Function at 0x52c1fe
Capabilities:
Get remote cert context via schannel
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa8
lea eax, [edx + 0x3c]
mov ebx, edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x9c], eax
lea eax, [edx + 0x98]
mov dword [ebp - 0x70], eax
lea eax, [edx + 0x44]
mov dword [ebp - 0xb4], eax
lea eax, [edx + 4]
mov dword [ebp - 0xa0], eax
lea eax, [edx + 0x88]
mov dword [ebp - 0xa4], eax
movzx eax, byte [ebx + 0x38]
test eax, eax
jne 0x52cb91
mov edx, ebx
mov bh, byte [ebx + 0x39]
mov cl, byte [edx + 0x3b]
mov al, byte [edx + 0x3a]
mov bl, byte [edx + 0x3c]
mov byte [ebp - 0x48], cl
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x18], al
call fcn.0052d05c
cmp byte [ebp - 0x6c], 4
jne 0x52c275
mov eax, dword [ebp - 0x68]
jmp 0x52c284
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
cmp cl, 4
jne 0x52cbd1
test eax, eax
jne 0x52c28c
test bh, bh
je 0x52c29c
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x38], 0
jne 0x52c29c
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x39], 0
or bl, byte [ebp - 0x48]
je 0x52c2a9
mov ebx, dword [ebp - 0x10]
jmp 0x52c73f
mov ebx, dword [ebp - 0x10]
cmp byte [ebx + 0xce], 0
jne 0x52c73f
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0
push eax
push 0x53
push dword [ebp - 0x70]
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
je 0x52c2fd
mov ecx, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], eax
je 0x52c307
cmp byte [ebp - 0x18], 0
je 0x52c307
lea eax, [ebp - 0x6c]
push eax
call fcn.004cd164
add esp, 4
xor eax, eax
mov dl, 4
mov bh, al
jmp 0x52c71c
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x6c], 4
mov ebx, dword [ebp - 0x6c]
cmp bl, 4
jne 0x52c3a0
mov eax, dword [ecx + 0x10]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x52c3b6
mov dword [ebp - 0x24], eax
push eax
call sub.crypt32.dll_CertDuplicateStore
mov edi, dword [ebp - 0x10]
mov esi, eax
mov ebx, 0
cmp dword [edi], 0
je 0x52c3e5
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0x6c]
call fcn.0048083d
test eax, eax
je 0x52c3c9
mov edi, edx
lea ecx, [ebp - 0x3c]
mov edx, esi
push edi
call fcn.004807fd
add esp, 4
cmp byte [ebp - 0x3c], 4
jne 0x52c380
mov esi, dword [ebp - 0x38]
and ebx, 0xffffff00
or ebx, 4
jmp 0x52c386
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x38]
cmp bl, 4
jne 0x52c54e
push esi
call sub.crypt32.dll_CertFreeCertificateContext
push edi
call sub.crypt32.dll_CertFreeCertificateContext
mov esi, dword [ebp - 0x14]
jmp 0x52c350
mov eax, ebx
mov edx, ebx
shrd eax, ecx, 0x10
shr ecx, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
jmp 0x52c71c
mov edi, dword [ebp - 0x10]
mov ebx, 0
mov esi, dword [edi]
test esi, esi
je 0x52c3f0
mov esi, dword [edi + 4]
jmp 0x52c3f0
cmp dword [ebp - 0x6c], 0
je 0x52c3d7
push dword [ebp - 0x68]
call sub.crypt32.dll_CertFreeCertificateContext
cmp dword [ebp - 0x24], 0
mov edi, dword [ebp - 0x10]
mov ebx, 0
je 0x52c3ed
push 0
push esi
call sub.crypt32.dll_CertCloseStore
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x6c], 0x10
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x64], 3
mov dword [ebp - 0x3c], str.1.3.6.1.5.5.7.3.1
mov dword [ebp - 0x38], str.1.3.6.1.4.1.311.10.3.3
mov dword [ebp - 0x34], str.2.16.840.1.113730.4.1
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x98]
push eax
push ebx
push 0xc0000001
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ecx
push ebx
call sub.crypt32.dll_CertGetCertificateChain
test eax, eax
je 0x52c52b
mov edx, dword [ebp - 0x98]
cmp dword [edi], 0
mov dword [ebp - 0x24], edx
je 0x52c585
lea ecx, [ebp - 0x3c]
call fcn.00480753
cmp dword [ebp - 0x3c], 0
je 0x52c5a7
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ecx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], 0
lea ecx, [ebp - 0x98]
call fcn.004807c7
mov esi, edx
cmp eax, 1
jne 0x52c58c
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x6c], 0
lea ecx, [ebp - 0x6c]
call fcn.0048083d
mov edi, eax
mov ebx, edx
cmp eax, 1
jne 0x52c4f5
mov eax, dword [ebx + 8]
cmp eax, dword [esi + 8]
jne 0x52c4ed
push eax
push dword [esi + 4]
push dword [ebx + 4]
call sub.msvcrt.dll_memcmp
add esp, 0xc
mov esi, eax
push ebx
call sub.crypt32.dll_CertFreeCertificateContext
test esi, esi
mov esi, dword [ebp - 0x14]
jne 0x52c4b4
jmp 0x52c4ff
push ebx
call sub.crypt32.dll_CertFreeCertificateContext
jmp 0x52c4b4
test edi, edi
je 0x52c4ff
push ebx
call sub.crypt32.dll_CertFreeCertificateContext
cmp dword [ebp - 0x6c], 0
je 0x52c50d
push dword [ebp - 0x68]
call sub.crypt32.dll_CertFreeCertificateContext
push esi
call sub.crypt32.dll_CertFreeCertificateContext
cmp edi, 1
mov edi, dword [ebp - 0x10]
mov ebx, 0
jne 0x52c48b
mov esi, 0xf10
jmp 0x52c59d
call sub.kernel32.dll_GetLastError
mov ecx, eax
shl eax, 0x10
mov dword [ebp - 0x14], 0
shr ecx, 0x10
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], ecx
mov bh, al
jmp 0x52c710
mov eax, esi
shr esi, 0x10
shld eax, ebx, 0x10
mov dword [ebp - 0x44], eax
push edi
call sub.crypt32.dll_CertFreeCertificateContext
cmp dword [ebp - 0x6c], 0
je 0x52c56e
push dword [ebp - 0x68]
call sub.crypt32.dll_CertFreeCertificateContext
push 0
push dword [ebp - 0x14]
call sub.crypt32.dll_CertCloseStore
mov eax, ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x14], eax
jmp 0x52c710
mov esi, 0xf00
jmp 0x52c5af
mov ecx, esi
mov esi, 0xf00
test eax, eax
je 0x52c59d
push ecx
call sub.crypt32.dll_CertFreeCertificateContext
push dword [ebp - 0x78]
call sub.crypt32.dll_CertFreeCertificateChain
jmp 0x52c5ac
mov esi, 0xf00
mov edx, dword [ebp - 0x24]
mov eax, dword [edi + 0xac]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x98], 0x10
mov dword [ebp - 0x94], 2
test eax, eax
je 0x52c5e8
cmp byte [edi + 0xcd], 0
jne 0x52c5e8
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x7c], 0xc
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x68]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 8], ebx
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x14
push eax
lea eax, [ebp - 0x7c]
push eax
push edx
push 4
call sub.crypt32.dll_CertVerifyCertificateChainPolicy
test eax, eax
je 0x52c637
mov esi, dword [ebp - 0x68]
test esi, esi
je 0x52c65a
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0
jmp 0x52c65e
call sub.kernel32.dll_GetLastError
mov ecx, eax
shl eax, 0x10
mov dword [ebp - 0x14], 0
shr ecx, 0x10
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], ecx
mov bh, al
jmp 0x52c707
mov byte [ebp - 0x2c], 4
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x52c6d5
mov eax, dword [edi + 0xa4]
mov edx, dword [eax + 8]
dec edx
and edx, 0xfffffff8
lea ecx, [edx + ecx + 8]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x3c]
push edx
push ecx
lea ecx, [ebp - 0x88]
push ecx
call dword [eax + 0x14]
add esp, 0xc
test esi, esi
je 0x52c6b0
lea eax, [ebp - 0x2c]
push eax
call fcn.004cd164
add esp, 4
mov ebx, dword [ebp - 0x88]
cmp bl, 4
je 0x52c6e5
mov ecx, dword [ebp - 0x84]
mov eax, ebx
mov dword [ebp - 0x14], ebx
shrd eax, ecx, 0x10
shr ecx, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
jmp 0x52c710
mov ebx, dword [ebp - 0x2c]
cmp bl, 4
jne 0x52c6f2
push dword [ebp - 0x24]
call sub.crypt32.dll_CertFreeCertificateChain
mov eax, dword [ebp - 0x1c]
push eax
call sub.crypt32.dll_CertFreeCertificateContext
mov bh, 1
jmp 0x52c725
mov ecx, dword [ebp - 0x28]
mov eax, ebx
mov dword [ebp - 0x14], ebx
shrd eax, ecx, 0x10
shr ecx, 0x10
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x24]
push eax
call sub.crypt32.dll_CertFreeCertificateChain
mov eax, dword [ebp - 0x1c]
push eax
call sub.crypt32.dll_CertFreeCertificateContext
mov edx, dword [ebp - 0x14]
cmp dl, 4
jne 0x52cc10
test bh, bh
je 0x52c2a1
mov ebx, dword [ebp - 0x10]
cmp byte [ebx + 0x38], 0
jne 0x52c73f
mov eax, dword [ebp - 0x9c]
mov byte [eax], 1
cmp byte [ebp - 0x18], 0
je 0x52cb0f
cmp dword [ebx + 0xb8], 0
je 0x52c77e
lea ecx, [ebp - 0x6c]
mov edx, ebx
call fcn.0052ce9b
cmp byte [ebp - 0x6c], 4
jne 0x52c767
mov eax, dword [ebp - 0x68]
jmp 0x52c776
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
cmp cl, 4
jne 0x52cbd1
test eax, eax
je 0x52cbdf
mov esi, dword [ebx + 0x68]
mov al, byte [0x5c91e8]
mov ecx, 0x18
mov edx, 4
call fcn.0041aa20
test eax, eax
je 0x52cceb
mov edx, dword [ebx + 0x78]
cmp edx, esi
jb 0x52ccfc
mov edx, dword [ebx + 0x70]
mov edi, eax
mov ecx, 2
mov dword [edi], esi
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
xor edx, edx
mov dword [edi + 0xc], edx
mov dword [edi + 0x10], edx
mov dword [edi + 0x14], edx
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov edx, dword [ebx + 0xc0]
test edx, edx
je 0x52c833
lea ecx, [ebp - 0x7c]
push dword [ebx + 0xc8]
call fcn.00480b5c
add esp, 4
mov eax, dword [ebp - 0x7c]
test eax, eax
mov dword [ebp - 0x18], eax
je 0x52c83c
mov ebx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
lea ecx, [ebp - 0x88]
mov edx, 2
call fcn.00464ae7
mov ecx, dword [ebp - 0x80]
mov edi, dword [ebp - 0x88]
lea eax, [ecx + ecx*2]
inc ecx
mov dword [edi + eax*4], ebx
mov ebx, dword [ebp - 0x10]
mov dword [edi + eax*4 + 4], 0x12
mov dword [edi + eax*4 + 8], esi
mov dword [ebp - 0x80], ecx
jmp 0x52c848
mov dword [ebp - 0x7c], 0
jmp 0x52c841
mov ecx, 2
mov dword [ebp - 0x18], 0
xor edx, edx
cmp byte [ebx + 0xce], 0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], 2
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], 0x11
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x18], edx
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x90], edi
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0x34], eax
je 0x52c8ee
mov ecx, dword [ebx + 0xa8]
cmp byte [ebx + 0xcf], 0
mov esi, dword [ebp - 0x70]
mov eax, 0
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
cmove eax, esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ecx
push edx
lea ecx, [ebp - 0xa8]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push esi
push edx
push 0x1011c
lea ecx, [ebp - 0x98]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call sub.secur32.dll_AcceptSecurityContext
jmp 0x52c940
mov ecx, dword [ebx + 0xac]
cmp byte [ebx + 0xcc], 0
mov eax, ecx
cmove eax, edx
test ecx, ecx
cmove eax, ecx
mov ecx, dword [ebx + 0xa8]
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ecx
push edx
lea ecx, [ebp - 0xa8]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push edx
push edx
lea ecx, [ebp - 0x98]
push ecx
push edx
push edx
push 0x9819c
push eax
push dword [ebp - 0x70]
lea eax, [ebp - 0x2c]
push eax
call sub.secur32.dll_InitializeSecurityContextW
mov esi, eax
xor ebx, ebx
xor eax, eax
inc eax
lea eax, [eax + eax*2]
mov eax, dword [ebp + eax*4 - 0x64]
test eax, eax
je 0x52c958
push eax
call sub.secur32.dll_FreeContextBuffer
test bl, 1
mov eax, 2
mov bl, 1
je 0x52c947
cmp esi, 0x80090318
je 0x52c9f0
mov ebx, dword [ebp - 0x10]
mov eax, esi
test esi, esi
je 0x52ca1b
cmp eax, 0x90312
jne 0x52cc04
mov edx, dword [ebp - 0x48]
mov byte [ebx + 0xcf], 0
cmp edx, 1
jbe 0x52ccc5
cmp dword [edi + 0x10], 5
mov edx, dword [ebx + 0x68]
jne 0x52c9a7
sub edx, dword [edi + 0xc]
mov edi, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x64]
mov ecx, ebx
call fcn.0052cf99
mov eax, dword [ebx + 0x68]
xor ecx, ecx
mov edx, esi
or eax, dword [ebx + 0x6c]
mov eax, str.failed_to_write_whole_buffer
sete cl
test edi, edi
mov dword [ebx + 0xb8], ecx
mov ecx, dword [ebp - 0xa4]
cmove edx, eax
add edi, edx
push edi
call fcn.004ba2b7
add esp, 4
push esi
call sub.secur32.dll_FreeContextBuffer
mov edi, dword [ebp - 0x18]
jmp 0x52cacd
mov edx, dword [ebp - 0x48]
mov ebx, dword [ebp - 0x10]
cmp edx, 1
jbe 0x52cccf
cmp dword [edi + 0x10], 4
mov eax, 1
jne 0x52ca0d
mov eax, dword [edi + 0xc]
mov edi, dword [ebp - 0x18]
mov dword [ebx + 0xb8], eax
jmp 0x52cacd
mov edx, dword [ebp - 0x48]
cmp edx, 1
jbe 0x52ccd9
cmp dword [edi + 0x10], 5
mov edx, dword [ebx + 0x68]
jne 0x52ca33
sub edx, dword [edi + 0xc]
mov esi, dword [ebp - 0x64]
test esi, esi
je 0x52ca80
mov edi, dword [ebp - 0x6c]
mov ecx, ebx
call fcn.0052cf99
mov eax, dword [ebx + 0x68]
xor ecx, ecx
mov edx, esi
or eax, dword [ebx + 0x6c]
mov eax, str.failed_to_write_whole_buffer
sete cl
test edi, edi
mov dword [ebx + 0xb8], ecx
mov ecx, dword [ebp - 0xa4]
cmove edx, eax
add edi, edx
push edi
call fcn.004ba2b7
add esp, 4
push esi
call sub.secur32.dll_FreeContextBuffer
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
jmp 0x52ca9c
mov ecx, ebx
call fcn.0052cf99
mov eax, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x6c]
xor edx, edx
mov esi, eax
or esi, ecx
sete dl
mov dword [ebx + 0xb8], edx
mov edi, dword [ebp - 0x18]
or eax, ecx
je 0x52cac0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
call fcn.0052cd0a
cmp byte [ebp - 0x2c], 4
je 0x52cac0
mov ebx, dword [ebp - 0x2c]
cmp bl, 4
jne 0x52cc39
mov ebx, dword [ebp - 0x10]
cmp byte [ebx + 0x38], 0
jne 0x52cacd
mov byte [ebx + 0x3a], 0
test edi, edi
je 0x52caea
mov eax, dword [ebp - 0x74]
cmp edi, 9
jb 0x52cadc
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
cmp dword [ebp - 0x84], 0
je 0x52c242
push dword [ebp - 0x88]
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
jmp 0x52c242
cmp byte [ebp - 0x48], 0
mov al, 2
jne 0x52cb62
xorps xmm0, xmm0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0
movups xmmword [ebp - 0x6c], xmm0
push eax
push 4
push dword [ebp - 0x70]
call sub.secur32.dll_QueryContextAttributesW
test eax, eax
jne 0x52ccb0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x68]
movsd xmm0, qword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x34], eax
movsd qword [ebp - 0x3c], xmm0
mov al, 1
mov edx, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xac]
mov byte [ebx + 0x38], al
movsd xmm0, qword [ebp - 0x3c]
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], ecx
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ebp - 0x34]
mov dword [ecx + 8], edx
movsd qword [ecx], xmm0
jmp 0x52c242
cmp eax, 1
jne 0x52cbc3
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [edx + 0x10]
movsd xmm0, qword [edx]
movsd xmm1, qword [edx + 8]
mov dword [ecx + 0x14], eax
movsd qword [ecx + 0xc], xmm1
movsd qword [ecx + 4], xmm0
mov dword [ecx], 1
jmp 0x52cca5
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
jmp 0x52cca5
mov edx, dword [ebp - 0x20]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
jmp 0x52cc9f
mov esi, dword [ebp - 0x20]
mov edx, 0x25
lea ecx, [esi + 4]
push 0x1f
push 0x5a3e24
call fcn.004c625d
add esp, 8
mov dword [esi], 2
jmp 0x52cca5
mov edi, dword [ebp - 0x18]
mov esi, eax
shl eax, 0x18
xor ebx, ebx
jmp 0x52cc42
mov ecx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x40]
movzx eax, bh
mov esi, edx
shl eax, 8
shld edi, ecx, 0x10
shl ecx, 0x10
or eax, ecx
mov ecx, esi
mov esi, dword [ebp - 0x20]
movzx ecx, cl
or ecx, eax
mov dword [esi + 8], edi
mov dword [esi + 4], ecx
jmp 0x52cbf9
mov esi, dword [ebp - 0x28]
mov eax, ebx
shrd eax, esi, 8
shr esi, 8
test edi, edi
je 0x52cc68
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
cmp edi, 9
jb 0x52cc57
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x5c9128]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x84], 0
je 0x52cc88
push dword [ebp - 0x88]
push 0
push dword [0x5c9128]
mov edi, eax
call sub.kernel32.dll_HeapFree
mov eax, edi
mov edx, dword [ebp - 0x20]
shld esi, eax, 8
shl eax, 8
movzx edi, bl
mov ecx, eax
or edi, ecx
mov dword [edx + 8], esi
mov dword [edx + 4], edi
mov dword [edx], 2
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov dword [ecx + 4], 0
mov dword [ecx], 2
jmp 0x52cca5
xor ecx, ecx
inc ecx
push 0x5a3e94
jmp 0x52cce1
xor ecx, ecx
inc ecx
push 0x5a3ea4
jmp 0x52cce1
xor ecx, ecx
inc ecx
push 0x5a3e84
call fcn.00444440
add esp, 4
ud2
mov ecx, 4
mov edx, 0x18
call fcn.0041b1c0
ud2
mov ecx, esi
push 0x5a3e74
call fcn.00445020
jmp 0x52cce6