Function at 0x5e9c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov eax, 0xc3
mov word [ebp - 0x2c], ax
movzx esi, word [ebp - 0xa4]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
cmp esi, eax
jbe 0x5e9c88
movzx ecx, word [ebp - 0x78]
test ecx, ecx
jne 0x5e9cbd
movzx edx, byte [ebp - 0xe3]
add edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x84]
movzx eax, word [ebp - 0x10c]
add eax, 0xb8
and edx, eax
xor edx, dword [ebp - 0x104]
movzx ecx, word [ebp - 0x3c]
and ecx, dword [ebp - 0xe8]
or edx, ecx
mov dword [ebp - 0x48], edx
jmp 0x5e9ce9
mov edx, dword [ebp - 8]
and edx, 0xffffffd1
mov eax, dword [ebp - 0x24]
sub eax, 0x14
or edx, eax
movzx ecx, word [ebp - 0xc0]
movzx eax, byte [ebp - 0xe3]
sub ecx, eax
and ecx, dword [ebp - 0xb0]
or edx, ecx
mov dword [ebp - 0x118], edx
push 0x40
push 0x1000
push 0x89aef
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x34], eax
movzx ecx, word [ebp - 0x38]
push ecx
movzx edx, word [ebp - 0xb4]
push edx
call fcn.005d4650
mov ecx, dword [ebp - 4]
sub ecx, eax
sub ecx, 0x9c
or ecx, 0xffffff68
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x5c], 0x53d430
movzx esi, byte [ebp - 0xb9]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
sub esi, eax
movzx edx, word [ebp - 0x18]
sub edx, dword [ebp - 0x5c]
and esi, edx
mov dword [ebp - 0x48], esi
push 0
push 0
call sub.KERNEL32.dll_Module32Next
cmp eax, 0xb5
je 0x5e9da2
cmp dword [ebp - 0xe8], 0x17
jne 0x5e9da2
mov eax, dword [ebp - 0xd0]
and eax, dword [ebp - 0x84]
and eax, 0x8e
mov ecx, dword [ebp - 0x100]
mov edx, dword [ebp - 0x34]
lea ecx, [edx + ecx + 0xb8]
movzx edx, byte [ebp - 0xb9]
sub ecx, edx
sub ecx, dword [ebp - 0xd4]
and eax, ecx
mov dword [ebp - 0xb0], eax
jmp 0x5e9dc3
mov eax, dword [ebp - 0x5c]
add eax, 0x16
sub eax, dword [ebp - 0x70]
and eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x104]
or eax, ecx
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x44], 0
mov esi, 0x83
sub esi, dword [ebp - 0x34]
and esi, dword [ebp - 0x118]
movzx edx, word [ebp - 0x4c]
push edx
call fcn.005d4670
movzx eax, ax
movzx ecx, word [ebp - 0x1c]
add eax, ecx
and esi, eax
mov dword [ebp - 0x6c], esi
mov edx, dword [ebp - 0x58]
or edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x28]
or edx, eax
movzx ecx, word [ebp - 0xc0]
add ecx, dword [ebp - 0xd0]
or edx, ecx
mov dword [ebp - 8], edx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0xe8]
add edx, dword [ebp - 0xb0]
add edx, dword [ebp - 4]
mov dword [ebp - 0x100], edx
mov dword [ebp - 8], 0xc542bc87
movzx eax, word [ebp - 0x88]
and eax, 0xe3
mov word [ebp - 0xa4], ax
mov dword [ebp - 0x38], 0x732064d7
cmp dword [ebp - 0x38], 0x36
je 0x5e9e86
cmp dword [ebp - 0x100], 0
jne 0x5e9e86
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.005d31b0
movzx edx, ax
mov eax, 0x84
sub eax, edx
or eax, dword [ebp - 0xe8]
mov word [ebp - 0xc0], ax
jmp 0x5e9e9c
movzx ecx, word [ebp - 0xc8]
add ecx, dword [ebp - 0x104]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x118], ecx
movzx edx, word [ebp - 0x14]
cmp edx, 0xcd
je 0x5e9ec7
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x34]
and eax, 0xbc
movzx ecx, word [ebp - 0x10c]
sub ecx, dword [ebp - 0x70]
or eax, ecx
mov dword [ebp - 0xd0], eax
jmp 0x5e9f00
movzx edx, byte [ebp - 0xc9]
mov esi, 0x28
sub esi, edx
movzx eax, word [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
call fcn.005d4650
add esi, dword [ebp - 0x6c]
add eax, esi
movzx edx, word [ebp - 0x14]
add eax, dword [ebp - 0xb0]
add edx, eax
and edx, 0x2b
mov dword [ebp - 0x94], edx
movzx eax, word [ebp - 0xa4]
mov ecx, 0xe4
sub ecx, eax
sub ecx, dword [ebp - 0x118]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xb0], 0x7efb5d87
movzx edx, byte [ebp - 0xa8]
sub edx, 0xfb
mov byte [ebp - 0xa], dl
mov esi, dword [ebp - 0x48]
add esi, dword [ebp - 0x44]
call fcn.005d3af0
movzx eax, al
add esi, eax
mov ecx, dword [ebp - 0x98]
add ecx, dword [ebp - 0x24]
and esi, ecx
mov dword [ebp - 0x48], esi
mov edx, dword [ebp - 0x94]
add edx, 0x95
or edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x6c], 0x171bd09f
mov eax, dword [ebp - 0x118]
add eax, 0xbc
sub eax, dword [ebp - 4]
sub eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x84]
lea edx, [eax + ecx + 0xae]
mov dword [ebp - 0x98], edx
movzx eax, word [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.005d4650
test eax, eax
je 0x5e9fd5
mov edx, dword [ebp - 0x48]
push edx
call fcn.005d3200
movzx eax, al
and eax, 0xa2
movzx ecx, word [ebp - 0x10c]
and eax, ecx
movzx edx, word [ebp - 0xec]
add edx, 0xe3
or eax, edx
or eax, 0x3b
mov dword [ebp - 0x104], eax
jmp 0x5ea001
movzx eax, byte [ebp - 0x7e]
add eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x98]
lea edx, [ecx + eax + 0x4e]
and edx, 0x48
movzx eax, word [ebp - 0xd8]
add eax, dword [ebp - 0xe8]
or edx, eax
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xd0], 0xcdad7ccd
mov ecx, dword [ebp - 4]
sub ecx, 0xfc
mov word [ebp - 0xd8], cx
mov esi, dword [ebp - 0x44]
add esi, dword [ebp - 0x104]
add esi, dword [ebp - 4]
movzx edx, byte [ebp - 0x70]
push edx
movzx eax, byte [ebp - 0xe3]
push eax
call fcn.005e9420
and esi, eax
and esi, dword [ebp - 0x98]
mov word [ebp - 0x7c], si
movzx ecx, byte [ebp - 0x66]
sub ecx, dword [ebp - 0xb0]
movzx edx, byte [ebp - 0xba]
add ecx, edx
sub ecx, dword [ebp - 0xb0]
mov word [ebp - 0xc8], cx
movzx eax, word [ebp - 0x9c]
test eax, eax
jne 0x5ea085
movzx ecx, word [ebp - 0xf0]
push ecx
call fcn.005d3200
movzx edx, al
cmp edx, 0x2a
jne 0x5ea0a2
movzx eax, word [ebp - 0x88]
mov ecx, dword [ebp - 0x28]
lea edx, [eax + ecx - 0xfc]
or edx, dword [ebp - 0xb0]
mov word [ebp - 0x74], dx
jmp 0x5ea0b6
mov eax, dword [ebp - 0x70]
sub eax, 0x158
sub eax, dword [ebp - 0x44]
or eax, dword [ebp - 0x100]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xd4], 0x541944d
movzx ecx, word [ebp - 0x110]
movzx edx, word [ebp - 0xc0]
or ecx, edx
mov word [ebp - 0x9c], cx
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
movzx ecx, word [ebp - 0xc8]
sub eax, ecx
mov edx, 0xeb
sub edx, dword [ebp - 0x104]
xor edx, dword [ebp - 0x44]
or eax, edx
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xce
je 0x5ea152
mov ebx, dword [ebp - 0x5c]
sub ebx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x94]
push eax
call fcn.005d3340
add ebx, eax
movzx ecx, word [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x98]
push edx
call fcn.005d4650
add ebx, eax
and ebx, 0x9b
and ebx, dword [ebp - 0x94]
movzx eax, word [ebp - 0xdc]
movzx ecx, word [ebp - 0x110]
sub eax, ecx
or ebx, eax
mov byte [ebp - 0xba], bl
jmp 0x5ea15e
mov edx, dword [ebp - 0x38]
and edx, 0x42
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x58], 0x100
je 0x5ea17f
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
cmp dword [ebp - 0x98], eax
je 0x5ea1c1
movzx eax, byte [ebp - 0x88]
push eax
call fcn.005d4900
movzx ecx, al
mov edx, 0x98
sub edx, dword [ebp - 0x24]
and ecx, edx
movzx eax, word [ebp - 0xf8]
add eax, 0xd2
movzx edx, word [ebp - 0xec]
sub eax, edx
add eax, dword [ebp - 0x70]
movzx edx, byte [ebp - 0x1d]
add eax, edx
and ecx, eax
mov dword [ebp - 0x94], ecx
jmp 0x5ea1d9
mov eax, dword [ebp - 4]
add eax, 0x20
movzx ecx, word [ebp - 0xe0]
add ecx, 7
or eax, ecx
mov byte [ebp - 0xa8], al
mov dword [ebp - 0x44], 0
jmp 0x5ea1eb
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x1550
jae 0x5ea7e4
movzx eax, byte [ebp - 0x67]
sub eax, 0xa0
mov dword [ebp - 0x70], eax
mov ecx, 0x79
sub ecx, dword [ebp - 0x38]
and ecx, 0xdf
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x118]
sub edx, 0x64
sub edx, dword [ebp - 0x58]
add edx, 0x198
or edx, dword [ebp - 0x38]
mov word [ebp - 0xd8], dx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x100], 0
je 0x5ea281
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ecx, dword [ebp - 0xd0]
lea edx, [eax + ecx - 0x3e]
movzx eax, byte [ebp - 0xa]
add eax, dword [ebp - 0x28]
movzx ecx, word [ebp - 0xf0]
sub eax, ecx
mov ecx, dword [ebp - 0x10]
shr eax, cl
or edx, eax
mov dword [ebp - 0x98], edx
jmp 0x5ea2be
movzx edx, byte [ebp - 0xa9]
push edx
movzx eax, byte [ebp - 0x100]
push eax
call fcn.005d3690
movzx ecx, ax
mov edx, 0xff
sub edx, dword [ebp - 0x38]
add edx, 0x68
or ecx, edx
movzx eax, word [ebp - 0x18]
sub eax, dword [ebp - 0x118]
and eax, dword [ebp - 0x5c]
or ecx, eax
or ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0xb0]
add ecx, 0x88
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x118], 0
je 0x5ea2fa
movzx edx, byte [ebp - 0xb9]
movzx eax, byte [ebp - 0x65]
sub edx, eax
sub edx, 0x23
movzx ecx, word [ebp - 0x10c]
sub ecx, dword [ebp - 0x5c]
or edx, ecx
or edx, 0x2d
mov dword [ebp - 0x24], edx
jmp 0x5ea321
mov esi, dword [ebp - 0x48]
add esi, 0x6e
sub esi, dword [ebp - 0x34]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x58]
lea eax, [edx + eax + 0xa2]
and esi, eax
mov word [ebp - 0x4c], si
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 8]
mov dword [ebp - 0x38], ecx
mov esi, 0xed
sub esi, dword [ebp - 0x98]
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
add eax, 0x114
and esi, eax
movzx edx, word [ebp - 0xa4]
and esi, edx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x6c]
xor eax, dword [ebp - 0xd0]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x100], 0x31
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp - 0x120]
sub edx, 0x14
mov dword [ebp - 0x120], edx
cmp dword [ebp - 0x120], 0xc4
ja case.0x5ea39b.2
mov eax, dword [ebp - 0x120]
movzx ecx, byte [eax + 0x5ea864]
jmp dword [ecx*4 + 0x5ea848]
mov edx, dword [ebp - 0x94]
sub edx, dword [ebp - 0x10]
and edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x28]
and edx, eax
mov dword [ebp - 0x104], edx
jmp 0x5ea46b
movzx ecx, byte [ebp - 0xa5]
mov dword [ebp - 4], ecx
jmp 0x5ea46b
mov edx, 0xf6
sub edx, dword [ebp - 0xe8]
movzx eax, word [ebp - 0x108]
and edx, eax
movzx ecx, byte [ebp - 0xa8]
sub ecx, 0xb6
and edx, ecx
mov dword [ebp - 0x28], edx
jmp 0x5ea46b
mov edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0xd0]
and edx, 0x6f
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x48]
xor edx, eax
mov dword [ebp - 0x24], edx
jmp 0x5ea46b
movzx ecx, word [ebp - 0xa0]
movzx edx, word [ebp - 0x9c]
sub ecx, edx
mov dword [ebp - 0x94], ecx
jmp 0x5ea46b
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x98]
movzx ecx, word [ebp - 0xc8]
mov edx, dword [ebp - 0x84]
sub edx, ecx
and eax, edx
mov ecx, dword [ebp - 0x10]
shr ecx, 4
and eax, ecx
mov dword [ebp - 0x104], eax
jmp 0x5ea46b
mov edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0xd0]
sub edx, dword [ebp - 0x5c]
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0xe8]
add eax, 0xdc
sub eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x38]
xor ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x28], 0
jne 0x5ea4d2
movzx edx, word [ebp - 0x4c]
test edx, edx
jne 0x5ea4d2
movzx eax, byte [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.005e9420
add eax, 0x2f
sub eax, dword [ebp - 0x104]
mov edx, dword [ebp - 0xe8]
add edx, 0xaf
sub edx, dword [ebp - 0x118]
xor eax, edx
mov dword [ebp - 0x70], eax
jmp 0x5ea4f5
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x48]
lea edx, [ecx + eax + 0xbe]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + eax + 0x59]
sub ecx, dword [ebp - 8]
movzx edx, byte [ebp - 0x66]
add ecx, edx
mov dword [ebp - 0x118], ecx
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0xd0]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x98], 0xf6
jne 0x5ea531
cmp dword [ebp - 0x98], 0
jne 0x5ea531
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0xb0]
lea eax, [edx + ecx + 0x98]
mov dword [ebp - 0x104], eax
jmp 0x5ea53e
movzx ecx, word [ebp - 0x4c]
add ecx, 0x61
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0xd4]
or edx, 0xc1
mov byte [ebp - 0x3d], dl
movzx esi, word [ebp - 0x110]
add esi, dword [ebp - 0xd4]
movzx eax, word [ebp - 0x58]
push eax
call fcn.005ea930
movzx ecx, al
mov edx, dword [ebp - 0x118]
lea edi, [edx + ecx + 0xc8]
movzx eax, byte [ebp - 4]
push eax
movzx ecx, byte [ebp - 0x48]
push ecx
call fcn.005d3690
movzx edx, ax
sub edi, edx
and esi, edi
mov eax, dword [ebp - 0x10]
push eax
movzx ecx, byte [ebp - 0x14]
push ecx
movzx edx, byte [ebp - 0xba]
push edx
call fcn.005d3f50
movzx eax, al
add eax, dword [ebp - 0x48]
and esi, eax
mov word [ebp - 0x14], si
mov ecx, dword [ebp - 0xb0]
xor ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xb0], ecx
movzx edx, byte [ebp - 0xaa]
test edx, edx
jne 0x5ea5ee
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x34]
lea edx, [ecx + eax + 0x1fe]
add edx, dword [ebp - 4]
movzx eax, word [ebp - 0x60]
add edx, eax
and edx, dword [ebp - 0x98]
mov word [ebp - 0x1c], dx
jmp 0x5ea5f8
mov dword [ebp - 0x84], 0x36
mov ecx, dword [ebp - 0xd4]
xor ecx, dword [ebp - 0x38]
mov dword [ebp - 0xd4], ecx
mov edx, 0xbf
sub edx, dword [ebp - 0x118]
movzx eax, word [ebp - 0xc8]
sub eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x34]
lea eax, [eax + ecx - 0x2e]
movzx ecx, byte [ebp - 0xa7]
sub eax, ecx
and edx, eax
mov byte [ebp - 0xa7], dl
movzx esi, byte [ebp - 0xa6]
add esi, 0xd4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov edx, 9
sub edx, eax
and esi, edx
mov dword [ebp - 0x84], esi
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd0], eax
movzx ecx, byte [ebp - 0x1d]
mov edx, dword [ebp - 0x100]
sub edx, ecx
and edx, 0x12b
movzx eax, byte [ebp - 0xa6]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
add ecx, 0x7d
or edx, ecx
mov word [ebp - 0x2c], dx
cmp dword [ebp - 0x24], 0
jne 0x5ea6d2
movzx edx, word [ebp - 0xa0]
cmp edx, dword [ebp - 0xd0]
je 0x5ea6d2
mov eax, dword [ebp - 0x100]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call fcn.005d3c40
movzx eax, al
and eax, 0xc5
mov word [ebp - 0x2c], ax
jmp 0x5ea6e6
movzx ecx, word [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.005d4650
mov dword [ebp - 0xe8], eax
movzx eax, word [ebp - 0x108]
movzx ecx, byte [ebp - 0xa8]
sub eax, ecx
movzx edx, word [ebp - 0xf8]
add eax, edx
movzx ecx, word [ebp - 0xdc]
sub eax, ecx
movzx edx, word [ebp - 0x3c]
add edx, dword [ebp - 0x84]
and eax, edx
and eax, dword [ebp - 0x104]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
movzx ecx, byte [ebp - 0x48]
push ecx
movzx edx, byte [ebp - 0x70]
push edx
call fcn.005d3690
movzx eax, ax
test eax, eax
jle 0x5ea75c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
cmp eax, 0x4d
jne 0x5ea75c
mov ecx, dword [ebp - 0x28]
sub ecx, 6
and ecx, dword [ebp - 0x48]
mov dword [ebp - 0x58], ecx
jmp 0x5ea763
mov dword [ebp - 0x70], 0xfe
movzx edx, byte [ebp - 4]
push edx
call fcn.005d4900
movzx eax, al
mov ecx, 0xe
sub ecx, dword [ebp - 8]
add ecx, 0x85
or eax, ecx
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x84]
and edx, dword [ebp - 0xb0]
mov dword [ebp - 0x98], edx
movzx eax, word [ebp - 0x64]
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx + ecx*4]
xor eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
mov dword [edx + ecx*4], eax
mov eax, dword [ebp - 0xd4]
sub eax, 0x9b
mov ecx, dword [ebp - 0x84]
and ecx, dword [ebp - 0x48]
movzx edx, word [ebp - 0x4c]
add edx, 0x50
and ecx, edx
or eax, ecx
mov dword [ebp - 0x84], eax
jmp 0x5ea1e2
cmp dword [ebp - 0x6c], 0x1c
jne 0x5ea7fb
movzx eax, byte [ebp - 0x7e]
push eax
call fcn.005d3200
movzx ecx, al
test ecx, ecx
jne 0x5ea819
movzx edx, word [ebp - 0xf0]
movzx eax, word [ebp - 0xdc]
add eax, dword [ebp - 0x84]
and edx, eax
mov dword [ebp - 0x118], edx
jmp 0x5ea839
mov ecx, 0x71
sub ecx, dword [ebp - 0x28]
movzx edx, word [ebp - 0xd8]
sub ecx, edx
sub ecx, dword [ebp - 0x58]
sub ecx, 0x60
sub ecx, dword [ebp - 0x104]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x34]
add eax, 0x3a00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret