Function at 0x52109c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x4c
push 0
push 0
dec ecx
jne 0x5210a5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00404de4
mov eax, dword [ebp - 0xc]
call fcn.00404de4
xor eax, eax
push ebp
push 0x52228d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x486684]
call fcn.004867e0
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x486684]
call fcn.004867e0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x52224e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.004049dc
lea eax, [ebp - 0x24]
call fcn.004f1f68
mov edx, eax
mov eax, dword [ebp - 0x10]
call fcn.00486878
xor ecx, ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x522216
mov eax, dword [ebp - 4]
add eax, 0x5e8
mov edx, dword [ebp - 0x24]
call fcn.00404998
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5e7], 0
jne 0x521166
mov eax, dword [0x530968]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
je 0x521170
call fcn.004043cc
jmp 0x522255
mov eax, dword [0x530968]
mov eax, dword [eax]
call fcn.0046705c
mov dl, 1
mov eax, dword [0x41562c]
call fcn.00403b24
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x52220f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 1
je 0x5211a8
cmp bl, 2
je 0x5211a8
cmp bl, 5
jne 0x5211b5
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00486d58
jmp 0x5211c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00486c90
xor eax, eax
mov al, bl
cmp eax, 0xa
ja case.0x5211cd.0
jmp dword [eax*4 + 0x5211d4]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00486e98
mov edx, dword [ebp - 4]
cmp al, 0xf
ja 0x52121b
and eax, 0x7f
bt dword [edx + 0x5e4], eax
jae 0x52122c
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00486f40
jmp 0x521234
lea eax, [ebp - 0x28]
call fcn.00404944
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
jne case.0x5211cd.0
xor ebx, ebx
cmp dword [ebp - 0x28], 0
je 0x521286
mov eax, dword [ebp - 0x28]
call fcn.00487798
test al, al
jne 0x521286
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea ecx, [ebp - 0x140]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x140]
mov eax, dword [ebp - 0x10]
call fcn.00486e98
mov edx, dword [ebp - 4]
cmp al, 0xf
ja 0x5212b6
and eax, 0x7f
bt dword [edx + 0x5e4], eax
jae 0x5214cf
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
jne case.0x5211cd.0
cmp dword [ebp - 0x28], 0
je 0x52132f
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 0x28]
call fcn.004ec1a4
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x14c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x14c]
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x148]
pop eax
call fcn.00404c04
mov edx, dword [ebp - 0x144]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
je 0x52132f
mov bl, 1
cmp dword [ebp - 0xc], 0
je 0x521393
test bl, bl
jne 0x521393
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 0xc]
call fcn.004ec1a4
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x158]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x158]
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x154]
pop eax
call fcn.00404c04
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
je 0x521393
mov bl, 1
test bl, bl
jne 0x521498
lea ecx, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x15c]
mov eax, 0x5222a4
call fcn.00404f38
test eax, eax
jne 0x52140d
lea ecx, [ebp - 0x168]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x168]
lea ecx, [ebp - 0x164]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x164]
mov eax, 0x5222b0
call fcn.00404f38
test eax, eax
je 0x521448
lea ecx, [ebp - 0x170]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x170]
lea ecx, [ebp - 0x16c]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
je 0x521498
mov bl, 1
jmp 0x521498
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x139]
push eax
push 0x104
push 0
lea ecx, [ebp - 0x178]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x178]
lea ecx, [ebp - 0x174]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov eax, dword [ebp - 0x174]
call fcn.00404df4
push eax
push 0
call sub.kernel32.dll_SearchPathA
test eax, eax
je 0x521498
mov bl, 1
test bl, bl
jne 0x5214cf
lea ecx, [ebp - 0x17c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x17c]
push eax
push 1
push 0
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54c]
mov ecx, dword [ebp - 0x24]
call fcn.0050ee64
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x521250
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x52151a
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea ecx, [ebp - 0x184]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x180]
call fcn.00408dd8
mov eax, dword [ebp - 0x180]
mov edx, 0x5222bc
call fcn.00404d40
je 0x521615
lea ecx, [ebp - 0x188]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x188]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
jne 0x521615
lea ecx, [ebp - 0x18c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x18c]
mov edx, dword [0x53071c]
mov edx, dword [edx]
mov eax, dword [ebp - 4]
call fcn.00520e20
test al, al
jne 0x521615
push dword [ebp - 8]
push 0x5222cc
lea ecx, [ebp - 0x194]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x194]
push 0x5222d8
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x19c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00525ffc
push dword [ebp - 0x198]
lea eax, [ebp - 0x190]
mov edx, 5
call fcn.00404cbc
mov edx, dword [ebp - 0x190]
mov eax, dword [ebp - 4]
call fcn.00525da0
mov eax, dword [ebp - 0xc]
mov edx, 0x5222e4
call fcn.00404d40
jne 0x521631
mov edx, 0x32
mov eax, dword [ebp - 4]
call fcn.00517aac
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x5214fc
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x52167c
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x1a4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x1a0]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x52174e
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
cmp dword [ebp - 0x28], 0
je 0x52174e
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00404e54
mov eax, dword [ebp - 0x1a8]
mov edx, 0x5222f0
call fcn.00404d40
je 0x52174e
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
jne 0x52174e
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x1b0]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1b0]
lea eax, [ebp - 0x1ac]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x52165e
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
jne case.0x5211cd.0
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x1b8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1b8]
lea eax, [ebp - 0x1b4]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x1b4]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x521976
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x1bc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1bc]
mov eax, dword [ebp - 4]
add eax, 0x5e8
mov edx, 3
call fcn.00404cbc
mov eax, dword [ebp - 4]
cmp byte [eax + 0x5e7], 1
jne 0x521821
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00486e98
mov edx, dword [ebp - 4]
cmp al, 0xf
ja 0x52183c
and eax, 0x7f
bt dword [edx + 0x5e4], eax
jae 0x52184d
lea ecx, [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00486f40
jmp 0x521855
lea eax, [ebp - 0x28]
call fcn.00404944
mov edx, dword [ebp - 0x28]
mov eax, 0x5222a4
call fcn.00404f38
test eax, eax
jne 0x521924
mov edx, dword [ebp - 0x28]
mov eax, 0x5222b0
call fcn.00404f38
test eax, eax
jne 0x521924
lea ecx, [ebp - 0x28]
mov edx, 0x5222fc
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov edx, dword [ebp - 0x28]
mov eax, 0x52230c
call fcn.00404f38
mov ebx, eax
test ebx, ebx
je 0x5218b6
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00404e54
cmp dword [ebp - 0x28], 0
jne 0x5218ef
mov edx, 0x522318
mov eax, dword [ebp - 0x10]
call fcn.00487260
test al, al
jne 0x5218ef
mov edx, 0x522338
mov eax, dword [ebp - 0x10]
call fcn.00487260
test al, al
jne 0x5218ef
mov edx, 0x522358
mov eax, dword [ebp - 0x10]
call fcn.00487260
test al, al
je 0x521924
lea ecx, [ebp - 0x1c0]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c0]
push eax
lea edx, [ebp - 0x1c4]
mov eax, dword [ebp - 0x28]
call fcn.004ec1a4
mov edx, dword [ebp - 0x1c4]
lea eax, [ebp - 0x28]
pop ecx
call fcn.00404c48
cmp dword [ebp - 0x28], 0
je 0x521939
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
jne 0x521976
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x1cc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1cc]
lea eax, [ebp - 0x1c8]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x52177b
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x5219c1
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea ecx, [ebp - 0x1d8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x1d8]
lea ecx, [ebp - 0x1d4]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov eax, dword [ebp - 0x1d4]
lea edx, [ebp - 0x1d0]
call fcn.004ec1a4
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x1dc]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x1dc]
pop eax
call fcn.00404c04
mov edx, dword [ebp - 0x1d0]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
jne 0x521a9e
push dword [ebp - 8]
push 0x5222cc
lea ecx, [ebp - 0x1e4]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1e4]
push 0x5222d8
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x1ec]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x1ec]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00525ffc
push dword [ebp - 0x1e8]
lea eax, [ebp - 0x1e0]
mov edx, 5
call fcn.00404cbc
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x5219a3
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x521ae9
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x1f0]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1f0]
mov eax, dword [ebp - 4]
add eax, 0x5e8
mov edx, 3
call fcn.00404cbc
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x1f8]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x1f8]
lea eax, [ebp - 0x1f4]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x1f4]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x521c2d
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov dl, 1
mov eax, dword [0x41562c]
call fcn.00403b24
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x521c26
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00486d58
mov eax, dword [ebp - 0x10]
call fcn.0048723c
test al, al
jne 0x521c10
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x521bd3
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jne 0x521c10
lea ecx, [ebp - 0x1fc]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x1fc], 0
jne 0x521c10
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x204]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x204]
lea eax, [ebp - 0x200]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x200]
mov eax, dword [ebp - 4]
call fcn.00525da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521c2d
mov eax, dword [ebp - 0x1c]
call fcn.00403b54
ret
mov eax, dword [0x530968]
mov eax, dword [eax]
call fcn.0046705c
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x208]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x208]
push 0x522368
mov eax, dword [ebp - 4]
add eax, 0x5e8
mov edx, 4
call fcn.00404cbc
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x210]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x210]
push 0x522368
lea eax, [ebp - 0x20c]
mov edx, 4
call fcn.00404cbc
mov edx, dword [ebp - 0x20c]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x521d8c
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov dl, 1
mov eax, dword [0x41562c]
call fcn.00403b24
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x521d85
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00486d58
mov eax, dword [ebp - 0x10]
call fcn.0048723c
test al, al
jne 0x521d6f
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x521d2d
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jne 0x521d6f
lea ecx, [ebp - 0x214]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x214], 0
jne 0x521d6f
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x21c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x21c]
push 0x522368
lea eax, [ebp - 0x218]
mov edx, 4
call fcn.00404cbc
mov edx, dword [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.00525da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x521d8c
mov eax, dword [ebp - 0x1c]
call fcn.00403b54
ret
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x521acb
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x220]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0x5e8
mov edx, 0x522380
call fcn.00404c48
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x521e00
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea ecx, [ebp - 0x228]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
mov edx, 0x522380
call fcn.00404c48
mov edx, dword [ebp - 0x224]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
jne 0x521e78
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x230]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x22c]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x521db9
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x521ec3
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea ecx, [ebp - 0x234]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x234]
mov eax, dword [ebp - 4]
call fcn.00520b28
test al, al
jne 0x521f23
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x23c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x238]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x521ea5
jmp case.0x5211cd.0
mov edx, 0x80000002
mov eax, dword [ebp - 0x14]
call fcn.00486878
lea eax, [ebp - 0x28]
mov edx, 0x5223c0
call fcn.004049dc
xor ecx, ecx
mov edx, 0x522400
mov eax, dword [ebp - 0x14]
call fcn.004868e0
test al, al
je 0x521f71
lea ecx, [ebp - 0x28]
mov edx, 0x52244c
mov eax, dword [ebp - 0x14]
call fcn.00486f40
mov edx, 0x80000001
mov eax, dword [ebp - 0x14]
call fcn.00486878
lea eax, [ebp - 0x2c]
call fcn.00404944
lea ecx, [ebp - 0x2c]
mov edx, 0x522464
mov eax, dword [ebp - 0x14]
call fcn.00486f40
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x521fd0
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 0x28]
call fcn.004ec1a4
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x244]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00404c04
mov eax, dword [ebp - 0x240]
call fcn.00487798
test al, al
jne 0x52208f
lea edx, [ebp - 0x248]
mov eax, dword [ebp - 0x2c]
call fcn.004ec1a4
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x24c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.00404c04
mov eax, dword [ebp - 0x248]
call fcn.00487798
test al, al
jne 0x52208f
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x254]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x254]
lea eax, [ebp - 0x250]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 4]
call fcn.00525da0
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x521fb2
jmp case.0x5211cd.0
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl case.0x5211cd.0
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00521060
test al, al
je 0x5220da
call fcn.004043cc
call fcn.004043cc
jmp 0x522255
push dword [ebp - 0x24]
push 0x5222a4
lea ecx, [ebp - 0x25c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x258]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
call fcn.004868e0
test al, al
je 0x5221ed
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00486f40
mov dl, 1
mov eax, dword [0x41562c]
call fcn.00403b24
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x5221e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.00486d58
mov eax, dword [ebp - 0x10]
call fcn.0048723c
test al, al
jne 0x5221d0
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x522193
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jne 0x5221d0
lea ecx, [ebp - 0x260]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
cmp dword [ebp - 0x260], 0
jne 0x5221d0
push dword [ebp - 8]
push 0x5222a4
lea ecx, [ebp - 0x268]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0xc]
push dword [ebp - 0x268]
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00404cbc
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 4]
call fcn.00525da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5221ed
mov eax, dword [ebp - 0x1c]
call fcn.00403b54
ret
inc dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x5220bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522216
mov eax, dword [ebp - 0x18]
call fcn.00403b54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522255
mov eax, dword [ebp - 4]
cmp byte [eax + 0x580], 0
jne 0x52223d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54c]
call fcn.0050d298
mov eax, dword [ebp - 0x10]
call fcn.00403b54
mov eax, dword [ebp - 0x14]
call fcn.00403b54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522294
lea eax, [ebp - 0x268]
mov edx, 0x4b
call fcn.00404968
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00404968
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404968
ret