Function at 0x411aa0
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data using crc32b
Terminate process

Disassembly:
sub esp, 0x828
mov eax, dword [0x6621f4]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0x34]
xor esi, esi
push edi
push esi
mov edx, dword [ecx + 0x3c]
mov dword [esp + 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x411dc8
push 0x645764
push str.IDR_RCP
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x411dc8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
mov dword [esp + 0x20], edi
je 0x411dbd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x411dbd
mov eax, dword [ebp]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x18], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x10], 0x6c7000
mov dword [esp + 0x14], eax
mov ebx, section..idr_dt
push eax
push section..idr
push section..idr_dt
call fcn.0060a650
add esp, 0xc
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, edx
jne 0x411de7
mov dword [esp + 0x1c], ebx
xor edi, edi
lea eax, [esp + 0x38]
mov edx, edi
xor esi, esi
mov ecx, 7
test dl, 1
je 0x411c80
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x411c72
shl esi, 0x18
mov dword [eax], esi
mov ecx, 8
mov edx, dword [eax]
mov esi, dword [eax]
and edx, 0x80000000
neg edx
sbb edx, edx
add esi, esi
and edx, 0x4c11db7
xor edx, esi
dec ecx
mov dword [eax], edx
jne 0x411c92
mov edx, dword [eax]
xor esi, esi
mov ecx, 0x1f
test dl, 1
je 0x411cc6
mov ebp, 1
shl ebp, cl
or esi, ebp
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x411cb8
mov dword [eax], esi
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x411c69
xor edx, edx
xor eax, eax
mov ecx, 0x1f
test dl, 1
je 0x411cf3
mov esi, 1
shl esi, cl
or eax, esi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x411ce5
not eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
not eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x411d3c
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dl, byte [esi]
and ecx, 0xff
xor ecx, edx
mov ecx, dword [esp + ecx*4 + 0x38]
mov edx, dword [esp + 0x10]
shr edx, 8
xor ecx, edx
inc esi
dec eax
mov dword [esp + 0x10], ecx
jne 0x411d17
mov ecx, dword [0x649bd8]
mov esi, dword [esp + 0x10]
xor eax, eax
test ecx, ecx
not esi
jle 0x411d6e
mov ecx, dword [eax*4 + 0x6478b0]
xor ecx, 0x6920
add ecx, ebx
mov edi, dword [ecx]
add edi, ebx
inc eax
mov dword [ecx], edi
mov ecx, dword [0x649bd8]
cmp eax, ecx
jl 0x411d4e
mov ecx, dword [0x649bd4]
xor eax, eax
test ecx, ecx
jle 0x411d9c
mov edx, dword [eax*8 + 0x647618]
mov ecx, dword [eax*8 + 0x64761c]
xor edx, 0x6920
inc eax
mov dword [edx + ebx], ecx
mov ecx, dword [0x649bd4]
cmp eax, ecx
jl 0x411d7a
mov edx, dword [0x647604]
push 0
xor edx, 0x6920
push 1
push 0
add edx, ebx
call edx
lea esi, [ebx]
nop
nop
nop
nop
nop
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
jne 0x411dfb
push 0
push str.Error
push str.An_installation_Error_occured_:_Module_50279
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0060a26d
mov ebx, dword [esp + 0x10]
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
jmp 0x411db9
mov eax, dword [0x647614]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
jne 0x4122cc
mov ecx, dword [0x6475c4]
lea eax, [esp + 0x38]
xor ecx, 0x38cc
add ecx, esi
xor edi, edi
mov edx, edi
shl edx, 8
mov dword [eax], edx
mov edx, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edx
mov dword [eax], ebx
jne 0x411e32
inc edi
add eax, 4
cmp edi, 0xff
jbe 0x411e26
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x411ec1
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x411ebc
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xf8
cmp ebx, edi
jae 0x411ec1
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x411e74
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x38]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x411ec3
xor edx, edx
test eax, eax
jbe 0x411f3c
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x411f37
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xf8
cmp edi, eax
jae 0x411f3c
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x411ef0
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
push 0x9eb13c2e
push 0x4ca11b
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
cmp eax, 1
sete bl
test bl, bl
jne 0x412158
mov eax, 3
jmp 0x411f80
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x41214b
mov eax, dword [esp + 0x34]
push 0x3f800000
push 0
push 3
mov ecx, dword [eax + 8]
push 3
push 0x400000c8
mov edx, dword [ecx]
call dword [edx + 0x74]
cmp eax, 3
mov dword [esp + 0x20], eax
jne 0x412142
mov eax, dword [0x6475e0]
mov ecx, dword [0x6475c4]
xor eax, 0x38cc
xor ecx, 0x38cc
add eax, esi
add ecx, esi
mov dword [esp + 0x1c], eax
xor edx, edx
lea eax, [esp + 0x38]
mov edi, edx
shl edi, 8
mov dword [eax], edi
mov edi, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edi
mov dword [eax], ebx
jne 0x411fe2
inc edx
add eax, 4
cmp edx, 0xff
jbe 0x411fd6
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x412071
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x41206c
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xf8
cmp ebx, edi
jae 0x412071
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x412024
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x38]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x412073
xor edx, edx
test eax, eax
jbe 0x4120ec
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x4120e7
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xf8
cmp edi, eax
jae 0x4120ec
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x4120a0
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
lea edi, [edx]
nop
nop
nop
nop
nop
call dword [esp + 0x1c]
push 0x9eb13c2e
push 0x4ca11b
call edi
cmp eax, 1
sete bl
cmp bl, 1
jne 0x411f7c
mov eax, dword [0x6475e4]
xor eax, 0x38cc
add eax, esi
call eax
cmp eax, 1
mov eax, dword [esp + 0x20]
sete bl
cmp bl, 1
jne 0x411f80
test bl, bl
jne 0x412158
cmp eax, 1
je 0x412616
mov eax, dword [0x6475e4]
mov ecx, dword [0x6475d8]
xor eax, 0x38cc
xor ecx, 0x38cc
add eax, esi
add ecx, esi
mov dword [esp + 0x1c], eax
xor edx, edx
lea eax, [esp + 0x38]
mov edi, edx
shl edi, 8
mov dword [eax], edi
mov edi, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edi
mov dword [eax], ebx
jne 0x412188
inc edx
add eax, 4
cmp edx, 0xff
jbe 0x41217c
mov eax, dword [0x649bd8]
mov edx, ecx
xor ebp, ebp
sub edx, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], edx
xor edx, edx
cmp eax, ebp
jbe 0x412217
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x412212
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xaee
cmp ebx, edi
jae 0x412217
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x4121ca
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x38]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xaee
jb 0x412219
xor edx, edx
test eax, eax
jbe 0x412292
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x41228d
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xaee
cmp edi, eax
jae 0x412292
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x412246
mov eax, dword [0x6475d8]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
call dword [esp + 0x1c]
cmp eax, 1
sete bl
test bl, bl
jne 0x412623
mov eax, 3
jmp 0x4122eb
push 0
push str.Error
push str.An_installation_Error_occured_during_Init:_Module_50279
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.0060a26d
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x41260d
mov eax, dword [esp + 0x34]
push 0x3f800000
push 0
push 3
mov ecx, dword [eax + 8]
push 3
push 0x400000c9
mov edx, dword [ecx]
call dword [edx + 0x74]
cmp eax, 3
mov dword [esp + 0x20], eax
jne 0x412604
mov eax, dword [0x6475e0]
mov ecx, dword [0x6475c4]
xor eax, 0x38cc
xor ecx, 0x38cc
add eax, esi
add ecx, esi
mov dword [esp + 0x1c], eax
xor edx, edx
lea eax, [esp + 0x38]
mov edi, edx
shl edi, 8
mov dword [eax], edi
mov edi, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edi
mov dword [eax], ebx
jne 0x41234d
inc edx
add eax, 4
cmp edx, 0xff
jbe 0x412341
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x4123dc
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x4123d7
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xf8
cmp ebx, edi
jae 0x4123dc
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x41238f
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x38]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xf8
jb 0x4123de
xor edx, edx
test eax, eax
jbe 0x412457
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x412452
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xf8
cmp edi, eax
jae 0x412457
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x41240b
mov eax, dword [0x6475c4]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
lea edi, [edx]
nop
nop
nop
nop
nop
call dword [esp + 0x1c]
push 0x9eb13c2e
push 0x4ca11b
call edi
cmp eax, 1
sete bl
cmp bl, 1
jne 0x4122e7
mov eax, dword [0x6475e4]
mov ecx, dword [0x6475d8]
xor eax, 0x38cc
xor ecx, 0x38cc
add eax, esi
add ecx, esi
mov dword [esp + 0x1c], eax
xor edx, edx
lea eax, [esp + 0x438]
mov edi, edx
shl edi, 8
mov dword [eax], edi
mov edi, 8
mov ebx, dword [eax]
mov ebp, dword [eax]
and ebx, 0x8000
neg ebx
sbb ebx, ebx
add ebp, ebp
and ebx, 0x1021
xor ebx, ebp
dec edi
mov dword [eax], ebx
jne 0x4124c8
inc edx
add eax, 4
cmp edx, 0xff
jbe 0x4124bc
mov eax, ecx
xor ebp, ebp
sub eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov eax, dword [0x649bd8]
xor edx, edx
cmp eax, ebp
jbe 0x412557
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x412552
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
add edi, 0xaee
cmp ebx, edi
jae 0x412557
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
sub edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x41250a
mov edi, ecx
xor edx, edx
xor ebx, ebx
mov dl, byte [esp + 0x19]
mov bl, byte [edi]
xor edx, ebx
mov edx, dword [esp + edx*4 + 0x438]
mov ebx, dword [esp + 0x18]
shl ebx, 8
xor edx, ebx
inc edi
inc ebp
mov dword [esp + 0x18], edx
cmp ebp, 0xaee
jb 0x412559
xor edx, edx
test eax, eax
jbe 0x4125d5
mov edi, dword [edx*4 + 0x6478b0]
xor edi, 0x6920
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, ebx
jb 0x4125d0
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
add eax, 0xaee
cmp edi, eax
jae 0x4125d5
mov eax, dword [esp + 0x14]
mov edi, ecx
sub edi, eax
mov eax, dword [esp + 0x10]
add eax, edi
mov edi, dword [eax]
add edi, esi
mov dword [eax], edi
mov eax, dword [0x649bd8]
inc edx
cmp edx, eax
jb 0x412589
mov eax, dword [0x6475d8]
mov ecx, dword [esp + 0x18]
xor eax, 0x38cc
mov edx, esi
and ecx, 0xffff
add edx, eax
lea eax, [edx]
nop
nop
nop
nop
nop
call eax
call dword [esp + 0x1c]
cmp eax, 1
mov eax, dword [esp + 0x20]
sete bl
cmp bl, 1
jne 0x4122eb
test bl, bl
jne 0x412623
cmp eax, 1
jne 0x412623
mov eax, dword [0x6621f4]
mov ecx, dword [eax + 0x30]
call fcn.00409cd0
mov ecx, dword [0x647604]
push 0
xor ecx, 0x6920
push 0
add ecx, esi
push 0
call ecx
push esi
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x828
ret