29bc]
mov dword [esi + 0x29b0], 0x1019767c
push edx
mov dword [esi + 0x29b8], ebx
call edi
mov dword [esi + 0x29b8], ebp
lea eax, [esi + 0x2994]
mov dword [esi + 0x298c], 0x10198870
push eax
mov dword [esi + 0x2990], ebx
call edi
mov dword [esi + 0x2990], ebp
lea ecx, [esi + 0x2970]
mov dword [esi + 0x2968], 0x10198870
push ecx
mov dword [esi + 0x296c], ebx
call edi
mov dword [esi + 0x296c], ebp
mov dword [esi + 0x2944], 0x10198870
mov dword [esi + 0x2948], ebx
lea edx, [esi + 0x294c]
push edx
call edi
mov dword [esi + 0x2948], ebp
lea eax, [esi + 0x2928]
mov dword [esi + 0x2920], 0x10198870
push eax
mov dword [esi + 0x2924], ebx
call edi
mov dword [esi + 0x2924], ebp
lea ecx, [esi + 0x2904]
mov dword [esi + 0x28fc], 0x10198870
push ecx
mov dword [esi + 0x2900], ebx
call edi
mov dword [esi + 0x2900], ebp
lea edx, [esi + 0x28e0]
mov dword [esi + 0x28d8], 0x10198870
push edx
mov dword [esi + 0x28dc], ebx
call edi
mov dword [esi + 0x28dc], ebp
lea eax, [esi + 0x28bc]
mov dword [esi + 0x28b4], 0x10198870
push eax
mov dword [esi + 0x28b8], ebx
call edi
mov dword [esi + 0x28b8], ebp
lea ecx, [esi + 0x2898]
mov dword [esi + 0x2890], 0x10198870
push ecx
mov dword [esi + 0x2894], ebx
call edi
mov dword [esi + 0x2894], ebp
lea edx, [esi + 0x2874]
mov dword [esi + 0x286c], 0x10198870
push edx
mov dword [esi + 0x2870], ebx
call edi
mov dword [esi + 0x2870], ebp
lea eax, [esi + 0x2850]
mov dword [esi + 0x2848], 0x10198870
push eax
mov dword [esi + 0x284c], ebx
call edi
mov dword [esi + 0x284c], ebp
lea ecx, [esi + 0x282c]
mov dword [esi + 0x2824], 0x10198870
push ecx
mov dword [esi + 0x2828], ebx
call edi
mov dword [esi + 0x2828], ebp
lea edx, [esi + 0x2808]
mov dword [esi + 0x2800], 0x10198870
push edx
mov dword [esi + 0x2804], ebx
call edi
mov dword [esi + 0x2804], ebp
lea eax, [esi + 0x27e0]
mov dword [esi + 0x27d8], 0x10198870
push eax
mov dword [esi + 0x27dc], ebx
call edi
mov dword [esi + 0x27dc], ebp
lea ecx, [esi + 0x27b4]
mov dword [esi + 0x27a8], 0x1019767c
push ecx
mov dword [esi + 0x27b0], ebx
call edi
mov dword [esi + 0x27b0], ebp
lea edx, [esi + 0x2784]
mov dword [esi + 0x2778], 0x1019767c
push edx
mov dword [esi + 0x2780], ebx
call edi
mov dword [esi + 0x2780], ebp
lea eax, [esi + 0x2754]
mov dword [esi + 0x2748], 0x1019767c
push eax
mov dword [esi + 0x2750], ebx
call edi
lea ecx, [esi + 0x26f0]
mov dword [esi + 0x2750], ebp
mov byte [esp + 0x3c], 0x20
call fcn.00598eb2
lea ecx, [esi + 0x26b8]
mov dword [esi + 0x26b0], 0x10198870
push ecx
mov dword [esi + 0x26b4], ebx
call edi
lea ecx, [esi + 0x2690]
mov dword [esi + 0x26b4], ebp
mov byte [esp + 0x3c], 0x1e
call fcn.004c68a8
lea edx, [esi + 0x266c]
mov dword [esi + 0x2660], 0x1019767c
push edx
mov dword [esi + 0x2668], ebx
call edi
lea eax, [esi + 0x2620]
mov dword [esi + 0x2668], ebp
mov ecx, dword [eax + 4]
xor edx, edx
cmp ecx, edx
je 0x541c3f
mov edx, dword [eax + 8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call fcn.00528068
mov eax, dword [esi + 0x2624]
push eax
call fcn.005f2b23
add esp, 0x14
xor edx, edx
mov dword [esi + 0x2624], edx
mov dword [esi + 0x2628], edx
mov dword [esi + 0x262c], edx
lea ecx, [esi + 0x25c0]
mov dword [esi + 0x25b8], 0x10198870
push ecx
mov dword [esi + 0x25bc], ebx
call edi
mov dword [esi + 0x25bc], ebp
cmp dword [esi + 0x25b4], 0x10
jb 0x541c88
mov eax, dword [esi + 0x25a0]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x25b4], 0xf
mov dword [esi + 0x25b0], 0
mov byte [esi + 0x25a0], 0
lea edx, [esi + 0x2578]
mov dword [esi + 0x2570], 0x10198870
push edx
mov dword [esi + 0x2574], ebx
call edi
lea ecx, [esi + 0x2426]
mov dword [esi + 0x2574], ebp
call fcn.004d26a8
lea eax, [esi + 0x23f0]
mov dword [esi + 0x23e8], 0x10198870
push eax
mov dword [esi + 0x23ec], ebx
call edi
mov dword [esi + 0x23ec], ebp
lea ecx, [esi + 0x23cc]
mov dword [esi + 0x23c4], 0x10198870
push ecx
mov dword [esi + 0x23c8], ebx
call edi
mov dword [esi + 0x23c8], ebp
lea edx, [esi + 0x23a0]
mov dword [esi + 0x2398], 0x10198870
push edx
mov dword [esi + 0x239c], ebx
call edi
mov dword [esi + 0x239c], ebp
lea eax, [esi + 0x2344]
mov dword [esi + 0x233c], 0x10198870
push eax
mov dword [esi + 0x2340], ebx
call edi
mov dword [esi + 0x2340], ebp
lea ecx, [esi + 0x2314]
mov dword [esi + 0x230c], 0x10198870
push ecx
mov dword [esi + 0x2310], ebx
call edi
mov dword [esi + 0x2310], ebp
lea edx, [esi + 0x22f0]
mov dword [esi + 0x22e8], 0x10198870
push edx
mov dword [esi + 0x22ec], ebx
call edi
mov dword [esi + 0x22ec], ebp
lea eax, [esi + 0x22c4]
mov dword [esi + 0x22b8], 0x1019767c
push eax
mov dword [esi + 0x22c0], ebx
call edi
mov dword [esi + 0x22c0], ebp
cmp dword [esi + 0x22a8], 0x10
jb 0x541dbe
mov eax, dword [esi + 0x2294]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x22a8], 0xf
mov dword [esi + 0x22a4], 0
mov byte [esi + 0x2294], 0
cmp dword [esi + 0x228c], 0x10
jb 0x541df1
mov eax, dword [esi + 0x2278]
push eax
call fcn.005f2b23
add esp, 4
mov dword [esi + 0x228c], 0xf
mov dword [esi + 0x2288], 0
mov byte [esi + 0x2278], 0
lea ecx, [esi + 0x222c]
mov dword [esi + 0x2224], 0x10198870
push ecx
mov dword [esi + 0x2228], ebx
call edi
mov dword [esi + 0x2228], ebp
lea edx, [esi + 0x2208]
mov dword [esi + 0x2200], 0x10198870
push edx
mov dword [esi + 0x2204], ebx
call edi
mov dword [esi + 0x2204], ebp
lea eax, [esi + 0x21e4]
mov dword [esi + 0x21dc], 0x10198870
push eax
mov dword [esi + 0x21e0], ebx
call edi
mov dword [esi + 0x21e0], ebp
lea ecx, [esi + 0x21c0]
mov dword [esi + 0x21b8], 0x10198870
push ecx
mov dword [esi + 0x21bc], ebx
call edi
lea ecx, [esi + 0x20f8]
mov dword [esi + 0x21bc], ebp
call fcn.00528728
lea ecx, [esi + 0x1e90]
call fcn.004ed7f8
lea edx, [esi + 0x1e5c]
mov dword [esi + 0x1e50], 0x1019767c
push edx
mov dword [esi + 0x1e58], ebx
call edi
mov dword [esi + 0x1e58], ebp
mov eax, dword [esi + 0x1e44]
xor ecx, ecx
cmp eax, ecx
je 0x541ed4
push eax
call fcn.005f2b23
add esp, 4
xor ecx, ecx
mov dword [esi + 0x1e44], ecx
mov dword [esi + 0x1e48], ecx
mov dword [esi + 0x1e4c], ecx
mov eax, dword [esi + 0x1e34]
cmp eax, ecx
je 0x541efb
push eax
call fcn.005f2b23
add esp, 4
xor ecx, ecx
mov dword [esi + 0x1e34], ecx
mov dword [esi + 0x1e38], ecx
mov dword [esi + 0x1e3c], ecx
lea eax, [esi + 0x1dfc]
mov dword [esi + 0x1df4], 0x10198870
push eax
mov dword [esi + 0x1df8], ebx
call edi
mov dword [esi + 0x1df8], ebp
lea ecx, [esi + 0x1dd8]
mov dword [esi + 0x1dd0], 0x10198870
push ecx
mov dword [esi + 0x1dd4], ebx
call edi
mov dword [esi + 0x1dd4], ebp
lea edx, [esi + 0x1db4]
mov dword [esi + 0x1dac], 0x10198870
push edx
mov dword [esi + 0x1db0], ebx
call edi
lea ecx, [esi + 0x1d44]
mov dword [esi + 0x1db0], ebp
mov byte [esp + 0x3c], 2
call fcn.00591a91
lea eax, [esi + 0x1d2c]
push eax
mov dword [esi + 0x1d28], ebx
call edi
mov dword [esi + 0x1d28], ebp
mov ecx, esi
mov dword [esi + 8], 0x10198748
mov dword [esp + 0x3c], 0xffffffff
call fcn.004c58b8
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret