Function at 0x557e74
Capabilities:
Access peb ldr_data
Get ntdll base address
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
mov edx, dword [0x5241b4]
call fcn.00405ab0
xor eax, eax
push ebp
push 0x5588b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
call fcn.00461014
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0xc], 0
jne 0x558889
mov byte [ebp - 0x57], 0
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2b4]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x2b0]
mov eax, dword [ebp - 0x38]
call fcn.004efe94
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax + 0x4a9]
mov ebx, dword [ebp - 0x44]
cmp eax, ebx
jg 0x558889
cmp dword [ebp - 0x40], 0
jl 0x558889
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.0053a750
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x374]
call fcn.005371a8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x228]
dec eax
mov esi, dword [ebp - 0x40]
cmp eax, esi
jne 0x557fb9
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
cmp dword [eax + 0x1c], 0
je 0x557fb9
mov ebx, dword [ebp - 0x44]
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.0053a750
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x374]
call fcn.005371a8
mov eax, dword [eax + 0xc4]
mov eax, dword [eax + 0x1c]
lea edx, [ebp - 0x88]
call fcn.0045b288
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
add eax, 0x38
call fcn.00404e84
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.005561fc
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
lea esi, [ebp - 0x98]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x558889
mov eax, dword [0x5a8798]
mov eax, dword [eax]
call fcn.0046b8b8
test eax, eax
jne 0x558889
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x558889
lea eax, [ebp - 0x74]
push eax
mov ebx, dword [ebp - 0x40]
mov ecx, ebx
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
call fcn.005561fc
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x504]
cmp byte [eax + 4], 0
je 0x558111
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x228]
dec eax
cmp ebx, eax
jne 0x558018
mov bl, 1
jmp 0x55801a
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x2b0]
sub eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x38]
add eax, dword [edx + 0x2f2]
lea ecx, [ebp - 0xa0]
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x2b4]
sub edx, dword [ebp - 0x70]
call fcn.00407660
lea edx, [ebp - 0xa0]
mov ecx, ebx
mov eax, dword [ebp - 0x38]
call fcn.005654d8
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x558889
test bl, bl
je 0x5580a2
mov eax, dword [ebp - 0x48]
mov esi, dword [eax + 0x154]
mov eax, esi
mov edx, dword [ebp - 0x48]
add eax, dword [edx + 0x15c]
push eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x48]
mov ebx, dword [eax + 0x150]
mov ecx, ebx
mov eax, dword [ebp - 0x48]
add ecx, dword [eax + 0x158]
mov edx, esi
mov eax, ebx
call fcn.00407644
jmp 0x5580db
mov eax, dword [ebp - 0x48]
mov esi, dword [eax + 0x154]
mov eax, esi
mov edx, dword [ebp - 0x48]
add eax, dword [edx + 0x15c]
push eax
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x48]
mov ebx, dword [eax + 0x160]
mov ecx, ebx
mov eax, dword [ebp - 0x48]
add ecx, dword [eax + 0x164]
mov edx, esi
mov eax, ebx
call fcn.00407644
lea eax, [ebp - 0x84]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x74]
call fcn.0040778c
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x2f2]
neg edx
lea eax, [ebp - 0x84]
xor ecx, ecx
call fcn.0040778c
lea esi, [ebp - 0x84]
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x2b4]
sub edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x2b0]
sub eax, dword [ebp - 0x74]
call fcn.00407660
mov byte [ebp - 0x55], 0
mov byte [ebp - 0x56], 0
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x3a4], 0
jne 0x55815a
mov dl, 1
mov eax, dword [0x42f5b4]
call fcn.00430e08
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x3a4], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
call dword [edx + 0x6c]
test al, al
je 0x558180
mov eax, dword [ebp - 0x38]
call fcn.0045df34
mov edx, eax
sub edx, dword [ebp - 0x6c]
sub edx, dword [ebp - 0x74]
lea eax, [ebp - 0x74]
xor ecx, ecx
call fcn.0040778c
mov eax, dword [ebp - 0x48]
call fcn.00533100
add eax, dword [ebp - 0x74]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x228]
dec eax
cmp eax, dword [ebp - 0x40]
jne 0x55830e
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.00532090
test al, al
je 0x55830e
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.005320c4
cmp eax, 2
jle 0x5581f4
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.005320c4
sub eax, 2
sub dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.005320c4
sub eax, 2
sub dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x35c]
cmp al, 1
jne 0x55825d
mov ebx, dword [ebp - 0x44]
mov edx, ebx
mov eax, dword [ebp - 0x38]
call fcn.0053a750
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x5ac]
mov eax, dword [edx + eax*8]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 4]
call fcn.00404ec8
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax + 0x4a9]
sub ebx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x5ac]
mov eax, dword [eax + ebx*8]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x68]
pop edx
sub eax, edx
inc eax
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x38]
cmp eax, dword [edx + 0x2b4]
jg 0x558889
jmp 0x55826e
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.00531944
mov eax, dword [ebp - 0x38]
mov edx, dword [eax]
call dword [edx + 0x35c]
cmp al, 1
je 0x558299
mov eax, dword [ebp - 0x38]
call fcn.0054d2ec
test eax, eax
jne 0x558299
mov eax, dword [ebp - 0x38]
call fcn.0054d2f4
test eax, eax
jne 0x558299
xor eax, eax
jmp 0x55829b
mov al, 1
mov byte [ebp - 0x55], al
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.0053191c
mov byte [ebp - 0x56], al
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.0053196c
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3a4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x3a4]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x250]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov eax, dword [eax + 0xc4]
call fcn.00532354
cmp al, 1
jne 0x5586a6
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x74]
call fcn.005282ec
jmp 0x5586a6
mov eax, dword [ebp - 0x38]
call fcn.0054fc98
movzx eax, al
mov ebx, dword [ebp - 0x40]
cmp eax, ebx
jg 0x5585ab
mov eax, dword [ebp - 0x38]
call fcn.0055a9a0
mov esi, eax
mov eax, dword [ebp - 0x38]
call fcn.0054fc98
movzx eax, al
add esi, eax
cmp ebx, esi
jge 0x5585ab
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x37c]
cmp byte [eax + 0x15], 0
je 0x5585ab
mov byte [ebp - 0x57], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x510]
cmp byte [eax + 9], 0
je 0x5583a3
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x27c]
cmp eax, dword [ebp - 0x40]
jne 0x5583a3
mov eax, dword [ebp - 0x38]
call fcn.0054fc98
movzx eax, al
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
call dword [ecx + 0x1e4]
mov ecx, dword [ebp - 0x68]
mov edx, dword [ebp - 0x70]
sub ecx, edx
cmp eax, ecx
jge 0x5583a3
add eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x38]
call fcn.0054fc98
movzx eax, al
mov edx, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x38]
call fcn.00550ba8
xor edx, edx
push ebp
push 0x5585a4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x538]
mov edx, dword [eax]
call dword [edx + 0x24]
test al, al
je 0x558408
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x538]
mov eax, dword [eax + 0x1c]
call fcn.00567f1c
test eax, eax
jle 0x558408
mov eax, dword [ebp - 0x38]
call fcn.00550d7c
cmp byte [eax + 0x50], 1
jne 0x558408
call fcn.00404834
jmp 0x558889
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov ebx, eax
lea ecx, [ebp - 0xa0]
lea edx, [ebx + 8]
mov eax, dword [ebp - 0x38]
call fcn.0045e0f8
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00404e30
lea esi, [ebp - 0x74]
lea edi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3a4]
mov dword [ebp - 0x24], eax
mov edx, dword [0x5a8820]
mov edx, dword [edx]
mov edx, dword [edx + 0x80]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
cmp word [eax + 0x40a], 0
je 0x5584bc
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [eax + 0x2b0]
mov ebx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebx + 0x40c]
call dword [ebx + 0x408]
cmp byte [ebp - 0x58], 0
jne 0x558504
cmp dword [ebp - 0x48], 0
je 0x558504
mov eax, dword [ebp - 0x48]
cmp word [eax + 0x102], 0
je 0x558504
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
lea ecx, [eax + 0x2b0]
mov ebx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebx + 0x104]
call dword [ebx + pe_nt_image_headers32]
cmp byte [ebp - 0x58], 0
jne 0x558532
mov eax, dword [ebp - 0x48]
call fcn.005355a8
test al, al
je 0x558532
mov eax, dword [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x38]
lea edx, [eax + 0x2b0]
lea ecx, [ebp - 0x44]
mov eax, dword [ebp - 0x38]
call fcn.00557aa8
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov ebx, eax
lea edi, [ebx + 0x18]
lea esi, [ebp - 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x38]
call fcn.0045e048
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x34], eax
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 8]
call fcn.00404e84
mov byte [ebp - 0x58], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5586a6
mov eax, dword [ebp - 0x38]
call fcn.00550cac
ret
mov eax, dword [ebp - 0x38]
call fcn.0054d2e4
test eax, eax
jle 0x558889
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x2d4]
dec eax
cmp eax, dword [ebp - 0x40]
jge 0x558889
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x40]
mov edx, esi
sub edx, dword [eax + 0x2d4]
mov eax, dword [ebp - 0x48]
call fcn.00535604
mov ebx, eax
mov eax, ebx
call fcn.0055e848
test al, al
je 0x558889
mov eax, ebx
call fcn.0055e668
mov edx, eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3a4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x3a4]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x250]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
movzx eax, byte [ebx + 0x31]
mov byte [ebp - 0x55], al
mov eax, ebx
call fcn.0055e644
mov byte [ebp - 0x56], al
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x38]
mov edx, esi
sub edx, dword [eax + 0x2d4]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
mov edi, dword [eax]
call dword [edi + 0x348]
mov eax, ebx
call fcn.0055e658
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x250]
mov eax, dword [eax + 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x56]
push eax
movzx eax, byte [0x5588c8]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
call fcn.0053a750
mov edx, eax
mov eax, dword [ebp - 0x38]
mov ecx, esi
sub ecx, dword [eax + 0x2d4]
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x2c8]
cmp byte [ebp - 0x58], 0
jne 0x55886e
cmp byte [ebp - 0x55], 0
je 0x5586bd
mov ebx, 2
jmp 0x5586bf
xor ebx, ebx
cmp byte [ebp - 0x57], 0
je 0x5586d7
mov eax, dword [ebp - 0x48]
call fcn.00533c80
add al, 0xfc
sub al, 2
jae 0x5586d7
mov al, 1
jmp 0x55870e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x3b4]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x74]
push eax
movzx eax, byte [ebp - 0x55]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
call fcn.00460fe8
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x250]
mov ecx, ebx
call fcn.00528304
mov edx, dword [ebp - 0x38]
cmp byte [edx + 0x29c], 0
je 0x558721
mov esi, 2
jmp 0x558726
mov esi, 1
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + 8]
mov ebx, edx
test al, al
jne 0x55874b
cmp byte [ebp - 0x56], 1
jne 0x558866
mov eax, dword [ebp - 0x50]
sub eax, 2
cmp eax, dword [ebp - 0x6c]
jle 0x558866
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.00404e84
push esi
lea edi, [ebx + 0x18]
lea esi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
movzx eax, byte [ebp - 0x56]
sub al, 1
jb 0x558775
je 0x55879d
dec al
je 0x5587cb
jmp 0x558815
lea ecx, [ebp - 0xa0]
mov edx, dword [ebp - 0x70]
sub edx, esi
mov eax, dword [ebp - 0x74]
dec eax
call fcn.00407660
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + 0xc], eax
jmp 0x558815
lea ecx, [ebp - 0xa0]
mov edx, dword [ebp - 0x70]
sub edx, esi
mov eax, dword [ebp - 0x50]
inc eax
sub eax, dword [ebp - 0x4c]
sub eax, 7
call fcn.00407660
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + 0xc], eax
jmp 0x558815
mov eax, dword [ebp - 0x50]
inc eax
sub eax, dword [ebp - 0x4c]
sub eax, 6
mov edx, dword [ebp - 0x4c]
sar edx, 1
jns 0x5587df
adc edx, 0
add eax, edx
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x74]
sub edx, 4
sar edx, 1
jns 0x5587f1
adc edx, 0
sub eax, edx
lea ecx, [ebp - 0xa0]
mov edx, dword [ebp - 0x70]
sub edx, esi
call fcn.00407660
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x48]
mov edx, dword [eax]
call dword [edx + 0x6c]
test al, al
je 0x55882f
mov eax, dword [ebp - 0x38]
call fcn.0045df34
sub eax, dword [ebx + 8]
mov dword [ebx + 8], eax
lea ecx, [ebp - 0xa0]
lea edx, [ebx + 8]
mov eax, dword [ebp - 0x38]
call fcn.0045e048
mov eax, dword [ebp - 0xa0]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebx + 0xc], eax
cmp byte [ebp - 0x55], 0
je 0x55886e
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x74]
sub eax, 4
mov dword [ebx + 0x10], eax
jmp 0x55886e
lea eax, [ebx + 0x38]
call fcn.00404e30
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
mov edx, dword [0x537f18]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x3a4]
mov dword [eax + 0x3c], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5588bf
lea eax, [ebp - 0x88]
call fcn.00404e30
lea eax, [ebp - 0x34]
mov edx, dword [0x5241b4]
call fcn.00405b80
lea eax, [ebp - 4]
call fcn.00404e30
ret