Function at 0x5aab00
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x600304
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x138
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13c], edi
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebx + 0x14]
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x128], eax
call fcn.005d91f0
test al, al
jne 0x5ab6c5
cmp dword [edi + 0x18], 0
jne 0x5aab7e
test dword [edi + 0x1c], 0x800
je 0x5ab6c5
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
push esi
lea ecx, [ebp - 0x50]
movq qword [ebp - 0x50], xmm0
call fcn.005dc570
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
movq qword [ebp - 0x44], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0
lea ecx, [ebp - 0x5c]
movq qword [ebp - 0x5c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x98], 0
lea ecx, [ebp - 0xa0]
movq qword [ebp - 0xa0], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x8c], 0
lea ecx, [ebp - 0x94]
movq qword [ebp - 0x94], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
lea ecx, [ebp - 0x88]
movq qword [ebp - 0x88], xmm0
call fcn.005dc5e0
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 8
call fcn.005dbeb0
test al, al
je 0x5aacd9
push 0
push 0
push 0x400
call fcn.005db9a0
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x400
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x50]
call fcn.005dc190
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.MD5Report.htm
lea ecx, [ebp - 0x50]
call fcn.005da780
xorps xmm0, xmm0
lea ecx, [ebp - 0x50]
push 0
push 0x8e
movups xmmword [ebp - 0x7c], xmm0
movups xmmword [ebp - 0x6c], xmm0
call fcn.005dc190
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e4770
mov byte [ebp - 4], 9
cmp byte [edi + 0xa8], 0
jne 0x5ab641
lea ecx, [ebp - 0x7c]
call fcn.005e4670
test eax, eax
je 0x5ab641
push 0
push str._html__head__r_n_meta_http_equiv_Content_Type__content_text_html__charsetutf_8___r_n_meta_http_equiv_Content_Language__content_en_us___r_n_title_VirusTotal_MD5_Report__title__r_n_style_type_text_css___r_nbody_font_family:_Arial_color:000000_text_align:center_r_n.maintable_border:1px_black_solid_width:800px_margin:0_auto_border_radius:6px__r_n.maintable_td_padding:0_10px_0_10px_border:0_text_align:left_r_n.headercell_height:104px_width:100__padding:0_margin:0_r_n.subtable_border:3px_black_solid_width:100__background:white_border_radius:4px__r_n.subtable_tr:hover_background:99FFCC_r_n.subtable_td_border:1px_black_solid_font_size:10pt_padding:2px__r_n.h104_min_height:104px__r_n.groupcolor1_background:white_r_n.guibkcolor_background:808080__r_nfilter:_progid:DXImageTransform.Microsoft.gradient__startColorstr808080__endColorstrFFFFFF__GradientType0___r_nbackground:_linear_gradient_to_bottom__808080_0___FFFFFF_100___r_n.f10pt_font_size:_10pt__r_n.f12pt_font_size:_12pt__r_n.f18pt_font_size:_18pt__r_n.mt20_margin_top:20px_r_n.center_text_align:center__r_n.vtop_vertical_align:top__r_n.filecell_vertical_align:bottom_width:100__r_n.filecell_p__.subtable_th_background:236_color:white_padding:8px_line_height:20px_r_n.w270_width:270px__r_n.w330_width:330px__r_n.w120_width:120px__r_n.green_color:green__r_n.red_color:red__r_n.w100_display:inline_block__min_width:105px_r_na.vt_color:white__r_na.vt:hover_color:9fc__r_n
call fcn.005e37e0
mov ecx, dword [ebp - 0x128]
mov edx, 0xc8
mov esi, 0x6e
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x134], esi
xor edi, edi
call fcn.005d8c40
test eax, eax
je 0x5aada2
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x400
push eax
push edi
push edi
push 0x400
lea ecx, [ebp - 0xa0]
call fcn.005db9a0
mov esi, dword [ebp - 0x128]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_UrlCreateFromPathW]
lea eax, [ebp - 0x134]
mov ecx, esi
push eax
lea edx, [ebp - 0x12c]
call fcn.005d3210
mov edx, dword [ebp - 0x12c]
mov esi, dword [ebp - 0x134]
push edx
lea ecx, [ebp - 0x44]
call fcn.005db290
push esi
lea ecx, [ebp - 0x5c]
call fcn.005db290
push 0
push 0
push 0
push 0
push 0
push str.___r_n_p_class_f18pt_center_mt20___a_class_vt__target__blank__href_https:__www.virustotal.com____b_VirusTotal__b___a__r_n_p_class_center_f12pt___b_VT_API_multiple_report__b___p___td___tr__r_n
lea ecx, [ebp - 0xa0]
call fcn.005dc190
push eax
push str.px_r_n__style___head__body__r_n_table_class_maintable_groupcolor1___tr__r_n_td_class_headercell_guibkcolor___r_n_img_alt___src_
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
push str.px_height:
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push str.img_border:0_margin:10px_float:left_width:
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
mov ecx, dword [ebp - 0x140]
xor edx, edx
mov dword [ebp - 0x120], edx
call fcn.005d9210
test eax, eax
je 0x5ab598
mov esi, dword [ebp - 0x13c]
lea eax, [esi + 0x34]
mov dword [ebp - 0x144], eax
nop
push edx
call fcn.005d9220
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc510
test dword [esi + 0x1c], 0x4000
je 0x5aae6b
push 0
push 1
push 1
push 0
push 0x629fdc
lea ecx, [ebp - 0x2c]
call fcn.005daa70
test eax, eax
je 0x5aae6b
dec eax
lea ecx, [ebp - 0x2c]
push eax
call fcn.005dae00
push 4
push 1
push 1
push 1
push str.http
lea ecx, [ebp - 0x2c]
call fcn.005daa70
test eax, eax
jne 0x5aaef7
push 4
push 1
push 1
push 1
push str.www.
lea ecx, [ebp - 0x2c]
call fcn.005daa70
test eax, eax
jne 0x5aaef7
push 4
push 1
push 1
push 1
push 0x624390
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x121], al
call fcn.005daa70
test eax, eax
je 0x5aaec8
push 4
lea ecx, [ebp - 0x2c]
call fcn.005dad50
jmp 0x5aaecf
mov byte [ebp - 0x121], 0
mov byte [ebp - 0x134], 1
lea ecx, [ebp - 0x20]
push dword [ebp - 0x134]
inc edi
push str._tr__td_class_filecell_f10pt___r_n_p_
mov dword [ebp - 0x12c], edi
call fcn.005dc260
mov esi, str._span_class_w100__nbsp_File:__span_
jmp 0x5aaf19
push 1
push str._tr__td_class_filecell_f10pt___r_n_p_
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x121], 1
call fcn.005dc260
inc edi
mov esi, str.nbsp_URL:
mov dword [ebp - 0x12c], edi
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._br__r_n
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.005da780
lea ecx, [ebp - 0x38]
call fcn.005dc400
lea ecx, [ebp - 0x88]
call fcn.005dc400
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, dword [ebp - 0x144]
push eax
call fcn.005d6740
test al, al
je 0x5ab45e
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x38]
call fcn.005dc190
mov esi, dword [ebp - 0x13c]
mov ecx, esi
push eax
call fcn.005a9cd0
mov byte [ebp - 0x121], al
mov dl, al
mov dword [ebp - 0x128], 0
test al, al
je 0x5ab00e
push 0
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005aa730
mov cl, byte [ebp - 0x121]
mov dl, cl
test eax, eax
jne 0x5ab00e
test dword [esi + 0x1c], 0x800
je 0x5ab00e
mov byte [ebp - 0x12d], cl
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x5ab008
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
mov ecx, esi
call fcn.005acb20
jmp 0x5ab014
mov dl, byte [ebp - 0x12d]
mov byte [ebp - 0x121], dl
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._br__r_n
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str._span_class_w100__nbsp_MD5_hash:__span_
lea ecx, [ebp - 0x20]
call fcn.005da780
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.nbsp___span_
lea ecx, [ebp - 0x88]
call fcn.005dc190
cmp dword [ebp - 0x128], 3
mov ecx, str.green__nbsp_
push eax
mov eax, str.red__
cmovle eax, ecx
lea ecx, [ebp - 0x20]
push eax
push str._span_class_w100__nbsp_Analysis_result:__span___span_style_background:
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
push 0x78
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00420090
add esp, 0xc
lea ecx, [ebp - 0x118]
call fcn.005af000
cmp byte [ebp - 0x121], 0
mov byte [ebp - 4], 0xa
je 0x5ab0e0
push 0
lea ecx, [ebp - 0x94]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x118]
call fcn.005aeac0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x5ab393
mov eax, dword [ebp - 0xdc]
lea ecx, [ebp - 0x44]
test eax, eax
jne 0x5ab10f
push 1
push str.today
call fcn.005dc260
jmp 0x5ab14a
cmp eax, 1
jne 0x5ab121
push eax
push str.yesterday
call fcn.005dc260
jmp 0x5ab14a
push eax
call fcn.005db320
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._days_ago
lea ecx, [ebp - 0x44]
call fcn.005da780
push 0
push 0
push 0
push 0
push str.__https:__www.virustotal.com...__a___p__r_n_table_class_subtable___r_n_tr__th_class_w330____Antivirus___Firewall__th__r_n_th_class_w330____Scan_result__th__r_n_th_class_w120____AV_update__th___tr__r_n
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
push str._span_class_w100__nbsp_Permalink:__span___a_class_vt__target__blank__href_
push str._._br__r_n
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
push 0x62d7ec
lea ecx, [ebp - 0x118]
call fcn.005dc190
push eax
push str._br__span_class_w100__nbsp_Analysis_date:__span_
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x128], ecx
nop word [eax + eax]
lea esi, [edi + 1]
mov dword [ebp - 0x138], esi
cmp dword [ebp - 0xd0], edi
ja 0x5ab1c9
mov dword [ebp - 0xd0], esi
jmp 0x5ab1cf
mov dword [ebp - 0x138], esi
mov eax, dword [ebp - 0xc8]
add eax, 0xc
push str.Clean
add ecx, eax
call fcn.005dc4c0
test al, al
jne 0x5ab26d
mov ecx, dword [ebp - 0xd0]
cmp ecx, edi
push 0
cmovbe ecx, esi
mov esi, dword [ebp - 0xc8]
add esi, dword [ebp - 0x128]
cmp ecx, edi
push 0
cmovbe ecx, dword [ebp - 0x138]
cmp ecx, edi
push 0
cmovbe ecx, dword [ebp - 0x138]
mov dword [ebp - 0xd0], ecx
lea ecx, [esi + 0x18]
push str.__td___tr__r_n
call fcn.005dc190
push eax
push str._td_class_center__
push str.__td__r_n
lea ecx, [esi + 0xc]
call fcn.005dc190
push eax
push str._td_class_red_center__
push str.__td__r_n
mov ecx, esi
call fcn.005dc190
push eax
push str._tr__td_
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
mov ecx, dword [ebp - 0x128]
inc edi
add ecx, 0x24
mov dword [ebp - 0x128], ecx
cmp edi, dword [ebp - 0x11c]
jb 0x5ab1b0
mov eax, dword [ebp - 0x12c]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], ecx
nop
lea edi, [esi + 1]
mov dword [ebp - 0x138], edi
cmp dword [ebp - 0xd0], esi
ja 0x5ab2b9
mov dword [ebp - 0xd0], edi
jmp 0x5ab2bf
mov dword [ebp - 0x138], edi
mov eax, dword [ebp - 0xc8]
add eax, 0xc
push str.Clean
add ecx, eax
call fcn.005dc480
test al, al
jne 0x5ab35d
mov ecx, dword [ebp - 0xd0]
cmp ecx, esi
push 0
cmovbe ecx, edi
mov edi, dword [ebp - 0xc8]
add edi, dword [ebp - 0x128]
cmp ecx, esi
push 0
cmovbe ecx, dword [ebp - 0x138]
cmp ecx, esi
push 0
cmovbe ecx, dword [ebp - 0x138]
mov dword [ebp - 0xd0], ecx
lea ecx, [edi + 0x18]
push str.__td___tr__r_n
call fcn.005dc190
push eax
push str._td_class_center__
push str.__td__r_n
lea ecx, [edi + 0xc]
call fcn.005dc190
push eax
push str._td__class_green_center__
push str.__td__r_n
mov ecx, edi
call fcn.005dc190
push eax
push str._tr__td_
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
mov ecx, dword [ebp - 0x128]
inc esi
add ecx, 0x24
mov dword [ebp - 0x128], ecx
cmp esi, dword [ebp - 0x11c]
jb 0x5ab2a0
push 0
push str.__table__r_n
lea ecx, [ebp - 0x7c]
call fcn.005e37e0
mov edi, dword [ebp - 0x12c]
jmp 0x5ab43b
lea ecx, [ebp - 0x20]
call fcn.005dc400
lea ecx, [ebp - 0x10c]
call fcn.005dc3a0
test eax, eax
je 0x5ab3cf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__https:__www.virustotal.com...__a__r_n
lea ecx, [ebp - 0x10c]
call fcn.005dc190
push eax
jmp 0x5ab3ff
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
cmp eax, 0x1e
jle 0x5ab40c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__https:__www.virustotal.com...__a__r_n
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str.https:__www.virustotal.com_gui_file_
push str._br__span_class_w100__nbsp_VT_result_page:__span___a_class_vt__target__blank__href_
lea ecx, [ebp - 0x20]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.__p_
lea ecx, [ebp - 0x20]
call fcn.005da780
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
push 0
push str._br___td___tr_
lea ecx, [ebp - 0x7c]
call fcn.005e37e0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 9
call fcn.004020d0
jmp 0x5ab572
cmp byte [ebp - 0x121], 0
mov dword [ebp - 0x128], 0
jne 0x5ab533
lea ecx, [ebp - 0x2c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x5ab492
mov eax, str._span_class_w100__nbsp_Analysis_result:__span__File_not_found__p__r_n
jmp 0x5ab538
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov ecx, eax
call fcn.005e0e70
test edx, edx
jl 0x5ab4b8
jg 0x5ab4ae
cmp eax, 0x8000000
jbe 0x5ab4b8
mov eax, str._span_class_w100__nbsp_Analysis_result:__span__File___128_MB__p__r_n
jmp 0x5ab538
lea ecx, [ebp - 0x38]
call fcn.005dbeb0
test al, al
je 0x5ab4fa
push 0
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], 0x100
push eax
push 0
push 0
push 0x100
call fcn.005db9a0
push eax
lea ecx, [ebp - 0x2c]
call fcn.005dc190
mov edx, 0x8003
mov ecx, eax
call fcn.005e6320
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
test eax, eax
je 0x5ab533
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str._br__r_n
lea ecx, [ebp - 0x38]
call fcn.005dc190
push eax
push str._span_class_w100__nbsp_MD5_hash:__span_
lea ecx, [ebp - 0x20]
call fcn.005da780
mov eax, str._span_class_w100__nbsp_Analysis_result:__span__Not_available__p__r_n
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
lea ecx, [ebp - 0x20]
call fcn.005da780
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
push 0
push str._br___td___tr_
lea ecx, [ebp - 0x7c]
call fcn.005e37e0
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x140]
inc edx
mov dword [ebp - 0x120], edx
call fcn.005d9210
mov esi, dword [ebp - 0x13c]
cmp edx, eax
jb 0x5aae30
push edi
lea ecx, [ebp - 0x44]
call fcn.005db320
cmp edi, 1
jne 0x5ab5b6
push edi
push str.One_item
lea ecx, [ebp - 0x5c]
call fcn.005dc260
jmp 0x5ab5e0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x62dabc
lea ecx, [ebp - 0x44]
call fcn.005dc190
push eax
lea ecx, [ebp - 0x5c]
call fcn.005dc200
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.analyzed.__b___p__r_n__td___tr___table___body___html__r_n
lea ecx, [ebp - 0x5c]
call fcn.005dc190
push eax
push str._tr__td__p__b__End_of_the_global_report.
lea ecx, [ebp - 0x20]
call fcn.005dc200
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x7c]
call fcn.005e3a10
push ecx
lea ecx, [ebp - 0x7c]
call fcn.005e36a0
lea ecx, [ebp - 0x50]
call fcn.005dc190
mov edx, dword [ebx + 0x18]
mov ecx, eax
call fcn.005ae950
mov ecx, dword [ebp - 0x13c]
call fcn.005acaa0
jmp 0x5ab655
push ecx
lea ecx, [ebp - 0x7c]
call fcn.005e36a0
xor edx, edx
mov ecx, esi
call fcn.005e4c40
xor edi, edi
lea ecx, [ebp - 0x74]
call fcn.005d9280
mov eax, dword [ebp - 0x7c]
cmp eax, 0xffffffff
je 0x5ab670
test eax, eax
je 0x5ab670
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x88]
call fcn.005dc430
lea ecx, [ebp - 0x2c]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
lea ecx, [ebp - 0x94]
call fcn.005dc430
lea ecx, [ebp - 0x20]
call fcn.005dc430
lea ecx, [ebp - 0xa0]
call fcn.005dc430
lea ecx, [ebp - 0x5c]
call fcn.005dc430
lea ecx, [ebp - 0x44]
call fcn.005dc430
lea ecx, [ebp - 0x50]
call fcn.005dc430
mov eax, edi
jmp 0x5ab6ca
mov eax, 0xfffffffb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x14