Function at 0x4eccf0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check if file exists
Check mutex on windows
Check os version
Delete file
Extract resource via kernel32 functions
Get common file path
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fba2e
mov eax, dword fs:[0]
push eax
sub esp, 0xcd8
mov eax, dword [0x544af0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xbb8], 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0xbbc]
mov dword [ecx + 0x284], eax
cmp dword [0x548e70], 1
jle 0x4ecf1d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x870], eax
lea ecx, [ebp - 0x86c]
call fcn.004f3ec0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x870]
push edx
lea ecx, [ebp - 0x86c]
call fcn.004f4000
push str.uinst
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
test eax, eax
je 0x4ecda1
mov eax, dword [ebp - 0xbbc]
mov dword [eax + 0x10c], 0
push 0x515c84
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
test eax, eax
je 0x4ecdc5
mov ecx, dword [ebp - 0xbbc]
mov dword [ecx + 0x110], 1
push 0x515c88
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
test eax, eax
je 0x4ecdf9
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x114], 1
mov eax, dword [ebp - 0xbbc]
mov dword [eax + 0x10c], 1
push str.update
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
test eax, eax
je 0x4ece2d
mov ecx, dword [ebp - 0xbbc]
mov dword [ecx + 0x118], 1
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x10c], 1
push 0x515ca8
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
je 0x4ece6b
push 0
mov ecx, dword [ebp - 0x838]
call fcn.004f3bd0
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x278
call fcn.00403c80
push 0x515cac
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
je 0x4ecea9
push 0
mov ecx, dword [ebp - 0x838]
call fcn.004f3bd0
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x104
call fcn.00403c80
push str.setuplog
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0
je 0x4ecee7
push 0
mov ecx, dword [ebp - 0x838]
call fcn.004f3bd0
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x108
call fcn.00403c80
push str.deleteuserdata
lea ecx, [ebp - 0x86c]
call fcn.004f3c10
test eax, eax
je 0x4ecf0b
mov eax, dword [ebp - 0xbbc]
mov dword [eax + 0x120], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.004f3e50
mov ecx, dword [ebp - 0xbbc]
cmp dword [ecx + 0x114], 0
jne 0x4ecfea
push str.Mutex_QiyiInstaller
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x274], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ecfea
push ecx
mov ecx, esp
mov dword [ebp - 0xae0], esp
push 0x515d18
call fcn.00403ca0
mov dword [ebp - 0xbc0], eax
mov ecx, 0x549cf8
call fcn.004eb140
push 0x515d44
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x874]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ecfe3
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x880], 0xa
mov dword [ebp - 0x878], 0
lea ecx, [ebp - 0x880]
push ecx
push 0
push 0x4a
mov edx, dword [ebp - 0x874]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x884], eax
xor eax, eax
jmp 0x4ee7ed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xbbc]
mov dword [ecx + 0x25c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x260], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0xbbc]
mov dword [ecx + 0x264], eax
mov edx, dword [ebp - 0xbbc]
add edx, 0x29c
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0x58
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test eax, eax
jle 0x4ed070
push 0x58
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, eax
mov eax, 0x3c0
cdq
idiv ecx
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x144], eax
push 0x58
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x549cbc], eax
push 0x5a
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [0x549cb8], eax
mov edx, dword [ebp - 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x515d58
push 0
call fcn.004b840c
add esp, 8
mov dword [ebp - 0x828], 8
mov dword [ebp - 0x824], 0xff
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
lea ecx, [ebp - 0xae4]
push ecx
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb8e0
mov dword [ebp - 0xbc4], eax
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc8], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xbc8]
push eax
mov ecx, 0x549df8
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.004079a0
push 0
call fcn.00499f41
add esp, 4
mov ecx, dword [ebp - 0xbbc]
call fcn.004eaa00
mov ecx, dword [ebp - 0xbbc]
call fcn.004ea980
push 0x104
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb8
call fcn.00403a50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb8
call fcn.00406880
push 0
push 0x19
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb0
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb0
call fcn.00406880
push 0
push 0
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb4
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xb4
call fcn.00406880
push 0
push 2
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xe0
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xe0
call fcn.00406880
push 0
push 0x17
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xcc
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xcc
call fcn.00406880
push 0x104
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd4
call fcn.00403a50
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd4
call fcn.00406880
push 0
push 0x14
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc4
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc4
call fcn.00406880
push 0x5c
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd4
call fcn.004048d0
add eax, 1
push eax
lea ecx, [ebp - 0xae8]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd4
call fcn.00404a60
mov dword [ebp - 0xbcc], eax
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0xbd0]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xbc
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae8]
call fcn.004079a0
push 0
push 0x1a
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd8
call fcn.00403a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd8
call fcn.00406880
push 0x104
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
call fcn.00403a50
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
call fcn.00406880
push 1
lea ecx, [ebp - 0xaf0]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
call fcn.004049d0
mov dword [ebp - 0xbd4], eax
push 0x515d5c
mov edx, dword [ebp - 0xbd4]
push edx
call fcn.00404c80
add esp, 8
mov byte [ebp - 0xae9], al
lea ecx, [ebp - 0xaf0]
call fcn.004079a0
movzx eax, byte [ebp - 0xae9]
test eax, eax
je 0x4ed3f9
push 0x515d60
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
call fcn.004045f0
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004d72a0
push 0x515d64
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd8
push ecx
lea edx, [ebp - 0xaf4]
push edx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0xbdc]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xa8
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xa8
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004d72a0
call fcn.004041b0
mov dword [ebp - 0x830], eax
mov edx, dword [ebp - 0xbbc]
add edx, 0x148
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4ed778
mov eax, dword [ebp - 0xbbc]
cmp dword [eax + 0x14c], 6
jae 0x4ed60f
push 0x515d80
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x13c
call fcn.00403c80
push 0
push 0x23
lea ecx, [ebp - 0xa8c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [ebp - 0xa8c]
push edx
lea ecx, [ebp - 0xa90]
call fcn.00403ca0
mov dword [ebp - 4], 4
push str.QiYi
lea eax, [ebp - 0xa90]
push eax
lea ecx, [ebp - 0xaf8]
push ecx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xbe0], eax
mov edx, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe4], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xbe4]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xac
call fcn.004032c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xaf8]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
cmp dword [ecx + 0x14c], 5
jne 0x4ed5d3
mov edx, dword [ebp - 0xbbc]
cmp dword [edx + 0x150], 1
jne 0x4ed594
push str.windowsXP
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
jmp 0x4ed5d1
mov eax, dword [ebp - 0xbbc]
cmp dword [eax + 0x150], 2
jne 0x4ed5bb
push str.windows2003
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
jmp 0x4ed5d1
push str.windows2000
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
jmp 0x4ed5f8
mov ecx, dword [ebp - 0xbbc]
cmp dword [ecx + 0x14c], 5
jae 0x4ed5f8
push str.windows98
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa90]
call fcn.004079a0
jmp 0x4ed778
push 0x515dec
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x13c
call fcn.00403c80
push 0x104
lea edx, [ebp - 0xa8c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0xa8c]
push eax
lea ecx, [ebp - 0xa94]
call fcn.00403ca0
mov dword [ebp - 4], 6
push 2
lea ecx, [ebp - 0xafc]
push ecx
lea ecx, [ebp - 0xa94]
call fcn.00404a60
mov dword [ebp - 0xbe8], eax
mov edx, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xbec]
push eax
lea ecx, [ebp - 0xa94]
call fcn.004032c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xafc]
call fcn.004079a0
push str.UsersPublicQiYi
lea ecx, [ebp - 0xa94]
push ecx
lea edx, [ebp - 0xb00]
push edx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0xbf4], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xbf4]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xac
call fcn.004032c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb00]
call fcn.004079a0
mov edx, dword [ebp - 0xbbc]
cmp dword [edx + 0x14c], 6
jne 0x4ed766
mov eax, dword [ebp - 0xbbc]
cmp dword [eax + 0x150], 1
jne 0x4ed729
push str.windows7
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
jmp 0x4ed766
mov ecx, dword [ebp - 0xbbc]
cmp dword [ecx + 0x150], 2
jne 0x4ed750
push str.windows8
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
jmp 0x4ed766
push str.windows_Vista
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call fcn.00403c80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa94]
call fcn.004079a0
push 0x515e64
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x13c
call fcn.00403c80
push str.install.ini
mov edx, dword [ebp - 0xbbc]
add edx, 0xbc
push edx
lea eax, [ebp - 0xb04]
push eax
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xbf8], eax
mov ecx, dword [ebp - 0xbf8]
mov dword [ebp - 0xbfc], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0xbfc]
push edx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb04]
call fcn.004079a0
push 0x515e84
mov eax, dword [ebp - 0xbbc]
add eax, 0xbc
push eax
lea ecx, [ebp - 0xb08]
push ecx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc00], eax
mov edx, dword [ebp - 0xc00]
mov dword [ebp - 0xc04], edx
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0xc04]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call fcn.004032c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb08]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4ed9f5
push ecx
mov ecx, esp
mov dword [ebp - 0xb10], esp
push str.main_version
call fcn.00403ca0
mov dword [ebp - 0xc08], eax
lea ecx, [ebp - 0xb14]
push ecx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc0c], eax
mov edx, dword [ebp - 0xc0c]
mov dword [ebp - 0xc10], edx
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0xbb8]
or eax, 1
mov dword [ebp - 0xbb8], eax
mov ecx, dword [ebp - 0xc10]
call fcn.00404ce0
movzx ecx, al
test ecx, ecx
jne 0x4ed93e
push ecx
mov ecx, esp
mov dword [ebp - 0xb18], esp
push 0x515ec4
call fcn.00403ca0
mov dword [ebp - 0xc14], eax
lea edx, [ebp - 0xb1c]
push edx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xc1c], eax
mov ecx, dword [ebp - 0xbb8]
or ecx, 2
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0xc1c]
call fcn.00404ce0
movzx edx, al
test edx, edx
jne 0x4ed93e
mov dword [ebp - 0xc20], 0
jmp 0x4ed948
mov dword [ebp - 0xc20], 1
mov al, byte [ebp - 0xc20]
mov byte [ebp - 0xb09], al
mov ecx, dword [ebp - 0xbb8]
and ecx, 2
je 0x4ed971
and dword [ebp - 0xbb8], 0xfffffffd
lea ecx, [ebp - 0xb1c]
call fcn.004079a0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xbb8]
and edx, 1
je 0x4ed995
and dword [ebp - 0xbb8], 0xfffffffe
lea ecx, [ebp - 0xb14]
call fcn.004079a0
movzx eax, byte [ebp - 0xb09]
test eax, eax
je 0x4ed9f5
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
push ecx
push str.Invalid_Install.ini
lea edx, [ebp - 0xb20]
push edx
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xc24], eax
mov ecx, dword [ebp - 0xc24]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0xb20]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call fcn.00403710
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4edd01
push 0x515f08
push 0x320
mov eax, dword [ebp - 0xbbc]
mov ecx, dword [eax + 0x284]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 0
je 0x4edcec
push 0x515f10
mov edx, dword [ebp - 0xbbc]
add edx, 0xdc
push edx
lea eax, [ebp - 0xb24]
push eax
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc28], eax
mov ecx, dword [ebp - 0xc28]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xb24]
call fcn.004079a0
mov ecx, dword [ebp - 0xa98]
push ecx
mov edx, dword [ebp - 0xbbc]
mov eax, dword [edx + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 0
je 0x4edcea
mov ecx, dword [ebp - 0xa9c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xab4], eax
mov edx, dword [ebp - 0xa98]
push edx
mov eax, dword [ebp - 0xbbc]
mov ecx, dword [eax + 0x284]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xaa0], eax
lea ecx, [ebp - 0xab0]
call fcn.00498ef6
mov dword [ebp - 4], 0xc
push 0x515f34
mov edx, dword [ebp - 0xbbc]
add edx, 0xdc
push edx
lea eax, [ebp - 0xb2c]
push eax
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc2c], eax
mov ecx, dword [ebp - 0xc2c]
mov dword [ebp - 0xc30], ecx
mov byte [ebp - 4], 0xd
push 0
push 0x1002
mov ecx, dword [ebp - 0xc30]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
lea ecx, [ebp - 0xab0]
call fcn.0049937f
mov dword [ebp - 0xb28], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb2c]
call fcn.004079a0
cmp dword [ebp - 0xb28], 0
je 0x4edccb
mov edx, dword [ebp - 0xaa0]
push edx
mov eax, dword [ebp - 0xab4]
push eax
lea ecx, [ebp - 0xab0]
call fcn.00498c2c
lea ecx, [ebp - 0xab0]
call fcn.00498d18
lea ecx, [ebp - 0xab0]
call fcn.00498e90
push 0x515f58
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
push ecx
lea edx, [ebp - 0xb30]
push edx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xc38]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call fcn.004032c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb30]
call fcn.004079a0
mov edx, dword [ebp - 0xbbc]
cmp dword [edx + 0x10c], 0
je 0x4edc6d
push str.PStyleQiyiInstaller.log
mov eax, dword [ebp - 0xbbc]
add eax, 0xa8
push eax
lea ecx, [ebp - 0xb34]
push ecx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc3c], eax
mov edx, dword [ebp - 0xc3c]
mov dword [ebp - 0xc40], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0xc40]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call fcn.004032c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb34]
call fcn.004079a0
jmp 0x4edccb
push str.QiyiInstaller.log
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xdc
push ecx
lea edx, [ebp - 0xb38]
push edx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xc44], eax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xc48], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xc48]
push ecx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call fcn.004032c0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb38]
call fcn.004079a0
mov edx, dword [ebp - 0xa9c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xab0]
call fcn.0049900f
jmp 0x4edd01
push 0
push 0
push str.b_rN0R
call fcn.00497a2e
xor eax, eax
jmp 0x4ee7ed
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xc0
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x140
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
push str.winosversion
push 0x516008
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5c
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call fcn.004048d0
add eax, 1
push eax
lea eax, [ebp - 0x818]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call fcn.00404a60
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0x818]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004d72a0
push 0
push 0x1041
mov ecx, dword [ebp - 0xbbc]
add ecx, 0xd0
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x28c
mov edx, dword [ebp - 0xbbc]
mov eax, dword [edx + 0x28c]
mov edx, dword [eax + 0x20]
call edx
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x28c
call fcn.00408430
mov byte [ebp - 0x81c], 0xff
mov byte [ebp - 0x81b], 0xfe
push 2
lea eax, [ebp - 0x81c]
push eax
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x28c
mov edx, dword [ebp - 0xbbc]
mov eax, dword [edx + 0x28c]
mov edx, dword [eax + 0x38]
call edx
mov ecx, dword [ebp - 0xbbc]
call fcn.004ec5d0
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x104
call fcn.00404ce0
movzx eax, al
test eax, eax
jne 0x4ede8a
mov ecx, dword [ebp - 0xbbc]
add ecx, 0x104
push ecx
mov edx, esp
mov dword [ebp - 0xb3c], esp
push ecx
mov ecx, edx
call fcn.00402580
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xc50], eax
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0xb40], esp
push str.forcerun_param
call fcn.00403ca0
mov dword [ebp - 0xc54], eax
mov byte [ebp - 4], 0x11
call fcn.004d7830
add esp, 8
push 0x516030
mov ecx, dword [ebp - 0xbbc]
call fcn.0049a414
push 0x516050
push ecx
mov ecx, esp
mov dword [ebp - 0xb48], esp
push 0x516054
call fcn.00403ca0
mov dword [ebp - 0xc58], eax
lea ecx, [ebp - 0xb4c]
push ecx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc5c], eax
mov edx, dword [ebp - 0xc5c]
mov dword [ebp - 0xc60], edx
mov eax, dword [ebp - 0xc60]
push eax
call fcn.00404c60
add esp, 8
mov byte [ebp - 0xb41], al
lea ecx, [ebp - 0xb4c]
call fcn.004079a0
movzx ecx, byte [ebp - 0xb41]
test ecx, ecx
je 0x4edf23
mov edx, dword [ebp - 0xbbc]
cmp dword [edx + 0x10c], 0
je 0x4edf23
mov eax, dword [ebp - 0xbbc]
mov dword [eax + 0x110], 1
push 0x516064
push ecx
mov ecx, esp
mov dword [ebp - 0xb54], esp
push 0x516068
call fcn.00403ca0
mov dword [ebp - 0xc64], eax
lea ecx, [ebp - 0xb58]
push ecx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc68], eax
mov edx, dword [ebp - 0xc68]
mov dword [ebp - 0xc6c], edx
mov eax, dword [ebp - 0xc6c]
push eax
call fcn.00404c60
add esp, 8
mov byte [ebp - 0xb4d], al
lea ecx, [ebp - 0xb58]
call fcn.004079a0
movzx ecx, byte [ebp - 0xb4d]
test ecx, ecx
je 0x4edf9d
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x11c], 1
push 0x516078
push ecx
mov ecx, esp
mov dword [ebp - 0xb60], esp
push 0x51607c
call fcn.00403ca0
mov dword [ebp - 0xc70], eax
lea eax, [ebp - 0xb64]
push eax
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc74], eax
mov ecx, dword [ebp - 0xc74]
mov dword [ebp - 0xc78], ecx
mov edx, dword [ebp - 0xc78]
push edx
call fcn.00404c60
add esp, 8
mov byte [ebp - 0xb59], al
lea ecx, [ebp - 0xb64]
call fcn.004079a0
movzx eax, byte [ebp - 0xb59]
test eax, eax
je 0x4ee026
mov ecx, dword [ebp - 0xbbc]
cmp dword [ecx + 0x10c], 0
je 0x4ee026
mov edx, dword [ebp - 0xbbc]
mov dword [edx + 0x118], 1
mov eax, dword [ebp - 0xbbc]
cmp dword [eax + 0x118], 0
je 0x4ee145
lea ecx, [ebp - 0xab8]
push ecx
push 0xf003f
push 0
push str.SoftwareQiYi
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ee140
mov dword [ebp - 0xac0], 0x400
mov dword [ebp - 0xabc], 1
lea ecx, [ebp - 0xac4]
call fcn.004032e0
mov byte [ebp - 4], 0x13
lea edx, [ebp - 0xac0]
push edx
push 0x400
lea ecx, [ebp - 0xac4]
call fcn.00403a50
push eax
lea eax, [ebp - 0xabc]
push eax
push 0
push str.ChannelID
mov ecx, dword [ebp - 0xab8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0xac4]
call fcn.00406880
lea ecx, [ebp - 0xac4]
call fcn.00404ce0
movzx edx, al
test edx, edx
jne 0x4ee124
push ecx
mov ecx, esp
mov dword [ebp - 0xb68], esp
lea eax, [ebp - 0xac4]
push eax
call fcn.00402580
mov dword [ebp - 0xc7c], eax
mov ecx, dword [ebp - 0xc7c]
mov dword [ebp - 0xc80], ecx
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0xb6c], esp
push 0x5160bc
call fcn.00403ca0
mov dword [ebp - 0xc84], eax
mov byte [ebp - 4], 0x13
call fcn.004d7830
add esp, 8
mov edx, dword [ebp - 0xab8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xac4]
call fcn.004079a0
jmp 0x4ee751
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xacc]
push eax
lea ecx, [ebp - 0xad4]
call fcn.00403ca0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xad4]
call fcn.00401060
push ecx
mov ecx, esp
mov dword [ebp - 0xb70], esp
push str.mincid
call fcn.00403ca0
mov dword [ebp - 0xc88], eax
lea ecx, [ebp - 0xad0]
push ecx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc8c], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0xb74], esp
push str.maxcid
call fcn.00403ca0
mov dword [ebp - 0xc90], eax
lea edx, [ebp - 0xac8]
push edx
call fcn.004d7880
add esp, 8
mov dword [ebp - 0xc94], eax
mov byte [ebp - 4], 0x17
push 0
push str._cid
lea ecx, [ebp - 0xad4]
call fcn.00404850
cmp eax, 0xffffffff
je 0x4ee447
push 0x5160fc
lea ecx, [ebp - 0xad4]
call fcn.004045f0
push 0
push 0x516100
lea ecx, [ebp - 0xad4]
call fcn.00404850
add eax, 5
push eax
push 0
lea ecx, [ebp - 0xad4]
call fcn.004078a0
push 0
push 0x51610c
lea ecx, [ebp - 0xad4]
call fcn.00404850
push eax
lea eax, [ebp - 0xad8]
push eax
lea ecx, [ebp - 0xad4]
call fcn.00404a60
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xad0]
push ecx
push 0x516120
lea edx, [ebp - 0xb7c]
push edx
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xc9c], eax
mov byte [ebp - 4], 0x19
push 0x516110
mov ecx, dword [ebp - 0xc9c]
push ecx
lea edx, [ebp - 0xb80]
push edx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xca4], eax
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0xb78], esp
lea edx, [ebp - 0xac8]
push edx
mov eax, dword [ebp - 0xca4]
push eax
push ecx
call fcn.00407360
add esp, 0xc
mov dword [ebp - 0xca8], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb80]
call fcn.004079a0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xb7c]
call fcn.004079a0
lea ecx, [ebp - 0xad8]
call fcn.00404ce0
movzx ecx, al
test ecx, ecx
jne 0x4ee433
lea ecx, [ebp - 0xad8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xad0]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
cmp esi, eax
jl 0x4ee404
lea ecx, [ebp - 0xad8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xac8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
cmp esi, eax
jg 0x4ee404
lea ecx, [ebp - 0xad8]
call fcn.00407960
push ecx
mov ecx, esp
mov dword [ebp - 0xb84], esp
lea edx, [ebp - 0xad8]
push edx
call fcn.00402580
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xcb0], eax
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0xb88], esp
push 0x516174
call fcn.00403ca0
mov dword [ebp - 0xcb4], eax
mov byte [ebp - 4], 0x18
call fcn.004d7830
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0xb8c], esp
lea edx, [ebp - 0xad8]
push edx
push 0x516188
push ecx
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xcb8], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
jmp 0x4ee433
push ecx
mov eax, esp
mov dword [ebp - 0xb90], esp
lea ecx, [ebp - 0xad8]
push ecx
push 0x5161b8
push eax
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xcbc], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xad8]
call fcn.004079a0
jmp 0x4ee724
lea ecx, [ebp - 0xad0]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xac8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
cmp esi, eax
jge 0x4ee724
push 0
push 0x5161ec
lea ecx, [ebp - 0xad4]
call fcn.00404850
cmp eax, 0xffffffff
je 0x4ee724
push 0x5161f0
push 0x5161f4
lea ecx, [ebp - 0xad4]
call fcn.00404670
push 0x5c
lea ecx, [ebp - 0xad4]
call fcn.004048d0
add eax, 1
push eax
push 0
lea ecx, [ebp - 0xad4]
call fcn.004078a0
push 0
push 0x5161f8
lea ecx, [ebp - 0xad4]
call fcn.00404850
add eax, 1
push eax
push 0
lea ecx, [ebp - 0xad4]
call fcn.004078a0
push 0
push 0x5161fc
lea ecx, [ebp - 0xad4]
call fcn.00404850
push eax
lea edx, [ebp - 0xadc]
push edx
lea ecx, [ebp - 0xad4]
call fcn.00404a60
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0xad0]
push eax
push str.Current_Installer_Channel_ID_Range_From
lea ecx, [ebp - 0xb98]
push ecx
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xcc0], eax
mov edx, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc4], edx
mov byte [ebp - 4], 0x1d
push 0x516200
mov eax, dword [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0xb9c]
push ecx
call fcn.00404ae0
add esp, 0xc
mov dword [ebp - 0xcc8], eax
mov edx, dword [ebp - 0xcc8]
mov dword [ebp - 0xccc], edx
mov byte [ebp - 4], 0x1e
push ecx
mov eax, esp
mov dword [ebp - 0xb94], esp
lea ecx, [ebp - 0xac8]
push ecx
mov edx, dword [ebp - 0xccc]
push edx
push eax
call fcn.00407360
add esp, 0xc
mov dword [ebp - 0xcd0], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xb9c]
call fcn.004079a0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xb98]
call fcn.004079a0
lea ecx, [ebp - 0xadc]
call fcn.00404ce0
movzx eax, al
test eax, eax
jne 0x4ee715
lea ecx, [ebp - 0xadc]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
test eax, eax
jle 0x4ee715
lea ecx, [ebp - 0xadc]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xad0]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
cmp esi, eax
jl 0x4ee6e6
lea ecx, [ebp - 0xadc]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
mov esi, eax
lea ecx, [ebp - 0xac8]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call fcn.004b8592
add esp, 4
cmp esi, eax
jg 0x4ee6e6
lea ecx, [ebp - 0xadc]
call fcn.00407960
push ecx
mov ecx, esp
mov dword [ebp - 0xba0], esp
lea edx, [ebp - 0xadc]
push edx
call fcn.00402580
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xcd8], eax
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, esp
mov dword [ebp - 0xba4], esp
push str.channelid
call fcn.00403ca0
mov dword [ebp - 0xcdc], eax
mov byte [ebp - 4], 0x1c
call fcn.004d7830
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0xba8], esp
lea edx, [ebp - 0xadc]
push edx
push 0x516278
push ecx
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xce0], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
jmp 0x4ee715
push ecx
mov eax, esp
mov dword [ebp - 0xbac], esp
lea ecx, [ebp - 0xadc]
push ecx
push str.Channel_ID_Beyond_Range
push eax
call fcn.00404b90
add esp, 0xc
mov dword [ebp - 0xce4], eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004eb140
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xadc]
call fcn.004079a0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xac8]
call fcn.004079a0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xad0]
call fcn.004079a0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xad4]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
call fcn.004ea8c0
mov edx, dword [ebp - 0xbbc]
mov byte [edx + 0x27c], al
lea eax, [ebp - 0xbb0]
push eax
mov ecx, dword [ebp - 0xbbc]
call fcn.004ebe60
lea ecx, [ebp - 0xbb0]
call fcn.004079a0
mov ecx, dword [ebp - 0xbbc]
call fcn.004ebb60
mov dword [ebp - 0x820], 0
push 0
lea ecx, [ebp - 0x814]
call fcn.004ea0c0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x814]
call fcn.0049ad4a
mov dword [ebp - 0x820], eax
mov dword [ebp - 0xbb4], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x814]
call fcn.004e9f70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x818]
call fcn.004079a0
mov eax, dword [ebp - 0xbb4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004b5e12
mov esp, ebp
pop ebp
ret 8