Function at 0x43c170
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x4a5080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 0xc]
push 0
push 4
push eax
mov eax, dword [0x4ac894]
add eax, 0xc12f3c
push eax
push dword [0x4ac7fc]
call edi
push 0
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x14
push eax
push dword [0x4ac7fc]
call edi
push 0
push 4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x3c
push eax
push dword [0x4ac7fc]
call edi
push 0
push 4
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0xc]
push dword [0x4ac7fc]
call edi
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x68]
push 0
push 8
push ecx
lea eax, [esi + 0x1a8]
push eax
push dword [0x4ac7fc]
mov dword [ebp - 0x20], eax
call edi
push 0
push 8
lea ecx, [ebp - 0x70]
lea eax, [esi + 0x1b0]
push ecx
push eax
push dword [0x4ac7fc]
mov dword [ebp - 0xcc], eax
call edi
push 0
push 8
lea ecx, [ebp - 0x68]
lea eax, [esi + 0x1b8]
push ecx
push eax
push dword [0x4ac7fc]
mov dword [ebp - 0xd0], eax
call edi
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test ax, ax
jns 0x43cea6
mov eax, dword [0x4ac874]
mov esi, dword [ebp - 0x20]
cmp eax, 1
jne 0x43c353
movsd xmm0, qword [0x497278]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971b8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4972b0]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x78], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x4c]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 2
jne 0x43c442
movsd xmm0, qword [0x497270]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971a0]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497218]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x80], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 3
jne 0x43c537
movsd xmm0, qword [0x497200]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971b0]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497260]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x88], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 4
jne 0x43c62c
movsd xmm0, qword [0x4972b8]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497188]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497250]
lea eax, [ebp - 0x28]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x90], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 5
jne 0x43c721
movsd xmm0, qword [0x4972a0]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497180]
lea eax, [ebp - 0x30]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497258]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x98], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x2c]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 6
jne 0x43c816
movsd xmm0, qword [0x497298]
lea eax, [ebp - 0x30]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497190]
lea eax, [ebp - 0x34]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4972c0]
lea eax, [ebp - 0x30]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xa0], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xa0]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 7
jne 0x43c90b
movsd xmm0, qword [0x497220]
lea eax, [ebp - 0x34]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971a8]
lea eax, [ebp - 0x38]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497230]
lea eax, [ebp - 0x34]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xa8], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xa8]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x34]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 8
jne 0x43ca00
movsd xmm0, qword [0x497240]
lea eax, [ebp - 0x38]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971c0]
lea eax, [ebp - 0x3c]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497288]
lea eax, [ebp - 0x38]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xb0], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x38]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 9
jne 0x43caf5
movsd xmm0, qword [0x497210]
lea eax, [ebp - 0x3c]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971d0]
lea eax, [ebp - 0x40]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971e8]
lea eax, [ebp - 0x3c]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xb8], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x3c]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 0xa
jne 0x43cbea
movsd xmm0, qword [0x497208]
lea eax, [ebp - 0x40]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971c8]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x4971f0]
lea eax, [ebp - 0x40]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xc0], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 0xb
jne 0x43ccdf
movsd xmm0, qword [0x497238]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497160]
lea eax, [ebp - 0x48]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x18], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497248]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0xc8], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 0xc
jne 0x43cdce
movsd xmm0, qword [0x497290]
lea eax, [ebp - 0x48]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x10], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 8
push esi
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497168]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 8
push dword [ebp - 0xcc]
movsd qword [ebp - 0x58], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 8
push dword [ebp - 0xcc]
push dword [0x4ac7fc]
call edi
movsd xmm0, qword [0x497280]
lea eax, [ebp - 0x48]
push eax
push 0x40
push 8
push dword [ebp - 0xd0]
movsd qword [ebp - 0x70], xmm0
push dword [0x4ac7fc]
call edi
push 0
push 8
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
push 8
push dword [ebp - 0xd0]
push dword [0x4ac7fc]
call edi
mov eax, dword [0x4ac874]
cmp eax, 0xd
jne 0x43cea6
movsd xmm0, qword [0x497268]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x58], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x58]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 8
push esi
push dword [0x4ac7fc]
call edi
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0xc]
movsd xmm0, qword [0x497178]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x68], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x68]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 8
push esi
push dword [0x4ac7fc]
call edi
mov esi, dword [ebp - 0xd0]
lea eax, [ebp - 0x14]
movsd xmm0, qword [0x497228]
push eax
push 0x40
push 8
push esi
push dword [0x4ac7fc]
movsd qword [ebp - 0x58], xmm0
call edi
push 0
push 8
lea eax, [ebp - 0x58]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push 8
push esi
push dword [0x4ac7fc]
call edi
mov esi, dword [0x4ac894]
lea eax, [ebp - 0xc]
push eax
push 0x40
add esi, 0x4405ef
mov byte [ebp - 0x1c], 1
cmp byte [0x4ac866], 0
push 1
push esi
push dword [0x4ac7fc]
jne 0x43ced2
mov byte [ebp - 0x1c], 0
call edi
push 0
push 1
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [0x4ac7fc]
call ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 1
push esi
push dword [0x4ac7fc]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00481c53
mov esp, ebp
pop ebp
ret