Function at 0x52d390
Capabilities:
Encode data using xor
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5307b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x5bdeec]
xor edx, edx
mov dword [eax], edx
cmp byte [0x5bcdfc], 0
je 0x52d3f4
mov byte [ebp - 0x15], 1
jmp 0x53076d
mov byte [ebp - 0x15], 0
mov eax, 0x5c03e0
mov ecx, dword [0x5bcea8]
mov edx, dword [0x5bcea4]
call fcn.00403cd8
cmp dword [0x5c03e4], 0
je 0x53076d
cmp dword [0x5c03e8], 0xa
jge 0x52d459
push dword [0x5bce48]
push dword [0x5bce5c]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
lea edx, [ebp - 0x20]
mov eax, dword [0x5c03e4]
mov ecx, 0xa
call fcn.004027e0
cmp word [ebp - 0x20], 0x5a4d
je 0x52d4b2
push dword [0x5bce48]
push dword [0x5bce58]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x7d0], 1
jmp 0x53076d
lea eax, [ebp - 0x68]
mov edx, 0xc
call fcn.00403f60
mov eax, dword [0x5c03e4]
add eax, 2
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x68]
call fcn.00403e5c
mov dword [ebp - 0x70], eax
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov ecx, 0xc
call fcn.004027e0
lea edx, [ebp - 0x84]
mov eax, dword [ebp - 0x68]
call fcn.00406fec
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x68]
call fcn.00403aa8
mov eax, dword [ebp - 0x68]
mov edx, 0x5307d0
call fcn.00403d9c
je 0x52d51d
mov eax, dword [ebp - 0x68]
mov edx, 0x5307e8
call fcn.00403d9c
push dword [0x5bce60]
lea ecx, [ebp - 0x88]
mov edx, 4
mov eax, 0x40
call fcn.0040746c
push dword [ebp - 0x88]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
cmp dword [0x5c03e8], 0x40
jge 0x52d59f
push dword [0x5bce48]
push dword [0x5bce5c]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
mov eax, 0x5c03ec
xor ecx, ecx
mov edx, 0x40
call fcn.00402b14
mov edx, 0x5c03ec
mov eax, dword [0x5c03e4]
mov ecx, 0x40
call fcn.004027e0
mov edx, dword [0x5bce64]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov eax, dword [0x5c0428]
mov dword [ebp - 0x28], eax
push dword [0x5bce68]
lea ecx, [ebp - 0x88]
mov edx, 4
mov eax, dword [ebp - 0x28]
call fcn.0040746c
push dword [ebp - 0x88]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov eax, dword [ebp - 0x28]
add eax, 0x78
cmp eax, dword [0x5c03e8]
jle 0x52d65f
push dword [0x5bce48]
push dword [0x5bce6c]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
mov eax, dword [ebp - 0x28]
mov dword [0x5c0430], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [0x5c03e4]
mov edx, dword [ebp - 0x40]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, 0x5c0438
xor ecx, ecx
mov edx, 0x78
call fcn.00402b14
mov eax, dword [0x5c03e4]
mov edx, dword [ebp - 0x40]
add eax, edx
mov edx, 0x5c0438
mov ecx, 0x78
call fcn.004027e0
add dword [ebp - 0x40], 0x78
mov eax, dword [0x5c0474]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x52d6bd
mov dword [ebp - 0x78], 0x200
mov eax, dword [0x5c0438]
and eax, 0xffff
cmp eax, 0x454e
jne 0x52d703
push dword [0x5bce48]
push dword [0x5bce70]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
mov eax, dword [0x5c0438]
and eax, 0xffff
cmp eax, 0x454c
jne 0x52d749
push dword [0x5bce48]
push dword [0x5bce74]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
cmp dword [0x5c0438], 0x4550
je 0x52d78a
push dword [0x5bce48]
push dword [0x5bce78]
push dword [0x5bce54]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
jmp 0x53076d
mov edx, dword [0x5bce7c]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov eax, dword [0x5be5f8]
xor dword [eax], 0xf455ff
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c043c]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
movzx eax, word [0x5c043c]
cmp eax, 0x1c2
jg 0x52d860
je 0x52db5a
cmp eax, 0x184
jg 0x52d83e
je 0x52d99b
sub eax, 0x14c
je 0x52d8ba
sub eax, 0x16
je 0x52d914
sub eax, 4
je 0x52d941
sub eax, 2
je 0x52d96e
jmp 0x52dbae
sub eax, 0x1a2
je 0x52db03
sub eax, 4
je 0x52db30
sub eax, 0x1a
je 0x52da22
jmp 0x52dbae
cmp eax, 0x284
jg 0x52d894
je 0x52d9c8
sub eax, 0x1f0
je 0x52d9f5
sub eax, 0x10
je 0x52d8e7
sub eax, 0x66
je 0x52da7c
sub eax, 2
je 0x52da4f
jmp 0x52dbae
sub eax, 0x366
je 0x52daa9
sub eax, 0x100
je 0x52dad6
sub eax, 0x81fe
je 0x52db84
jmp 0x52dbae
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x53080c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x53081c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530830
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530840
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530850
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530860
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530874
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530890
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5308a0
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5308ac
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5308cc
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5308dc
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5308f4
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x53090c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530920
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530934
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530944
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52dbd6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530954
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
cmp word [0x5c043c], 0x14c
sete byte [0x5bcf4c]
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c043e]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 1
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
movzx eax, word [0x5c043e]
mov dword [0x5c04bc], eax
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0440]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 2
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x84]
mov eax, dword [0x5c0440]
call fcn.0059d4cc
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 2
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0444]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 3
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0448]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 4
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c044c]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 5
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c044e]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 6
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
cmp word [0x5c0450], 0
jne 0x52de37
mov edx, dword [0x5bcee0]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov word [0x5c0450], 0x10b
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c0450]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov ax, word [0x5c0450]
sub ax, 0x107
je 0x52dea6
sub ax, 4
je 0x52ded6
sub ax, 0x100
je 0x52df03
jmp 0x52df30
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530968
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52df5b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x53097c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52df5b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x53098c
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
jmp 0x52df5b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530954
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x58]
mov eax, dword [0x5be2d4]
mov ecx, 8
call fcn.004027e0
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x58]
mov dl, byte [ebp - 0x30]
add dl, 0x55
xor byte [eax], dl
inc dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], 8
jne 0x52df75
push 0xa
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x5be640]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FindResourceA
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x52dfb0
mov eax, dword [0x5be570]
mov dword [eax], 0x1feb25b8
jmp 0x52dfb9
mov eax, dword [0x5be570]
xor edx, edx
mov dword [eax], edx
lea ecx, [ebp - 0x88]
xor eax, eax
mov al, byte [0x5c0453]
mov edx, 2
call fcn.0040746c
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8c]
xor eax, eax
mov al, byte [0x5c0452]
mov edx, 2
call fcn.0040746c
push dword [ebp - 0x8c]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 8
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x88]
xor eax, eax
mov al, byte [0x5c0452]
call fcn.0040743c
push dword [ebp - 0x88]
push 0x53099c
lea edx, [ebp - 0x8c]
xor eax, eax
mov al, byte [0x5c0453]
call fcn.0040743c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 8
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0454]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 9
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0458]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xa
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c045c]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xb
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov eax, dword [0x5c0460]
add eax, dword [0x5c046c]
mov edx, 8
call fcn.0040746c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x614]
call fcn.00422130
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x614]
call fcn.00422100
lea eax, [ebp - 0x90]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xc
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0464]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xd
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0468]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xe
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c046c]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x21c]
mov eax, dword [eax + 0x130]
mov edx, 0xf
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0470]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
xor edx, edx
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
cmp dword [0x5c0474], 0
jne 0x52e372
mov edx, dword [0x5bcee4]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov dword [0x5c0474], 0x200
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0474]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 1
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x88]
movzx eax, word [0x5c047a]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8c]
movzx eax, word [0x5c0478]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x8c]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 2
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x88]
movzx eax, word [0x5c0478]
call fcn.0040743c
push dword [ebp - 0x88]
push 0x53099c
lea edx, [ebp - 0x8c]
movzx eax, word [0x5c047a]
call fcn.0040743c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 2
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x88]
movzx eax, word [0x5c047e]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8c]
movzx eax, word [0x5c047c]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x8c]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 3
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x88]
movzx eax, word [0x5c047c]
call fcn.0040743c
push dword [ebp - 0x88]
push 0x53099c
lea edx, [ebp - 0x8c]
movzx eax, word [0x5c047e]
call fcn.0040743c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 3
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x88]
movzx eax, word [0x5c0482]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8c]
movzx eax, word [0x5c0480]
mov edx, 4
call fcn.0040746c
push dword [ebp - 0x8c]
push 0x530800
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 4
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x88]
movzx eax, word [0x5c0480]
call fcn.0040743c
push dword [ebp - 0x88]
push 0x53099c
lea edx, [ebp - 0x8c]
movzx eax, word [0x5c0482]
call fcn.0040743c
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 4
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0484]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 5
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 5
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x5309a8
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0488]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 6
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea edx, [ebp - 0x84]
mov eax, dword [0x5c0488]
call fcn.0040743c
lea eax, [ebp - 0x84]
mov edx, 0x5309bc
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 6
call fcn.004830e4
mov eax, dword [eax + 8]
mov edx, 1
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c048c]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 7
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0490]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 8
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [0x5c0490]
mov dword [0x5bcee8], eax
push 0x5bceec
push 0x5bcee8
mov eax, dword [0x5c03d4]
call fcn.00403e50
push eax
call sub.IMAGEHLP.DLL_MapFileAndCheckSumA
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, 4
ja case.default.0x52e875
jmp dword [eax*4 + 0x52e87c]
push 0x5309cc
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5bcee8]
call fcn.0040746c
push dword [ebp - 0x84]
push 0x530800
push 0x5309f4
lea ecx, [ebp - 0x88]
mov edx, 8
mov eax, dword [0x5bceec]
call fcn.0040746c
push dword [ebp - 0x88]
push 0x530a10
lea eax, [ebp - 0x2c]
mov edx, 6
call fcn.00403d4c
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5bceec]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x624]
call fcn.00422130
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x628]
mov dl, 1
call fcn.00422098
jmp case.default.0x52e875
lea eax, [ebp - 0x2c]
mov edx, 0x530a1c
call fcn.00403aa8
jmp case.default.0x52e875
lea eax, [ebp - 0x2c]
mov edx, 0x530a34
call fcn.00403aa8
jmp case.default.0x52e875
lea eax, [ebp - 0x2c]
mov edx, 0x530a48
call fcn.00403aa8
jmp case.default.0x52e875
lea eax, [ebp - 0x2c]
mov edx, 0x530a60
call fcn.00403aa8
cmp dword [ebp - 0x38], 0
je 0x52e992
push dword [0x5bce48]
push 0x530a78
push dword [ebp - 0x2c]
push 0x530a84
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00403d4c
push dword [0x5bce80]
push 0x530a90
push dword [ebp - 0x2c]
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
movzx ebx, word [0x5c0494]
cmp ebx, 9
ja case.0x52e9ce.4
jmp dword [ebx*4 + 0x52e9d5]
lea eax, [ebp - 0x2c]
mov edx, 0x530954
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530a9c
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530aac
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530ac0
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530ad8
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530af0
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530b08
call fcn.00403aa8
jmp 0x52ea73
lea eax, [ebp - 0x2c]
mov edx, 0x530954
call fcn.00403aa8
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c0494]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 9
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 9
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea eax, [ebp - 0x2c]
call fcn.00403a10
mov ax, word [0x5c0496]
sub ax, 0x800
je 0x52eb10
sub ax, 0x1800
je 0x52eb1f
sub ax, 0x6000
je 0x52eb2e
jmp 0x52eb3b
lea eax, [ebp - 0x2c]
mov edx, 0x530b1c
call fcn.00403aa8
jmp 0x52eb3b
lea eax, [ebp - 0x2c]
mov edx, 0x530b30
call fcn.00403aa8
jmp 0x52eb3b
lea eax, [ebp - 0x2c]
mov edx, 0x530b44
call fcn.00403aa8
lea ecx, [ebp - 0x84]
movzx eax, word [0x5c0496]
mov edx, 4
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xa
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xa
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x2c]
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c0498]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xb
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c049c]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xc
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c04a0]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xd
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c04a4]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xe
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c04a8]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xf
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0xf
call fcn.004830e4
mov eax, dword [eax + 8]
mov ecx, 0x530b64
mov edx, 1
mov ebx, dword [eax]
call dword [ebx + 0x20]
lea ecx, [ebp - 0x84]
mov edx, 8
mov eax, dword [0x5c04ac]
call fcn.0040746c
lea eax, [ebp - 0x84]
mov edx, 0x530800
call fcn.00403c94
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x220]
mov eax, dword [eax + 0x130]
mov edx, 0x10
call fcn.004830e4
mov eax, dword [eax + 8]
xor edx, edx
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x20]
call fcn.005231f4
mov dword [0x5c04c4], eax
mov ebx, dword [0x5c04c4]
shl ebx, 3
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5c04b4], eax
mov eax, dword [0x5c04b4]
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
mov eax, dword [0x5c03e4]
mov edx, dword [ebp - 0x40]
add eax, edx
mov edx, dword [0x5c04b4]
mov ecx, ebx
call fcn.004027e0
mov dword [0x5c04b0], ebx
mov eax, dword [ebp - 0x24]
call fcn.00523204
mov ebx, eax
mov eax, ebx
sub eax, dword [0x5c03e4]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x61], 0
mov eax, dword [0x5c04bc]
dec eax
test eax, eax
jl 0x52eebe
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
cmp dword [ebx + eax*8 + 8], 0
jne 0x52eeb6
push 0x530b78
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
lea edx, [ebx + edx*8]
mov ecx, 8
call fcn.00403c3c
push dword [ebp - 0x88]
push 0x530ba4
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
call fcn.0040743c
push dword [ebp - 0x8c]
push 0x530bb0
lea eax, [ebp - 0x84]
mov edx, 5
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov byte [ebp - 0x61], 1
inc dword [ebp - 0x30]
dec dword [ebp - 0x80]
jne 0x52ee45
cmp byte [ebp - 0x61], 0
je 0x52f12a
mov ax, word [0x530bc4]
push eax
xor ecx, ecx
mov edx, dword [0x5bd090]
mov eax, 0x530bd0
call fcn.00449a14
cmp eax, 6
jne 0x52f12a
mov eax, dword [0x5c04bc]
dec eax
test eax, eax
jl 0x52f123
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov esi, dword [ebp - 0x30]
lea esi, [esi + esi*4]
cmp dword [ebx + esi*8 + 8], 0
jne 0x52f117
mov eax, dword [ebx + esi*8 + 0x10]
mov dword [ebx + esi*8 + 8], eax
push 0x530cc4
lea eax, [ebp - 0x88]
lea edx, [ebx + esi*8]
mov ecx, 8
call fcn.00403c3c
push dword [ebp - 0x88]
push 0x530ba4
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
call fcn.0040743c
push dword [ebp - 0x8c]
push 0x530cf8
mov eax, dword [ebx + esi*8 + 8]
lea ecx, [ebp - 0x94]
mov edx, 8
call fcn.0040746c
push dword [ebp - 0x94]
push 0x530d04
mov eax, dword [ebx + esi*8 + 8]
lea edx, [ebp - 0x98]
call fcn.0040743c
push dword [ebp - 0x98]
push 0x530d10
lea eax, [ebp - 0x84]
mov edx, 9
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
mov eax, dword [ebx + esi*8 + 0x24]
and eax, 0xe0
cmp eax, 0x80
jne 0x52f117
xor eax, eax
mov dword [ebx + esi*8 + 0x10], eax
push 0x530d1c
lea eax, [ebp - 0x88]
lea edx, [ebx + esi*8]
mov ecx, 8
call fcn.00403c3c
push dword [ebp - 0x88]
push 0x530ba4
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
call fcn.0040743c
push dword [ebp - 0x8c]
push 0x530cf8
mov eax, dword [ebx + esi*8 + 0x10]
lea ecx, [ebp - 0x94]
mov edx, 8
call fcn.0040746c
push dword [ebp - 0x94]
push 0x530d04
mov eax, dword [ebx + esi*8 + 0x10]
lea edx, [ebp - 0x98]
call fcn.0040743c
push dword [ebp - 0x98]
push 0x530d10
lea eax, [ebp - 0x84]
mov edx, 9
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
cmp dword [ebx + esi*8 + 0x14], 0
jne 0x52f117
cmp dword [ebp - 0x30], 0
jne 0x52f078
mov eax, dword [0x5c048c]
mov dword [ebx + esi*8 + 0x14], eax
jmp 0x52f084
mov eax, dword [ebx + esi*8 - 0x14]
add eax, dword [ebx + esi*8 - 0x18]
mov dword [ebx + esi*8 + 0x14], eax
push 0x530d50
lea eax, [ebp - 0x88]
lea edx, [ebx + esi*8]
mov ecx, 8
call fcn.00403c3c
push dword [ebp - 0x88]
push 0x530ba4
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
call fcn.0040743c
push dword [ebp - 0x8c]
push 0x530cf8
mov eax, dword [ebx + esi*8 + 0x14]
lea ecx, [ebp - 0x94]
mov edx, 8
call fcn.0040746c
push dword [ebp - 0x94]
push 0x530d04
mov eax, dword [ebx + esi*8 + 0x14]
lea edx, [ebp - 0x98]
call fcn.0040743c
push dword [ebp - 0x98]
push 0x530d10
lea eax, [ebp - 0x84]
mov edx, 9
call fcn.00403d4c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
call fcn.00524268
inc dword [ebp - 0x30]
dec dword [ebp - 0x80]
jne 0x52ef03
mov byte [0x5bd068], 1
mov ebx, dword [0x5c04bc]
shl ebx, 3
lea ebx, [ebx + ebx*4]
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5c04c0], eax
mov eax, dword [0x5c04c0]
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
mov eax, dword [0x5c03e4]
mov edx, dword [ebp - 0x40]
add eax, edx
mov edx, dword [0x5c04c0]
mov ecx, ebx
call fcn.004027e0
mov dword [0x5c04b8], ebx
mov ebx, dword [0x5c04bc]
shl ebx, 3
lea ebx, [ebx + ebx*2]
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5c0548], eax
mov eax, dword [0x5c0548]
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
mov ebx, dword [0x5c04bc]
shl ebx, 2
lea ebx, [ebx + ebx*8]
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5c04cc], eax
mov eax, dword [0x5c04cc]
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
xor eax, eax
mov dword [0x5c04c8], eax
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 0x14]
lea ecx, [ebp - 0x84]
mov edx, 8
call fcn.0040746c
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x23c]
call fcn.00422130
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov ebx, dword [edx + eax*8 + 0x14]
mov eax, ebx
cdq
idiv dword [ebp - 0x78]
imul dword [ebp - 0x78]
mov ebx, eax
test ebx, ebx
jne 0x52f235
mov ebx, dword [0x5c048c]
mov dword [ebp - 0x74], ebx
push 4
push 0x1000
push ebx
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x5c0434], eax
mov eax, dword [0x5c0434]
xor ecx, ecx
mov edx, ebx
call fcn.00402b14
mov edx, dword [0x5c0434]
mov eax, dword [0x5c03e4]
mov ecx, ebx
call fcn.004027e0
mov dword [0x5c042c], ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x238]
mov eax, dword [eax + 0x130]
call fcn.004831a8
xor eax, eax
mov dword [0x5c054c], eax
mov esi, 0x530d80
mov edi, 0x5c0550
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [0x5be4bc]
mov eax, dword [eax]
sub eax, dword [0x5c046c]
sub eax, dword [0x5c0468]
mov edx, dword [0x5be6d0]
mov dword [edx], eax
mov eax, dword [0x5bec94]
mov eax, dword [eax]
mov edx, dword [0x5bdf0c]
sub eax, dword [edx]
mov edx, dword [0x5be0d8]
mov edx, dword [edx]
mov ecx, dword [0x5be180]
sub edx, dword [ecx]
add eax, edx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x52f36f
mov eax, dword [0x5be1ec]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be430]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be93c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be788]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bdef0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be1e8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be0cc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be224]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be3e4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bea64]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bdf8c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be2b0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be834]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be100]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be118]
xor edx, edx
mov dword [eax], edx
pushal
xor eax, eax
mov dword [0x5bdc4c], eax
mov esi, 0x5bdc58
mov esi, dword [esi]
mov ebx, dword [esi]
mov edi, 0x5bdc5c
mov eax, 0x53a1e394
xor ebx, eax
mov dword [edi], ebx
popal
xor eax, eax
mov dword [ebp - 0x7c], eax
mov eax, dword [0x5c04bc]
dec eax
test eax, eax
jl 0x52f3f6
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx + ebx*4]
mov eax, dword [0x5c04c0]
mov eax, dword [eax + ebx*8 + 8]
mov edx, dword [0x5c0470]
call fcn.00523218
test eax, eax
jne 0x52f3dc
mov eax, dword [0x5c04c0]
mov eax, dword [eax + ebx*8 + 0x10]
mov edx, dword [0x5c0470]
call fcn.00523218
mov edx, dword [0x5c04c0]
add eax, dword [edx + ebx*8 + 0xc]
cmp eax, dword [ebp - 0x7c]
jle 0x52f3ee
mov dword [ebp - 0x7c], eax
inc dword [ebp - 0x30]
dec dword [ebp - 0x80]
jne 0x52f3aa
xor eax, eax
mov dword [0x5c0528], eax
xor eax, eax
mov dword [0x5c052c], eax
mov eax, dword [0x5c04bc]
dec eax
test eax, eax
jl 0x52fb19
inc eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x30], 0
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx + ebx*2]
mov eax, dword [0x5c0548]
xor edx, edx
mov dword [eax + ebx*8], edx
lea ecx, [ebp - 0x84]
mov edx, 4
mov eax, dword [ebp - 0x30]
call fcn.0040746c
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
mov esi, dword [ebp - 0x30]
lea esi, [esi + esi*4]
mov edx, dword [0x5c04c0]
lea edx, [edx + esi*8]
mov ecx, 8
call fcn.00403c3c
mov edx, dword [ebp - 0x88]
pop eax
call fcn.00403c94
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x198]
mov ecx, 0xff
call fcn.00403c68
lea edx, [ebp - 0x198]
mov eax, dword [0x5c0548]
lea eax, [eax + ebx*8 + 4]
mov cl, 0x10
call fcn.004029f0
mov eax, dword [0x5be950]
mov eax, dword [eax]
xor eax, 0x4d3412
mov dword [ebp - 0x44], eax
mov eax, dword [0x5be9d4]
mov eax, dword [eax]
xor eax, 0xa502f3bc
mov dword [ebp - 0x48], eax
mov eax, dword [0x5c04c0]
mov eax, dword [eax + esi*8 + 0x14]
cdq
idiv dword [ebp - 0x78]
mov ebx, eax
imul ebx, dword [ebp - 0x78]
cmp dword [ebp - 0x30], 0
jne 0x52f51d
cmp dword [ebp - 0x74], 0
je 0x52f51d
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
cmp dword [edx + eax*8 + 0x14], 0
jne 0x52f51d
mov eax, dword [0x5c03e4]
add eax, dword [ebp - 0x74]
mov edx, dword [0x5be17c]
mov edx, dword [edx]
not edx
xor edx, 0x883cc625
add eax, edx
mov edx, dword [0x5c04c8]
lea edx, [edx + edx*8]
mov ecx, dword [0x5c04cc]
mov dword [ecx + edx*4 + 0x20], eax
jmp 0x52f545
add ebx, dword [0x5c03e4]
mov eax, dword [0x5be17c]
mov eax, dword [eax]
not eax
xor eax, 0x883cc625
add ebx, eax
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*8]
mov edx, dword [0x5c04cc]
mov dword [edx + eax*4 + 0x20], ebx
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
cmp dword [edx + eax*8 + 0x14], 0
je 0x52f5e8
mov eax, dword [0x5be784]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c04c0]
lea edx, [ecx + edx*8]
mov ecx, 8
call fcn.00403c3c
mov eax, dword [ebp - 0x84]
push eax
lea eax, [ebp - 0x88]
mov edx, dword [0x5be6a4]
mov ecx, 5
call fcn.00403c3c
mov edx, dword [ebp - 0x88]
pop eax
call fcn.00403d9c
jne 0x52f5e8
mov eax, dword [0x5be580]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*8]
mov edx, dword [0x5c04cc]
mov eax, dword [edx + eax*4 + 0x20]
mov edx, dword [0x5be784]
mov dword [edx], eax
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], 0xffff
call fcn.005231f4
mov dword [0x5c04c4], eax
mov edx, dword [0x5c04c4]
dec edx
test edx, edx
jl 0x52f780
inc edx
xor eax, eax
mov ecx, dword [0x5c04b4]
cmp dword [ecx + eax*8], 0
je 0x52f65d
mov ecx, dword [0x5c04b4]
cmp dword [ecx + eax*8 + 4], 0
je 0x52f65d
mov ecx, dword [0x5c04b4]
mov ecx, dword [ecx + eax*8]
cmp ecx, dword [ebp - 0x7c]
jge 0x52f65d
mov ecx, dword [0x5c04b4]
cmp dword [ecx + eax*8], 0
jle 0x52f65d
mov ecx, dword [0x5c04b4]
mov ecx, dword [ecx + eax*8 + 4]
cmp ecx, dword [0x5c0488]
jge 0x52f65d
mov ecx, dword [0x5c04b4]
cmp dword [ecx + eax*8 + 4], 0
jg 0x52f661
xor ecx, ecx
jmp 0x52f663
mov cl, 1
mov ebx, eax
cmp ebx, 0xe
ja case.default.0x52f66e
jmp dword [ebx*4 + 0x52f675]
mov byte [0x5bcef4], cl
jmp case.default.0x52f66e
mov byte [0x5bcef8], cl
jmp case.default.0x52f66e
mov byte [0x5bcefc], cl
jmp case.default.0x52f66e
mov byte [0x5bcf00], cl
jmp case.default.0x52f66e
mov byte [0x5bcf04], cl
jmp case.default.0x52f66e
mov byte [0x5bcf08], cl
cmp byte [0x5bcf08], 0
je case.default.0x52f66e
mov ecx, dword [0x5c04b4]
mov ecx, dword [ecx + eax*8]
mov dword [0x5c0528], ecx
mov ecx, dword [0x5c04b4]
mov ecx, dword [ecx + eax*8 + 4]
mov dword [0x5c052c], ecx
jmp case.default.0x52f66e
mov byte [0x5bcf10], cl
jmp case.default.0x52f66e
mov byte [0x5bcf14], cl
jmp case.default.0x52f66e
mov byte [0x5bcf18], cl
jmp case.default.0x52f66e
mov byte [0x5bcf1c], cl
jmp case.default.0x52f66e
mov byte [0x5bcf20], cl
jmp case.default.0x52f66e
mov byte [0x5bcf24], cl
jmp case.default.0x52f66e
mov byte [0x5bcf28], cl
jmp case.default.0x52f66e
mov byte [0x5bcf2c], cl
jmp case.default.0x52f66e
mov byte [0x5bcf30], cl
mov ecx, dword [0x5c04b4]
mov ecx, dword [ecx + eax*8]
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx + ebx*4]
mov esi, dword [0x5c04c0]
cmp ecx, dword [esi + ebx*8 + 0xc]
jne 0x52f778
mov dword [ebp - 0x34], eax
jmp 0x52f780
inc eax
dec edx
jne 0x52f60b
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*8]
mov edx, dword [0x5c04cc]
mov byte [edx + eax*4], 1
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*8]
mov edx, dword [0x5c04cc]
mov ecx, dword [ebp - 0x30]
mov dword [edx + eax*4 + 4], ecx
mov eax, dword [0x5c04c8]
lea eax, [eax + eax*8]
mov edx, dword [0x5c04cc]
mov ecx, dword [ebp - 0x34]
mov dword [edx + eax*4 + 8], ecx
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 8]
mov edx, dword [0x5be5f8]
xor eax, dword [edx]
mov edx, dword [0x5c04c8]
lea edx, [edx + edx*8]
mov ecx, dword [0x5c04cc]
mov dword [ecx + edx*4 + 0xc], eax
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 0xc]
mov edx, dword [0x5be5f8]
xor eax, dword [edx]
mov edx, dword [0x5c04c8]
lea edx, [edx + edx*8]
mov ecx, dword [0x5c04cc]
mov dword [ecx + edx*4 + 0x10], eax
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 0x10]
mov edx, dword [0x5be5f8]
xor eax, dword [edx]
mov edx, dword [0x5c04c8]
lea edx, [edx + edx*8]
mov ecx, dword [0x5c04cc]
mov dword [ecx + edx*4 + 0x14], eax
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*4]
mov edx, dword [0x5c04c0]
mov eax, dword [edx + eax*8 + 0x14]
mov edx, dword [0x5be5f8]
xor eax, dword [edx]
mov edx, dword [0x5c04c8]
lea edx, [edx + edx*8]
mov ecx, dword [0x5c04cc]
mov dword [ecx + edx*4 + 0x18], eax
mov eax, dword [0x5be580]
cmp dword [eax], 0xffffffff
je 0x52f8e5
mov eax, dword [0x5be580]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x30]
jne 0x52f8e5
pushal
mov dword [0x5bdc48], 0
mov ebx, dword [0x5bdc50]
add ebx, 4
mov ecx, dword [ebp - 4]
cmp ecx, ebx
jb 0x52f8e4
mov esi, dword [0x5bdc4c]
cmp dword [0x5bdc54], 0
je 0x52f8e4
cmp dword [0x5bdc4c], 0
je 0x52f8e4
mov edi, dword [0x5bdc54]
sub ebx, 4
add esi, ebx
mov eax, dword [edi]
xor eax, dword [esi]
mov ebx, dword [edi + 4]
xor ebx, dword [esi + 4]
mov ecx, dword [edi + 8]
xor ecx, dword [esi + 8]
mov edx, dword [edi + 0xc]
xor edx, dword [esi + 0xc]
xor eax, ebx
xor ecx, edx
sub eax, ecx
jne 0x52f8e4
mov dword [0x5bdc48], sub.user32.dll_GetMenuStringA
popal
inc dword [0x5c04c8]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x238]
mov eax, dword [eax + 0x130]
call fcn.00483078
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00482b50
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebx + 8]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dl, 1
mov eax, ebx
call fcn.00482af4
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c04c0]
lea edx, [ecx + edx*8]
mov ecx, 8
call fcn.00403c3c
mov eax, dword [ebp - 0x84]
mov edx, 0x530d98
call fcn.00403d9c
je 0x52f9e6
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c04c0]
lea edx, [ecx + edx*8]
mov ecx, 8
call fcn.00403c3c
mov eax, dword [ebp - 0x84]
mov edx, 0x530da8
call fcn.00403d9c
je 0x52f9e6
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c04c0]
lea edx, [ecx + edx*8]
mov ecx, 8
call fcn.00403c3c
mov eax, dword [ebp - 0x84]
mov edx, 0x530db8
call fcn.00403d9c
jne 0x52fb0d
cmp byte [0x5bcd7c], 0
je 0x52fb0d
mov eax, dword [0x5bdeec]
mov al, byte [eax]
and al, 0xff
mov edx, dword [0x5bdeec]
mov edx, dword [edx]
shr edx, 8
and dl, 0xff
xor al, dl
mov edx, dword [0x5bdeec]
mov edx, dword [edx]
shr edx, 0x10
and dl, 0xff
xor al, dl
mov edx, dword [0x5bdeec]
mov edx, dword [edx]
shr edx, 0x18
and dl, 0xff
xor al, dl
mov edx, dword [0x5bea4c]
cmp dword [edx], 0
jne 0x52fa4b
test al, al
jne 0x52fa4b
cmp dword [ebp - 0x44], 0
jne 0x52fa4b
cmp dword [ebp - 0x48], 0
je 0x52fb0d
xor ebx, ebx
push ebp
push 0x52fb03
push dword fs:[ebx]
mov dword fs:[ebx], esp
mov dl, byte [ebp - 0x44]
and dl, 0xff
mov ecx, dword [ebp - 0x44]
shr ecx, 8
and cl, 0xff
xor dl, cl
mov ecx, dword [ebp - 0x44]
shr ecx, 0x10
and cl, 0xff
xor dl, cl
mov ecx, dword [ebp - 0x44]
shr ecx, 0x18
and cl, 0xff
xor dl, cl
mov byte [ebp - 0x39], dl
mov dl, byte [ebp - 0x48]
and dl, 0xff
mov ecx, dword [ebp - 0x48]
shr ecx, 8
and cl, 0xff
xor dl, cl
mov ecx, dword [ebp - 0x48]
shr ecx, 0x10
and cl, 0xff
xor dl, cl
mov ecx, dword [ebp - 0x48]
shr ecx, 0x18
and cl, 0xff
xor dl, cl
mov byte [ebp - 0x3a], dl
mov edx, dword [ebp - 0x30]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c04c0]
mov edx, dword [ecx + edx*8 + 0x10]
dec edx
test edx, edx
jl 0x52faf7
inc edx
xor ecx, ecx
mov ebx, dword [ebp - 0x30]
lea ebx, [ebx + ebx*8]
mov esi, dword [0x5c04cc]
mov ebx, dword [esi + ebx*4 + 0x20]
mov bl, byte [ebx + ecx]
xor bl, al
xor bl, byte [ebp - 0x39]
xor bl, byte [ebp - 0x3a]
mov esi, dword [ebp - 0x30]
lea esi, [esi + esi*8]
mov edi, dword [0x5c04cc]
mov esi, dword [edi + esi*4 + 0x20]
mov byte [esi + ecx], bl
inc ecx
dec edx
jne 0x52fac5
pop dword fs:[0]
add esp, 8
jmp 0x52fb0d
inc dword [ebp - 0x30]
dec dword [ebp - 0x80]
jne 0x52f41d
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x10], eax
pushal
jmp 0x52fb3b
mov ecx, 0xe8032b14
mov eax, 0x52fb2b
mov edx, dword [eax]
sub edx, ecx
mov dword [ebp - 8], edx
add eax, 4
mov ebx, dword [eax]
sub ebx, ecx
sub ebx, edx
dec ebx
mov dword [ebp - 0xc], ebx
add eax, 4
mov ebx, dword [eax]
sub ebx, ecx
mov dword [ebp - 0x10], ebx
popal
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x5c], eax
push 0x40
push 0x1000
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 0x60], eax
xor eax, eax
push ebp
push 0x52fca8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402b14
mov eax, dword [ebp - 0x60]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402b14
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.004027e0
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call fcn.004027e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x60]
call fcn.0059d76c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
call fcn.00407028
test al, al
jne 0x52fc7a
mov eax, dword [0x5be1ec]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be430]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be93c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be788]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bdef0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be1e8]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be0cc]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be224]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be3e4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bea64]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5bdf8c]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be2b0]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be834]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be100]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x5be118]
xor edx, edx
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52fcaf
push 0x8000
push 0
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_VirtualFree_1
push 0x8000
push 0
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_VirtualFree_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5307bd
lea eax, [ebp - 0x98]
mov edx, 2
call fcn.00403a34
lea eax, [ebp - 0x90]
call fcn.00403a10
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.00403a34
lea eax, [ebp - 0x68]
call fcn.00403a10
lea eax, [ebp - 0x2c]
call fcn.00403a10
ret