Function at 0x52dc10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e08ce
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x62fda0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62fda0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x4c], edi
xor ebx, ebx
call fcn.004f5420
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.004ee1e0
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.00568b40
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x52e39b
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x52dcf4.18
movzx ecx, byte [eax + 0x52e418]
jmp dword [ecx*4 + 0x52e404]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x52dd2c
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x52dd21
mov dword [eax + 4], ecx
jmp 0x52dd24
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.0052c760
mov edi, eax
push edi
push ebp
mov ecx, esi
call fcn.00529280
test eax, eax
je 0x52e31f
test edi, edi
jl 0x52e31f
jmp 0x52e2b2
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ebx, dword [ecx + edx*4]
je 0x52dd80
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebx + 0x14]
je 0x52dd75
mov dword [eax + 4], ecx
jmp 0x52dd78
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x52ddba
cmp eax, 0x16
je 0x52ddba
cmp eax, 0x20
jne 0x52ddfc
mov ecx, dword [esi + 0xc]
mov eax, edi
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x52ddba
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, ebx
call fcn.004f5e90
test eax, eax
jne 0x52e2b2
mov ecx, esi
call fcn.0052c760
mov ebp, eax
push ebp
lea edx, [ebx + 4]
push edx
mov ecx, esi
call fcn.005290b0
test eax, eax
je 0x52e31f
mov edi, ebp
test ebp, ebp
jl 0x52e31f
mov eax, dword [ebx + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x52df6f
mov dword [ebp + 4], eax
jmp 0x52e2b2
cmp eax, 0x31
je 0x52de0a
cmp eax, 0x32
jne 0x52def5
cmp dword [esp + 0x2c], 0
je 0x52def5
push ebx
lea ecx, [esp + 0x70]
call fcn.004fd450
mov ebp, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.00582740
cmp dword [esp + 0x6c], 0
jne 0x52de45
cmp dword [esp + 0x70], 0
je 0x52de83
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.004fd670
test eax, eax
jne 0x52de83
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.0052d7e0
mov edi, eax
test edi, edi
jl 0x52e31f
mov eax, dword [ebx + 0x14]
mov ecx, edi
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0051f170
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004fa0c0
add esp, 8
test eax, eax
jne 0x52dea1
lea eax, [ebx + 4]
push eax
jmp 0x52df31
mov edx, dword [ebx + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [ebx + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0052c550
add esp, 0x18
test eax, eax
je 0x52e2b2
lea eax, [ebx + 4]
push eax
jmp 0x52df31
cmp eax, 0x11
jne 0x52e2b2
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 0x28]
cmp eax, dword [ebx + 0x14]
je 0x52e2b2
mov eax, edx
lea ebp, [ebx + 4]
add eax, 0xc
push ebp
push eax
call fcn.004fa0c0
add esp, 8
test eax, eax
je 0x52df30
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0x24]
cmp ecx, dword [eax + 0x28]
je 0x52df58
push ebp
mov ecx, esi
call fcn.0052d7e0
mov edi, eax
test edi, edi
jl 0x52e31f
mov eax, dword [ebx + 0x14]
mov ecx, edi
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0051f170
jmp 0x52e2b2
mov eax, dword [ebx + 0x14]
lea ecx, [edi + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0051f170
jmp 0x52e2b2
mov dword [ebp + 0xc], eax
jmp 0x52e2b2
cmp dword [esp + 0x14], 0x16
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov edi, dword [eax + ecx*4]
mov dword [esp + 0x2c], edi
jne 0x52e08a
test ebx, ebx
je 0x52e08a
push ebx
lea ecx, [esp + 0x60]
call fcn.004fd450
lea edx, [esp + 0x30]
push edx
mov ecx, edi
mov dword [esp + 0x5c], 0
call fcn.00582740
cmp dword [esp + 0x5c], 0
jne 0x52dfc4
cmp dword [esp + 0x60], 0
je 0x52dfff
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x64]
call fcn.004fd670
test eax, eax
jne 0x52dfff
lea edx, [ebx + 0xc]
push edx
mov ecx, esi
call fcn.0052d7e0
test eax, eax
jl 0x52e31f
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0051f170
lea eax, [ebx + 0xc]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.004fa0c0
add esp, 8
test eax, eax
jne 0x52e01b
lea edx, [esp + 0x34]
push edx
jmp 0x52e06a
mov ecx, dword [edi + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edi + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [ebx + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [ebx + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0052c550
add esp, 0x18
test eax, eax
je 0x52e08a
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.0052d7e0
test eax, eax
jl 0x52e31f
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0051f170
cmp dword [esp + 0x18], 0
jne 0x52e0f6
lea ecx, [esp + 0x84]
push ecx
mov ecx, edi
mov dword [esp + 0x48], 1
call fcn.00582760
lea edx, [esp + 0x88]
push edx
lea ecx, [esp + 0x20]
call fcn.00568b90
test dword [esp + 0x1c], 0x80000
mov edi, dword [edi + 0x20]
je 0x52e0cc
mov dword [esp + 0x20], edi
jmp 0x52e0d0
mov dword [esp + 0x28], edi
mov ecx, esi
call fcn.0052c760
mov edi, eax
push edi
lea eax, [esp + 0x20]
push eax
mov ecx, esi
call fcn.00528f60
test eax, eax
je 0x52e31f
test edi, edi
jl 0x52e31f
mov ecx, esi
call fcn.0052c760
mov ecx, dword [esp + 0x2c]
mov ebp, eax
add ecx, 4
push ebp
push ecx
mov ecx, esi
call fcn.005290b0
test eax, eax
je 0x52e31f
mov edi, ebp
test ebp, ebp
jl 0x52e31f
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.00568ef0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x52e157
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.00568f30
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x52e2b2
mov edi, dword [esp + 0x2c]
lea edx, [esp + 0x84]
push edx
mov ecx, edi
call fcn.00582760
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x20]
call fcn.00568b90
test dword [esp + 0x1c], 0x80000
mov eax, dword [edi + 0x20]
je 0x52e19f
mov dword [esp + 0x20], eax
jmp 0x52e1a3
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0052d7b0
mov edi, eax
test edi, edi
jl 0x52e31f
jmp 0x52e2b2
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x52e237
cmp dword [ebp + 0x14], 1
jne 0x52e1f6
lea ecx, [ebx + 0xc]
push ecx
mov ecx, esi
call fcn.0052d7e0
test eax, eax
jl 0x52e31f
mov ecx, dword [ebx + 0x14]
jmp 0x52e250
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.00588620
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x52e264
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x52e264
lea eax, [ebx + 0xc]
push eax
mov ecx, esi
call fcn.0052d7e0
test eax, eax
jl 0x52e31f
mov ecx, dword [ebx + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0051f170
jmp 0x52e264
cmp ecx, 0x20
jne 0x52e264
mov edi, dword [eax - 4]
lea ecx, [edi + 4]
push ecx
mov ecx, esi
call fcn.0052d7e0
mov edi, dword [edi + 0x1c]
lea ecx, [edi + edi]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x52e261
mov dword [eax + 4], ecx
jmp 0x52e264
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x52e299
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x52e279
lea edx, [ebp + 4]
push edx
jmp 0x52e27d
lea eax, [ebp + 0xc]
push eax
call fcn.0052d7e0
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x52e296
mov dword [eax + 4], ecx
jmp 0x52e299
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.0052c760
mov edi, eax
push edi
push ebp
mov ecx, esi
call fcn.005293d0
test eax, eax
jne 0x52e2b2
or edi, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x52dcd0
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x52e362
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.0052c760
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x52e35c
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.005290b0
test eax, eax
je 0x52e31f
test edi, edi
jl 0x52e31f
mov ebx, dword [ebx + 0x24]
jmp 0x52e387
push 0x302
call fcn.005bbd50
add esp, 4
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
call fcn.0045c490
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004eeaf0
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f54b0
xor eax, eax
jmp 0x52e3d9
lea ecx, [ebx + 0xc]
push ecx
jmp 0x52e2fe
cmp eax, 0x16
jne 0x52e39b
mov ecx, esi
call fcn.0052c760
mov edi, eax
push edi
lea edx, [ebx + 0xc]
push edx
mov ecx, esi
call fcn.005290b0
test eax, eax
je 0x52e31f
test edi, edi
jl 0x52e31f
mov ebx, dword [ebx + 0x14]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x52e398
mov dword [edi + 4], ebx
jmp 0x52e39b
mov dword [edi + 0xc], ebx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xb4], 1
call fcn.0045c490
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.004eeaf0
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.004f54b0
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005bd2c6
add esp, 0xa4
ret 4