Function at 0x5ba7464c
Capabilities:
Check mutex on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x5bb70c3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x158], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x150], ebx
lea edi, [ebp - 0x14c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
push 6
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
mov dword [ebp - 0x128], ebx
push ebx
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x164], 8
mov dword [ebp - 0x160], 0x37ff
mov dword [ebp - 0x13c], ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x15c], ebx
call dword [sym.imp.ole32.dll_OleInitialize]
lea edi, [esi + 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x38], ebx
jne 0x5ba746ec
cmp dword [esi + 0x48], ebx
jne 0x5ba746ec
push 3
call dword [0x5bb70bb0]
mov dword [esi + 0x48], 1
inc dword [esi + 0x18]
mov ecx, dword [ebp - 0x158]
cmp ecx, ebx
mov eax, dword [esi + 0x18]
je 0x5ba746fe
mov dword [ecx], eax
cmp dword [esi + 0x18], 1
push edi
jle 0x5ba74712
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
jmp 0x5ba7532e
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
and al, 0x40
sub al, 0x40
neg al
sbb eax, eax
inc eax
push eax
call fcn.5ba82b68
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10c], eax
mov edi, 0x1073
jl 0x5ba75264
call fcn.5ba562f0
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
push ebx
neg eax
push ebx
mov dword [0x5bb73890], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.5ba82bcf
test eax, eax
jne 0x5ba74777
mov dword [ebp - 0x10c], 0x8004100a
jmp 0x5ba7530c
mov eax, dword [ebp - 0x130]
cmp dword [eax + 8], ebx
jne 0x5ba747dd
push 0x5ba50450
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, ebx
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 8], eax
jne 0x5ba747dd
mov dword [ebp - 0x120], 0x1742
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], ebx
call esi
mov dword [ebp - 0x110], eax
jmp 0x5ba750ca
test byte [ebp + 8], 8
jne 0x5ba747f4
mov eax, dword [ebp - 0x130]
push 0xffffffffffffffff
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x130]
cmp dword [eax + 0x1c], ebx
mov dword [ebp - 0x15c], 1
jne 0x5ba74818
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x130]
mov dword [ecx + 0x1c], eax
call fcn.5bae54fd
cmp dword [0x5bb7382c], ebx
jne 0x5ba74848
push 0x5bb7382c
call sub.INETCOMM.dll_MimeOleGetAllocator
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74848
mov dword [ebp - 0x120], 0x1743
jmp 0x5ba75232
push 2
call sub.INETCOMM.dll_MimeOleSetCompatMode
cmp dword [0x5bb73898], ebx
jne 0x5ba7487d
push 0x5bb73898
push 0x5ba513e8
push 1
push ebx
push 0x5ba513f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jl 0x5ba7508e
call fcn.5ba7ec21
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jl 0x5ba75264
cmp dword [ebp - 0x12c], ebx
je 0x5ba74901
push dword [ebp - 0x12c]
push ebx
call sub.MSOERT2.dll_PszToANSI
cmp eax, ebx
mov dword [ebp - 0x12c], eax
je 0x5ba750ca
push eax
call fcn.5ba7f51d
push dword [ebp - 0x12c]
mov dword [ebp - 0x10c], eax
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0x10c], ebx
jne 0x5ba748e6
mov dword [ebp - 0x10c], 0x8004100a
jmp 0x5ba752e1
jge 0x5ba74901
mov dword [ebp - 0x120], 0x1744
mov dword [ebp - 0x11c], 0x175a
jmp 0x5ba7523c
test byte [ebp + 8], 0x20
mov dword [ebp - 0x10c], 0x5ba503d8
jne 0x5ba7491b
mov dword [ebp - 0x10c], 0x5ba50410
lea eax, [ebp - 0x1b4]
push eax
push dword [ebp - 0x10c]
push dword [0x5bb73710]
call sub.SHLWAPI.dll_Ordinal_69
test eax, eax
jne 0x5ba749dc
push 0xa
pop ecx
lea edi, [ebp - 0x1b4]
rep stosd dword es:[edi], eax
mov eax, dword [0x5bb73710]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x1b4]
push eax
mov dword [ebp - 0x1b0], 0x5ba5a064
call sub.SHLWAPI.dll_Ordinal_131
test ax, ax
jne 0x5ba749d7
push dword [ebp - 0x10c]
push ebx
call sub.MSOERT2.dll_PszToANSI
mov edi, eax
mov dword [ebp - 0x128], 0x1073
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x120], 0x1748
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], edi
call esi
mov dword [ebp - 0x110], eax
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
jmp 0x5ba74d99
mov edi, 0x1073
cmp dword [0x5bb7380c], ebx
jne 0x5ba74a99
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x14c]
push ebx
push dword [0x5bb73710]
push ebx
push ebx
push eax
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x150]
push eax
push dword [ebp - 0x14c]
push dword [ebp - 0x150]
push SysReAllocString
push dword [ebp - 0x10c]
push dword [ebp - 0x10c]
push 8
call sub.SHLWAPI.dll_Ordinal_55
cmp eax, ebx
mov dword [0x5bb7380c], eax
jne 0x5ba74a99
push dword [ebp - 0x10c]
push ebx
call sub.MSOERT2.dll_PszToANSI
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x120], 0x1748
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], eax
call esi
push dword [ebp - 0x12c]
mov dword [ebp - 0x110], eax
mov eax, dword [0x5bb73714]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
jmp 0x5ba74ae0
push ebx
push ebx
call fcn.5ba7f6b4
test eax, eax
jne 0x5ba74aef
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x120], 0x174a
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], ebx
call esi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0x80004005
jmp 0x5ba75270
push ebx
push ebx
call fcn.5ba7d3c9
cmp eax, 0x8004100a
mov dword [ebp - 0x10c], eax
je 0x5ba752e1
cmp eax, ebx
jl 0x5ba75228
test byte [ebp + 8], 1
je 0x5ba74bbb
push 0xae
call fcn.5ba5c700
test eax, eax
jne 0x5ba74bbb
mov eax, dword [0x5bb7381c]
and eax, 0xb
cmp al, 0xb
je 0x5ba74bbb
mov eax, dword [ebp - 0x130]
add eax, 0x44
push eax
push 0x5ba52434
push 1
push ebx
push 0x5ba52454
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x5ba74bbb
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [eax + 0x44]
mov edi, dword [ecx]
add eax, 0x40
push eax
push 6
push 0xc
push dword [ebp - 0x12c]
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor ecx, ecx
cmp eax, 8
mov eax, dword [ebp - 0x130]
setle cl
add eax, 0x44
lea ecx, [ecx + ecx + 5]
push ecx
push dword [0x5bb73708]
push dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x12c]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edi, 0x1073
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba4dab4
push 0x5ba4c6b4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x134], 4
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
je 0x5ba74bf9
or dword [ebp - 0x138], 0xffffffff
cmp dword [ebp - 0x138], ebx
jne 0x5ba74c10
mov dword [0x5bb7079c], 0xb
jmp 0x5ba74ccd
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba4daa4
push 0x5ba4c690
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x134], 4
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
je 0x5ba74c4e
or dword [ebp - 0x154], 0xffffffff
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba4daa4
push 0x5ba4c690
push SysReAllocString
mov dword [ebp - 0x134], 4
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
je 0x5ba74c90
or eax, 0xffffffff
mov dword [ebp - 0x138], eax
jmp 0x5ba74c96
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x154]
cmp ecx, 0xffffffff
je 0x5ba74cb9
cmp eax, 0xffffffff
je 0x5ba74caa
cmp ecx, eax
jbe 0x5ba74cb2
mov dword [0x5bb7079c], ecx
jmp 0x5ba74ccd
mov dword [0x5bb7079c], eax
jmp 0x5ba74ccd
cmp eax, 0xffffffff
mov dword [0x5bb7079c], eax
jne 0x5ba74ccd
mov dword [0x5bb7079c], 1
push 0x5ba45d7c
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x5bb73814], eax
lea eax, [ebp - 0x18c]
push eax
push 0x5ba45d18
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_GetClassInfoA]
test eax, eax
jne 0x5ba74db2
push 0xa
pop ecx
lea edi, [ebp - 0x18c]
rep stosd dword es:[edi], eax
mov eax, dword [0x5bb73708]
push 0x7f00
push ebx
mov dword [ebp - 0x188], 0x5bb4fb58
mov dword [ebp - 0x17c], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x174], eax
lea eax, [ebp - 0x18c]
push eax
mov dword [ebp - 0x168], 0x5ba45d18
mov dword [ebp - 0x170], 6
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x5ba74dad
mov dword [ebp - 0x128], 0x1073
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x120], 0x1748
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], 0x5ba45d18
call esi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], 0x80004005
mov edi, 0x1073
jmp 0x5ba75270
mov edi, 0x1073
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp eax, ebx
je 0x5ba74de5
lea ecx, [ebp - 0x150]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0x14
pop eax
add dword [ebp - 0x150], eax
add dword [ebp - 0x14c], eax
sub dword [ebp - 0x144], eax
sub dword [ebp - 0x148], eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba4cb20
push ebx
mov dword [ebp - 0x134], 0x104
call fcn.5ba57361
test eax, eax
jne 0x5ba74e75
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x12c]
push eax
push ebx
push 0x5ba4cb34
push ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x10c], 4
call fcn.5ba57361
xor eax, eax
cmp dword [ebp - 0x12c], ebx
setne al
push eax
lea eax, [ebp - 0x108]
push eax
push dword [0x5bb7380c]
call fcn.5baf2380
test eax, eax
jl 0x5ba74e75
push 0x5ba4cb20
push ebx
call fcn.5bac0fea
push 0x5ba4cb34
push ebx
call fcn.5bac0fea
lea eax, [ebp - 0x164]
push eax
call dword [0x5ba5607c]
cmp dword [0x5bb73820], ebx
jne 0x5ba74f42
push 0x5bb73820
call fcn.5ba6eaae
push eax
call fcn.5ba7d460
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74eb7
mov dword [ebp - 0x120], 0x174e
jmp 0x5ba75232
push 0x10
call fcn.5ba5615b
cmp eax, ebx
pop ecx
je 0x5ba74ed2
mov ecx, eax
call fcn.5ba7d4ef
mov dword [ebp - 0x13c], eax
jmp 0x5ba74ed8
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0x13c], ebx
jne 0x5ba74eef
mov dword [ebp - 0x120], 0x1751
jmp 0x5ba747a6
mov ecx, dword [ebp - 0x13c]
call fcn.5ba7d508
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74f13
mov dword [ebp - 0x120], 0x1752
jmp 0x5ba75232
mov eax, dword [0x5bb73820]
mov ecx, dword [eax]
push 0x5bb70798
push dword [ebp - 0x13c]
push eax
call dword [ecx + 0x34]
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74f42
mov dword [ebp - 0x120], 0x1754
jmp 0x5ba75232
cmp dword [0x5bb7386c], ebx
jne 0x5ba74f93
push 0x5bb7386c
push ebx
call fcn.5ba7d52c
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74f6e
mov dword [ebp - 0x120], 0x17cf
jmp 0x5ba75232
mov eax, dword [0x5bb7386c]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74f93
mov dword [ebp - 0x120], 0x17d0
jmp 0x5ba75232
cmp dword [0x5bb73830], ebx
jne 0x5ba74ff3
push 0x6c8
call fcn.5ba5615b
cmp eax, ebx
pop ecx
je 0x5ba74fb3
mov ecx, eax
call fcn.5ba7d663
jmp 0x5ba74fb5
xor eax, eax
cmp eax, ebx
mov dword [0x5bb73830], eax
jne 0x5ba74fcd
mov dword [ebp - 0x120], 0x1755
jmp 0x5ba747a6
push dword [0x5bb73820]
mov ecx, eax
call fcn.5ba7d6fe
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba74ff3
mov dword [ebp - 0x120], 0x1756
jmp 0x5ba75232
push 1
call fcn.5ba7d77c
cmp dword [0x5bb7383c], ebx
jne 0x5ba75028
push 1
push 0x5bb7383c
push ebx
call fcn.5ba7d7e7
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba75028
mov dword [ebp - 0x120], 0x1757
jmp 0x5ba75232
cmp dword [0x5bb73838], ebx
jne 0x5ba7507c
push 0x5bb73838
push 0x5ba51558
push 1
push ebx
push 0x5ba51568
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x5ba7505b
mov dword [ebp - 0x120], 0x1758
jmp 0x5ba747a6
mov eax, dword [0x5bb73838]
mov edi, dword [eax]
push ebx
push 0x5ba4ce24
call fcn.5ba57156
push eax
push dword [0x5bb73838]
call dword [edi + 0xc]
mov edi, 0x1073
push dword [ebp + 8]
call fcn.5ba7e27c
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jge 0x5ba7509d
mov dword [ebp - 0x120], 0x183e
jmp 0x5ba75232
call fcn.5ba79f8f
cmp dword [0x5bb73c8c], ebx
jne 0x5ba750ee
push 0xc
call fcn.5ba5615b
cmp eax, ebx
pop ecx
je 0x5ba750bf
mov ecx, eax
call fcn.5ba7a1c0
jmp 0x5ba750c1
xor eax, eax
cmp eax, ebx
mov dword [0x5bb73c8c], eax
jne 0x5ba750d9
mov dword [ebp - 0x10c], 0x8007000e
jmp 0x5ba75270
mov ecx, eax
call fcn.5ba7a1d9
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jl 0x5ba75264
push 0xc6
call fcn.5ba5c700
test eax, eax
je 0x5ba75103
push 0x1e
call fcn.5ba6add4
cmp dword [0x5bb73840], ebx
jne 0x5ba7519f
push 0x5ba45d68
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba45d50
mov dword [0x5bb73840], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba45d40
mov dword [0x5bb73844], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba4ccd8
mov dword [0x5bb73848], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba4cd00
mov dword [0x5bb7384c], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba4cd80
mov dword [0x5bb73850], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba45d28
mov dword [0x5bb73854], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba4cd98
mov dword [0x5bb73858], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
push 0x5ba4cdb4
mov dword [0x5bb7385c], eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatA]
mov dword [0x5bb73860], eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba44ce4
push 0x5ba4ce24
mov dword [ebp - 0x134], 4
call fcn.5ba57156
push eax
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
jne 0x5ba751e2
mov eax, dword [ebp - 0x138]
mov dword [0x5bb73894], eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x5ba4f13c
push 0x5ba4f120
push SysReAllocString
mov dword [ebp - 0x134], 4
call sub.SHLWAPI.dll_SHGetValueA
test eax, eax
je 0x5ba75220
push 1
call fcn.5ba5c5e7
push ebx
call fcn.5babc5ac
jmp 0x5ba75264
mov dword [ebp - 0x120], 0x1745
mov dword [ebp - 0x11c], 0x1759
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], 0x1741
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], ebx
call esi
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x10c], 0x8004100a
je 0x5ba752d9
test byte [ebp + 8], 0x10
je 0x5ba752d9
cmp dword [ebp - 0x10c], ebx
jge 0x5ba752d9
cmp dword [ebp - 0x120], ebx
jne 0x5ba752ba
mov dword [ebp - 0x128], edi
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], 0x175c
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], 0x175b
mov dword [ebp - 0x114], ebx
call esi
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x128]
push eax
push ebx
push dword [ebp - 0x10c]
push dword [0x5bb73708]
call fcn.5bae5562
cmp dword [ebp - 0x15c], ebx
je 0x5ba752f0
mov eax, dword [ebp - 0x130]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [ebp - 0x13c], ebx
je 0x5ba75304
mov eax, dword [ebp - 0x13c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x10c], ebx
jge 0x5ba75328
mov ecx, dword [ebp - 0x130]
call fcn.5ba7374b
push dword [ebp - 0x158]
mov ecx, dword [0x5bb73808]
call fcn.5ba6f505
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 0xc