Function at 0x537630
Capabilities:
Check os version
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0x284
xor ecx, ecx
test eax, eax
setne cl
test eax, eax
push ebx
push esi
push edi
mov dword [0x100ef814], ecx
je 0x53766f
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [0x100ef818], edx
mov edx, dword [eax + 8]
mov dword [0x100ef81c], ecx
mov dword [0x100ef810], edx
jmp 0x537695
mov eax, dword [ebp + 8]
test eax, eax
mov ecx, dword [ebp + 0xc]
jne 0x53767d
test ecx, ecx
je 0x537685
mov dword [0x100ef81c], ecx
jmp 0x537690
call fcn.0050b9c0
mov dword [0x100ef81c], edx
mov dword [0x100ef818], eax
call dword [0x100cf09c]
push 0
push 0
push 0
mov dword [0x100ef80c], eax
call dword [0x100cf1d4]
mov esi, dword [0x100cf1d8]
mov dword [0x100ef808], eax
call esi
mov dword [0x100e7a04], eax
call esi
mov dword [0x100ef804], eax
call esi
mov dword [0x100e7a08], eax
call esi
push 0x100e3420
push 0x100cf820
mov dword [0x100e7a10], eax
mov dword [0x100ef800], 0
call dword [0x100cf258]
mov esi, dword [0x100cf25c]
push eax
call esi
test eax, eax
mov dword [0x100ef7fc], eax
je 0x537711
push 0x100ef800
call dword [0x100cf22c]
push eax
call dword [0x100ef7fc]
mov eax, dword [0x100ef800]
mov ebx, dword [0x100cf254]
xor ecx, ecx
test eax, eax
setne cl
push 0x100cf3dc
mov dword [0x100ef7f8], eax
lea ecx, [ecx*4 + 4]
mov dword [0x100ef7f4], ecx
call ebx
mov edi, eax
push 0x100e3430
push edi
call esi
push 0x100cf3cc
push edi
mov dword [0x100ef7f0], eax
call esi
push 0x100e343c
push edi
mov dword [0x100ef7ec], eax
call esi
push 0x100e344c
push edi
mov dword [0x100ef7e8], eax
call esi
push 0x100da38c
push edi
mov dword [0x100ef7e4], eax
call esi
push 0x100e3460
push edi
mov dword [0x100ef7e0], eax
call esi
push 0x100d786c
push edi
mov dword [0x100ef7dc], eax
call esi
push 0x100d77cc
push edi
mov dword [0x100ef7d8], eax
call esi
push 0x100e3478
push edi
mov dword [0x100ef7d4], eax
call esi
push 0x100e3490
push edi
mov dword [0x100ef7d0], eax
call esi
push 0x100d79d0
push edi
mov dword [0x100ef7cc], eax
call esi
push 0x100e34a8
push edi
mov dword [0x100ef7c8], eax
call esi
push 0x100e34c0
push edi
mov dword [0x100ef7c4], eax
call esi
push 0x100e34dc
push edi
mov dword [0x100ef7c0], eax
call esi
push 0x100e34f8
push edi
mov dword [0x100ef7bc], eax
call esi
push 0x100e350c
push edi
mov dword [0x100ef7b8], eax
call esi
push 0x100e3528
push edi
mov dword [0x100ef7b4], eax
call esi
push 0x100d763c
mov dword [0x100ef7b0], eax
push edi
call esi
push 0x100d7678
push edi
mov dword [0x100ef7ac], eax
call esi
push 0x100e353c
push edi
mov dword [0x100ef7a8], eax
call esi
push 0x100e355c
push edi
mov dword [0x100ef7a4], eax
call esi
push 0x100e3574
push edi
mov dword [0x100ef7a0], eax
call esi
push 0x100e358c
push edi
mov dword [0x100ef79c], eax
call esi
push 0x100e35a4
push edi
mov dword [0x100ef798], eax
call esi
push 0x100e35b8
push edi
mov dword [0x100ef794], eax
call esi
push 0x100e35d0
push edi
mov dword [0x100ef790], eax
call esi
push 0x100e35dc
push edi
mov dword [0x100ef78c], eax
call esi
push 0x100e35ec
push edi
mov dword [0x100ef788], eax
call esi
push 0x100e3604
push edi
mov dword [0x100ef784], eax
call esi
push 0x100d7610
push edi
mov dword [0x100ef780], eax
call esi
push 0x100d75b8
push edi
mov dword [0x100ef77c], eax
call esi
push 0x100d7628
push edi
mov dword [0x100ef778], eax
call esi
push 0x100e3610
push edi
mov dword [0x100ef774], eax
call esi
push 0x100e355c
push edi
mov dword [0x100ef770], eax
call esi
push 0x100d77b4
push edi
mov dword [0x100ef7a0], eax
call esi
push 0x100d7550
push edi
mov dword [0x100ef76c], eax
call esi
push 0x100d7568
push edi
mov dword [0x100ef768], eax
call esi
push 0x100d75d8
push edi
mov dword [0x100ef764], eax
call esi
push 0x100d75d0
push edi
mov dword [0x100ef760], eax
call esi
push 0x100cf820
mov dword [0x100ef75c], eax
call ebx
mov edi, eax
push 0x100d7908
push edi
call esi
push 0x100e3628
push edi
mov dword [0x100ef758], eax
call esi
push 0x100e3638
push edi
mov dword [0x100ef754], eax
call esi
push 0x100e364c
push edi
mov dword [0x100ef750], eax
call esi
push 0x100e3660
push edi
mov dword [0x100ef74c], eax
call esi
push 0x100e366c
push edi
mov dword [0x100ef748], eax
call esi
push 0x100e368c
push edi
mov dword [0x100ef744], eax
call esi
push 0x100e36ac
push edi
mov dword [0x100ef740], eax
call esi
push 0x100e36c8
push edi
mov dword [0x100ef73c], eax
call esi
push 0x100e36d4
push edi
mov dword [0x100ef820], eax
call esi
push 0x100e36f4
push edi
mov dword [0x100ef738], eax
call esi
push 0x100e3710
push edi
mov dword [0x100ef734], eax
call esi
push 0x100e3730
push edi
mov dword [0x100ef730], eax
call esi
push 0x100cf954
mov dword [0x100ef72c], eax
call ebx
test eax, eax
mov dword [0x100ef728], eax
je 0x537a0a
push 0x100e3740
push eax
call esi
mov dword [0x100ef724], eax
jmp 0x537a14
mov dword [0x100ef724], 0
push 0x100be3d0
push 1
call dword [0x100ef734]
mov esi, dword [0x100cf160]
push 0x40
push 0x1000
push 0x25
xor ebx, ebx
push ebx
mov dword [0x100ef720], eax
call esi
push 0x25
push 0x100e3754
push eax
mov dword [0x100ef71c], eax
call dword [0x100ef7ec]
push ebx
push 0x100ef718
push 1
push 0x100e377c
call dword [0x100cf004]
test eax, eax
mov edi, dword [0x100cf040]
je 0x537ab9
mov ecx, dword [0x100ef718]
lea edx, [esp + 0x58]
push edx
push 0x100ef714
lea eax, [esp + 0x110]
push eax
push ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x68], ebx
call dword [0x100cf03c]
test eax, eax
je 0x537ab9
push 1
push 0x100ef700
call edi
mov edx, dword [esp + 0x58]
mov eax, dword [0x100ef714]
push edx
push eax
push 1
push 0x100ef700
call dword [0x100cf044]
push 1
push 0x100ef6ec
call edi
push ebx
push ebx
push 1
push 0x100ef6ec
call dword [0x100cf048]
push 4
push 0x1000
push 0xa0000
push ebx
call esi
mov esi, eax
push 0xa0000
xor eax, eax
mov ecx, 0x400
mov dword [0x100ef6e8], esi
call fcn.00539270
add esp, 4
test eax, eax
je 0x538ea6
push 0x100ef6c4
call dword [0x100cf15c]
push 0x100ef5a8
mov dword [0x100ef5a8], 0x11c
call dword [0x100cf1cc]
cmp dword [0x100ef5ac], 6
jb 0x537b3f
mov eax, 1
cmp dword [0x100ef5b0], eax
mov dword [0x100ef5a4], eax
jae 0x537b45
mov dword [0x100ef5a4], ebx
push 0x20000
call fcn.0053b370
add esp, 4
mov dword [0x100ef5a0], eax
xor esi, esi
lea esp, [esp]
push esi
call dword [0x100ef7d0]
mov ecx, dword [0x100ef5a0]
mov word [ecx + esi*2], ax
add esi, 1
cmp esi, 0x10000
jl 0x537b60
xor edx, edx
mov dword [esp + 0x11c], edx
mov ecx, 0x100ef4b4
mov eax, 0x100ef4b8
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], edx
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x138], ecx
lea ecx, [esp + 0x128]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x124]
lea ebx, [esp + 0x1b]
mov edi, ecx
mov dword [esp + 0x12c], 0xffffffff
mov dword [esp + 0x134], edx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
call fcn.00535220
test al, al
jne 0x537bf3
xor ebx, ebx
jmp 0x537c01
mov eax, dword [esp + 0x138]
add dword [eax], 1
mov al, 1
xor ebx, ebx
mov edx, dword [0x100ef808]
push 0xc
push 1
push edx
mov byte [esp + 0x150], al
call dword [0x100cf14c]
cmp byte [esp + 0x144], 0
mov esi, eax
je 0x537c6b
mov eax, dword [esp + 0x140]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [ecx], ebx
jne 0x537c6b
mov edx, ecx
mov dword [edx], ebx
mov eax, dword [edi + 8]
push ebx
push eax
call dword [0x100cf084]
mov ecx, dword [edi + 0xc]
test ecx, ecx
lea eax, [edi + 0xc]
jle 0x537c6b
push eax
call dword [0x100cf080]
mov edx, dword [edi + 0x14]
push ebx
push 1
push edx
call dword [0x100cf088]
cmp esi, ebx
je 0x537c97
mov eax, 0x200
xor ecx, ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.0053b3c0
mov dword [esi], eax
mov dword [esi + 4], ebx
mov word [eax], bx
mov dword [0x100ef824], esi
jmp 0x537c9d
mov dword [0x100ef824], ebx
lea eax, [esp + 0x14]
push eax
push 8
call dword [0x100cf22c]
push eax
call dword [0x100cf02c]
test eax, eax
je 0x537d7a
mov edx, dword [esp + 0x14]
mov ebx, dword [0x100cf000]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 1
push edx
mov dword [esp + 0x24], 0
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x537d6d
push eax
mov edi, eax
call fcn.0053b370
mov ecx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 1
push ecx
call ebx
test eax, eax
je 0x537d62
mov eax, dword [esi]
lea edx, [esp + 0x28]
push edx
push eax
call dword [0x100cf00c]
mov ebx, dword [esp + 0x28]
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call fcn.00475be0
mov ebx, dword [esp + 0x60]
mov edi, dword [0x100ef824]
call fcn.00475be0
xor edi, edi
cmp ebx, edi
je 0x537d57
mov eax, ebx
call fcn.00472510
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov ecx, dword [esp + 0x28]
push ecx
call dword [0x100cf218]
test esi, esi
je 0x537d6d
mov eax, esi
call fcn.00472510
mov edx, dword [esp + 0x14]
push edx
call dword [0x100cf21c]
xor ebx, ebx
push 0x100d3bb4
push 0x100ef598
call dword [0x100ef7e0]
mov dword [0x100ef594], ebx
xor ecx, ecx
mov eax, 0x100e37a0
add eax, 2
add ecx, 1
cmp word [eax], bx
jne 0x537d97
lea eax, [ecx + ecx + 2]
push eax
push ebx
call dword [0x100cf140]
push eax
call dword [0x100cf14c]
mov dword [0x100ef590], eax
xor edx, edx
mov ecx, 0x100e37a0
add ecx, 2
add edx, 1
cmp word [ecx], bx
jne 0x537dc1
lea ecx, [edx + edx + 2]
push ecx
push 0x100e37a0
push eax
call dword [0x100ef7ec]
mov edi, dword [0x100cf254]
push 0x100e3918
call edi
cmp eax, ebx
mov dword [0x100ef58c], eax
je 0x53804b
mov esi, dword [0x100cf25c]
push 0x100e3928
push eax
call esi
mov edx, dword [0x100ef58c]
push 0x100e3948
push edx
mov dword [0x100ef588], eax
call esi
mov dword [0x100ef584], eax
mov eax, dword [0x100ef58c]
push 0x100e3974
push eax
call esi
mov dword [0x100ef580], eax
mov eax, dword [0x100ef58c]
cmp eax, ebx
je 0x537e91
push 0x10
push 1
push eax
call dword [0x100cf158]
mov ecx, dword [0x100ef58c]
mov esi, eax
push esi
push ecx
call dword [0x100cf16c]
push eax
call dword [0x100cf170]
mov edx, dword [0x100ef58c]
push esi
push edx
mov ebx, eax
call dword [0x100cf174]
test ebx, ebx
je 0x537e91
cmp word [ebx + 0x26], 0
lea eax, [ebx + 0x26]
jne 0x537e89
jmp 0x537e80
add eax, 2
cmp word [eax], 0
je 0x537e80
mov eax, dword [eax + 0x10]
mov dword [0x100ef57c], eax
push 0x100e39a0
push 0x100cf3dc
call dword [0x100cf258]
mov esi, dword [0x100cf25c]
push eax
call esi
push 0x100e39bc
mov dword [0x100ef578], eax
call edi
push 0x100e3730
push eax
mov dword [0x100ef574], eax
call esi
push 0x100e39d8
mov dword [0x100ef72c], eax
call edi
push 0x100e39e8
push eax
mov dword [0x100ef570], eax
call esi
mov esi, dword [0x100cf140]
push 2
push 0
mov dword [0x100ef56c], eax
mov dword [esp + 0x14], 1
call esi
mov ebx, dword [0x100cf14c]
push eax
call ebx
mov edi, dword [0x100cf1d0]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [0x100ef568], eax
mov word [eax], 0
call edi
test eax, eax
jne 0x537f52
call dword [0x100cf204]
cmp eax, 0x6f
jne 0x537f52
mov eax, dword [esp + 0xc]
add eax, 1
lea edx, [eax + eax]
mov dword [esp + 0xc], eax
mov eax, dword [0x100ef568]
push edx
push eax
push 0
call esi
push eax
call dword [0x100cf1dc]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [0x100ef568], eax
call edi
call dword [0x100cf248]
mov dword [0x100ef564], eax
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x1f8]
call fcn.00532c00
mov edx, dword [0x100ef808]
push 0x10000
push 1
push edx
call ebx
cmp byte [esp + 0x210], 0
mov esi, eax
je 0x537fdc
mov eax, dword [esp + 0x20c]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [ecx], 0
jne 0x537fdc
mov edx, ecx
mov dword [edx], 0
mov eax, dword [edi + 8]
push 0
push eax
call dword [0x100cf084]
mov ecx, dword [edi + 0xc]
test ecx, ecx
lea eax, [edi + 0xc]
jle 0x537fdc
push eax
call dword [0x100cf080]
mov edx, dword [edi + 0x14]
push 0
push 1
push edx
call dword [0x100cf088]
lea eax, [esp + 0x1c]
push eax
push 0x100e39fc
push 0x80000005
mov dword [0x100ef560], 1
call dword [0x100cf008]
test eax, eax
jne 0x53806f
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push ecx
push 0x10000
push esi
push 7
push edx
call dword [0x100ef7d8]
mov ecx, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x100ef560], eax
lea eax, [esp + 0x48]
push eax
push 0x10000
push esi
push 5
push ecx
call dword [0x100ef7d8]
test eax, eax
jne 0x538056
mov edx, dword [esp + 0x48]
mov dword [0x100ef55c], edx
jmp 0x538060
mov dword [0x100ef588], ebx
jmp 0x537e91
mov dword [0x100ef55c], 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x53806f
push eax
call dword [0x100cf010]
test esi, esi
je 0x5380b4
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x238]
call fcn.00532c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0x250], 0
je 0x5380b4
mov esi, dword [esp + 0x24c]
call fcn.005154d0
mov ebx, dword [0x100cf14c]
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x218]
call fcn.00532c00
mov ecx, dword [0x100ef808]
push 0x10000
push 1
push ecx
call ebx
cmp byte [esp + 0x230], 0
mov esi, eax
je 0x538133
mov eax, dword [esp + 0x22c]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov edx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [edx], 0
jne 0x538133
mov eax, edx
mov dword [eax], 0
mov ecx, dword [edi + 8]
push 0
push ecx
call dword [0x100cf084]
mov edx, dword [edi + 0xc]
test edx, edx
lea eax, [edi + 0xc]
jle 0x538133
push eax
call dword [0x100cf080]
mov eax, dword [edi + 0x14]
push 0
push 1
push eax
call dword [0x100cf088]
lea ecx, [esp + 0x30]
push ecx
push 0x100e39fc
push 0x80000005
mov dword [0x100ef558], 1
call dword [0x100cf008]
test eax, eax
jne 0x53818c
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1a8]
push edx
push 0x10000
push esi
push 7
push eax
call dword [0x100ef7d8]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x100ef558], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x53818c
push eax
call dword [0x100cf010]
test esi, esi
je 0x5381cc
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x258]
call fcn.00532c00
mov ecx, dword [0x100ef808]
push esi
push 1
push ecx
call dword [0x100cf260]
cmp byte [esp + 0x270], 0
je 0x5381cc
mov esi, dword [esp + 0x26c]
call fcn.005154d0
push 0x100e3a0c
lea edx, [esp + 0x1b4]
mov esi, 0xfefe
push edx
mov dword [esp + 0x5c], esi
call dword [0x100ef7e0]
xor edi, edi
lea ecx, [esp + 0x54]
push ecx
push edi
push edi
push edi
lea edx, [esp + 0x188]
lea eax, [esp + 0x1c0]
push edx
mov dword [esp + 0x194], eax
push 0x20019
lea eax, [esp + 0x1c4]
mov ebx, 0x40
push eax
mov dword [esp + 0x194], 0x18
mov dword [esp + 0x198], edi
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a8], edi
call dword [0x100ef7d4]
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
xor ecx, ecx
cmp dword [esp + 0x54], edi
push 0x100cf494
sete cl
lea edx, [esp + 0x1bc]
push edx
mov dword [0x100ef554], ecx
mov ecx, dword [eax + 0x10]
mov edi, dword [ecx + 0x2c]
mov eax, 0xfefefefe
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
call dword [0x100ef7e0]
lea eax, [esp + 0x1b8]
lea ecx, [esp + 0x150]
mov dword [esp + 0x198], eax
xor eax, eax
push ecx
lea edx, [esp + 0x194]
push edx
mov dword [esp + 0x198], 0x18
mov dword [esp + 0x19c], edi
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
call dword [0x100ef77c]
test eax, eax
jne 0x53834e
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
lea edx, [esp + 0x280]
mov dword [esp + 0x148], eax
push edx
lea eax, [esp + 0x14c]
push eax
mov dword [esp + 0x154], ecx
call dword [0x100cf1e0]
mov dword [0x100ef550], eax
jmp 0x538358
mov dword [0x100ef550], 1
push 0x100d7918
push 0x100da380
call dword [0x100cf258]
push eax
call dword [0x100cf25c]
lea ecx, [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x27c]
push edx
push 1
push edi
mov dword [esp + 0x4c], esi
call eax
xor eax, eax
xor ebx, ebx
cmp dword [esp + 0x38], ebx
push 0x13
push 8
setne al
lea ecx, [esp + 0x1f0]
push ecx
lea edx, [esp + 0x1ec]
push edx
push edi
mov dword [0x100ef54c], eax
call dword [0x100ef778]
cmp dword [0x100ef758], ebx
mov dword [0x100ef548], eax
je 0x538410
push 0x20
lea eax, [esp + 0x1c4]
push eax
call dword [0x100ef7e8]
push ebx
mov dword [esp + 0x1c4], 0x20
mov dword [esp + 0x1e0], 1
mov dword [esp + 0x1c8], 0x80
call dword [0x100cf210]
lea ecx, [esp + 0x1c0]
push ecx
call dword [0x100ef758]
call dword [0x100cf204]
mov dword [0x100ef544], eax
mov eax, 0x100ef4b8
mov dword [esp + 0x11c], ebx
mov edx, dword [esp + 0x11c]
mov ecx, 0x100ef4b4
mov dword [esp + 0x124], ebx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x78], edx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
call fcn.00535fe0
call dword [0x100cf08c]
mov edx, dword [esp + 0x74]
mov esi, eax
mov eax, dword [edx]
cmp esi, eax
je 0x5384a5
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
test edx, edx
jne 0x538ead
mov eax, dword [esp + 0x74]
push ebx
push esi
push eax
call dword [0x100cf090]
test eax, eax
sete al
test al, al
je 0x538ead
mov ecx, dword [esp + 0x7c]
mov dword [ecx], ebx
mov eax, dword [esp + 0x7c]
add dword [eax], 1
mov al, 1
mov edx, dword [0x100ef808]
push 0x38
push 1
push edx
mov byte [esp + 0x94], al
call dword [0x100cf14c]
cmp byte [esp + 0x88], bl
mov edi, eax
je 0x538517
mov eax, dword [esp + 0x84]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov esi, eax
add eax, 0x10
cmp dword [ecx], ebx
jne 0x538517
mov edx, ecx
mov dword [edx], ebx
mov eax, dword [esi + 8]
push ebx
push eax
call dword [0x100cf084]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea eax, [esi + 0xc]
jle 0x538517
push eax
call dword [0x100cf080]
mov edx, dword [esi + 0x14]
push ebx
push 1
push edx
call dword [0x100cf088]
cmp edi, ebx
je 0x538ec4
call fcn.0050b720
mov esi, eax
cmp esi, ebx
je 0x538531
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov dword [0x100ef540], esi
je 0x53854c
push 0x70
push eax
push 0x100ef4d0
call dword [0x100ef7ec]
call fcn.005355b0
call fcn.0053ac80
lea ebx, [esp + 0x20]
call fcn.004ad910
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x110], esi
je 0x53857a
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
lea ecx, [esp + 0x110]
push ecx
push 0x100cff38
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x53859a
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x5385b2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x20], 0
mov eax, dword [0x100ef828]
push 0x100cff38
push 0x100d009c
call fcn.0053ad20
lea ebx, [esp + 0x40]
call fcn.004ada50
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x10c], esi
je 0x5385ea
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0x10c]
push edx
push 0x100cff48
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x53860a
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x538622
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x40], 0
mov ecx, dword [0x100ef540]
mov edx, dword [ecx]
mov eax, dword [edx + 0xbc]
call eax
lea ebx, [esp + 0x94]
mov esi, eax
call fcn.004ac230
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cff58
mov ecx, esi
call edx
mov eax, dword [esp + 0x94]
test eax, eax
je 0x538664
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x50]
call fcn.004af9e0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc4], esi
je 0x538688
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc4]
push edx
push 0x100cff08
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x5386a8
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x5386c0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x50], 0
mov eax, dword [0x100ef828]
push 0x100cff08
push 0x100d00ac
call fcn.0053ad20
lea ebx, [esp + 0x24]
call fcn.004afaf0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x9c], esi
je 0x5386f8
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0x9c]
push eax
push 0x100cff18
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538718
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x538730
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x24], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xcc]
mov esi, eax
call fcn.004ae0f0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cff28
mov ecx, esi
call edx
mov eax, dword [esp + 0xcc]
test eax, eax
je 0x538772
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x2c]
call fcn.004b0730
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xa4], esi
je 0x538796
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xa4]
push edx
push 0x100cfed8
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x5387b6
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x5387ce
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x2c], 0
mov eax, dword [0x100ef828]
push 0x100cfed8
push 0x100d00bc
call fcn.0053ad20
lea ebx, [esp + 0x34]
call fcn.004b0840
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd4], esi
je 0x538806
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xd4]
push eax
push 0x100cfee8
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538826
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x53883e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x34], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xac]
mov esi, eax
call fcn.004afcc0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfef8
mov ecx, esi
call edx
mov eax, dword [esp + 0xac]
test eax, eax
je 0x538880
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x3c]
call fcn.004b1560
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xdc], esi
je 0x5388a4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xdc]
push edx
push 0x100cfea8
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x5388c4
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x5388dc
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x3c], 0
mov eax, dword [0x100ef828]
push 0x100cfea8
push 0x100d00fc
call fcn.0053ad20
lea ebx, [esp + 0x44]
call fcn.004b1670
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xb4], esi
je 0x538914
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xb4]
push eax
push 0x100cfeb8
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538934
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x53894c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x44], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xe4]
mov esi, eax
call fcn.004b0b00
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfec8
mov ecx, esi
call edx
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x53898e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x4c]
call fcn.0053aad0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xbc], esi
je 0x5389b2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xbc]
push edx
push 0x100cfb08
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x5389d2
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x5389ea
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x4c], 0
mov eax, dword [0x100ef828]
push 0x100cfb08
push 0x100cf39c
call fcn.0053ad20
lea ebx, [esp + 0x5c]
call fcn.0053abe0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xec], esi
je 0x538a22
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xec]
push eax
push 0x100cfb18
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538a42
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x538a5a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x5c], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xf4]
mov esi, eax
call fcn.005398d0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfb28
mov ecx, esi
call edx
mov eax, dword [esp + 0xf4]
test eax, eax
je 0x538a9c
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x8c]
call fcn.00519ba0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc8], esi
je 0x538ac3
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc8]
push edx
push 0x100cfb58
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538ae3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x538af6
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0x100]
call fcn.005189e0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd0], esi
je 0x538b1d
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xd0]
push eax
push 0x100cfb88
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538b3d
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x100]
test eax, eax
je 0x538b50
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0x104]
call fcn.00518a60
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd8], esi
je 0x538b77
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xd8]
push edx
push 0x100cfb98
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538b97
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x104]
test eax, eax
je 0x538baa
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0x114]
call fcn.00515280
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xe0], esi
je 0x538bd1
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xe0]
push eax
push 0x100cfba8
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538bf1
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x114]
test eax, eax
je 0x538c04
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0xfc]
call fcn.004802f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xe8], esi
je 0x538c2b
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xe8]
push edx
push 0x100d007c
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538c4b
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0xfc]
test eax, eax
je 0x538c5e
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0xf8]
call fcn.00480370
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xf0], esi
je 0x538c85
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xf0]
push eax
push 0x100d006c
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538ca5
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x538cb8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0x90]
call fcn.004803f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc0], esi
je 0x538cdf
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc0]
push edx
push 0x100d008c
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538cff
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x90]
test eax, eax
je 0x538d12
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0xa0]
call fcn.0047c9f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x98], esi
je 0x538d39
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0x98]
push eax
push 0x100d00cc
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538d59
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x538d6c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0xb0]
call fcn.0047ca70
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xa8], esi
je 0x538d93
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xa8]
push edx
push 0x100d00dc
mov eax, edi
call fcn.005356a0
test esi, esi
je 0x538db3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x538dc6
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
call fcn.00485320
call fcn.00485410
call fcn.00483d90
call fcn.00483e80
call fcn.004b6d50
call fcn.004b8b50
call fcn.004bb0a0
call fcn.00511570
call fcn.00511660
call fcn.004ba070
call fcn.004ca680
call fcn.004ca770
call fcn.004ca860
call fcn.004ca950
call fcn.004caa40
call fcn.004feca0
call fcn.004fed90
call fcn.004fee80
call fcn.004fef70
call fcn.004e07e0
call fcn.004e08d0
call fcn.004e09c0
call fcn.004e0ab0
call fcn.004e0ba0
call fcn.004e0c90
call fcn.004e0d80
call fcn.004e0e70
call fcn.004e0f60
call fcn.004e1050
call fcn.004aa3e0
call fcn.004aa4d0
call fcn.004aa5c0
call fcn.00478cc0
cmp dword [0x100ef488], 0
jne 0x538ea1
lea ebx, [esp + 0xb8]
call fcn.004b1950
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esp + 0xb8]
test eax, eax
mov dword [0x100ef488], ecx
je 0x538ea1
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
call fcn.004b5d40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x70]
call fcn.00535290
test al, al
jne 0x5384a5
jmp 0x5384ae
xor esi, esi
jmp 0x538531