Function at 0x4d5638
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x4d5641
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004040cc
xor eax, eax
push ebp
push 0x4d6335
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x215], 0
mov byte [ebp - 0x25], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x272], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x2be], 0
je 0x4d56b8
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c0]
call dword [ebx + 0x2bc]
lea eax, [ebp - 0x34]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040411c
mov eax, dword [ebp - 0x34]
mov edx, 0x4d634c
call fcn.00404028
jne 0x4d58d5
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.0040415c
push 0
lea eax, [ebp - 0x24]
push eax
xor ecx, ecx
mov edx, 0x4d6358
mov eax, dword [ebp - 8]
call fcn.0046724c
push 0
lea eax, [ebp - 0x34]
push eax
xor ecx, ecx
mov edx, 0x4d6364
mov eax, dword [ebp - 0x24]
call fcn.0046724c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x24]
call fcn.00403d34
xor eax, eax
push ebp
push 0x4d578c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004d4af0
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4d6370
call fcn.00403f64
mov ecx, dword [ebp - 0x34]
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.005ac7c4
push 0
push 1
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4d6370
call fcn.00403f64
mov edx, dword [ebp - 0x34]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004d473c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5793
ret
xor ecx, ecx
push ebp
push 0x4d6300
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x5a6340]
call fcn.005a6728
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1f8], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov dword [ebx + 0xc0], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x2c], 0x4d8fd8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x94]
mov dword [ebx + 0x94], edx
mov edx, dword [eax + 0x98]
mov dword [ebx + 0x98], edx
mov eax, dword [ebp - 4]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x34], 0x4d8e24
mov eax, ebx
mov dl, 1
call fcn.005a74fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
add eax, 0x240
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x240]
call fcn.00403cf0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov dword [eax + 0x1a8], edx
mov edx, dword [ebp - 4]
cmp word [edx + 0x17a], 0
je 0x4d59af
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x178]
mov dword [eax + 0x178], ecx
mov ecx, dword [edx + 0x17c]
mov dword [eax + 0x17c], ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c0], 0
je 0x4d59c7
mov eax, dword [ebp - 4]
test byte [eax + 0x1c1], 1
jne 0x4d59cb
xor eax, eax
jmp 0x4d59cd
mov al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1f8]
mov byte [edx + 0x1b8], al
test al, al
je 0x4d59ef
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1c0]
mov byte [edx + 0x1c0], al
mov eax, dword [ebp - 4]
cmp word [eax + 0x2b6], 0
je 0x4d5a1c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov cl, byte [eax + 0xc4]
mov edx, eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x2b8]
call dword [ebx + 0x2b4]
mov eax, dword [ebp - 4]
mov byte [eax + 0x271], 1
mov eax, dword [ebp - 4]
call fcn.005a9470
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d5a44
call fcn.004037b0
jmp 0x4d630a
mov byte [ebp - 0x2d], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0x316], 0
je 0x4d5a6d
lea eax, [ebp - 0x2d]
push eax
mov ebx, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x318]
call dword [ebx + 0x314]
mov dl, byte [ebp - 0x2d]
mov eax, dword [ebp - 4]
call fcn.004d4af0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x273]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1f8]
mov byte [edx + 0x1ac], al
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004d50f4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5aca
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5aca
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5aca
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
jne 0x4d5b02
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5ae2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
je 0x4d5aee
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
jmp 0x4d5af8
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
cmp byte [ebp - 9], 0
jne 0x4d5b29
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov al, byte [eax + 0xdc]
add al, 0xf6
sub al, 2
jb 0x4d5b29
sub al, 1
je 0x4d5b29
sub al, 3
jne 0x4d5bde
mov byte [ebp - 9], 1
mov edx, 0x4d6390
mov eax, dword [ebp - 4]
call fcn.004d7ff0
test al, al
je 0x4d5b51
push 0
push 1
xor ecx, ecx
mov edx, 0x4d63a0
mov eax, dword [ebp - 4]
call fcn.004d473c
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d8624
test al, al
je 0x4d5b81
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5b81
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x4d5b85
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5bde
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5bde
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5bde
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x4d5bde
mov eax, dword [ebp - 4]
cmp word [eax + 0x2be], 0
je 0x4d5bde
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c0]
call dword [ebx + 0x2bc]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5c0e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5c0e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5c0e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
jne 0x4d5c46
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5c26
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
je 0x4d5c32
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
jmp 0x4d5c3c
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
cmp byte [ebp - 9], 0
je 0x4d5c7a
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d5414
test al, al
jne 0x4d5d91
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
xor edx, edx
call fcn.005a6cb4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x340]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x33c]
mov eax, dword [ebp - 4]
call fcn.004db378
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x1f8]
mov dword [ebx + 0xf4], eax
mov eax, ebx
mov dl, 1
call fcn.005aa6c0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5ce0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5ce0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d5d18
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5cf8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
je 0x4d5d04
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
jmp 0x4d5d0e
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
call fcn.004d895c
test al, al
jne 0x4d5d38
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5d91
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5d91
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5d91
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x4d5d91
mov eax, dword [ebp - 4]
cmp word [eax + 0x2be], 0
je 0x4d5d91
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c0]
call dword [ebx + 0x2bc]
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0x12c
jle 0x4d5e00
cmp ax, 0x258
jge 0x4d5e00
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d5e00
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d5dcb
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
jmp 0x4d5dd5
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ce], 0
jne 0x4d5df6
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4d1ddc]
call fcn.0040bbf8
call fcn.00403710
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
jne 0x4d5e20
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
mov byte [eax + 0x32d], dl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x1d8], edx
mov dword [eax + 0x1d4], 0x4d51f0
push 0
push 1
lea edx, [ebp - 0x34]
mov eax, 0x4d1d64
call fcn.00405c9c
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.00403f20
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d473c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d5ec4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d5ec4
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5ec4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x4d5ec4
mov eax, dword [ebp - 4]
cmp word [eax + 0x2be], 0
je 0x4d5ec4
mov eax, dword [0x5bc024]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c0]
call dword [ebx + 0x2bc]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
jne 0x4d5ee4
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0x12c
jle 0x4d5fe2
cmp ax, 0x258
jge 0x4d5fe2
cmp ax, 0x1aa
je 0x4d5fe2
cmp ax, 0x1a9
je 0x4d5fe2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d5fe2
mov eax, dword [ebp - 8]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x4d5fad
push 0
push 1
lea edx, [ebp - 0x34]
mov eax, 0x4d1d64
call fcn.00405c9c
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d473c
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0x12c
jle 0x4d5f6c
cmp ax, 0x258
jl 0x4d5f78
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d5fe2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ce], 0
jne 0x4d5fa3
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4d1ddc]
call fcn.0040bbf8
call fcn.00403710
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ce], 0
jne 0x4d5fd8
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4d1ddc]
call fcn.0040bbf8
call fcn.00403710
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0x12c
jle 0x4d603d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d603d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d0], 0
jne 0x4d603d
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ce], 0
jne 0x4d6033
mov ecx, dword [ebp - 0x14]
mov dl, 1
mov eax, dword [0x4d1ddc]
call fcn.0040bbf8
call fcn.00403710
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
jne 0x4d605d
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
call fcn.004037b0
jmp 0x4d630a
mov eax, dword [ebp - 4]
test byte [eax + 0x1c1], 1
jne 0x4d610b
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0x12c
jge 0x4d610b
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0x258
jge 0x4d610b
cmp byte [ebp - 9], 0
jne 0x4d610b
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d98a0
jmp 0x4d610b
lea ecx, [ebp - 0x10]
mov eax, ebx
xor edx, edx
call fcn.005a97ac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004d8e78
mov eax, dword [ebp - 0x10]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x4d60d6
mov dx, 5
mov eax, dword [ebp - 4]
call fcn.005acc80
jmp 0x4d60e0
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.005accec
mov eax, dword [ebp - 4]
cmp word [eax + 0x6e], 0
je 0x4d60f6
lea edx, [ebp - 0x25]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x70]
call dword [ebx + 0x6c]
cmp byte [ebp - 0x25], 0
je 0x4d610b
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
jmp 0x4d6195
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1f8]
test ebx, ebx
je 0x4d6195
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d6195
cmp byte [ebx + 0x268], 0
je 0x4d6195
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d6195
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d6195
cmp byte [ebx + 0x216], 0
je 0x4d609f
jmp 0x4d6195
lea ecx, [ebp - 0x24]
mov eax, ebx
xor edx, edx
call fcn.005a97ac
mov eax, dword [ebp - 0x24]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x4d61c3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d61c3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d61c3
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004d8e78
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x1f8]
test ebx, ebx
je 0x4d61c3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d61c3
cmp byte [ebx + 0x216], 0
jne 0x4d61c3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
je 0x4d6154
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d61f6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d61f6
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0xc7
jge 0x4d61f6
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.004db41c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d630a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x4d629d
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0xc8
jge 0x4d6232
push 1
mov cl, 1
mov edx, 0x4d63b4
mov eax, dword [ebp - 4]
call fcn.004d80c4
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ee], 0
je 0x4d6251
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2f0]
call dword [ebx + 0x2ec]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1f8], 0
je 0x4d629d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
cmp byte [eax + 0x215], 0
jne 0x4d6278
cmp byte [eax + 0x216], 0
je 0x4d6282
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1f8], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d0], 0
jne 0x4d62ff
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x215]
test al, al
jne 0x4d62c2
mov edx, dword [ebp - 4]
cmp byte [edx + 0x272], 0
jne 0x4d62de
test al, al
je 0x4d62d2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
jmp 0x4d62ff
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
jmp 0x4d62ff
mov eax, dword [ebp - 4]
cmp word [eax + 0x2c6], 0
je 0x4d62ff
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c8]
call dword [ebx + 0x2c4]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d633c
lea eax, [ebp - 0x34]
call fcn.00403c9c
lea eax, [ebp - 0x24]
mov edx, 6
call fcn.00403cc0
lea eax, [ebp - 8]
call fcn.00403c9c
ret