Function at 0x6f1af0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x19
push 0
push 0
dec ecx
jne 0x6f1af8
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebp
push 0x6f27b8
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetThreadLocale
mov dword [0x72e360], eax
lea ecx, [ebp - 0x8c]
mov dl, 1
mov eax, 0x6f27d4
call fcn.006e8524
mov edx, dword [ebp - 0x8c]
mov eax, 0x713584
call reloc.comctl32.dll_ImageList_DragEnter
mov eax, dword [ebp - 0x3c]
add eax, 0x40c
call fcn.00407460
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a4]
xor edx, edx
call fcn.004a5bdc
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
xor edx, edx
call fcn.004a5bdc
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3b8]
xor edx, edx
call fcn.004a5bdc
push 0
call sub.ole32.dll_CoInitialize
xor eax, eax
push ebp
push 0x6f1c08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x398]
mov eax, dword [eax + 0x1b8]
call fcn.00481b94
mov edx, dword [0x7140bc]
mov edx, dword [edx]
mov edx, dword [edx + 0xa4]
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x4000
push 0x30
push 0x30
push 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x398]
mov eax, dword [eax + 0x1b8]
call fcn.00481b94
call fcn.004869f8
push eax
call sub.user32.dll_CopyImage
push eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x398]
mov eax, dword [eax + 0x1b8]
call fcn.00481b94
pop edx
call fcn.00486d50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6f1c1e
mov dl, 1
mov eax, dword [0x5c0b24]
call fcn.005c359c
mov dword [ebp - 0x4c], eax
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 8]
mov edx, 0x6f2834
mov eax, dword [ebp - 0x4c]
call fcn.005c37fc
mov eax, dword [0x714624]
mov eax, dword [eax]
call fcn.005c34c4
mov edx, dword [0x5c0b24]
call fcn.00405a18
mov ecx, eax
mov edx, 0x6f2850
mov eax, dword [ebp - 0x4c]
call fcn.005c37cc
cmp dword [0x713584], 0
je 0x6f1c89
mov ecx, dword [0x713584]
mov edx, 0x6f2874
mov eax, dword [ebp - 0x4c]
call fcn.005c37fc
lea eax, [ebp - 0x18]
call fcn.006ea114
cmp dword [ebp - 0x18], 0
je 0x6f1ca7
mov ecx, dword [ebp - 0x18]
mov edx, 0x6f2894
mov eax, dword [ebp - 0x4c]
call fcn.005c37fc
cmp dword [ebp - 0x18], 0
jne 0x6f1ce8
lea eax, [ebp - 0x1c]
call fcn.006ea1c0
cmp dword [ebp - 0x1c], 0
je 0x6f1ccd
mov ecx, dword [ebp - 0x1c]
mov edx, 0x6f2894
mov eax, dword [ebp - 0x4c]
call fcn.005c37fc
jmp 0x6f1ce8
mov dl, 1
mov eax, dword [0x5c1104]
call fcn.005c1c18
mov ecx, eax
mov edx, 0x6f2894
mov eax, dword [ebp - 0x4c]
call fcn.005c37cc
lea eax, [ebp - 0x20]
call fcn.006ea6dc
cmp dword [ebp - 0x20], 0
je 0x6f1d16
lea eax, [ebp - 0x90]
call fcn.006ea6dc
mov ecx, dword [ebp - 0x90]
mov edx, 0x6f28b8
mov eax, dword [ebp - 0x4c]
call fcn.005c37fc
jmp 0x6f1d31
mov dl, 1
mov eax, dword [0x5c1104]
call fcn.005c1c18
mov ecx, eax
mov edx, 0x6f28b8
mov eax, dword [ebp - 0x4c]
call fcn.005c37cc
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x4c]
call fcn.006e89e8
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 5
jge 0x6f1ef9
xor eax, eax
push ebp
push 0x6f1ee8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6f1dab
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x4c]
call fcn.006e89e8
mov eax, dword [ebp - 0x94]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov eax, dword [0x7139bc]
mov eax, dword [eax]
mov ecx, 0x6f28ec
call fcn.006e5824
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6f1e5b
cmp dword [ebp - 8], 0
je 0x6f1e6b
call fcn.00406c4c
jmp 0x6f1ef9
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 5
jne 0x6f1ec7
lea eax, [ebp - 0x2c]
mov edx, dword [0x713590]
call fcn.00407888
mov byte [ebp - 0x5d], 3
movzx eax, word [0x6f290c]
mov word [ebp - 0x5f], ax
xor eax, eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
movzx edx, byte [ebp - 0x5d]
movzx ecx, word [ebp - 0x5f]
mov eax, dword [ebp - 0x2c]
call fcn.004d5a0c
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 6
jne 0x6f1ec0
xor eax, eax
mov dword [ebp - 0x54], eax
jmp 0x6f1ec7
push 0
call sub.KERNEL32.DLL_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f1eef
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x6c]
call reloc.user32.dll_CreateWindowExW
ret
mov eax, dword [ebp - 8]
call fcn.005c34c4
mov edx, dword [0x5c0b24]
call fcn.00405a18
mov dword [ebp - 0x50], eax
mov edx, 0x6f291c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
test eax, eax
je 0x6f1f60
mov edx, 0x6f291c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xa0]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xa0]
mov edx, 0x6f2944
call fcn.0040864c
jne 0x6f1f60
mov eax, dword [0x713594]
call fcn.004d5aa0
push 0
call sub.KERNEL32.DLL_ExitProcess_1
mov edx, 0x6f295c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
test eax, eax
je 0x6f1f99
mov edx, 0x6f295c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xa4]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xa4]
call fcn.006ed344
mov edx, 0x6f297c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
test eax, eax
je 0x6f1feb
mov edx, 0x6f297c
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xa8]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xa8]
mov edx, 0x6f2944
call fcn.0040864c
jne 0x6f1fe3
mov eax, dword [0x7142b4]
mov byte [eax], 1
jmp 0x6f1feb
mov eax, dword [0x7142b4]
mov byte [eax], 0
mov edx, 0x6f27d4
mov eax, dword [ebp - 0x50]
call fcn.005c3670
test eax, eax
je 0x6f203d
mov edx, 0x6f27d4
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xac]
mov ecx, dword [eax]
call dword [ecx - 0x24]
mov eax, dword [ebp - 0xac]
mov edx, 0x6f2944
call fcn.0040864c
jne 0x6f2035
mov eax, dword [0x713850]
mov byte [eax], 1
jmp 0x6f203d
mov eax, dword [0x713850]
mov byte [eax], 0
xor edx, edx
mov eax, 0x6f299c
call fcn.006ed1f0
mov eax, dword [0x713878]
mov eax, dword [eax]
xor edx, edx
call fcn.006ed1f0
mov eax, dword [0x7138b8]
mov eax, dword [eax]
xor edx, edx
call fcn.006ed1f0
call fcn.00424834
fstp qword [ebp - 0x78]
wait
push dword [ebp - 0x74]
push dword [ebp - 0x78]
lea edx, [ebp - 0x30]
mov eax, dword [0x7141e8]
call fcn.0042573c
xor edx, edx
mov eax, dword [ebp - 0x30]
call fcn.006ed1f0
call fcn.00424834
fstp qword [ebp - 0x80]
wait
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
lea edx, [ebp - 0x34]
mov eax, dword [0x7141e8]
call fcn.00425754
xor edx, edx
mov eax, dword [ebp - 0x34]
call fcn.006ed1f0
mov edx, dword [0x713878]
mov edx, dword [edx]
lea eax, [ebp - 0xb0]
mov ecx, 0x6f29b8
call fcn.00408514
mov eax, dword [ebp - 0xb0]
xor edx, edx
call fcn.006ed1f0
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.006ed1f0
cmp dword [ebp - 0x50], 0
jne 0x6f20f7
xor edx, edx
mov eax, 0x6f29cc
call fcn.006ed1f0
jmp 0x6f278d
mov edx, 0x6f2a44
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
mov edx, dword [0x5c0b24]
call fcn.00405a18
mov ebx, eax
mov edx, 0x6f2a60
mov eax, ebx
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xb4]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0xb4]
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
add eax, 4
call reloc.comctl32.dll_ImageList_DragEnter
mov edx, 0x6f2a78
mov eax, ebx
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xb8]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0xb8]
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
add eax, 8
call reloc.comctl32.dll_ImageList_DragEnter
mov edx, 0x6f2a90
mov eax, ebx
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xbc]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
add eax, 0xc
call reloc.comctl32.dll_ImageList_DragEnter
mov edx, 0x6f2aa8
mov eax, ebx
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xc0]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0xc0]
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
add eax, 0x10
call reloc.comctl32.dll_ImageList_DragEnter
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 4]
xor edx, edx
call fcn.006ed1f0
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
xor edx, edx
call fcn.006ed1f0
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0xc]
xor edx, edx
call fcn.006ed1f0
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
xor edx, edx
call fcn.006ed1f0
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [0x72e364]
call fcn.004a5bdc
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a4]
call fcn.004a5bdc
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
call fcn.004a5bdc
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a4]
call fcn.004a5bdc
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea edx, [ebp - 0x48]
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
call fcn.004211ec
test al, al
je 0x6f22e8
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea eax, [ebp - 0xc4]
call fcn.006e8a68
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
call fcn.004a5bdc
jmp 0x6f22fb
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
mov edx, 0x6f2ac0
call fcn.004a5bdc
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
mov edx, 0x6f2adc
call fcn.0040864c
je 0x6f2328
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
cmp dword [eax + 8], 0
jne 0x6f23c8
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a0]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3b0]
call fcn.004a5184
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
mov edx, dword [eax + 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3b4]
call fcn.004a5184
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a0]
call fcn.004a61e4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a8]
call fcn.004a61e4
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3b0]
mov edx, dword [eax + 0x4c]
add edx, 7
call fcn.004a5184
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3b4]
mov edx, dword [eax + 0x4c]
add edx, 7
call fcn.004a5184
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x39c]
mov edx, dword [eax + 0x4c]
add edx, 7
call fcn.004a5184
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3a4]
mov edx, dword [eax + 0x4c]
add edx, 7
call fcn.004a5184
xor eax, eax
push ebp
push 0x6f240c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6f2aec
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xc8]
mov ecx, dword [eax]
call dword [ecx]
mov edx, dword [ebp - 0xc8]
mov eax, dword [0x713610]
call reloc.comctl32.dll_ImageList_DragEnter
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6f2473
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b74
call fcn.0040864c
je 0x6f24a5
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b88
call fcn.0040864c
jne 0x6f24d8
mov ecx, dword [0x713f30]
mov eax, dword [0x7140bc]
mov eax, dword [eax]
mov edx, dword [0x6ed708]
call fcn.005350a0
mov eax, dword [0x72e364]
call fcn.00530514
mov eax, dword [0x713f30]
mov eax, dword [eax]
call fcn.0053051c
jmp 0x6f2562
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b9c
call fcn.0040864c
jne 0x6f24fd
mov eax, dword [0x72e364]
call fcn.00530514
jmp 0x6f2562
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2bb0
call fcn.0040864c
jne 0x6f255a
mov ecx, dword [0x713e94]
mov eax, dword [0x7140bc]
mov eax, dword [eax]
mov edx, dword [0x6eef50]
call fcn.005350a0
mov eax, dword [0x713e94]
mov eax, dword [eax]
mov eax, dword [eax + 0x3f0]
mov dl, 1
call fcn.004a5a9c
mov eax, dword [0x72e364]
call fcn.00530514
mov eax, dword [0x713e94]
mov eax, dword [eax]
call fcn.0053051c
jmp 0x6f2562
mov eax, dword [ebp - 0x3c]
call fcn.006f6958
lea eax, [ebp - 0x24]
mov edx, 0x6f2bc4
call fcn.00407888
lea eax, [ebp - 0x24]
mov edx, 0x6f2bdc
call fcn.004084bc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
call fcn.005c3670
call fcn.005c2848
lea edx, [ebp - 0xc]
call fcn.006e89e8
cmp dword [ebp - 0xc], 0
jne 0x6f25cc
xor edx, edx
mov eax, 0x6f2bf0
call fcn.006ed1f0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3d0]
call fcn.004a61e4
mov byte [0x713588], 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.006f5388
jmp 0x6f278d
lea eax, [ebp - 0x24]
mov edx, 0x6f2bc4
call fcn.00407888
lea eax, [ebp - 0x24]
mov edx, 0x6f2bdc
call fcn.004084bc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
call fcn.005c3670
mov ecx, eax
mov dl, 1
mov eax, dword [0x5c0b24]
call fcn.005c35e0
mov edx, eax
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 0x3c]
call fcn.006f6054
cmp dword [ebp - 0x10], 0
jne 0x6f2644
xor edx, edx
mov eax, 0x6f2c48
call fcn.006ed1f0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3d0]
call fcn.004a61e4
mov byte [0x713588], 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.006f5388
jmp 0x6f278d
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x10]
mov eax, dword [0x7139bc]
mov eax, dword [eax]
mov ecx, 0x6f28ec
call fcn.006e5824
lea eax, [ebp - 0x24]
mov edx, 0x6f2ca0
call fcn.00407888
lea eax, [ebp - 0x24]
mov edx, 0x6f2cbc
call fcn.004084bc
cmp dword [ebp - 0x14], 0
je 0x6f2697
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
call fcn.0040864c
jne 0x6f26c9
xor edx, edx
mov eax, 0x6f2ce0
call fcn.006ed1f0
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x3d0]
call fcn.004a61e4
mov byte [0x713588], 1
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.006f5388
jmp 0x6f278d
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x3c]
call fcn.006f5388
mov eax, dword [ebp - 0x3c]
add eax, 0x40c
mov edx, dword [ebp - 0x14]
call reloc.comctl32.dll_ImageList_DragEnter
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b74
call fcn.0040864c
je 0x6f2749
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b88
call fcn.0040864c
je 0x6f2749
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2bb0
call fcn.0040864c
je 0x6f2749
mov eax, dword [0x713754]
mov eax, dword [eax]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x10]
mov edx, 0x6f2b9c
call fcn.0040864c
jne 0x6f275c
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x40c]
mov eax, dword [ebp - 0x3c]
call fcn.006f38a0
jmp 0x6f278d
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x390]
xor edx, edx
call fcn.004a5a9c
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax + 0x40c]
mov eax, dword [ebp - 0x3c]
call fcn.006f2d20
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x390]
mov dl, 1
call fcn.004a5a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f27bf
lea eax, [ebp - 0xcc]
mov edx, 0x11
call fcn.004074c0
lea eax, [ebp - 0x38]
mov edx, 0xe
call fcn.004074c0
ret