Function at 0x40da90
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Get program files directory
Persist via run registry key
Set current directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52b0bf
mov eax, dword fs:[0]
push eax
mov eax, 0x10534
call fcn.00511fe0
mov eax, dword [0x58482c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x588198], 0
je 0x40dacd
call fcn.0040d0f0
push 0
push 0x26
lea eax, [ebp - 0x10424]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x10424]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.00401020
mov dword [ebp - 4], 0
cmp dword [0x588198], 0
je 0x40db29
push 0
push 0x53d710
lea ecx, [ebp - 0x1042c]
call fcn.0040f940
cmp eax, 0xffffffff
jne 0x40db29
push 0x53d718
lea ecx, [ebp - 0x1042c]
call fcn.0040f650
push 0
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x53d720
mov edx, 6
add edx, 0x81
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [0x587f10], 0
je 0x40db81
push 0xa
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
cmp dword [ebp - 0x18], 0x64
jbe 0x40dd35
push 0
push 0x53d728
push 0x53d738
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x10444]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104a4], eax
mov eax, dword [ebp - 0x104a4]
mov dword [ebp - 0x104a8], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x104a8]
push ecx
lea edx, [ebp - 0x10448]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104ac], eax
mov ecx, dword [ebp - 0x104ac]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x10448]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10444]
call fcn.004019f0
push 0x53d73c
push 0x53d74c
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x1044c]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104b0], eax
mov edx, dword [ebp - 0x104b0]
mov dword [ebp - 0x104b4], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x104b4]
push eax
lea ecx, [ebp - 0x10450]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104b8], eax
mov ecx, dword [ebp - 0x104b8]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x10450]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1044c]
call fcn.004019f0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 0x10438]
push ecx
call fcn.004077b0
mov dword [ebp - 0x244], 0xffffffff
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00406470
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x1043c], ecx
mov dword [ebp - 0x244], 0
jmp 0x40dcec
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x1043c]
jae 0x40dd29
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.00406470
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.004063b0
jmp 0x40dcdd
mov eax, dword [ebp - 0x10438]
push eax
call fcn.004063d0
cmp dword [0x587f10], 0
je 0x40dd4e
push 0x1e
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
cmp dword [0x588198], 0
je 0x40df6a
push 0x53d750
mov ecx, 7
add ecx, 0x81
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x64
jbe 0x40df68
mov byte [0x58819d], 1
lea eax, [ebp - 0x10424]
push eax
lea ecx, [ebp - 0x1042c]
call fcn.004010a0
push 0x53d4dd
push 0x53d758
lea ecx, [ebp - 0x1042c]
call fcn.0040f670
push 0
push 0x53d760
push 0x53d770
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x10454]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104bc], eax
mov eax, dword [ebp - 0x104bc]
mov dword [ebp - 0x104c0], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x104c0]
push ecx
lea edx, [ebp - 0x10458]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104c4], eax
mov ecx, dword [ebp - 0x104c4]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x10458]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10454]
call fcn.004019f0
push 0x53d774
push 0x53d784
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x1045c]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104c8], eax
mov edx, dword [ebp - 0x104c8]
mov dword [ebp - 0x104cc], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x104cc]
push eax
lea ecx, [ebp - 0x10460]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104d0], eax
mov ecx, dword [ebp - 0x104d0]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [ebp - 0x10460]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1045c]
call fcn.004019f0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea ecx, [ebp - 0x10438]
push ecx
call fcn.004077b0
mov dword [ebp - 0x244], 0xffffffff
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x10438]
push eax
call fcn.00406470
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x1043c], ecx
mov dword [ebp - 0x244], 0
jmp 0x40df1f
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x1043c]
jae 0x40df5c
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.00406470
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x10438]
push edx
call fcn.004063b0
jmp 0x40df10
mov eax, dword [ebp - 0x10438]
push eax
call fcn.004063d0
jmp 0x40df71
mov byte [0x58819d], 1
cmp dword [0x587f10], 0
je 0x40df8a
push 0x32
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
cmp dword [0x588198], 0
je 0x40dfbc
movzx ecx, byte [0x58819d]
test ecx, ecx
jne 0x40dfbc
push 0x53d788
mov edx, 0x12
add edx, 0x81
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
jmp 0x40dfd7
push 0x53d790
mov eax, 0xd
add eax, 0x81
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
push 0xffdc
push 0
lea edx, [ebp - 0x10224]
push edx
call fcn.00511c50
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
lea edx, [ebp - 0x10224]
push edx
call fcn.00511270
add esp, 0xc
push str.ini.reg
push 0x53d7a4
push 0x53d7b4
lea eax, [ebp - 0x1042c]
push eax
lea ecx, [ebp - 0x10464]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104d4], eax
mov edx, dword [ebp - 0x104d4]
mov dword [ebp - 0x104d8], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x104d8]
push eax
lea ecx, [ebp - 0x10468]
push ecx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104dc], eax
mov edx, dword [ebp - 0x104dc]
mov dword [ebp - 0x104e0], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x104e0]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0040cd30
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x10468]
call fcn.004019f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10464]
call fcn.004019f0
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10428], eax
cmp dword [ebp - 0x10428], 0xffffffff
je 0x40e122
push 0
push 0
push 0
mov edx, dword [ebp - 0x10428]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x10440]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10224]
push edx
mov eax, dword [ebp - 0x10428]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10428]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x587f10], 0
je 0x40e13b
push 0x46
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
lea ecx, [ebp - 0x10430]
call fcn.0040f5f0
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x14]
push edx
push str._S___s_
lea eax, [ebp - 0x10430]
push eax
call fcn.00410150
add esp, 0xc
push 0
push 0x53d7c0
push 0x53d7d0
lea ecx, [ebp - 0x1042c]
push ecx
lea edx, [ebp - 0x1046c]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104e4], eax
mov eax, dword [ebp - 0x104e4]
mov dword [ebp - 0x104e8], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x104e8]
push ecx
lea edx, [ebp - 0x10470]
push edx
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x104ec], eax
mov eax, dword [ebp - 0x104ec]
mov dword [ebp - 0x104f0], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x104f0]
call fcn.00401750
push eax
lea ecx, [ebp - 0x10430]
call fcn.00401750
push eax
push str.regedit.exe
push 0
push 0
call fcn.0040d830
add esp, 0x18
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x10470]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1046c]
call fcn.004019f0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5881b8
call fcn.00401750
push eax
push str.TC_TCServer
push 0x53d7ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
mov ecx, dword [0x5881a0]
push ecx
push str.TC_TCPort
push 0x53d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d9b0
add esp, 0x10
mov ecx, 0x5881b4
call fcn.00401750
push eax
push str.TC_PatchServer
push 0x53d840
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
mov edx, dword [0x5881a4]
push edx
push str.TC_HTTP_Port
push 0x53d86c
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d9b0
add esp, 0x10
mov ecx, 0x5881ac
call fcn.0040fa10
mov ecx, 0x5882a8
call fcn.0040fa10
mov ecx, 0x5881b0
call fcn.0040fa10
mov ecx, 0x5881ac
call fcn.00401750
push eax
push str.TC_Org
push 0x53d890
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
mov ecx, 0x5882a8
call fcn.00401750
push eax
push str.TC_Section
push 0x53d8b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
mov ecx, 0x5881b0
call fcn.00401750
push eax
push str.TC_User_office
push 0x53d8e4
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
push 0x53d900
lea ecx, [ebp - 0x10474]
call fcn.00401020
mov dword [ebp - 0x104f4], eax
mov eax, dword [ebp - 0x104f4]
mov dword [ebp - 0x104f8], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x104f8]
push ecx
push 0x53d910
lea ecx, [ebp - 0x10478]
call fcn.00401020
mov dword [ebp - 0x104fc], eax
mov edx, dword [ebp - 0x104fc]
mov dword [ebp - 0x10500], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x10500]
push eax
lea ecx, [ebp - 0x10424]
push ecx
lea edx, [ebp - 0x1047c]
push edx
call fcn.0040ce00
add esp, 0xc
mov dword [ebp - 0x10504], eax
mov eax, dword [ebp - 0x10504]
mov dword [ebp - 0x10508], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10508]
push ecx
lea edx, [ebp - 0x10480]
push edx
call fcn.0040fc30
add esp, 0xc
mov dword [ebp - 0x1050c], eax
mov eax, dword [ebp - 0x1050c]
mov dword [ebp - 0x10510], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10510]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.0040f610
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x10480]
call fcn.004019f0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1047c]
call fcn.004019f0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x10478]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10474]
call fcn.004019f0
cmp dword [0x588198], 0
je 0x40e550
movzx edx, byte [0x58819d]
test edx, edx
jne 0x40e550
push 0
push 0x53d914
lea ecx, [ebp - 0x1042c]
call fcn.0040f940
cmp eax, 0xffffffff
jne 0x40e550
push 0x53d91c
lea ecx, [ebp - 0x10484]
call fcn.00401020
mov dword [ebp - 0x10514], eax
mov eax, dword [ebp - 0x10514]
mov dword [ebp - 0x10518], eax
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10518]
push ecx
push str.__x86__
lea ecx, [ebp - 0x10488]
call fcn.00401020
mov dword [ebp - 0x1051c], eax
mov edx, dword [ebp - 0x1051c]
mov dword [ebp - 0x10520], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x10520]
push eax
lea ecx, [ebp - 0x10424]
push ecx
lea edx, [ebp - 0x1048c]
push edx
call fcn.0040ce00
add esp, 0xc
mov dword [ebp - 0x10524], eax
mov eax, dword [ebp - 0x10524]
mov dword [ebp - 0x10528], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10528]
push ecx
lea edx, [ebp - 0x10490]
push edx
call fcn.0040fc30
add esp, 0xc
mov dword [ebp - 0x1052c], eax
mov eax, dword [ebp - 0x1052c]
mov dword [ebp - 0x10530], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x10530]
push ecx
lea ecx, [ebp - 0x1042c]
call fcn.0040f610
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x10490]
call fcn.004019f0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1048c]
call fcn.004019f0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10488]
call fcn.004019f0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10484]
call fcn.004019f0
cmp dword [0x588198], 0
je 0x40e590
movzx edx, byte [0x58819d]
test edx, edx
je 0x40e590
push 0
push 0x53d934
lea ecx, [ebp - 0x1042c]
call fcn.0040f940
cmp eax, 0xffffffff
je 0x40e590
push 0x53d4de
push str.__x86_
lea ecx, [ebp - 0x1042c]
call fcn.0040f670
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
push str.TC_InstallPath
push 0x53d954
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
push str._m__d__Y
lea eax, [ebp - 0x10434]
push eax
lea ecx, [ebp - 0x10498]
push ecx
call fcn.0040e7f0
mov ecx, eax
call fcn.0040e830
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x10434]
call fcn.00401750
push eax
push str.TC_IDATE
push str.SOFTWARETrueCut_tc_INSTALL
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
cmp dword [0x5881a8], 0
jne 0x40e634
push 0
push str.EnableLUA
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d9b0
add esp, 0x10
push 1
push str.UacDisableNotify
push str.SoftwareMicrosoftSecurity_Center
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d9b0
add esp, 0x10
cmp dword [0x587f10], 0
je 0x40e64d
push 0x5a
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
lea ecx, [ebp - 0x1042c]
call fcn.00401750
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x53da24
push 0x53da34
lea edx, [ebp - 0x1042c]
push edx
lea eax, [ebp - 0x1049c]
push eax
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x10534], eax
mov ecx, dword [ebp - 0x10534]
mov dword [ebp - 0x10538], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x10538]
push edx
lea eax, [ebp - 0x104a0]
push eax
call fcn.0040cd30
add esp, 0xc
mov dword [ebp - 0x1053c], eax
mov ecx, dword [ebp - 0x1053c]
mov dword [ebp - 0x10540], ecx
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x10540]
push edx
lea ecx, [ebp - 0x14]
call fcn.0040f610
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x104a0]
call fcn.004019f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1049c]
call fcn.004019f0
push 5
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push 0
push 0
call fcn.0040d830
add esp, 0x18
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push 0x53da38
push 0x53da44
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
push str.tc_au.exe
push str.trojancut.exe
lea ecx, [ebp - 0x14]
call fcn.0040f670
lea ecx, [ebp - 0x14]
call fcn.00401750
push eax
push str.TrojanCutAutoPatch
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040d8b0
add esp, 0x10
cmp dword [0x588198], 0
je 0x40e769
call fcn.0040d120
cmp dword [0x587f10], 0
je 0x40e782
push 0x64
mov ecx, dword [0x587f10]
add ecx, 0x74
call fcn.0040e900
cmp dword [0x587f10], 0
je 0x40e796
mov ecx, dword [0x587f10]
call fcn.0040ca40
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10434]
call fcn.004019f0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10430]
call fcn.004019f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004019f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1042c]
call fcn.004019f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00511b60
mov esp, ebp
pop ebp
ret