Function at 0x435794
Capabilities:
Print debug messages

Disassembly:
push 0x75c
mov eax, 0x55bf86
call fcn.004ee073
mov edi, ecx
mov dword [ebp - 0x70c], edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6f4], esi
mov dword [ebp - 0x72c], ebx
mov dword [ebp - 0x728], ebx
mov dword [ebp - 0x724], ebx
mov dword [ebp - 0x720], ebx
push eax
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 4], ebx
call fcn.0040fe60
lea eax, [ebp - 0x72c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x6ec]
push eax
call fcn.00421754
cmp eax, 2
pop ecx
pop ecx
setne byte [ebp - 0x6e5]
mov ecx, dword [ebp - 0x6ec]
add ecx, 0xfffffff4
mov byte [ebp - 4], 2
cmp ecx, dword [section..data]
je 0x43581d
call fcn.0040d510
cmp byte [ebp - 0x6e5], 0
mov byte [ebp - 4], bl
je 0x435956
mov ecx, dword [0x5cdaa0]
test ecx, ecx
je 0x435844
call fcn.004247c8
mov dword [ebp - 0x6ec], eax
jmp 0x43584a
mov dword [ebp - 0x6ec], ebx
push 0x2800
call fcn.0051367e
mov dword [ebp - 0x6e0], eax
mov dword [esp], 0x5000
call fcn.0051367e
mov dword [esp], str.warning_____Add_ResProvider_Error.
push 0xffffffffffffffff
push 0x2800
push eax
mov dword [ebp - 0x6e4], eax
call fcn.0042fe78
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x6e4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x4358b7
push ebx
push ebx
push eax
push dword [ebp - 0x6e0]
push 0xffffffffffffffff
push dword [ebp - 0x6e4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x6e4]
call fcn.00508cb9
pop ecx
mov ecx, dword [ebp - 0x6ec]
test ecx, ecx
je 0x435903
mov eax, dword [ecx]
push 1
push ebx
call dword [eax + 0x2c]
test al, al
je 0x435903
push dword [ebp + 4]
mov ecx, dword [ebp - 0x6ec]
push str.SOUI::SUiDefInfo::Init
push 0x55
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push dword [ebp - 0x6e0]
mov eax, dword [ecx]
push str.soui
push 1
push ebx
call dword [eax + 0x34]
jmp 0x43594a
push 0x2800
call fcn.0051367e
push 0x55
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push str.SOUI::SUiDefInfo::Init
push dword [ebp - 0x6e0]
mov esi, eax
push str._s__s__s:_d_n
push 0xffffffffffffffff
push 0x2800
push esi
call fcn.0042fe59
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00508cb9
mov esi, dword [ebp - 0x6f4]
pop ecx
push dword [ebp - 0x6e0]
call fcn.00508cb9
pop ecx
mov ecx, dword [ebp - 0x72c]
mov eax, dword [esi]
push dword [ecx + 4]
push dword [ecx]
mov ecx, esi
call dword [eax + 0x28]
mov dword [ebp - 0x6f0], eax
test eax, eax
jne 0x435a86
mov ecx, dword [0x5cdaa0]
test ecx, ecx
je 0x435989
call fcn.004247c8
mov edi, eax
jmp 0x43598b
mov edi, ebx
push 0x2800
call fcn.0051367e
mov dword [ebp - 0x6e0], eax
mov dword [esp], 0x5000
call fcn.0051367e
mov dword [esp], str.warning_____uidef_was_not_found_in_the_specified_resprovider
mov esi, eax
push 0xffffffffffffffff
push 0x2800
push esi
mov dword [ebp - 0x6f4], esi
call fcn.0042fe78
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
cmp eax, 0x2800
jae 0x4359f3
push ebx
push ebx
push eax
push dword [ebp - 0x6e0]
push 0xffffffffffffffff
push dword [ebp - 0x6f4]
push ebx
push ebx
call esi
push dword [ebp - 0x6f4]
call fcn.00508cb9
pop ecx
test edi, edi
je 0x435a37
mov eax, dword [edi]
mov ecx, edi
push 1
push ebx
call dword [eax + 0x2c]
test al, al
je 0x435a37
push dword [ebp + 4]
mov eax, dword [edi]
mov ecx, edi
push str.SOUI::SUiDefInfo::Init
push 0x5b
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push dword [ebp - 0x6e0]
push str.soui
push 1
push ebx
call dword [eax + 0x34]
jmp 0x435a75
mov edi, 0x2800
push edi
call fcn.0051367e
push 0x5b
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push str.SOUI::SUiDefInfo::Init
push dword [ebp - 0x6e0]
mov esi, eax
push str._s__s__s:_d_n
push 0xffffffffffffffff
push edi
push esi
call fcn.0042fe59
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00508cb9
pop ecx
push dword [ebp - 0x6e0]
call fcn.00508cb9
pop ecx
jmp 0x436418
lea ecx, [ebp - 0x164]
call fcn.0052ed15
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x6f0]
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 4
call fcn.0041fc5e
push dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x72c]
push dword [ebp - 0x9c]
mov eax, dword [esi]
push dword [ecx + 4]
push dword [ecx]
mov ecx, esi
call dword [eax + 0x2c]
push 1
push 0x74
push dword [ebp - 0x18]
lea eax, [ebp - 0x768]
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x164]
push eax
call fcn.0052ffe8
lea ecx, [ebp - 0x768]
call fcn.0052ed9a
test al, al
jne 0x435c0c
mov ecx, dword [0x5cdaa0]
test ecx, ecx
je 0x435b15
call fcn.004247c8
mov edi, eax
jmp 0x435b17
mov edi, ebx
push 0x2800
call fcn.0051367e
mov dword [ebp - 0x6e0], eax
mov dword [esp], 0x5000
call fcn.0051367e
mov dword [esp], str.warning____load_uidef_as_xml_document_failed
mov esi, eax
push 0xffffffffffffffff
push 0x2800
push esi
mov dword [ebp - 0x6f0], esi
call fcn.0042fe78
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
cmp eax, 0x2800
jae 0x435b7f
push ebx
push ebx
push eax
push dword [ebp - 0x6e0]
push 0xffffffffffffffff
push dword [ebp - 0x6f0]
push ebx
push ebx
call esi
push dword [ebp - 0x6f0]
call fcn.00508cb9
pop ecx
test edi, edi
je 0x435bc3
mov eax, dword [edi]
mov ecx, edi
push 1
push ebx
call dword [eax + 0x2c]
test al, al
je 0x435bc3
push dword [ebp + 4]
mov eax, dword [edi]
mov ecx, edi
push str.SOUI::SUiDefInfo::Init
push 0x68
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push dword [ebp - 0x6e0]
push str.soui
push 1
push ebx
call dword [eax + 0x34]
jmp 0x435c01
mov edi, 0x2800
push edi
call fcn.0051367e
push 0x68
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push str.SOUI::SUiDefInfo::Init
push dword [ebp - 0x6e0]
mov esi, eax
push str._s__s__s:_d_n
push 0xffffffffffffffff
push edi
push esi
call fcn.0042fe59
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00508cb9
pop ecx
push dword [ebp - 0x6e0]
jmp 0x435d3c
push ebx
push str.uidef
lea eax, [ebp - 0x6e0]
push eax
lea ecx, [ebp - 0x164]
call fcn.0052f1f7
lea ecx, [ebp - 0x6e0]
call fcn.0052ed9a
test al, al
je 0x435d47
mov ecx, dword [0x5cdaa0]
test ecx, ecx
je 0x435c4a
call fcn.004247c8
mov edi, eax
jmp 0x435c4c
mov edi, ebx
push 0x2800
call fcn.0051367e
mov dword [ebp - 0x6e4], eax
mov dword [esp], 0x5000
call fcn.0051367e
mov dword [esp], str.warning_____uidef__element_is_not_the_root_element_of_uidef_xml
mov esi, eax
push 0xffffffffffffffff
push 0x2800
push esi
mov dword [ebp - 0x6f0], esi
call fcn.0042fe78
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
call esi
cmp eax, 0x2800
jae 0x435cb4
push ebx
push ebx
push eax
push dword [ebp - 0x6e4]
push 0xffffffffffffffff
push dword [ebp - 0x6f0]
push ebx
push ebx
call esi
push dword [ebp - 0x6f0]
call fcn.00508cb9
pop ecx
test edi, edi
je 0x435cf8
mov eax, dword [edi]
mov ecx, edi
push 1
push ebx
call dword [eax + 0x2c]
test al, al
je 0x435cf8
push dword [ebp + 4]
mov eax, dword [edi]
mov ecx, edi
push str.SOUI::SUiDefInfo::Init
push 0x6e
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push dword [ebp - 0x6e4]
push str.soui
push 1
push ebx
call dword [eax + 0x34]
jmp 0x435d36
mov edi, 0x2800
push edi
call fcn.0051367e
push 0x6e
push str.H:w4playonekeyfun_souiSOUI_src_res.mgrSUiDef.cpp
push str.SOUI::SUiDefInfo::Init
push dword [ebp - 0x6e4]
mov esi, eax
push str._s__s__s:_d_n
push 0xffffffffffffffff
push edi
push esi
call fcn.0042fe59
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.00508cb9
pop ecx
push dword [ebp - 0x6e4]
call fcn.00508cb9
pop ecx
jmp 0x436402
lea ecx, [ebp - 0x6e4]
call fcn.00422648
push ebx
push 0x56b888
lea eax, [ebp - 0x758]
push eax
lea ecx, [ebp - 0x6e0]
call fcn.0052f1f7
lea ecx, [ebp - 0x6e4]
mov eax, dword [eax]
mov dword [ebp - 0x6e4], eax
call fcn.0052edd0
test eax, eax
je 0x4361c2
push 0xc
push ebx
push 0x567f5c
lea eax, [ebp - 0x754]
push eax
lea ecx, [ebp - 0x6e4]
call fcn.0052f186
mov ecx, eax
call fcn.0052f121
push 1
push ebx
mov esi, eax
lea ecx, [ebp - 0x6e4]
push 0x56bb18
lea eax, [ebp - 0x750]
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f121
push ebx
push ebx
mov dword [ebp - 0x6f0], eax
lea ecx, [ebp - 0x6e4]
push 0x56bb28
lea eax, [ebp - 0x75c]
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f101
push ebx
push ebx
mov byte [ebp - 0x6e5], al
lea ecx, [ebp - 0x6e4]
push 0x56bb34
lea eax, [ebp - 0x734]
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f101
push ebx
push ebx
mov byte [ebp - 0x6f5], al
lea ecx, [ebp - 0x6e4]
push 0x56bb48
lea eax, [ebp - 0x738]
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f101
xor edi, edi
lea ecx, [ebp - 0x6e4]
push edi
push edi
mov bh, al
lea eax, [ebp - 0x73c]
push 0x56bb58
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f101
push edi
push edi
mov bl, al
lea ecx, [ebp - 0x6e4]
push 0x56bb68
lea eax, [ebp - 0x740]
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f15f
add esi, esi
movzx ecx, bh
or esi, ecx
mov edx, eax
movzx ecx, byte [ebp - 0x6e5]
add esi, esi
or esi, ecx
movzx ecx, byte [ebp - 0x6f5]
add esi, esi
or esi, ecx
add esi, esi
movzx eax, bl
lea ecx, [ebp - 0x6e4]
or esi, eax
xor ebx, ebx
lea eax, [edx + 2]
shl esi, 0x10
shl eax, 6
and eax, 0xff00
or esi, eax
mov eax, dword [ebp - 0x6f0]
push str.default
movzx eax, al
push ebx
or esi, eax
lea eax, [ebp - 0x744]
push str.name
push eax
call fcn.0052f186
mov ecx, eax
call fcn.0052f148
mov edi, dword [ebp - 0x70c]
push eax
lea ecx, [edi + 0x54]
call fcn.0040fcd0
push ebx
push str.face
lea eax, [ebp - 0x748]
mov dword [edi + 0x58], esi
push eax
lea ecx, [ebp - 0x6e4]
call fcn.0052f186
mov ecx, eax
call fcn.0053032d
push eax
lea ecx, [ebp - 0x710]
call fcn.0040fe60
push ebx
lea eax, [ebp - 0x710]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x730]
push eax
call fcn.0041efdc
add esp, 0xc
lea esi, [edi + 0x5c]
mov byte [ebp - 4], 6
push eax
mov ecx, esi
call fcn.0040fd50
mov ecx, dword [ebp - 0x730]
mov edx, dword [section..data]
add ecx, 0xfffffff4
mov byte [ebp - 4], 7
cmp ecx, edx
je 0x435f71
call fcn.0040d510
mov edx, dword [section..data]
mov ecx, dword [ebp - 0x710]
add ecx, 0xfffffff4
mov byte [ebp - 4], 8
cmp ecx, edx
je 0x435f87
call fcn.0040d510
mov eax, dword [esi]
mov byte [ebp - 4], 4
cmp dword [eax - 8], ebx
je 0x435f9e
push esi
call dword [0x5c5148]
pop ecx
test eax, eax
jne 0x435faa
push 0x56b840
mov ecx, esi
call fcn.0040fcd0
mov esi, dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6ec]
call fcn.00422648
push ebx
push str.unit
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x6e0]
call fcn.0052f1f7
lea ecx, [ebp - 0x6ec]
mov eax, dword [eax]
mov dword [ebp - 0x6ec], eax
call fcn.0052edd0
test eax, eax
je 0x436049
push 0x56b6dc
push ebx
push str.defUnit
lea eax, [ebp - 0x708]
push eax
lea ecx, [ebp - 0x6ec]
call fcn.0052f186
mov ecx, eax
call fcn.0052f148
push eax
lea ecx, [ebp - 0x6f4]
call fcn.0040fe60
lea eax, [ebp - 0x6f4]
mov byte [ebp - 4], 9
push eax
call fcn.00434844
pop ecx
mov ecx, dword [ebp - 0x6f4]
add ecx, 0xfffffff4
mov byte [ebp - 4], 0xa
cmp ecx, dword [section..data]
je 0x436045
call fcn.0040d510
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6dc]
call fcn.0052ed15
push str.string
push esi
lea eax, [ebp - 0x6dc]
mov byte [ebp - 4], 0xb
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x714]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x714]
call fcn.0052edd0
test eax, eax
je 0x436096
push dword [ebp - 0x714]
lea ecx, [edi + 0x2c]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x6dc]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x614]
call fcn.0052ed15
push 0x56b7f0
push esi
lea eax, [ebp - 0x614]
mov byte [ebp - 4], 0xc
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x718]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x718]
call fcn.0052edd0
test eax, eax
je 0x4360f2
push dword [ebp - 0x718]
lea ecx, [edi + 0x18]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x614]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x54c]
call fcn.0052ed15
push 0x56b7fc
push esi
lea eax, [ebp - 0x54c]
mov byte [ebp - 4], 0xd
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x6fc]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x6fc]
call fcn.0052edd0
test eax, eax
je 0x43614e
push dword [ebp - 0x6fc]
lea ecx, [edi + 0x40]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x54c]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x484]
call fcn.0052ed15
push 0x56b804
push esi
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0xe
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x704]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x704]
call fcn.0052edd0
test eax, eax
je 0x436217
push 0x14
call fcn.004749cc
pop ecx
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0xf
test eax, eax
je 0x4361e8
mov ecx, eax
call fcn.0041f8a7
mov dword [ebp - 0x6fc], eax
jmp 0x4361ee
push str.default
lea ecx, [edi + 0x54]
call fcn.0040fcd0
push 0x56b840
lea ecx, [edi + 0x5c]
mov dword [edi + 0x58], 0xc00001
call fcn.0040fcd0
jmp 0x435fb0
mov dword [ebp - 0x6fc], ebx
mov ecx, dword [edi + 8]
mov byte [ebp - 4], 0xe
test ecx, ecx
je 0x436201
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x6fc]
mov ecx, eax
push dword [ebp - 0x704]
mov dword [edi + 8], eax
call fcn.0042013c
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x3bc]
call fcn.0052ed15
push str.style
push esi
lea eax, [ebp - 0x3bc]
mov byte [ebp - 4], 0x10
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x700]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x700]
call fcn.0052edd0
test eax, eax
je 0x4362bd
push 0xdc
call fcn.004749cc
pop ecx
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0x11
test eax, eax
je 0x43628e
mov ecx, eax
call fcn.0043065e
mov dword [ebp - 0x704], eax
jmp 0x436294
mov dword [ebp - 0x704], ebx
mov ecx, dword [edi + 0xc]
mov byte [ebp - 4], 0x10
test ecx, ecx
je 0x4362a7
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x704]
mov ecx, eax
push dword [ebp - 0x700]
mov dword [edi + 0xc], eax
call fcn.00437617
lea ecx, [ebp - 0x3bc]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x2f4]
call fcn.0052ed15
push str.template
push esi
lea eax, [ebp - 0x2f4]
mov byte [ebp - 4], 0x12
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x71c]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x71c]
call fcn.0052edd0
test eax, eax
je 0x436360
push 0x14
call fcn.004749cc
pop ecx
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0x13
test eax, eax
je 0x436331
mov ecx, eax
call fcn.004306b0
mov dword [ebp - 0x700], eax
jmp 0x436337
mov dword [ebp - 0x700], ebx
mov ecx, dword [edi + 0x14]
mov byte [ebp - 4], 0x12
test ecx, ecx
je 0x43634a
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x700]
mov ecx, eax
push dword [ebp - 0x71c]
mov dword [edi + 0x14], eax
call fcn.0043771c
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 4
call fcn.0052ed61
lea ecx, [ebp - 0x22c]
call fcn.0052ed15
push str.objattr
push esi
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 0x14
push eax
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x70c]
push eax
call fcn.004355a8
add esp, 0x14
lea ecx, [ebp - 0x70c]
call fcn.0052edd0
test eax, eax
je 0x4363f4
push 0xdc
call fcn.004749cc
pop ecx
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0x15
test eax, eax
je 0x4363d1
mov ecx, eax
call fcn.004350f2
mov ebx, eax
mov ecx, dword [edi + 0x10]
mov byte [ebp - 4], 0x14
test ecx, ecx
je 0x4363e4
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x70c]
mov ecx, ebx
mov dword [edi + 0x10], ebx
call fcn.0046bc28
lea ecx, [ebp - 0x22c]
call fcn.0052ed61
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x9c]
call fcn.0041fdab
lea ecx, [ebp - 0x164]
call fcn.0052ed61
push dword [ebp - 0x728]
mov esi, dword [ebp - 0x72c]
push esi
mov dword [ebp - 4], 0x16
call fcn.00420e96
push esi
call fcn.0041eff8
add esp, 0xc
mov eax, ebx
call fcn.004ee022
ret 8