Function at 0x512c8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
mov eax, dword [0x5dcef0]
xor eax, esp
mov dword [esp + 0xdc], eax
mov ecx, dword [esp + 0xf0]
push ebx
mov ebx, dword [esp + 0xe8]
push ebp
push esi
mov esi, dword [esp + 0xf4]
cmp dword [ebx + 0x7608], 0
push edi
mov dword [esp + 0xa0], esi
jne 0x512cd9
mov edx, dword [esp + 0xfc]
add edx, esi
mov dword [esp + 0x34], edx
jmp 0x512ce3
mov eax, dword [ebx + 0x7600]
mov dword [esp + 0x34], eax
mov edx, dword [ebx + 0x74b0]
mov ebp, esi
mov eax, dword [ebx + 0x7578]
mov esi, dword [ebx + 0x7588]
mov dword [esp + 0x3c], edx
add esi, eax
cmp dword [esp + 0x108], 0
mov edx, dword [ebx + 0x74b4]
mov dword [esp + 0x58], edx
mov edx, dword [ebx + 0x74b8]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x54], edx
je 0x5137ce
push dword [esp + 0x104]
lea eax, [ebx + 0x682c]
mov dword [ebx + 0x750c], 1
mov esi, eax
mov dword [esp + 0xa0], eax
lea edi, [esp + 0xe4]
push ecx
lea eax, [esp + 0xbc]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0050a6d6
add esp, 0xc
cmp eax, 0xffffff88
jbe 0x512d77
push 0xffffffffffffffec
pop edi
jmp 0x513840
push dword [ebx]
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.00513b0e
push dword [ebx + 8]
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0xe4]
push eax
call fcn.00513b0e
push dword [ebx + 4]
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.00513b0e
mov eax, dword [esp + 0xdc]
add esp, 0x24
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xd8]
mov esi, dword [esp + 0xdc]
mov edi, dword [esp + 0xc8]
mov edx, dword [esp + 0xd4]
mov eax, dword [esp + 0xd0]
mov ebx, dword [esi + ecx*8 + 4]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x60], ebx
mov ebx, dword [esp + 0xcc]
mov esi, dword [ebx + edi*8 + 4]
mov cl, byte [ebx + edi*8 + 2]
mov dword [esp + 0x30], esi
mov dword [esp + 0x5c], esi
mov esi, dword [edx + eax*8 + 4]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0xdc]
mov byte [esp + 0x1b], cl
mov ecx, dword [esp + 0xd8]
mov bl, byte [esi + ecx*8 + 2]
mov byte [esp + 0x27], bl
mov bl, byte [edx + eax*8 + 2]
mov byte [esp + 0x26], bl
mov ebx, dword [esp + 0xcc]
movzx esi, word [ebx + edi*8]
mov dword [esp + 0x78], esi
mov esi, dword [esp + 0xdc]
movzx ebx, word [esi + ecx*8]
movzx ecx, byte [esi + ecx*8 + 3]
mov dword [esp + 0x80], ebx
movzx ebx, word [edx + eax*8]
movzx eax, byte [edx + eax*8 + 3]
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x48], eax
mov al, byte [esp + 0x26]
mov dword [esp + 0x7c], ecx
movzx edi, byte [ebx + edi*8 + 3]
mov dword [esp + 0x74], edi
cmp al, 1
jbe 0x5130af
cmp dword [esp + 0x10c], 0
je 0x512faf
cmp al, 0x19
jb 0x512faf
mov edx, dword [esp + 0x14]
mov ecx, edx
mov ebx, dword [esp + 0x10]
and ecx, 0x1f
movzx eax, al
mov edi, ebx
shl edi, cl
sub eax, 5
mov ecx, eax
add edx, eax
neg ecx
and ecx, 0x1f
shr edi, cl
shl edi, 5
add edi, dword [esp + 0x20]
cmp edx, 0x20
ja 0x512f8d
cmp ebp, dword [esp + 0xc4]
jb 0x512f27
mov eax, edx
and edx, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], edx
push 4
lea eax, [esp + 0x90]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov ebx, dword [esp + 0x98]
jmp 0x512f71
mov ecx, dword [esp + 0xc0]
cmp ebp, ecx
je 0x512f8d
mov esi, edx
mov eax, ebp
shr esi, 3
sub eax, esi
cmp eax, ecx
jae 0x512f43
mov esi, ebp
sub esi, ecx
mov eax, esi
sub ebp, esi
shl eax, 3
sub edx, eax
mov dword [esp + 0xbc], ebp
push 4
lea eax, [esp + 0x94]
mov dword [esp + 0xbc], edx
push ebp
push eax
call fcn.005282e0
mov ebx, dword [esp + 0x9c]
mov edx, dword [esp + 0xc4]
add esp, 0xc
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x10]
mov ecx, edx
and ecx, 0x1f
mov eax, ebx
shl eax, cl
add edx, 5
shr eax, 0x1b
add edi, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edi
jmp 0x51308a
mov ebx, dword [esp + 0x14]
mov ecx, ebx
mov esi, dword [esp + 0x10]
and ecx, 0x1f
movzx edx, al
mov edi, esi
shl edi, cl
add ebx, edx
mov ecx, edx
mov dword [esp + 0x14], ebx
neg ecx
and ecx, 0x1f
shr edi, cl
add edi, dword [esp + 0x20]
mov dword [esp + 0x20], edi
cmp ebx, 0x20
ja 0x51308a
cmp ebp, dword [esp + 0xc4]
jb 0x513024
mov eax, ebx
and ebx, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], ebx
push 4
lea eax, [esp + 0x50]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov ecx, dword [esp + 0x58]
mov esi, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc0], ecx
jmp 0x513075
mov ecx, dword [esp + 0xc0]
cmp ebp, ecx
je 0x51308a
mov edx, ebx
mov eax, ebp
shr edx, 3
sub eax, edx
cmp eax, ecx
jae 0x513040
mov edx, ebp
sub edx, ecx
mov eax, edx
sub ebp, edx
shl eax, 3
sub ebx, eax
mov dword [esp + 0xbc], ebp
push 4
lea eax, [esp + 0x54]
mov dword [esp + 0xbc], ebx
push ebp
push eax
call fcn.005282e0
mov eax, dword [esp + 0x5c]
mov esi, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0xc4]
add esp, 0xc
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0xe0]
mov dword [esp + 0xe4], eax
jmp 0x51314b
mov ecx, dword [esp + 0x30]
xor edx, edx
mov esi, dword [esp + 0x10]
test ecx, ecx
sete dl
test al, al
jne 0x5130e4
mov edi, dword [esp + edx*4 + 0xe0]
neg ecx
sbb eax, eax
mov ecx, dword [esp + 0x14]
and eax, 4
mov eax, dword [esp + eax + 0xe0]
mov dword [esp + 0xe4], eax
jmp 0x513147
mov ecx, dword [esp + 0x14]
mov eax, esi
mov ebx, dword [esp + 0xe0]
and ecx, 0x1f
shl eax, cl
mov ecx, dword [esp + 0x14]
shr eax, 0x1f
inc ecx
add edx, eax
mov dword [esp + 0x14], ecx
add edx, dword [esp + 0x20]
lea edi, [ebx - 1]
mov dword [esp + 0xb8], ecx
cmp edx, 3
je 0x51311e
mov edi, dword [esp + edx*4 + 0xe0]
xor eax, eax
test edi, edi
sete al
add edi, eax
mov eax, dword [esp + 0xe8]
cmp edx, 1
cmovne eax, dword [esp + 0xe4]
mov dword [esp + 0xe8], eax
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x20], edi
mov al, byte [esp + 0x27]
mov dword [esp + 0xe0], edi
mov dword [esp + 0x64], edi
movzx edi, al
test al, al
je 0x513189
mov edx, dword [esp + 0x1c]
and ecx, 0x1f
mov eax, esi
shl eax, cl
mov ecx, edi
neg ecx
and ecx, 0x1f
shr eax, cl
mov ecx, dword [esp + 0x14]
add ecx, edi
add edx, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x60], edx
movzx ebx, byte [esp + 0x1b]
lea eax, [edi + ebx]
cmp eax, 0x14
jb 0x513247
cmp ecx, 0x20
ja 0x513247
cmp ebp, dword [esp + 0xc4]
jb 0x5131fd
mov eax, ecx
and ecx, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], ecx
push 4
lea eax, [esp + 0xa8]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xc4]
add esp, 0xc
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0x14], ecx
jmp 0x51324b
mov edx, dword [esp + 0xc0]
cmp ebp, edx
je 0x513241
mov esi, ecx
mov eax, ebp
shr esi, 3
sub eax, esi
cmp eax, edx
jae 0x513219
mov esi, ebp
sub esi, edx
imul eax, esi, 0xfffffff8
sub ebp, esi
push 4
push ebp
mov dword [esp + 0xc4], ebp
add ecx, eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0xc4], ecx
call fcn.005282e0
mov eax, dword [esp + 0x74]
jmp 0x5131db
mov eax, dword [esp + 0x10]
jmp 0x513252
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc0]
cmp byte [esp + 0x1b], 0
jbe 0x51327b
and ecx, 0x1f
shl eax, cl
mov ecx, ebx
neg ecx
and ecx, 0x1f
shr eax, cl
mov ecx, dword [esp + 0x14]
add ecx, ebx
mov ebx, dword [esp + 0x30]
add ebx, eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x5c], ebx
cmp ecx, 0x20
ja 0x51330d
cmp ebp, dword [esp + 0xc4]
jb 0x5132d0
mov eax, ecx
and ecx, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], ecx
push 4
lea eax, [esp + 0x70]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0xc8]
add esp, 0xc
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0xb4], ebx
jmp 0x513311
cmp ebp, edx
je 0x51330d
mov esi, ecx
mov eax, ebp
shr esi, 3
sub eax, esi
cmp eax, edx
jae 0x5132e5
mov esi, ebp
sub esi, edx
imul eax, esi, 0xfffffff8
sub ebp, esi
push 4
push ebp
mov dword [esp + 0xc4], ebp
add ecx, eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0xc4], ecx
call fcn.005282e0
mov ebx, dword [esp + 0x7c]
jmp 0x5132b6
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
mov edx, ebx
lea esi, [ecx + eax]
mov ecx, esi
mov dword [esp + 0xb8], esi
neg ecx
and ecx, 0x1f
shr edx, cl
and edx, dword [eax*4 + 0x5bd4e0]
mov eax, dword [esp + 0x78]
movzx eax, ax
add edx, eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0xc8], edx
mov edx, ebx
lea ecx, [esi + eax]
neg ecx
lea edi, [eax + esi]
and ecx, 0x1f
shr edx, cl
and edx, dword [eax*4 + 0x5bd4e0]
mov eax, dword [esp + 0x80]
movzx eax, ax
add edx, eax
mov dword [esp + 0xd8], edx
cmp edi, 0x20
ja 0x51340c
cmp ebp, dword [esp + 0xc4]
jb 0x5133b1
mov eax, edi
and edi, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], edi
push 4
lea eax, [esp + 0x88]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov ebx, dword [esp + 0x90]
jmp 0x5133fb
mov ecx, dword [esp + 0xc0]
cmp ebp, ecx
je 0x51340c
mov edx, edi
mov eax, ebp
shr edx, 3
sub eax, edx
cmp eax, ecx
jae 0x5133cd
mov edx, ebp
sub edx, ecx
mov eax, edx
sub ebp, edx
shl eax, 3
sub edi, eax
mov dword [esp + 0xbc], ebp
push 4
lea eax, [esp + 0x8c]
mov dword [esp + 0xbc], edi
push ebp
push eax
call fcn.005282e0
mov ebx, dword [esp + 0x94]
mov edi, dword [esp + 0xc4]
add esp, 0xc
mov dword [esp + 0xb4], ebx
mov eax, dword [esp + 0x48]
lea esi, [esp + 0x5c]
add edi, eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0xb8], edi
neg edi
and edi, 0x1f
mov ecx, edi
lea edi, [esp + 0xa8]
movsd dword es:[edi], dword [esi]
shr ebx, cl
and ebx, dword [eax*4 + 0x5bd4e0]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
movsd dword es:[edi], dword [esi]
movzx eax, ax
add ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xd0], ebx
add eax, ecx
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x2c]
lea edi, [ecx + edx]
mov dword [esp + 0x38], eax
lea ebp, [ecx + esi]
mov ebx, ebp
sub ebx, dword [esp + 0x20]
cmp eax, dword [esp + 0x44]
ja 0x51365c
mov eax, dword [esp + 0x34]
lea ecx, [edi + esi]
add eax, 0xffffffe0
cmp ecx, eax
ja 0x51365c
mov ecx, dword [esp + 0x34]
lea eax, [edi + 0x20]
sub ecx, esi
cmp ecx, eax
jb 0x51365c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
movups xmm0, xmmword [ecx]
movups xmmword [esi], xmm0
cmp eax, 0x10
jbe 0x5134e3
lea edx, [ecx + 0x10]
add eax, 0xfffffff0
lea ecx, [esi + 0x10]
movups xmm0, xmmword [edx]
lea esi, [ecx + eax]
movups xmmword [ecx], xmm0
cmp eax, 0x10
jle 0x5134df
push 0x10
pop eax
add ecx, eax
add edx, eax
movups xmm0, xmmword [edx]
add edx, eax
movups xmmword [ecx], xmm0
add ecx, eax
movups xmm0, xmmword [edx]
add edx, eax
movups xmmword [ecx], xmm0
add ecx, eax
cmp ecx, esi
jb 0x5134c7
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], eax
mov eax, ebp
sub eax, esi
cmp ecx, eax
jbe 0x51355a
mov eax, ebp
sub eax, dword [esp + 0x58]
cmp ecx, eax
ja 0x512d6f
mov ecx, dword [esp + 0x54]
mov eax, ecx
sub eax, esi
add ebx, eax
lea eax, [edx + ebx]
cmp eax, ecx
ja 0x513536
push edx
push ebx
push ebp
call fcn.005282e0
add esp, 0xc
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
jmp 0x513698
mov esi, ecx
sub esi, ebx
push esi
push ebx
push ebp
call fcn.005282e0
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ebx, dword [esp + 0x3c]
add ebp, esi
sub eax, esi
mov dword [esp + 0xac], eax
jmp 0x513561
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0xb0]
push 0x10
pop edx
mov dword [esp + 0x1c], eax
cmp ecx, edx
jb 0x5135a2
lea ecx, [eax + ebp]
movups xmm0, xmmword [ebx]
movups xmmword [ebp], xmm0
cmp eax, edx
jle 0x513529
add ebp, 0x10
add ebx, edx
movups xmm0, xmmword [ebx]
add ebx, edx
movups xmmword [ebp], xmm0
add ebp, edx
movups xmm0, xmmword [ebx]
add ebx, edx
movups xmmword [ebp], xmm0
add ebp, edx
cmp ebp, ecx
jb 0x513586
jmp 0x513529
cmp ecx, 8
jae 0x5135d5
mov al, byte [ebx]
mov byte [ebp], al
mov al, byte [ebx + 1]
mov byte [ebp + 1], al
mov al, byte [ebx + 2]
mov byte [ebp + 2], al
mov al, byte [ebx + 3]
add ebx, dword [ecx*4 + 0x5bd3a0]
mov byte [ebp + 3], al
mov edx, ebx
sub ebx, dword [ecx*4 + 0x5bd3c0]
lea eax, [ebp + 4]
push 4
jmp 0x5135db
mov eax, ebp
mov edx, ebx
push 8
pop ecx
push ecx
push edx
push eax
call fcn.005282e0
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, 8
jbe 0x513529
add ebp, 8
lea ecx, [eax - 8]
add ebx, 8
mov eax, ebp
push 0x10
sub eax, ebx
pop edx
lea esi, [ecx + ebp]
cmp eax, edx
jge 0x513628
sub ebx, ebp
push 8
lea eax, [ebx + ebp]
push eax
push ebp
call fcn.005282e0
add ebp, 8
add esp, 0xc
cmp ebp, esi
jb 0x51360d
jmp 0x513529
movups xmm0, xmmword [ebx]
movups xmmword [ebp], xmm0
cmp ecx, edx
jle 0x513529
add ebp, 0x10
add ebx, 0x10
movups xmm0, xmmword [ebx]
add ebx, edx
movups xmmword [ebp], xmm0
add ebp, edx
movups xmm0, xmmword [ebx]
add ebx, edx
movups xmmword [ebp], xmm0
add ebp, edx
cmp ebp, esi
jb 0x51363d
jmp 0x513529
push dword [esp + 0x54]
mov ebp, dword [esp + 0x30]
lea eax, [esp + 0x44]
push dword [esp + 0x5c]
lea esi, [esp + 0x64]
push dword [esp + 0x44]
push dword [esp + 0x50]
push eax
sub esp, 0xc
mov edi, esp
push dword [esp + 0x54]
movsd dword es:[edi], dword [esi]
push ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0051385b
mov edi, eax
add esp, 0x28
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
cmp edi, 0xffffff88
ja 0x513840
add ebp, edi
sub dword [esp + 0x108], 1
mov dword [esp + 0x2c], ebp
je 0x51377b
mov ecx, dword [esp + 0xb8]
mov ebp, dword [esp + 0xbc]
mov dword [esp + 0x14], ecx
cmp ecx, 0x20
ja 0x512dd3
cmp ebp, dword [esp + 0xc4]
jb 0x51370a
mov eax, ecx
and ecx, 7
shr eax, 3
sub ebp, eax
mov dword [esp + 0xb8], ecx
push 4
lea eax, [esp + 0x98]
mov dword [esp + 0xc0], ebp
push ebp
push eax
call fcn.005282e0
mov eax, dword [esp + 0xa0]
jmp 0x513756
mov edx, dword [esp + 0xc0]
cmp ebp, edx
je 0x512dd3
mov esi, ecx
mov eax, ebp
shr esi, 3
sub eax, esi
cmp eax, edx
jae 0x51372a
mov esi, ebp
sub esi, edx
imul eax, esi, 0xfffffff8
sub ebp, esi
push 4
push ebp
mov dword [esp + 0xc4], ebp
add ecx, eax
lea eax, [esp + 0xa0]
push eax
mov dword [esp + 0xc4], ecx
call fcn.005282e0
mov eax, dword [esp + 0xa4]
mov ebp, dword [esp + 0xc8]
add esp, 0xc
mov dword [esp + 0x10], eax
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x14], eax
jmp 0x512dde
mov edx, dword [esp + 0xb8]
cmp edx, 0x20
ja 0x5137b9
mov ecx, dword [esp + 0xbc]
cmp ecx, dword [esp + 0xc4]
jb 0x5137a7
mov eax, edx
shr eax, 3
sub ecx, eax
and edx, 7
lea eax, [esp + 0x38]
jmp 0x513807
cmp ecx, dword [esp + 0xc0]
jne 0x5137e1
cmp edx, 0x20
jb 0x512d6f
mov edi, dword [esp + 0x9c]
lea esi, [esp + 0xe0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
sub esi, eax
sub ecx, ebp
cmp esi, ecx
jbe 0x513826
push 0xffffffffffffffba
jmp 0x512d71
mov esi, edx
mov eax, ecx
shr esi, 3
sub eax, esi
cmp eax, dword [esp + 0xc0]
jae 0x5137fc
mov esi, ecx
sub esi, dword [esp + 0xc0]
imul eax, esi, 0xfffffff8
sub ecx, esi
add edx, eax
lea eax, [esp + 0x48]
push 4
push ecx
push eax
mov dword [esp + 0xc8], ecx
mov dword [esp + 0xc4], edx
call fcn.005282e0
add esp, 0xc
jmp 0x512d6f
test ebp, ebp
je 0x513837
push esi
push eax
push ebp
call fcn.005282e0
add esp, 0xc
add ebp, esi
mov edi, ebp
sub edi, dword [esp + 0xa0]
mov ecx, dword [esp + 0xec]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00527959
add esp, 0xe0
ret