Function at 0x523458
Capabilities:
Access peb ldr_data
Check os version
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x12
push 0
push 0
dec ecx
jne 0x523460
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov esi, dword [0x5446e8]
xor eax, eax
push ebp
push 0x5243ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi], 0
je 0x524379
xor edx, edx
push ebp
push 0x52433d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
mov ecx, dword [eax]
mov dl, 1
mov eax, dword [0x4403c0]
call fcn.00440470
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x52432c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [esi]
mov al, byte [eax + 0x30]
push eax
mov ecx, 0x5243c4
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x548448]
mov eax, dword [eax + 0x444]
mov al, byte [eax + 0x57]
push eax
mov ecx, 0x5243e8
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [0x548448]
mov eax, dword [eax + 0x5d0]
mov al, byte [eax + 0x57]
push eax
mov ecx, 0x5243f8
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea eax, [ebp - 0x3c]
mov edx, dword [esi]
mov dl, byte [edx + 0x26]
call fcn.00404c14
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, 0x52440c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
push eax
mov ecx, 0x524424
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 6]
push eax
mov ecx, 0x524438
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 7]
push eax
mov ecx, 0x52444c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x3c]
push eax
mov ecx, 0x524460
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x20]
push eax
mov ecx, 0x524478
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x3d]
push eax
mov ecx, 0x524490
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x3e]
push eax
mov ecx, 0x5244a8
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x3f]
push eax
mov ecx, 0x5244c0
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x40]
push eax
mov ecx, 0x5244d8
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x41]
push eax
mov ecx, 0x5244f0
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x42]
push eax
mov ecx, 0x52450c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
push eax
mov ecx, 0x524528
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0x48]
push eax
mov ecx, 0x52453c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
push eax
mov ecx, 0x524550
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x22b]
dec al
je 0x52369f
dec al
jne 0x5236a6
mov ebx, 2
jmp 0x5236a8
mov ebx, 1
jmp 0x5236a8
xor ebx, ebx
mov eax, 0x2c
call fcn.004027e0
mov edi, eax
mov dword [edi], 4
push edi
mov eax, dword [0x54447c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [edi + 8]
test eax, eax
je 0x5236d7
cmp eax, 2
jne 0x5236dc
mov ebx, 1
mov edx, 0x2c
mov eax, edi
call fcn.00402800
cmp ebx, 2
jne 0x523793
mov eax, 0x2c
call fcn.004027e0
mov edi, eax
mov dword [edi], 4
push edi
mov eax, dword [0x548448]
call fcn.00486784
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [edi + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [edi + 0x28]
mov dword [ebp - 0x34], eax
mov edx, 0x2c
mov eax, edi
call fcn.00402800
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x64], ebx
mov byte [ebp - 0x60], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x28]
jno 0x523764
call fcn.00403b58
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x2c]
jno 0x523778
call fcn.00403b58
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea edx, [ebp - 0x64]
mov ecx, 4
mov eax, 0x524564
call fcn.0040a674
jmp 0x5237e4
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x64], ebx
mov byte [ebp - 0x60], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
lea edx, [ebp - 0x64]
mov ecx, 4
mov eax, 0x524564
call fcn.0040a674
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x52457c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x54]
call fcn.00409a1c
test al, al
je 0x52382b
lea edx, [ebp - 0x68]
mov eax, dword [esi]
mov eax, dword [eax + 0x54]
call fcn.00409e04
mov eax, dword [ebp - 0x68]
push eax
mov ecx, 0x52458c
mov edx, 0x5243d8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0x13]
push eax
mov ecx, 0x5245a0
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x12]
push eax
mov ecx, 0x5245c4
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x14]
push eax
mov ecx, 0x5245d8
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x10]
push eax
mov ecx, 0x5245ec
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x15]
push eax
mov ecx, 0x524604
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x11]
push eax
mov ecx, 0x52461c
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x16]
push eax
mov ecx, 0x524638
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x18]
push eax
mov ecx, 0x524650
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x19]
push eax
mov ecx, 0x524660
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x1a]
push eax
mov ecx, 0x524670
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 8]
push eax
mov ecx, 0x52468c
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 9]
push eax
mov ecx, 0x5246a4
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0xa]
push eax
mov ecx, 0x5246bc
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
push eax
mov ecx, 0x5246d0
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
movzx eax, word [eax + 0x24]
push eax
mov ecx, 0x5246e0
mov edx, 0x5245b4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c0]
mov eax, dword [eax + 0x34]
call fcn.004927ec
sub eax, 1
jno 0x5239af
call fcn.00403b58
test eax, eax
jl 0x5239f0
inc eax
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x5c0]
mov eax, dword [eax + 0x34]
mov edx, ebx
call fcn.004927fc
mov eax, dword [eax + 0x30]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
call fcn.00409508
mov ecx, dword [ebp - 0x6c]
mov edx, 0x5246f4
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 4]
inc ebx
dec dword [ebp - 0x38]
jne 0x5239b9
mov eax, dword [esi]
movzx eax, word [eax + 0x76]
push eax
mov ecx, 0x524708
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x79]
push eax
mov ecx, 0x524738
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
movzx eax, byte [eax + 0x78]
push eax
mov ecx, 0x524750
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x7c]
push eax
mov ecx, 0x524768
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0x7a]
push eax
mov ecx, 0x52477c
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x80]
push eax
mov ecx, 0x524790
mov edx, 0x524720
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x8d]
push eax
mov ecx, 0x5246a4
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x8e]
push eax
mov ecx, 0x5247bc
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x8f]
push eax
mov ecx, 0x5247d4
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x90]
push eax
mov ecx, 0x5247ec
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
movzx eax, word [eax + 0x96]
push eax
mov ecx, 0x524804
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
movzx eax, word [eax + 0x94]
push eax
mov ecx, 0x524818
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0x9c]
push eax
mov ecx, 0x524830
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x98]
push eax
mov ecx, 0x524844
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x99]
push eax
mov ecx, 0x52485c
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x9a]
push eax
mov ecx, 0x524870
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x9b]
push eax
mov ecx, 0x524888
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0xa0]
push eax
mov ecx, 0x52489c
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xa8]
push eax
mov ecx, 0x5248b0
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xa4]
push eax
mov ecx, 0x5248c4
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xac]
push eax
mov ecx, 0x5248d8
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
movzx eax, byte [eax + 0xb0]
push eax
mov ecx, 0x5248ec
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov eax, dword [eax + 0xb4]
push eax
mov ecx, 0x524900
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0xb8]
push eax
mov ecx, 0x524910
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0xbc]
push eax
mov ecx, 0x524924
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0xc0]
push eax
mov ecx, 0x52493c
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea eax, [ebp - 0x24]
mov edx, dword [esi]
mov edx, dword [edx + 0xc4]
call fcn.00404ac4
mov eax, dword [ebp - 0x24]
call fcn.00404cec
test eax, eax
jle 0x523cea
mov dword [ebp - 0x38], eax
mov ebx, 1
mov eax, dword [ebp - 0x24]
mov al, byte [eax + ebx - 1]
cmp al, 0xd
je 0x523cd7
cmp al, 0xa
jne 0x523ce4
lea eax, [ebp - 0x24]
call fcn.00404f44
mov byte [eax + ebx - 1], 0x20
inc ebx
dec dword [ebp - 0x38]
jne 0x523cc8
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x524950
mov edx, 0x5247a4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0xc8]
push eax
mov ecx, 0x524960
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0xcc]
push eax
mov ecx, 0x524984
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xd0]
push eax
mov ecx, 0x524994
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xd4]
push eax
mov ecx, 0x5249a4
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xd8]
push eax
mov ecx, 0x5249b8
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xdc]
push eax
mov ecx, 0x5249c8
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xe0]
push eax
mov ecx, 0x5249d8
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x70]
mov eax, dword [esi]
mov eax, dword [eax + 0xe4]
call fcn.004c3630
mov eax, dword [ebp - 0x70]
push eax
mov ecx, 0x5249ec
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0xc9]
push eax
mov ecx, 0x5249f8
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0xe8]
push eax
mov ecx, 0x524a0c
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xec]
push eax
mov ecx, 0x524a1c
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xf0]
push eax
mov ecx, 0x524a30
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xf4]
push eax
mov ecx, 0x524a40
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0xf8]
push eax
mov ecx, 0x524a50
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x74]
mov eax, dword [esi]
mov eax, dword [eax + 0xfc]
call fcn.004c3630
mov eax, dword [ebp - 0x74]
push eax
mov ecx, 0x524a64
mov edx, 0x524974
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
movzx eax, byte [eax + 0x58]
push eax
mov ecx, 0x524a70
mov edx, 0x524a84
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x64]
push eax
mov ecx, 0x524aa4
mov edx, 0x524a84
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
lea edx, [ebp - 0x78]
mov eax, dword [esi]
mov eax, dword [eax + 0x5c]
call fcn.004c3630
mov eax, dword [ebp - 0x78]
push eax
mov ecx, 0x524ab8
mov edx, 0x524a84
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
lea edx, [ebp - 0x7c]
mov eax, dword [esi]
mov eax, dword [eax + 0x60]
call fcn.004c3630
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, 0x524acc
mov edx, 0x524a84
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x68]
push eax
mov ecx, 0x524ae0
mov edx, 0x524af4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x6c]
push eax
mov ecx, 0x524b0c
mov edx, 0x524af4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov eax, dword [eax + 0x70]
push eax
mov ecx, 0x524b24
mov edx, 0x524af4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0x75]
push eax
mov ecx, 0x524b38
mov edx, 0x524af4
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
movzx eax, byte [eax + 0x8c]
push eax
mov ecx, 0x524b50
mov edx, 0x524b64
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x81]
push eax
mov ecx, 0x524b7c
mov edx, 0x524b64
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
movzx eax, byte [eax + 0x82]
push eax
mov ecx, 0x524b90
mov edx, 0x524ba8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
movzx eax, byte [eax + 0x83]
push eax
mov ecx, 0x524bbc
mov edx, 0x524ba8
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [esi]
mov al, byte [eax + 0x84]
push eax
mov ecx, 0x524bd4
mov edx, 0x524bec
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x87]
push eax
mov ecx, 0x524c14
mov edx, 0x524bec
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov eax, dword [eax + 0x88]
push eax
mov ecx, 0x524c30
mov edx, 0x524bec
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
mov eax, dword [esi]
mov al, byte [eax + 0x85]
push eax
mov ecx, 0x524c44
mov edx, 0x524bec
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [esi]
mov al, byte [eax + 0x86]
push eax
mov ecx, 0x524c58
mov edx, 0x524bec
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov eax, dword [eax + 0x23c]
call fcn.0041cc8c
mov dword [ebp - 0xc], 1
sub eax, 1
jno 0x52409d
call fcn.00403b58
test eax, eax
jl 0x524149
inc eax
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, ebx
call fcn.0045d130
cmp dword [eax + 0x2c], 0xfffffffe
je 0x5240f3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, ebx
call fcn.0045d130
call fcn.004576bc
push eax
lea edx, [ebp - 0x80]
mov eax, ebx
call fcn.00409508
mov ecx, dword [ebp - 0x80]
mov edx, 0x524c6c
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
jmp 0x52411d
mov eax, dword [esi]
mov eax, dword [eax + 0x50]
movzx eax, word [eax + ebx*2]
push eax
lea edx, [ebp - 0x84]
mov eax, ebx
call fcn.00409508
mov ecx, dword [ebp - 0x84]
mov edx, 0x524c6c
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3e0]
mov edx, ebx
call fcn.0045d130
cmp dword [eax + 0x2c], 0xfffffffe
je 0x52413f
mov ecx, ebx
mov eax, 1
shl eax, cl
or dword [ebp - 0xc], eax
inc ebx
dec dword [ebp - 0x38]
jne 0x5240ab
mov eax, dword [ebp - 0xc]
push eax
mov ecx, 0x524c88
mov edx, 0x524c6c
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
call fcn.004927ec
test eax, eax
jle 0x524273
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
xor edx, edx
call fcn.004927fc
cmp byte [eax + 0x39], 0
je 0x524273
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
call fcn.004927ec
sub eax, 1
jno 0x5241a7
call fcn.00403b58
test eax, eax
jl 0x524273
inc eax
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x350]
mov edx, ebx
call fcn.004927fc
mov eax, dword [eax + 0x30]
lea edx, [ebp - 0x18]
call fcn.00409114
lea eax, [ebp - 0x18]
mov ecx, 2
mov edx, 1
call fcn.00404f8c
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x18]
call fcn.00409114
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x18]
call fcn.00404ac4
cmp dword [ebp - 0x18], 0
je 0x524269
lea eax, [ebp - 0x1c]
call fcn.00404a2c
lea eax, [ebp - 0x20]
call fcn.00404a2c
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.00409d70
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00409e04
cmp dword [ebp - 0x1c], 0
je 0x524269
cmp dword [ebp - 0x20], 0
je 0x524269
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x8c]
mov eax, ebx
add eax, 1
jno 0x52424c
call fcn.00403b58
call fcn.00409508
mov ecx, dword [ebp - 0x8c]
mov edx, 0x524ca0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
cmp ebx, 7
jg 0x524273
inc ebx
dec dword [ebp - 0x38]
jne 0x5241b5
mov eax, dword [0x5442f0]
cmp dword [eax], 0
je 0x524316
mov eax, dword [0x5442f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x524316
mov eax, dword [0x5442f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
sub eax, 1
jno 0x5242bf
call fcn.00403b58
test eax, eax
jl 0x524316
inc eax
mov dword [ebp - 0x38], eax
xor ebx, ebx
lea ecx, [ebp - 0x90]
mov eax, dword [0x5442f0]
mov eax, dword [eax]
mov eax, dword [eax + 0x348]
mov eax, dword [eax + 0x23c]
mov edx, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x90]
push eax
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00409508
mov ecx, dword [ebp - 0x94]
mov edx, 0x524cb0
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 4]
inc ebx
dec dword [ebp - 0x38]
jne 0x5242c9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524333
mov eax, dword [ebp - 8]
call fcn.00403c18
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5243b3
lea eax, [ebp - 0x94]
mov edx, 0xc
call fcn.00404a50
lea eax, [ebp - 0x3c]
call fcn.00404a2c
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.00404a50
ret