found the code. it's in the dump...
00594614 8BD0 MOV EDX,EAX
00594616 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00594619 8B80 A80A0000 MOV EAX,DWORD PTR DS:[EAX+AA8]
0059461F 8B08 MOV ECX,DWORD PTR DS:[EAX]
00594621 FF51 5C CALL DWORD PTR DS:[ECX+5C]
00594624 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00594627 8B80 000B0000 MOV EAX,DWORD PTR DS:[EAX+B00]
0059462D 33D2 XOR EDX,EDX
0059462F E8 2864FEFF CALL zupa.0057AA5C
00594634 A1 D0AC5B00 MOV EAX,DWORD PTR DS:[5BACD0] <<< checks the dword in 5BACD0 = RVA 5BACD2
00594639 E8 CA64E7FF CALL zupa.0040AB08
0059463E 85C0 TEST EAX,EAX
00594640 76 10 JBE SHORT zupa.00594652 <<< jump UNREGISTERED
00594642 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
00594645 8B80 5C090000 MOV EAX,DWORD PTR DS:[EAX+95C]
0059464B 33D2 XOR EDX,EDX
0059464D E8 CE23EBFF CALL zupa.00446A20
00594652 33C0 XOR EAX,EAX
the dword 5BACD0 begins in my dump with B8, in your dump with B7.
the solution is to nop the JBE @RVA 00594640
@59A5C3 is another JBE, this must also be nopped.