Function at 0x506acc
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x61
push 0
push 0
dec ecx
jne 0x506ad4
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x5077fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x44]
mov esi, dword [ebx + 0x34]
push esi
push 0x5065e8
lea edx, [ebp - 0x1a0]
mov eax, dword [esi]
call fcn.00404408
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0xa0]
call fcn.00405588
lea eax, [ebp - 0xa0]
mov edx, 0x507814
call fcn.00405608
mov eax, dword [ebp - 0xa0]
mov dl, byte [ebx + 0x48]
call fcn.00505610
mov esi, dword [ebx + 0x38]
push esi
push 0x507e04
lea edx, [ebp - 0x1a0]
mov eax, dword [esi]
call fcn.00404408
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0x1a4]
call fcn.00405588
lea eax, [ebp - 0x1a4]
mov edx, 0x507814
call fcn.00405608
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebx + 0x48]
call fcn.00505610
mov esi, dword [ebx + 0x44]
push esi
push 0x5080e0
lea edx, [ebp - 0x1a0]
mov eax, dword [esi]
call fcn.00404408
lea edx, [ebp - 0x1a0]
lea eax, [ebp - 0x1a8]
call fcn.00405588
lea eax, [ebp - 0x1a8]
mov edx, 0x507814
call fcn.00405608
mov eax, dword [ebp - 0x1a8]
mov dl, byte [ebx + 0x48]
call fcn.00505610
lea eax, [ebp - 0x9c]
mov edx, 0x94
call fcn.00408b34
mov dword [ebp - 0x9c], 0x94
lea eax, [ebp - 0x9c]
push eax
call fcn.00407f64
mov eax, dword [ebp - 0x8c]
mov dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x98]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x94]
mov dword [ebx + 0xc], eax
movzx eax, word [ebp - 0x90]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x8c]
sub eax, 1
jb 0x506c22
je 0x506c31
dec eax
je 0x506c40
jmp 0x506c4d
lea eax, [ebx + 0x10]
mov edx, 0x507828
call fcn.00405378
jmp 0x506c4d
lea eax, [ebx + 0x10]
mov edx, 0x507840
call fcn.00405378
jmp 0x506c4d
lea eax, [ebx + 0x10]
mov edx, 0x507854
call fcn.00405378
lea eax, [ebx + 0x18]
lea edx, [ebp - 0x88]
mov ecx, 0x80
call fcn.00405594
lea eax, [ebx + 0x1c]
call fcn.00405324
lea eax, [ebx + 0x20]
call fcn.00405324
lea eax, [ebx + 0x28]
call fcn.00405324
lea eax, [ebx + 0x24]
call fcn.00405324
mov dl, 1
mov eax, dword [0x4433d0]
call fcn.0044353c
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.00443618
mov eax, dword [0x6c60c4]
cmp byte [eax], 0
je 0x506cb2
mov edx, 0x507868
mov eax, esi
call fcn.00443880
jmp 0x506cbe
mov edx, 0x5078a0
mov eax, esi
call fcn.00443880
test al, al
je 0x507044
mov eax, dword [0x6c60c4]
cmp byte [eax], 0
je 0x506d02
mov edx, 0x5078d4
mov eax, esi
call fcn.004440b0
test al, al
je 0x506d32
mov edx, 0x5078d4
lea ecx, [ebp - 0x1ac]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1ac]
lea eax, [ebx + 0x1c]
call fcn.00405378
jmp 0x506d32
mov edx, 0x5078e8
mov eax, esi
call fcn.004440b0
test al, al
je 0x506d32
mov edx, 0x5078e8
lea ecx, [ebp - 0x1b0]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1b0]
lea eax, [ebx + 0x1c]
call fcn.00405378
mov edx, 0x5078f8
mov eax, esi
call fcn.004440b0
test al, al
je 0x506d62
mov edx, 0x5078f8
lea ecx, [ebp - 0x1b4]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1b4]
lea eax, [ebx + 0x28]
call fcn.00405378
mov edx, 0x507918
mov eax, esi
call fcn.004440b0
test al, al
je 0x506d92
mov edx, 0x507918
lea ecx, [ebp - 0x1b8]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1b8]
lea eax, [ebx + 0x20]
call fcn.00405378
mov edx, 0x507930
mov eax, esi
call fcn.004440b0
test al, al
je 0x506dc2
mov edx, 0x507930
lea ecx, [ebp - 0x1bc]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1bc]
lea eax, [ebx + 0x24]
call fcn.00405378
mov edx, 0x507944
mov eax, esi
call fcn.004440b0
test al, al
je 0x506df2
mov edx, 0x507944
lea ecx, [ebp - 0x1c0]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1c0]
lea eax, [ebx + 0x3c]
call fcn.00405378
mov edx, 0x507958
mov eax, esi
call fcn.004440b0
test al, al
je 0x506e22
mov edx, 0x507958
lea ecx, [ebp - 0x1c4]
mov eax, esi
call fcn.00443e90
mov edx, dword [ebp - 0x1c4]
lea eax, [ebx + 0x40]
call fcn.00405378
lea ecx, [ebp - 0x1cc]
mov edx, 0x50796c
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1cc]
lea eax, [ebp - 0x1c8]
mov edx, 0x507984
call fcn.0040564c
mov edx, dword [ebp - 0x1c8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1d4]
mov edx, 0x50799c
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
mov edx, 0x5079b4
call fcn.0040564c
mov edx, dword [ebp - 0x1d0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1dc]
mov edx, 0x5079cc
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1dc]
lea eax, [ebp - 0x1d8]
mov edx, 0x5079e0
call fcn.0040564c
mov edx, dword [ebp - 0x1d8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1e4]
mov edx, 0x5079f0
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1e0]
mov edx, 0x507a08
call fcn.0040564c
mov edx, dword [ebp - 0x1e0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1ec]
mov edx, 0x507a20
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1e8]
mov edx, 0x507a34
call fcn.0040564c
mov edx, dword [ebp - 0x1e8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1f4]
mov edx, 0x507a44
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1f0]
mov edx, 0x507a58
call fcn.0040564c
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x1fc]
mov edx, 0x507a68
mov eax, esi
call fcn.00443e90
mov ecx, dword [ebp - 0x1fc]
lea eax, [ebp - 0x1f8]
mov edx, 0x507a80
call fcn.0040564c
mov edx, dword [ebp - 0x1f8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, esi
call fcn.004435e8
lea eax, [ebx + 0x4c]
call fcn.00405324
mov eax, dword [0x6c60c4]
cmp byte [eax], 0
je 0x507014
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x18]
call fcn.00405378
mov eax, dword [ebx + 0x18]
mov edx, 0x507a94
call fcn.0040574c
jne 0x507044
mov edx, 0x507aac
mov eax, esi
call fcn.00443880
test al, al
je 0x507044
mov edx, 0x507af0
mov eax, esi
call fcn.004440b0
test al, al
je 0x50700b
mov edx, 0x507af0
mov eax, esi
call fcn.00443f1c
dec eax
jne 0x50700b
lea eax, [ebx + 0x18]
mov edx, 0x507b04
call fcn.00405378
mov eax, esi
call fcn.004435e8
jmp 0x507044
mov eax, dword [0x6c5ce0]
cmp byte [eax], 0
je 0x50702d
lea eax, [ebx + 0x4c]
mov edx, 0x507b1c
call fcn.00405378
jmp 0x507044
mov eax, dword [0x6c6030]
cmp byte [eax], 0
je 0x507044
lea eax, [ebx + 0x4c]
mov edx, 0x507b2c
call fcn.00405378
mov eax, esi
call fcn.004044b8
mov esi, 0x104
mov eax, esi
call fcn.0040b478
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.00407f6c
lea eax, [ebp - 0x204]
mov edx, dword [ebp - 4]
call fcn.0040551c
mov ecx, dword [ebp - 0x204]
lea eax, [ebp - 0x200]
mov edx, 0x507b44
call fcn.0040564c
mov edx, dword [ebp - 0x200]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push esi
mov eax, dword [ebp - 4]
push eax
call fcn.00407f1c
lea eax, [ebp - 0x20c]
mov edx, dword [ebp - 4]
call fcn.0040551c
mov ecx, dword [ebp - 0x20c]
lea eax, [ebp - 0x208]
mov edx, 0x507b58
call fcn.0040564c
mov edx, dword [ebp - 0x208]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
push eax
push esi
call fcn.00407f34
lea eax, [ebp - 0x214]
mov edx, dword [ebp - 4]
call fcn.0040551c
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x210]
mov edx, 0x507b68
call fcn.0040564c
mov edx, dword [ebp - 0x210]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
call fcn.0040b4d4
call fcn.004086ac
mov esi, eax
lea ecx, [ebp - 0x21c]
mov edx, 0x1a
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
mov edx, 0x507b78
call fcn.0040564c
mov edx, dword [ebp - 0x218]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x224]
mov edx, 0x19
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x224]
lea eax, [ebp - 0x220]
mov edx, 0x507b8c
call fcn.0040564c
mov edx, dword [ebp - 0x220]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x22c]
mov edx, 0x1e
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
mov edx, 0x507ba8
call fcn.0040564c
mov edx, dword [ebp - 0x228]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x234]
mov edx, 0xa
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
mov edx, 0x507bc4
call fcn.0040564c
mov edx, dword [ebp - 0x230]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x23c]
mov edx, 0x17
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x23c]
lea eax, [ebp - 0x238]
mov edx, 0x507bd8
call fcn.0040564c
mov edx, dword [ebp - 0x238]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x244]
mov edx, 0x16
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x244]
lea eax, [ebp - 0x240]
mov edx, 0x507bf0
call fcn.0040564c
mov edx, dword [ebp - 0x240]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x24c]
mov edx, 0x18
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x248]
mov edx, 0x507c0c
call fcn.0040564c
mov edx, dword [ebp - 0x248]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x254]
mov edx, 0x1f
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x254]
lea eax, [ebp - 0x250]
mov edx, 0x507c24
call fcn.0040564c
mov edx, dword [ebp - 0x250]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x25c]
mov edx, 0x21
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x25c]
lea eax, [ebp - 0x258]
mov edx, 0x507c40
call fcn.0040564c
mov edx, dword [ebp - 0x258]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x264]
mov edx, 3
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x260]
mov edx, 0x507c54
call fcn.0040564c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x26c]
xor edx, edx
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x26c]
lea eax, [ebp - 0x268]
mov edx, 0x507c68
call fcn.0040564c
mov edx, dword [ebp - 0x268]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x274]
mov edx, 0x10
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x274]
lea eax, [ebp - 0x270]
mov edx, 0x507c7c
call fcn.0040564c
mov edx, dword [ebp - 0x270]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x27c]
mov edx, 6
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
mov edx, 0x507c90
call fcn.0040564c
mov edx, dword [ebp - 0x278]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x284]
mov edx, 0x11
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x284]
lea eax, [ebp - 0x280]
mov edx, 0x507ca4
call fcn.0040564c
mov edx, dword [ebp - 0x280]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x28c]
mov edx, 0x14
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x28c]
lea eax, [ebp - 0x288]
mov edx, 0x507cb4
call fcn.0040564c
mov edx, dword [ebp - 0x288]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x294]
mov edx, 0x22
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x507cc4
call fcn.0040564c
mov edx, dword [ebp - 0x290]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x29c]
mov edx, 1
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x29c]
lea eax, [ebp - 0x298]
mov edx, 0x507cd8
call fcn.0040564c
mov edx, dword [ebp - 0x298]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2a4]
mov edx, 0x20
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2a4]
lea eax, [ebp - 0x2a0]
mov edx, 0x507cec
call fcn.0040564c
mov edx, dword [ebp - 0x2a0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2ac]
mov edx, 0x12
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebp - 0x2a8]
mov edx, 0x507d04
call fcn.0040564c
mov edx, dword [ebp - 0x2a8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2b4]
mov edx, 0x13
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2b4]
lea eax, [ebp - 0x2b0]
mov edx, 0x507d18
call fcn.0040564c
mov edx, dword [ebp - 0x2b0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2bc]
mov edx, 5
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2bc]
lea eax, [ebp - 0x2b8]
mov edx, 0x507d2c
call fcn.0040564c
mov edx, dword [ebp - 0x2b8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2c4]
mov edx, 0x1b
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2c4]
lea eax, [ebp - 0x2c0]
mov edx, 0x507d44
call fcn.0040564c
mov edx, dword [ebp - 0x2c0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2cc]
mov edx, 4
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2cc]
lea eax, [ebp - 0x2c8]
mov edx, 0x507d58
call fcn.0040564c
mov edx, dword [ebp - 0x2c8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2d4]
mov edx, 2
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2d4]
lea eax, [ebp - 0x2d0]
mov edx, 0x507d6c
call fcn.0040564c
mov edx, dword [ebp - 0x2d0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2dc]
mov edx, 8
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2dc]
lea eax, [ebp - 0x2d8]
mov edx, 0x507d80
call fcn.0040564c
mov edx, dword [ebp - 0x2d8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2e4]
mov edx, 9
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2e4]
lea eax, [ebp - 0x2e0]
mov edx, 0x507d90
call fcn.0040564c
mov edx, dword [ebp - 0x2e0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2ec]
mov edx, 0xb
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2ec]
lea eax, [ebp - 0x2e8]
mov edx, 0x507da0
call fcn.0040564c
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2f4]
mov edx, 7
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2f4]
lea eax, [ebp - 0x2f0]
mov edx, 0x507db4
call fcn.0040564c
mov edx, dword [ebp - 0x2f0]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x2fc]
mov edx, 0x15
mov eax, esi
call fcn.004ebaf0
mov ecx, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2f8]
mov edx, 0x507dc8
call fcn.0040564c
mov edx, dword [ebp - 0x2f8]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea ecx, [ebp - 0x300]
mov edx, 0x507ddc
mov eax, dword [ebx + 0x30]
call fcn.004233a0
mov eax, dword [ebp - 0x300]
lea edx, [ebp - 8]
call fcn.004eb0d0
lea eax, [ebp - 0x308]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x507dec
call fcn.00405944
mov edx, eax
inc edx
mov ecx, 0xff
mov eax, dword [ebp - 8]
call fcn.00405860
mov eax, dword [ebp - 0x308]
lea edx, [ebp - 0x304]
call fcn.004eb0d0
mov edx, dword [ebp - 0x304]
lea eax, [ebp - 8]
call fcn.004053bc
lea eax, [ebp - 0x30c]
mov ecx, dword [ebp - 8]
mov edx, 0x507df8
call fcn.0040564c
mov edx, dword [ebp - 0x30c]
mov eax, dword [ebx + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2c]
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebx + 0x2c]
call fcn.004eb8e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x507805
lea eax, [ebp - 0x30c]
mov edx, 0x5b
call fcn.00405348
lea eax, [ebp - 0xa0]
call fcn.00405324
lea eax, [ebp - 8]
call fcn.00405324
ret