Function at 0x533710
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e824e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x4c], edi
call fcn.004f8520
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.004f1250
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.004e79a0
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x533f59
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x5337f4.18
movzx ecx, byte [eax + 0x533fd8]
jmp dword [ecx*4 + 0x533fc4]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x53382c
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x533821
mov dword [eax + 4], ecx
jmp 0x533824
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.00532260
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0052ef30
test eax, eax
je 0x533ed5
test ebx, ebx
jl 0x533ed5
jmp 0x533e52
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx + edx*4]
je 0x533880
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [edi + 0x14]
je 0x533875
mov dword [eax + 4], ecx
jmp 0x533878
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5338ba
cmp eax, 0x16
je 0x5338ba
cmp eax, 0x20
jne 0x5338fc
mov ecx, dword [esi + 0xc]
mov eax, ebx
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x5338ba
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, edi
call fcn.004f8f70
test eax, eax
jne 0x533e52
mov ecx, esi
call fcn.00532260
mov ebp, eax
push ebp
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.0052ed60
test eax, eax
je 0x533ed5
mov ebx, ebp
test ebp, ebp
jl 0x533ed5
mov eax, dword [edi + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x533ac2
mov dword [ebp + 4], eax
jmp 0x533e52
cmp eax, 0x31
je 0x53390a
cmp eax, 0x32
jne 0x533a46
cmp dword [esp + 0x1c], 0
je 0x533a46
push edi
lea ecx, [esp + 0x70]
call fcn.00501a30
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.00588b80
cmp dword [esp + 0x6c], 0
jne 0x533945
cmp dword [esp + 0x70], 0
je 0x533983
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.00501c50
test eax, eax
jne 0x533983
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.005332e0
mov ebx, eax
test ebx, ebx
jl 0x533ed5
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00524af0
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004fa8a0
add esp, 8
test eax, eax
jne 0x5339a1
lea eax, [edi + 4]
push eax
jmp 0x533a84
mov edx, dword [edi + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.005321b0
add esp, 0x18
test eax, eax
je 0x5339f4
lea eax, [edi + 4]
push eax
jmp 0x533a84
mov edx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x10]
sub ecx, dword [edi + 4]
sub eax, dword [edi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x3c]
sub edx, ebp
mov ebp, dword [esp + 0x40]
sub ebp, dword [esp + 0x14]
test ecx, ecx
jle 0x533a22
test edx, edx
jl 0x533a40
test ecx, ecx
jge 0x533a28
test edx, edx
jg 0x533a40
test eax, eax
jle 0x533a32
test ebp, ebp
jl 0x533a40
test eax, eax
jge 0x533e52
test ebp, ebp
jle 0x533e52
lea eax, [edi + 4]
push eax
jmp 0x533a84
cmp eax, 0x11
jne 0x533e52
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x28]
cmp eax, dword [edi + 0x14]
je 0x533e52
mov ecx, dword [esp + 0x48]
lea ebp, [edi + 4]
add ecx, 0xc
push ebp
push ecx
call fcn.004fa8a0
add esp, 8
test eax, eax
je 0x533a83
mov eax, dword [esp + 0x48]
mov edx, dword [eax + 0x24]
cmp edx, dword [eax + 0x28]
je 0x533aab
push ebp
mov ecx, esi
call fcn.005332e0
mov ebx, eax
test ebx, ebx
jl 0x533ed5
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00524af0
jmp 0x533e52
mov eax, dword [edi + 0x14]
lea ecx, [ebx + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.00524af0
jmp 0x533e52
mov dword [ebp + 0xc], eax
jmp 0x533e52
cmp dword [esp + 0x14], 0x16
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + edx*4]
mov dword [esp + 0x1c], eax
jne 0x533c2a
test edi, edi
je 0x533c2a
push edi
lea ecx, [esp + 0x60]
call fcn.00501a30
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x5c], 0
call fcn.00588b80
cmp dword [esp + 0x5c], 0
jne 0x533b1b
cmp dword [esp + 0x60], 0
je 0x533b56
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
call fcn.00501c50
test eax, eax
jne 0x533b56
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.005332e0
test eax, eax
jl 0x533ed5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00524af0
lea ebx, [edi + 0xc]
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.004fa8a0
add esp, 8
test eax, eax
jne 0x533b75
lea eax, [esp + 0x34]
push eax
jmp 0x533c0a
mov ecx, dword [ebp + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.005321b0
add esp, 0x18
test eax, eax
je 0x533bc6
lea eax, [esp + 0x34]
push eax
jmp 0x533c0a
mov eax, dword [ebx + 4]
mov edx, dword [edi + 8]
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x1c]
sub ecx, dword [edi + 4]
mov ebp, dword [ebx + 4]
sub ebp, dword [esp + 0x34]
sub eax, edx
mov edx, dword [ebx + 8]
sub edx, dword [esp + 0x38]
test ecx, ecx
jle 0x533bef
test ebp, ebp
jl 0x533c05
test ecx, ecx
jge 0x533bf5
test ebp, ebp
jg 0x533c05
test eax, eax
jle 0x533bff
test edx, edx
jl 0x533c05
test eax, eax
jge 0x533c2a
test edx, edx
jle 0x533c2a
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.005332e0
test eax, eax
jl 0x533ed5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00524af0
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x1c]
jne 0x533c9a
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
mov dword [esp + 0x48], 1
call fcn.00588ba0
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x24]
call fcn.0056fa20
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x533c70
mov dword [esp + 0x24], eax
jmp 0x533c74
mov dword [esp + 0x2c], eax
mov ecx, esi
call fcn.00532260
mov ebp, eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0052ec10
test eax, eax
je 0x533ed5
test ebp, ebp
jl 0x533ed5
mov ecx, esi
call fcn.00532260
mov ebp, eax
push ebp
add ebx, 4
push ebx
mov ecx, esi
call fcn.0052ed60
test eax, eax
je 0x533ed5
mov ebx, ebp
test ebp, ebp
jl 0x533ed5
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.0056fd80
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x533cf7
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.0056fdc0
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x533e52
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
call fcn.00588ba0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x24]
call fcn.0056fa20
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x533d3f
mov dword [esp + 0x24], eax
jmp 0x533d43
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.005332b0
mov ebx, eax
test ebx, ebx
jl 0x533ed5
jmp 0x533e52
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x533dd7
cmp dword [ebp + 0x14], 1
jne 0x533d96
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.005332e0
test eax, eax
jl 0x533ed5
mov ecx, dword [edi + 0x14]
jmp 0x533df0
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.0058ea50
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x533e04
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x533e04
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call fcn.005332e0
test eax, eax
jl 0x533ed5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.00524af0
jmp 0x533e04
cmp ecx, 0x20
jne 0x533e04
mov ebx, dword [eax - 4]
lea ecx, [ebx + 4]
push ecx
mov ecx, esi
call fcn.005332e0
mov ebx, dword [ebx + 0x1c]
lea ecx, [ebx + ebx]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x533e01
mov dword [eax + 4], ecx
jmp 0x533e04
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x533e39
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x533e19
lea edx, [ebp + 4]
push edx
jmp 0x533e1d
lea eax, [ebp + 0xc]
push eax
call fcn.005332e0
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x533e36
mov dword [eax + 4], ecx
jmp 0x533e39
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.00532260
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0052f080
test eax, eax
jne 0x533e52
or ebx, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x5337d0
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x533f20
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.00532260
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x533f15
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.0052ed60
test eax, eax
je 0x533ed5
test edi, edi
jl 0x533ed5
mov ebx, dword [ebx + 0x24]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x533f1b
mov dword [edi + 4], ebx
jmp 0x533f59
push 0x302
call fcn.005c2c00
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.00440ab0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004f1b60
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f85b0
xor eax, eax
jmp 0x533f97
lea ecx, [ebx + 0xc]
push ecx
jmp 0x533ea2
mov dword [edi + 0xc], ebx
jmp 0x533f59
cmp eax, 0x16
jne 0x533f59
mov ecx, esi
call fcn.00532260
mov ebx, eax
push ebx
lea edx, [edi + 0xc]
push edx
mov ecx, esi
call fcn.0052ed60
test eax, eax
je 0x533ed5
test ebx, ebx
jl 0x533ed5
mov edi, dword [edi + 0x14]
shl ebx, 4
add ebx, dword [esi + 0xc]
test byte [ebx + 2], 8
je 0x533f56
mov dword [ebx + 4], edi
jmp 0x533f59
mov dword [ebx + 0xc], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.00440ab0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004f1b60
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f85b0
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005c3bb6
add esp, 0xa4
ret 4