Function at 0x42029e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
sub esp, 0x13c
lea ebp, [esp - 4]
mov eax, dword [0x592894]
xor eax, ebp
mov dword [ebp + 0x13c], eax
push 0x2d4
mov eax, 0x51e316
call fcn.0047b854
lea eax, [ebp - 0x18]
mov edi, 0x2710
push eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], edi
call fcn.00432974
mov ecx, eax
call fcn.00431f04
xor ebx, ebx
inc ebx
test al, al
je 0x4203d6
push ebx
push 3
lea ecx, [ebp - 0x1a0]
call fcn.0040ac7d
lea eax, [ebp - 0x198]
push str.begin_Installer::postflight__
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0040a99a
pop ecx
pop ecx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], edi
call fcn.00432974
mov ecx, eax
call fcn.00431f04
test al, al
je 0x4203c5
push str.bp::install::Installer::postflight
lea ecx, [ebp - 0x40]
call fcn.0040979d
push str........._srclibsinstallerlibInstaller_Windows.cpp
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], bl
call fcn.0040979d
push 0xbd
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], edi
call fcn.004095fe
mov edi, eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 3
call fcn.00409e20
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 4
call fcn.00432974
mov ecx, eax
call fcn.004322cc
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
lea ecx, [ebp - 0x118]
call fcn.004a73e9
push esi
push ebx
lea ecx, [ebp - 0x88]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a0]
call fcn.0040441f
jmp 0x4203d8
xor esi, esi
mov edi, dword [ebp - 0x24]
add edi, 0x28
mov ecx, edi
mov dword [ebp - 0x18], edi
call fcn.0043c8f7
push eax
mov ecx, edi
call fcn.00494b6a
push eax
mov ecx, edi
call fcn.0043c8f3
push eax
lea eax, [ebp + 0xe0]
push eax
call fcn.0043d2dd
add esp, 0x10
push str.HKCUSoftwareMicrosoftWindowsCurrentVersionUninstallYahoo__BrowserPlus
lea ecx, [ebp + 0x120]
mov dword [ebp - 4], 5
call fcn.0040979d
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp + 0xe0]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx + 0xe0]
mov byte [ebp - 4], 6
call fcn.00410869
push ebx
push eax
lea ecx, [ebp + 0x98]
mov byte [ebp - 4], 7
call fcn.00409fbe
push esi
push ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.004036a7
push str.BrowserPlusUninstaller.exe
lea eax, [ebp + 0x98]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0040a096
push str.ybang.ico
lea eax, [ebp + 0x98]
push eax
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040a096
add esp, 0x18
lea eax, [ebp - 0x1d8]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.0043cad8
push eax
lea eax, [ebp + 0x40]
push 0x52f844
push eax
mov byte [ebp - 4], 0xc
call fcn.0040bccd
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push str.DisplayName
lea ecx, [ebp - 0x40]
call fcn.0040979d
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0xf
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push str.DisplayIcon
lea ecx, [ebp - 0x40]
call fcn.0040979d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 0x10
call fcn.0042c036
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x11
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push str.UninstallString
lea ecx, [ebp - 0x40]
call fcn.0040979d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp + 0x20]
mov byte [ebp - 4], 0x12
call fcn.0042c036
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x13
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push 0x52f810
lea ecx, [ebp - 0x88]
call fcn.0040979d
push str.Publisher
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.0040979d
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push str.NoModify
lea ecx, [ebp - 0x40]
call fcn.0040979d
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x16
call fcn.00426739
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.0040365c
push str.NoRepair
lea ecx, [ebp - 0x40]
call fcn.0040979d
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x17
call fcn.00426739
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xe
call fcn.0040365c
lea eax, [ebp - 0xbc]
push eax
call fcn.0041f707
pop ecx
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x18
call fcn.00431fd9
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
jmp 0x420881
lea ecx, [ebp - 0x48]
call fcn.00429ce5
mov ecx, eax
call fcn.0043c8f3
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.0043c8f3
mov ecx, dword [ebp - 0x1c]
cmp ecx, eax
jne 0x420876
lea ecx, [ebp - 0x48]
call fcn.00429ce5
mov edi, dword [ebp - 0x18]
push edi
mov ecx, eax
call fcn.0043c8fb
test eax, eax
jle 0x42084f
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x7530
call fcn.00432974
mov ecx, eax
call fcn.00431f04
test al, al
je 0x420879
push ebx
push 3
lea ecx, [ebp - 0x1a0]
call fcn.0040ac7d
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x19
call fcn.00429ce5
lea ecx, [ebp - 0x40]
push ecx
mov ecx, eax
call fcn.0043cad8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1a
call fcn.0043cad8
push str.__ignoring_it
push dword [ebp - 0x1c]
mov byte [ebp - 4], 0x1b
push str.__found
push eax
lea eax, [ebp - 0x198]
push str.trying_to_install
push eax
call fcn.0040a99a
pop ecx
pop ecx
push eax
call fcn.0040aad8
pop ecx
pop ecx
push eax
call fcn.0040a99a
pop ecx
pop ecx
push eax
call fcn.0040aad8
pop ecx
pop ecx
push eax
call fcn.0040a99a
pop ecx
pop ecx
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x19
call fcn.0040365c
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x7530
call fcn.00432974
mov ecx, eax
call fcn.00431f04
test al, al
je 0x42083e
push str.bp::install::Installer::postflight
lea ecx, [ebp - 0x88]
call fcn.0040979d
push str........._srclibsinstallerlibInstaller_Windows.cpp
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1c
call fcn.0040979d
push 0xdc
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x14], 0x7530
call fcn.004095fe
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 0x1e
call fcn.00409e20
push dword [ebp - 0x1c]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00432974
mov ecx, eax
call fcn.004322cc
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
lea ecx, [ebp - 0x118]
call fcn.004a73e9
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x88]
call fcn.0040365c
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 0x18
call fcn.0040441f
jmp 0x420879
lea ecx, [ebp - 0x48]
call fcn.00429ce5
push edi
mov ecx, eax
call fcn.0043c8fb
test eax, eax
jge 0x420879
lea ecx, [ebp - 0x48]
call fcn.00429ce5
mov ecx, dword [ebp - 0x24]
push eax
call fcn.00419091
jmp 0x420879
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call fcn.00416d23
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0xac]
lea ecx, [ebp - 0x6c]
call fcn.00431fd9
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00416d52
test al, al
je 0x42068c
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
call fcn.0042ffb6
push esi
call fcn.004291a9
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
mov ecx, edi
call fcn.0043cad8
push eax
lea eax, [ebp - 0x1bc]
push str.YBPAddon_
push eax
mov byte [ebp - 4], 0x20
call fcn.0040bccd
push str..dll
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0x21
call fcn.004104cc
add esp, 0x18
push ebx
push eax
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 0x22
call fcn.0042c7a8
mov byte [ebp - 4], 0x23
cmp eax, esi
jne 0x420916
mov dword [ebp - 0x18], esi
jmp 0x420920
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
mov dword [ebp - 0x18], ecx
push str.Plugins
lea eax, [ebp + 0xe0]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040a096
add esp, 0xc
mov byte [ebp - 4], 0x24
cmp eax, esi
jne 0x420947
xor ecx, ecx
jmp 0x42094e
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x64]
push ecx
push eax
call fcn.00409e94
add esp, 0xc
push ebx
push eax
lea ecx, [ebp + 0x78]
mov byte [ebp - 4], 0x25
call fcn.00409fbe
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp - 0x22c]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp - 0xf8]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x1bc]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x2c
call fcn.0040365c
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.00426c0c
mov edi, eax
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 0x2d
call fcn.00426b62
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x104]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00426b48
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc4]
push eax
mov byte [ebp - 4], 0x2f
call fcn.0041f277
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1f4]
push eax
mov byte [ebp - 4], 0x30
call fcn.0041f291
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x84]
push eax
mov byte [ebp - 4], 0x31
call fcn.0041f801
mov byte [ebp - 4], 0x32
push edi
push dword [ebp - 0x14]
lea ecx, [ebp + 0x78]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 0x24]
push eax
call fcn.004270a2
add esp, 0x38
test eax, eax
lea ecx, [ebp - 0x84]
setne byte [ebp - 0x1d]
call fcn.0040ca42
push dword [ebp - 0x84]
call fcn.0047acc9
pop ecx
push esi
push ebx
lea ecx, [ebp - 0x1f4]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0xc4]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0x104]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0xdc]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x2c
call fcn.0040365c
cmp byte [ebp - 0x1d], 0
je 0x420bc2
lea eax, [ebp + 0x104]
push eax
lea ecx, [ebp + 0x78]
call fcn.0042c036
push eax
lea eax, [ebp - 0xdc]
push str.unable_to_register
push eax
mov byte [ebp - 4], 0x33
call fcn.0040bccd
push eax
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 0x34
call fcn.004392e4
add esp, 0x14
push eax
lea ecx, [ebp + 0xb8]
mov byte [ebp - 4], 0x35
call fcn.00439086
push esi
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0xdc]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0x104]
mov byte [ebp - 4], 0x39
call fcn.0040365c
push 0x52db29
lea ecx, [ebp - 0x64]
call fcn.0040979d
push str.bp::install::Installer::postflight
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0x3a
call fcn.0040979d
push str........._srclibsinstallerlibInstaller_Windows.cpp
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x3b
call fcn.0040979d
lea eax, [ebp - 0x64]
push eax
push 0xf3
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp + 0xb8]
push eax
mov byte [ebp - 4], 0x3c
call fcn.004394a1
add esp, 0x14
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x88]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x39
call fcn.0040365c
lea eax, [ebp + 0xb8]
push eax
lea ecx, [ebp - 0x258]
call fcn.004390bb
push 0x578ccc
lea eax, [ebp - 0x258]
push eax
call fcn.0047b16b
lea eax, [ebp + 0x5c]
push eax
call fcn.0043d967
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x3d
mov dword [esp], 0x52f788
call fcn.0040b592
test eax, eax
jl 0x420e86
push ebx
lea eax, [ebp + 0xe0]
push eax
lea ecx, [ebp + 0x100]
mov byte [ebp - 4], 0x3e
call fcn.00409c43
lea eax, [ebp - 0xdc]
push eax
mov byte [ebp - 4], 0x3f
call fcn.0041f277
pop ecx
push eax
lea eax, [ebp - 0xa4]
push str.HKCUSoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy_
push eax
mov byte [ebp - 4], 0x40
call fcn.0040bccd
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp + 0x120]
mov byte [ebp - 4], 0x41
call fcn.00404aa4
push esi
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0x3f
call fcn.0040365c
lea eax, [ebp + 0x120]
push eax
call fcn.0042663c
pop ecx
push str.Policy
lea ecx, [ebp - 0x64]
call fcn.0040979d
push 3
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x42
call fcn.00426739
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x3f
call fcn.0040365c
push str.BrowserPlusCore.exe
lea ecx, [ebp - 0x40]
call fcn.0040979d
push str.AppName
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x43
call fcn.0040979d
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x44
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
mov byte [ebp - 4], 0x3f
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
push str.AppPath
lea ecx, [ebp - 0x64]
call fcn.0040979d
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp + 0x100]
mov byte [ebp - 4], 0x45
call fcn.0042c036
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x120]
push eax
mov byte [ebp - 4], 0x46
call fcn.00426773
add esp, 0xc
push esi
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0x104]
call fcn.004036a7
mov dword [ebp - 4], 0x3d
jmp 0x420e86
lea eax, [ebp - 0x14]
mov edi, 0x2710
push eax
mov dword [ebp - 0x14], edi
call fcn.00432974
mov ecx, eax
call fcn.00431f04
test al, al
je 0x420f8c
push ebx
push 3
lea ecx, [ebp - 0x2e0]
call fcn.0040ac7d
lea eax, [ebp - 0x2d8]
push str.complete_Installer::postflight__
push eax
mov byte [ebp - 4], 0x4d
call fcn.0040a99a
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], edi
call fcn.00432974
mov ecx, eax
call fcn.00431f04
test al, al
je 0x420f7d
push str.bp::install::Installer::postflight
lea ecx, [ebp - 0x40]
call fcn.0040979d
push str........._srclibsinstallerlibInstaller_Windows.cpp
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x4e
call fcn.0040979d
push 0x107
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x4f
mov dword [ebp - 0x14], edi
call fcn.004095fe
mov edi, eax
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x50
call fcn.00409e20
push edi
push eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 0x51
call fcn.00432974
mov ecx, eax
call fcn.004322cc
push esi
push ebx
lea ecx, [ebp - 0xa4]
call fcn.0040365c
lea ecx, [ebp - 0x118]
call fcn.004a73e9
push esi
push ebx
lea ecx, [ebp - 0x64]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040365c
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x3d
call fcn.0040441f
push esi
push ebx
lea ecx, [ebp + 0x5c]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0x7c]
call fcn.004036a7
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xe
call fcn.0041713d
push esi
push ebx
lea ecx, [ebp + 0x40]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 4]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp + 0x24]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp + 0x9c]
call fcn.004036a7
push esi
push ebx
lea ecx, [ebp + 0x120]
call fcn.0040365c
push esi
push ebx
lea ecx, [ebp + 0xe4]
call fcn.004036a7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x13c]
xor ecx, ebp
call fcn.0047b812
add ebp, 0x140
leave
ret