Function at 0x457cf0
Capabilities:
Enumerate files on windows
Enumerate files recursively
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x586632
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x6531f0]
xor eax, esp
mov dword [esp + 0x318], eax
push ebx
push esi
push edi
mov eax, dword [0x6531f0]
xor eax, esp
push eax
lea eax, [esp + 0x330]
mov dword fs:[0], eax
cmp byte [ebp + 0x24], 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], esi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], ecx
je 0x457d93
cmp dword [ebp + 0x28], 0
jne 0x457d93
call fcn.00451a50
mov edx, ebx
lea ecx, [esp + 0x34]
call fcn.00451ce0
mov dword [esp + 0x338], 0
call fcn.0040e9d0
mov dword [esp + 0x338], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.00402750
mov edx, dword [esp + 0x4c]
push edx
lea eax, [esp + 0x9c]
push eax
mov ebx, str..
call fcn.0042b340
add esp, 8
mov dword [esp + 0x338], 1
mov eax, dword [eax]
lea ecx, [esp + 0xd4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x338], 0xffffffff
lea ecx, [esp + 0x98]
call fcn.00402750
cmp ebx, 0xffffffff
je 0x458a84
nop
mov edx, dword [0x66b0a4]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push edx
call edi
test eax, eax
je 0x458a7d
mov eax, dword [0x66b0ac]
mov ecx, dword [eax + 0x2c]
push 0xffffffffffffffff
push ecx
call edi
mov ecx, 0x632c68
lea eax, [esp + 0x100]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x457e48
test dx, dx
je 0x457e44
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x457e48
add eax, 4
add ecx, 4
test dx, dx
jne 0x457e22
xor eax, eax
jmp 0x457e4d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x458a66
mov ecx, 0x632c6c
lea eax, [esp + 0x100]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x457e87
test dx, dx
je 0x457e83
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x457e87
add eax, 4
add ecx, 4
test dx, dx
jne 0x457e61
xor eax, eax
jmp 0x457e8c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x458a66
mov edx, dword [esp + 0x4c]
push edx
lea eax, [esp + 0x74]
push eax
mov ebx, 0x63132c
call fcn.0042b340
mov dword [esp + 0x340], 2
push eax
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x110]
call fcn.0042b340
add esp, 0x10
mov byte [esp + 0x338], 4
lea ecx, [esp + 0x70]
call fcn.00402750
lea edi, [esp + 0x18]
call fcn.0040cc50
lea edx, [esp + 0x1c]
push edx
mov ecx, ebx
call fcn.004026a0
mov bl, 5
mov byte [esp + 0x338], bl
lea edi, [esp + 0x1c]
call fcn.0040cc50
mov eax, dword [esp + 0x1c]
push str.System_Volume_Information
push eax
mov byte [esp + 0x1f], 1
call fcn.004ff23a
add esp, 8
test eax, eax
jne 0x457f1f
mov byte [esp + 0x17], al
cmp byte [ebp + 0x24], 0
je 0x457fa6
cmp dword [0x65236c], 1
jl 0x457fa6
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x1c]
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0x33c], 6
lea eax, [esp + 0x7c]
push eax
mov byte [esp + 0x340], bl
call fcn.004060e0
add esp, 8
mov edi, eax
mov byte [esp + 0x338], 7
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x457f7f
mov ecx, dword [eax + 4]
push ecx
push edi
call fcn.0040e950
mov edi, dword [edi]
push edi
push str.CLEAN:_Processing_file:__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], bl
lea ecx, [esp + 0x78]
call fcn.0040ca90
test byte [esp + 0xd4], 0x10
je 0x458208
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [ebp + 0x28]
push eax
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
inc edx
push edx
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
push esi
push ecx
push edx
lea eax, [esp + 0x44]
push eax
call fcn.00457cf0
add esp, 0x30
cmp byte [ebp + 0x24], 0
je 0x458a3d
cmp dword [0x65236c], 1
jl 0x45807f
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x1c]
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0x33c], 8
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x340], bl
call fcn.004060e0
add esp, 8
mov edi, eax
mov byte [esp + 0x338], 9
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x458055
mov ecx, dword [eax + 4]
push ecx
push edi
call fcn.0040e950
mov edi, dword [edi]
push edi
push str.CLEAN:_Processing_file:_directory__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], bl
lea ecx, [esp + 0x80]
call fcn.0040ca90
cmp byte [esp + 0x17], 0
je 0x458a3d
mov ecx, dword [esp + 0x18]
mov edi, ecx
call fcn.004296f0
cmp eax, 0xffffffff
je 0x4580aa
test al, 6
je 0x4580aa
and eax, 0xfffffff8
mov ecx, eax
mov edx, edi
call fcn.004297a0
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x104]
call fcn.004026a0
mov byte [esp + 0x338], 0xa
push str.__r_n_t_v
lea eax, [esp + 0x3c]
call fcn.004642a0
mov ebx, eax
mov eax, str.__r_n_t_v
call fcn.00464300
mov eax, dword [esp + 0x38]
mov ebx, dword [eax - 0xc]
test ebx, ebx
je 0x4580f9
lea edi, [esp + 0x38]
call fcn.00451c90
cmp eax, ebx
jne 0x4581f7
cmp dword [0x65236c], 1
jl 0x458170
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
lea edx, [esp + 0x1c]
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0x33c], 0xb
lea eax, [esp + 0x90]
mov bl, 0xa
push eax
mov byte [esp + 0x340], bl
call fcn.004060e0
add esp, 8
mov byte [esp + 0x338], 0xc
mov esi, eax
call fcn.0040cb30
push eax
push str.CLEAN:_renaming_file__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], bl
lea ecx, [esp + 0x8c]
call fcn.0040ca90
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0xa0]
push ecx
call fcn.00452220
mov byte [esp + 0x338], 0xd
lea eax, [esp + 0x18]
lea edi, [esp + 0xa0]
call fcn.0040e9d0
mov edx, dword [esp + 0x4c]
push edx
lea eax, [esp + 0x70]
push eax
mov ebx, str.DATA_RESTORED
call fcn.0042b340
add esp, 8
mov byte [esp + 0x338], 0xe
lea edi, [esp + 0xa4]
call fcn.0040e9d0
mov byte [esp + 0x338], 0xd
lea ecx, [esp + 0x6c]
call fcn.00402750
mov edi, dword [esp + 0x50]
lea ecx, [esp + 0xa0]
push ecx
call fcn.00463dc0
mov byte [esp + 0x338], 0xa
lea edx, [esp + 0xa0]
push edx
call fcn.00458ab0
mov byte [esp + 0x338], 5
lea ecx, [esp + 0x38]
jmp 0x458a38
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x33c], 0xf
mov byte [esp + 0x33c], bl
call fcn.00461090
test al, al
jne 0x458a3d
cmp byte [ebp + 0x10], al
je 0x45826e
push ecx
mov edx, esp
mov dword [esp + 0x24], esp
lea eax, [esp + 0x1c]
push eax
push edx
call fcn.0040cbb0
mov byte [esp + 0x33c], 0x10
mov ecx, dword [0x66b064]
add ecx, 0xc0
push ecx
mov byte [esp + 0x340], bl
call fcn.0046c070
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x66ade4]
push 0x66b07c
call edi
mov edx, dword [0x66b07c]
push edx
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push eax
mov ecx, str.ManualScanned
call fcn.004026a0
mov byte [esp + 0x340], 0x11
mov byte [esp + 0x340], bl
call fcn.004302e0
mov ecx, dword [esp + 0xf4]
mov edx, dword [esp + 0xf0]
lea eax, [esp + 0x24]
mov dword [esp + 0x40], 0
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edx
call fcn.0040cb50
mov byte [esp + 0x338], 0x12
mov ecx, dword [esp + 0x18]
push 0
push ecx
lea edx, [esp + 0x50]
push edx
call fcn.00457890
add esp, 0xc
mov byte [esp + 0x338], 0x13
mov eax, dword [esp + 0x48]
cmp dword [eax - 0xc], 0
jne 0x458947
cmp byte [ebp + 0x24], 0
je 0x458947
cmp byte [esp + 0x17], 0
je 0x458947
mov ebx, 1
add dword [0x66ade4], ebx
push 0x66b07c
call edi
mov ecx, dword [0x66b07c]
push ecx
push ecx
mov edx, esp
mov dword [esp + 0x28], esp
push edx
mov ecx, str.ManualScanned
call fcn.004026a0
mov byte [esp + 0x340], 0x14
mov byte [esp + 0x340], 0x13
call fcn.004302e0
mov esi, dword [esp + 0x18]
call fcn.004296d0
cmp dword [ebp + 0x28], 0
jne 0x458435
push ecx
mov eax, esp
mov dword [esp + 0x24], esp
push eax
mov ecx, str..lnk
call fcn.004026a0
mov byte [esp + 0x33c], 0x15
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.0040cbb0
mov byte [esp + 0x340], 0x16
mov byte [esp + 0x340], 0x13
call fcn.004291b0
add esp, 8
test al, al
je 0x458435
cmp dword [0x65236c], ebx
jl 0x458427
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x33c], 0x17
lea edx, [esp + 0x64]
push edx
mov byte [esp + 0x340], 0x13
call fcn.004060e0
add esp, 8
mov byte [esp + 0x338], 0x18
mov esi, eax
call fcn.0040cb30
push eax
push str.CLEAN:_Processing_file:_removing_root__s
push str.ScanFolder
push ebx
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], 0x13
lea ecx, [esp + 0x60]
call fcn.0040ca90
mov edx, str.Lnk.Suspicious.Reputation
lea edi, [esp + 0x24]
call fcn.004027b0
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
xor edi, edi
mov byte [esp + 0x17], 0
cmp ebx, edi
jb 0x45845d
ja 0x458452
cmp esi, 0x10000
jbe 0x45845d
mov eax, 0x10000
mov dword [esp + 0x30], edi
jmp 0x458463
mov eax, esi
mov dword [esp + 0x30], ebx
push eax
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0046d170
add esp, 0xc
mov byte [esp + 0x338], 0x19
lea eax, [esp + 0x28]
call fcn.004317a0
test al, al
je 0x458543
cmp ebx, edi
jb 0x4584a8
ja 0x45849d
cmp esi, 0x10000
jbe 0x4584a8
mov esi, 0x10000
mov dword [esp + 0x30], edi
jmp 0x4584ac
mov dword [esp + 0x30], ebx
lea edx, [esp + 0x7c]
push edx
mov ecx, 0x632fb8
call fcn.004026a0
mov byte [esp + 0x338], 0x1a
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x8c]
push edx
mov ebx, eax
call fcn.0042b2a0
mov byte [esp + 0x340], 0x1b
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x84]
push eax
call fcn.0046d170
add esp, 0x14
mov byte [esp + 0x338], 0x1c
push eax
lea ebx, [esp + 0x2c]
call fcn.004635e0
mov byte [esp + 0x338], 0x1b
lea ebx, [esp + 0x74]
call fcn.00431770
mov byte [esp + 0x338], 0x1a
lea ecx, [esp + 0x88]
call fcn.00402750
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0x7c]
call fcn.00402750
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x28]
call fcn.004317a0
test al, al
jne 0x4585d6
lea eax, [esp + 0x28]
lea edi, [esp + 0x94]
call fcn.0046ec20
cmp dword [esp + 0x94], 0xd
jne 0x458573
mov byte [esp + 0x17], 1
lea eax, [esp + 0x28]
call fcn.004317a0
test al, al
jne 0x4585d6
lea ecx, [esp + 0x34]
push ecx
call fcn.0040c980
mov byte [esp + 0x338], 0x1d
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x1c]
push ebx
push esi
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0x9c]
push eax
call fcn.0046f4d0
add esp, 0x1c
lea ecx, [esp + 0x84]
push ecx
call fcn.00431660
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0x34]
call fcn.0040ca90
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x458692
mov esi, dword [esp + 0x5c]
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jl 0x458692
push ecx
push eax
call fcn.0050006e
add esp, 8
test eax, eax
je 0x458692
sub eax, dword [esi]
sar eax, 1
cmp eax, 0xffffffff
je 0x458692
cmp dword [0x65236c], 1
jl 0x458684
push ecx
mov edx, esp
mov dword [esp + 0x30], esp
lea eax, [esp + 0x1c]
push eax
push edx
call fcn.0040cbb0
mov byte [esp + 0x33c], 0x1e
lea ecx, [esp + 0xa0]
push ecx
mov byte [esp + 0x340], 0x19
call fcn.004060e0
add esp, 8
mov byte [esp + 0x338], 0x1f
mov esi, eax
call fcn.0040cb30
push eax
push str.CLEAN:_Processing_file:_removing_related__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0x9c]
call fcn.0040ca90
mov edx, str.Lnk.Suspicious.Reputation
lea edi, [esp + 0x24]
call fcn.004027b0
lea eax, [esp + 0x1c]
call fcn.00451a10
test al, al
je 0x458724
cmp dword [0x65236c], 1
jl 0x458716
push ecx
mov edx, esp
mov dword [esp + 0x30], esp
lea eax, [esp + 0x1c]
push eax
push edx
call fcn.0040cbb0
mov byte [esp + 0x33c], 0x20
lea ecx, [esp + 0x94]
push ecx
mov byte [esp + 0x340], 0x19
call fcn.004060e0
add esp, 8
mov byte [esp + 0x338], 0x21
mov esi, eax
call fcn.0040cb30
push eax
push str.CLEAN:_Processing_file:_removing_by_mask__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0x90]
call fcn.0040ca90
mov edx, str.Lnk.Suspicious.Reputation
lea edi, [esp + 0x24]
call fcn.004027b0
cmp byte [esp + 0x17], 0
je 0x4588ec
push 0
push 0
push 0x66b09c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
jne 0x4588ec
test byte [esp + 0xd4], 2
jne 0x458839
push ecx
mov edx, esp
mov dword [esp + 0x30], esp
push edx
mov ecx, str..exe
call fcn.004026a0
mov byte [esp + 0x33c], 0x22
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x340], 0x23
mov byte [esp + 0x340], 0x19
call fcn.00425bd0
add esp, 8
test al, al
jne 0x4588ec
push ecx
mov edx, esp
mov dword [esp + 0x30], esp
push edx
mov ecx, str..sys
call fcn.004026a0
mov byte [esp + 0x33c], 0x24
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x340], 0x25
mov byte [esp + 0x340], 0x19
call fcn.00425bd0
add esp, 8
test al, al
jne 0x4588ec
push ecx
mov edx, esp
mov dword [esp + 0x30], esp
push edx
mov ecx, str..dll
call fcn.004026a0
mov byte [esp + 0x33c], 0x26
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x340], 0x27
mov byte [esp + 0x340], 0x19
call fcn.00425bd0
add esp, 8
test al, al
jne 0x4588ec
mov edx, dword [esp + 0x1c]
push 0x2e
push edx
call fcn.004fed59
add esp, 8
test eax, eax
je 0x458871
mov ecx, dword [esp + 0x1c]
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x458871
mov ecx, dword [ecx - 0xc]
add ecx, 0xfffffffb
cmp eax, ecx
jl 0x458871
test byte [esp + 0xd4], 6
je 0x4588ec
cmp dword [0x65236c], 1
jl 0x4588de
push ecx
mov eax, esp
mov dword [esp + 0x30], esp
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0040cbb0
mov byte [esp + 0x33c], 0x28
lea edx, [esp + 0x68]
push edx
mov byte [esp + 0x340], 0x19
call fcn.004060e0
add esp, 8
mov byte [esp + 0x338], 0x29
mov esi, eax
call fcn.0040cb30
push eax
push str.Suspicous_executable_file__s
push str.ScanFolder
push 1
call fcn.004fa3c2
add esp, 0x10
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0x64]
call fcn.0040ca90
mov edx, str.Lnk.Hidden.PE
lea edi, [esp + 0x24]
call fcn.004027b0
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
je 0x458930
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + 0xd0]
push eax
call fcn.00452290
mov byte [esp + 0x338], 0x2a
mov edi, dword [esp + 0x58]
mov ebx, eax
call fcn.00463c00
mov byte [esp + 0x338], 0x19
lea ecx, [esp + 0xcc]
push ecx
call fcn.00458ab0
mov byte [esp + 0x338], 0x13
lea ebx, [esp + 0x28]
call fcn.00431770
mov esi, dword [esp + 0x54]
mov bl, 5
mov edx, dword [esp + 0x48]
cmp dword [edx - 0xc], 0
jne 0x45895f
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], 0
jne 0x45895f
xor al, al
jmp 0x458964
mov eax, 1
push eax
call fcn.00452810
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0xf4]
add esp, 4
add dword [esi], eax
adc dword [esi + 4], ecx
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [esp + 0xac], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0xb0], eax
mov eax, dword [ebp + 0x18]
fild qword [esp + 0xac]
and ecx, 0x80000000
xor edx, edx
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xc4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xbc], edx
fild qword [esp + 0xbc]
mov ecx, eax
and eax, 0x7fffffff
and ecx, 0x80000000
fchs
mov dword [esp + 0xc8], eax
faddp st(1)
mov dword [esp + 0xb8], ecx
fild qword [esp + 0xc4]
mov dword [esp + 0xb4], edx
fild qword [esp + 0xb4]
fchs
faddp st(1)
fdivp st(1)
fmul qword [0x638dc0]
call fcn.005027f0
push eax
push 0x6563f8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [esp + 0x338], 0x12
lea ecx, [esp + 0x48]
call fcn.0040ca90
mov byte [esp + 0x338], bl
lea ecx, [esp + 0x24]
call fcn.00402750
mov byte [esp + 0x338], 4
lea ecx, [esp + 0x1c]
call fcn.00402750
mov dword [esp + 0x338], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00402750
mov ebx, dword [esp + 0x68]
lea ecx, [esp + 0xd4]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x457df0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x330]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x318]
xor ecx, esp
call fcn.004fdb4a
mov esp, ebp
pop ebp
ret