Function at 0x42282f
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41b8
lea ebp, [esp - 0x74]
call fcn.0047bd30
push ebx
push esi
mov dword [ebp + 0x58], ecx
push edi
lea ecx, [ebp + 0x7c]
call fcn.0040b43e
and dword [ebp + 0x54], 0
and dword [ebp + 0x5c], 0
mov dword [ebp + 0x6c], 1
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 0x7c]
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x40], 0x3e8
mov ax, word [ecx]
cmp ax, 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x73], 0
mov bl, 0x2a
jne 0x42288b
mov bl, al
movsx esi, bl
movzx eax, ax
cmp esi, eax
jne 0x422bc9
push 0x40
pop edi
cmp bl, 0x2d
jne 0x4228b8
xor eax, eax
mov ax, word [ecx + 2]
push eax
call fcn.00433834
add esp, 4
test al, al
jne 0x4229f8
push 3
lea eax, [ebp + 0x7c]
inc ecx
push eax
inc ecx
push 0x4935b4
mov dword [ebp + 0x7c], ecx
call fcn.00435950
add esp, 0xc
test al, al
je 0x4228dd
mov byte [ebp + 0x73], 1
jmp 0x4229ea
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x4935b0
call fcn.00435950
add esp, 0xc
test al, al
je 0x4228fd
mov byte [ebp + 0x68], 1
jmp 0x4229ea
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.00435950
add esp, 0xc
test al, al
je 0x42291d
mov byte [ebp + 0x68], 0x41
jmp 0x4229ea
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.00435950
add esp, 0xc
test al, al
je 0x42293d
mov byte [ebp + 0x68], 0x10
jmp 0x4229ea
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.00435950
add esp, 0xc
test al, al
je 0x42295d
mov byte [ebp + 0x68], 0x50
jmp 0x4229ea
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.00435950
add esp, 0xc
test al, al
je 0x42297d
mov dword [ebp + 0x54], 0x10000
jmp 0x4229ea
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.00435950
add esp, 0xc
test al, al
je 0x42299a
mov byte [ebp + 0x72], 1
jmp 0x4229ea
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x492978
call fcn.00435950
add esp, 0xc
test al, al
je 0x4229b6
mov dword [ebp + 0x5c], edi
jmp 0x4229ea
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.0042fae7
add esp, 0xc
test al, al
je 0x4229e0
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004369c5
pop ecx
jmp 0x4229e9
lea eax, [ebp + 0x7c]
push eax
call fcn.0040418b
pop ecx
mov ecx, dword [ebp + 0x7c]
movzx eax, word [ecx]
cmp esi, eax
je 0x42289c
cmp byte [ebp + 0x68], 0
je 0x422b15
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
call fcn.0040b7e1
mov ebx, dword [ebp + 0x68]
and ebx, edi
push ebx
mov dword [ebp + 0x64], eax
call fcn.0040dd42
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
pop ecx
pop ecx
push dword [ebp + 0x7c]
mov dword [ebp + 0x5c], eax
call edi
mov esi, eax
add esi, 0x10
lea eax, [esi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.00433c42
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x422a67
push dword [ebp + 0x24]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call edi
mov ecx, dword [ebp + 0x6c]
inc esi
push esi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov esi, dword [ebp + 0x6c]
push esi
call edi
shl eax, 1
push eax
push esi
push 1
push str.HOTKEY9000000
push str.SOFTWAREPELOGON
push 0x80000002
call fcn.0042f97c
add esp, 0x18
cmp dword [ebp + 0x5c], 0
jne 0x422ab9
push ebx
push dword [ebp + 0x58]
call fcn.00413f2b
test eax, eax
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
je 0x422ae9
push 0
push 0x895440
push 0x312
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp + 0x6c]
mov esi, eax
call fcn.0042eb98
cmp dword [ebp + 0x64], 0
je 0x422b03
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x422b03
lea ecx, [ebp + 0x6c]
call fcn.0042eb98
cmp dword [ebp + 0x64], 0
je 0x422b00
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor esi, esi
inc esi
push 0x4a7658
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x4232d6
cmp byte [ebp + 0x72], 0
je 0x422bc9
lea ecx, [ebp + 0x5c]
mov ebx, str.PressKey
call fcn.00433c24
mov eax, dword [ebp + 0x7c]
xor esi, esi
cmp word [eax], si
je 0x422b4b
push 0x2c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004364f8
mov ebx, dword [ebp + 0x5c]
add esp, 0xc
push 0x3f
xor eax, eax
mov byte [ebp - 0x140], 0
pop ecx
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov word [ebp - 0x4144], si
lea edi, [ebp - 0x4144]
movzx eax, byte [ebp + esi - 0x140]
push eax
push 0x493528
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 0xa
cmp esi, 0x100
jl 0x422b7c
mov ecx, dword [ebp + 0x58]
and word [ebp - 0x3746], 0
lea eax, [ebp - 0x4144]
push eax
push ebx
call fcn.004335ed
lea ecx, [ebp + 0x5c]
call fcn.0042eb98
and dword [ebp + 0x6c], 0
jmp 0x4232c9
fld qword [0x493520]
mov esi, 0x80000000
fstp qword [ebp + 0x1c]
mov dword [ebp + 0x60], esi
cmp word [ecx], 0x2d
jne 0x422c08
lea eax, [ecx + 2]
mov dx, word [eax]
or dx, 0x20
cmp dx, 0x63
je 0x422c08
cmp dx, 0x64
je 0x422c08
lea ecx, [ebp + 0x7c]
mov dword [ebp + 0x7c], eax
mov byte [ebp + 0x71], 1
call fcn.0040b43e
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0x3d
jne 0x422c17
mov bl, byte [ecx]
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
jmp 0x422c19
xor bl, bl
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00433834
add esp, 4
test al, al
je 0x422c4e
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x38], ecx
call fcn.004369c5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043679a
mov ecx, dword [ebp + 0x7c]
add esp, 0x10
cmp word [ecx], 0x2a
je 0x422e11
cmp dword [ebp + 0x60], esi
jne 0x422c71
fld qword [ebp + 0x1c]
fcomp qword [0x493518]
fnstsw ax
test ah, 1
jne 0x422e11
xor edi, edi
lea ecx, [ebp + 0x64]
mov word [ebp - 0x3e], di
mov word [ebp - 0x40], di
mov dword [ebp + 0x68], str.PressKey
call fcn.00433c24
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x422cb4
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004364f8
mov eax, dword [ebp + 0x64]
add esp, 0xc
cmp word [eax], di
je 0x422cb4
mov dword [ebp + 0x68], eax
cmp byte [ebp + 0x71], 0
mov edi, dword [ebp + 0x60]
jne 0x422d4b
test edi, edi
jne 0x422cd7
fld qword [ebp + 0x1c]
fcomp qword [0x493518]
fnstsw ax
test ah, 0x41
jnp 0x422d46
test edi, edi
jl 0x422df7
test bl, bl
je 0x422d0b
and dword [ebp + 0x6c], 0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x60], esi
cmp word [eax], 0
jne 0x422df7
lea ecx, [ebp + 0x64]
call fcn.0042eb98
xor eax, eax
jmp 0x4232d6
test edi, edi
jg 0x422d2f
fld qword [ebp + 0x1c]
fcomp qword [0x493518]
fnstsw ax
test ah, 0x41
jne 0x422d2f
fld qword [ebp + 0x1c]
fmul qword [0x493510]
call fcn.0047c064
jmp 0x422d31
xor eax, eax
mov ecx, dword [ebp + 0x58]
push eax
push edi
call fcn.0040ce12
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x60], esi
jmp 0x422df7
push 2
pop eax
jmp 0x422d4e
xor eax, eax
inc eax
or eax, dword [ebp + 0x54]
push eax
push edi
call fcn.00416bb0
cmp byte [ebp + 0x73], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x6c], ebx
jne 0x422d75
cmp ebx, 0x60
jl 0x422d75
cmp ebx, 0x69
jg 0x422d75
sub ebx, 0x30
mov dword [ebp + 0x6c], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, str.0x_X
jle 0x422d94
push ebx
lea eax, [ebp - 0x40]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x40]
jmp 0x422d99
mov eax, 0x493508
mov ecx, dword [ebp + 0x58]
push eax
push str.PressKey.Hex
call fcn.004335ed
test ebx, ebx
jle 0x422ddc
cmp ebx, 0x41
jl 0x422db5
cmp ebx, 0x5a
jle 0x422dc2
push ebx
call fcn.00433834
add esp, 4
test al, al
je 0x422dd1
and word [ebp - 0x3e], 0
movsx ax, bl
mov word [ebp - 0x40], ax
jmp 0x422ddc
push ebx
lea eax, [ebp - 0x40]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x58]
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x68]
call fcn.004335ed
mov dword [ebp + 0x60], 0x80000000
mov esi, 0x80000000
lea ecx, [ebp + 0x7c]
call fcn.0040b43e
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x60], esi
mov byte [ebp + 0x71], 0
call fcn.0042eb98
mov ecx, dword [ebp + 0x7c]
cmp word [ecx], 0
je 0x4232c9
xor ebx, ebx
mov dword [ebp + 0x50], ebx
or esi, 0xffffffff
cmp word [ecx], 0x2a
mov byte [ebp + 0x73], bl
jne 0x422e45
mov eax, dword [ebp + 0x24]
inc ecx
xor esi, esi
inc ecx
inc esi
mov dword [ebp + 0x50], eax
jmp 0x422e3c
inc esi
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp word [ecx], 0x2a
je 0x422e39
cmp esi, ebx
jle 0x422e9f
mov ax, word [ecx]
cmp ax, 0x2d
jne 0x422e5c
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov dword [ebp + 0x50], ebx
jmp 0x422e9f
cmp ax, 0x3d
jne 0x422e6b
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
mov byte [ebp + 0x73], 1
xor eax, eax
mov ax, word [ecx]
push eax
call fcn.00433834
add esp, 4
test al, al
je 0x422e8d
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004369c5
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x422e9f
push esi
push dword [ebp + 0x50]
call fcn.0040eb22
pop ecx
pop ecx
mov dword [ebp + 0x50], eax
or dword [ebp + 0x34], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.0040b43e
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x422ec0
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x422ec4
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.00433834
add esp, 4
test al, al
je 0x422ee3
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004369c5
pop ecx
pop ecx
cmp dword [ebp + 0x50], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x6c], ebx
je 0x422f1b
cmp byte [ebp + 0x73], 0
push dword [ebp + 0x50]
push ebx
push 0x100000
je 0x422f05
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x422f0b
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [ebp + 0x48], eax
jne 0x422f1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x6c], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.00433c42
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x3c]
call fcn.0043de1a
push 0x5c
push dword [ebp + 0x3c]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.0040b43e
lea ecx, [ebp + 0x28]
call fcn.00433e90
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x38], ebx
je 0x4230c1
push 4
pop edi
cmp byte [0x4a5290], 0
jle 0x4230c1
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.00435950
add esp, 0xc
test al, al
je 0x422fd8
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004369c5
cmp dword [ebp + 0x40], ebx
pop ecx
pop ecx
jge 0x4230ad
mov dword [ebp + 0x40], ebx
jmp 0x4230ad
push edi
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.00435950
add esp, 0xc
test al, al
je 0x42308d
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x4c], eax
push 1
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x4c]
push eax
mov dword [ebp + 0x54], ebx
call fcn.00414faa
add esp, 0xc
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x7c], eax
call fcn.00433c24
lea ecx, [ebp + 0x68]
call fcn.00433c24
push dword [ebp + 0x54]
lea ecx, [ebp + 0x68]
push dword [ebp + 0x4c]
call fcn.00433d4a
lea eax, [ebp + 0x64]
push eax
push dword [ebp + 0x68]
call fcn.0040efe9
pop ecx
pop ecx
lea ecx, [ebp + 0x68]
call fcn.0042eb98
cmp dword [ebp + 0x54], ebx
jle 0x42307b
push edi
call fcn.0047b518
cmp eax, ebx
pop ecx
je 0x423060
mov ecx, dword [ebp + 0x64]
mov dword [eax], ecx
mov dword [ebp + 0x64], ebx
mov esi, eax
jmp 0x423062
xor esi, esi
push edi
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x28]
push eax
push dword [ebp + 0x30]
call fcn.00433e53
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x30]
lea ecx, [ebp + 0x7c]
call fcn.0040b43e
lea ecx, [ebp + 0x64]
call fcn.0042eb98
jmp 0x4230ad
push edi
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.00435950
add esp, 0xc
test al, al
jne 0x4230bb
lea eax, [ebp + 0x7c]
push eax
call fcn.0040418b
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x422f94
jmp 0x4230c1
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x38], eax
cmp byte [ebp + 0x71], 0
je 0x4230ca
neg dword [ebp + 0x60]
cmp dword [ebp + 0x5c], ebx
jne 0x4230dd
cmp dword [ebp + 0x48], ebx
je 0x4230dd
push dword [ebp + 0x44]
call fcn.0040d9ae
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x60]
cmp dword [ebp + 0x48], ebx
je 0x423198
cmp byte [0x4a5290], 0
jle 0x423198
mov ebx, 0x3e8
cmp dword [ebp + 0x60], 0
je 0x423198
mov edi, ebx
jle 0x423126
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x60], ecx
js 0x423198
cmp ecx, ebx
jge 0x423126
mov edi, ecx
push 0x4ff
push edi
push 0
lea eax, [ebp + 0x48]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x423198
cmp byte [0x4a5290], 0
mov dword [ebp + 0x4c], 0x64
jle 0x423198
xor edi, edi
push 1
push edi
push edi
push edi
lea eax, [ebp]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x42318b
dec dword [ebp + 0x4c]
je 0x42318b
cmp dword [ebp + 4], 0x12
je 0x42318b
lea eax, [ebp]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x4a5290], 0
jg 0x423150
cmp byte [0x4a5290], 0
jg 0x423103
xor ebx, ebx
cmp dword [ebp + 0x34], ebx
jl 0x4231bb
cmp byte [ebp + 0x72], bl
je 0x4231af
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4231bb
mov ecx, dword [ebp + 0x58]
push ebx
push dword [ebp + 0x34]
call fcn.0040ce12
cmp dword [ebp + 0x30], ebx
jle 0x42327b
cmp byte [0x4a5290], 0
jle 0x42327b
cmp dword [ebp + 0x5c], ebx
jne 0x4231df
push dword [ebp + 0x44]
call fcn.0040d9ae
pop ecx
cmp dword [ebp + 0x30], ebx
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x64], eax
jle 0x42327b
cmp byte [0x4a5290], 0
jle 0x42327b
mov eax, dword [ebp + 0x30]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x68], eax
jle 0x42327b
cmp byte [0x4a5290], 0
jle 0x423260
mov eax, dword [ebp + 0x64]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x42325a
push ebx
push dword [eax]
call fcn.004214a4
mov eax, dword [esi]
push dword [eax]
call fcn.0047aba9
add esp, 0xc
test eax, eax
jne 0x423254
mov eax, dword [esi]
cmp eax, ebx
mov dword [ebp + 0x4c], eax
je 0x423250
mov ecx, eax
call fcn.0042eb98
push dword [ebp + 0x4c]
call fcn.0047b354
pop ecx
mov dword [esi], ebx
jmp 0x42325a
lea eax, [edi + 1]
mov dword [ebp + 0x54], eax
inc edi
cmp edi, dword [ebp + 0x68]
jl 0x42320a
mov esi, dword [ebp + 0x54]
cmp esi, ebx
jle 0x42327b
mov ecx, dword [ebp + 0x58]
push ebx
push dword [ebp + 0x40]
call fcn.0040ce12
mov dword [ebp + 0x30], esi
jmp 0x4231ee
cmp dword [ebp + 0x5c], ebx
jne 0x42328e
cmp dword [ebp + 0x48], ebx
je 0x42328e
push dword [ebp + 0x3c]
call fcn.0040d9ae
pop ecx
mov eax, dword [ebp + 0x38]
cmp eax, ebx
je 0x4232a9
cmp word [eax], bx
je 0x4232a9
mov ecx, dword [ebp + 0x58]
push ebx
push ebx
push ebx
push eax
call fcn.00424fb6
mov dword [ebp + 0x6c], eax
lea ecx, [ebp + 0x28]
call fcn.0041049f
lea ecx, [ebp + 0x3c]
call fcn.0042eb98
lea ecx, [ebp + 0x44]
call fcn.0042eb98
lea ecx, [ebp + 0x48]
call fcn.00402ac9
mov ecx, dword [ebp + 0x58]
push 0
call fcn.004453fa
mov eax, dword [ebp + 0x6c]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4