Function at 0x41deb0
Capabilities:
Check mutex on windows
Compare security identifiers
Initialize winsock library
Resolve dns

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c9a3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x20d0
call fcn.004d7530
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x20d4], esi
mov dword [ebp - 0x20c0], ecx
mov edi, dword [ebx + 8]
lea ecx, [ebp - 0x1ac0]
push 0x16
xor eax, eax
mov dword [ebp - 0x1ab0], 0
push str.______Init_Begin______
mov dword [ebp - 0x1aac], 7
mov word [ebp - 0x1ac0], ax
call fcn.00413520
mov dword [ebp - 4], 0
call fcn.00420710
lea eax, [ebp - 0x20b0]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov byte [ebp - 0x20d8], 0
mov dword [ebp - 0x20dc], 0
push 0xffffffffffffffff
mov byte [ebp - 4], 1
call dword [sym.imp.IMM32.dll_ImmDisableIME]
lea eax, [ebp - 0x20b8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41ec66
lea eax, [ebp - 0x20d0]
mov dword [ebp - 0x20d0], 0
push eax
push 0x800
lea eax, [ebp - 0x1aa0]
push eax
push 1
push dword [ebp - 0x20b8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41ec66
push dword [ebp - 0x20b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x800
lea eax, [ebp - 0xaa0]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x12a0]
push 0x800
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
mov dword [ebp - 0x20bc], 0x400
lea eax, [ebp - 0x1aa8]
mov dword [ebp - 0x20c4], 0x400
push eax
lea eax, [ebp - 0x20c4]
push eax
lea eax, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x20bc]
push eax
lea eax, [ebp - 0xaa0]
push eax
push dword [ebp - 0x1aa0]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
push str.SYSTEM
lea eax, [ebp - 0xaa0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x41e06e
push str.NT_AUTHORITY
lea eax, [ebp - 0x12a0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x41ec66
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x41e08c
push 0xc
mov dword [edi], 0xb
push str.IsInSafeMode
jmp 0x41ec73
mov byte [ebp - 0x20c4], 0
mov dword [ebp - 0x20c8], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20c8]
push esi
mov dword [esi], 0
call fcn.0041d7d0
add esp, 4
test al, al
jne 0x41e0ee
push 0x15
push str.ParseStartFlag_Failed
lea ecx, [ebp - 0x1ac0]
mov dword [edi], 0xa
call fcn.00413520
call fcn.00420710
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
mov eax, dword [esi]
test eax, eax
jne 0x41e128
push 0x30
push str.p_startUpInfo.m_dwStartupFlag__START_FLAG_NULL
lea ecx, [ebp - 0x1ac0]
mov dword [edi], 0xd
call fcn.00413520
call fcn.00420710
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
cmp eax, 0x201
jne 0x41e1a9
push dword [ebp - 0x20c0]
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x20b8], 0
call fcn.0044fe90
lea eax, [ebp - 0x20b8]
mov byte [ebp - 4], 0x15
push eax
lea eax, [esi + 0x414]
push eax
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x20dc]
call fcn.0041da80
add esp, 8
mov byte [ebp - 0x20b1], al
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 2
call fcn.00424a60
cmp byte [ebp - 0x20b1], 0
jne 0x41e19e
mov dword [edi], 9
push str.ParseCmdPara_Failed
jmp 0x41e987
mov eax, dword [ebp - 0x20b8]
mov dword [0x5d1f0c], eax
cmp dword [esi], 1
jne 0x41e270
push 0x5947dc
push dword [ebp - 0x20c0]
call fcn.004d9502
add esp, 8
mov dword [ebp - 0x20b8], eax
test eax, eax
je 0x41e270
cmp word [eax + 6], 0
je 0x41e270
push 0x40
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.004d9fe0
mov eax, dword [ebp - 0x20b8]
add esp, 0xc
add eax, 6
push 0x557374
push eax
call fcn.004d9502
add esp, 8
test eax, eax
jne 0x41e21a
mov eax, dword [ebp - 0x20b8]
push 0x1f
add eax, 6
push eax
jmp 0x41e22d
mov edx, dword [ebp - 0x20b8]
lea ecx, [edx + 6]
cmp eax, ecx
jbe 0x41e23e
sub eax, ecx
sar eax, 1
push eax
push ecx
lea eax, [ebp - 0x260]
push 0x20
push eax
call fcn.004e2f3b
add esp, 0x10
cmp word [ebp - 0x260], 0
je 0x41e270
push 0xa
lea eax, [ebp - 0x20bc]
mov dword [ebp - 0x20bc], 0
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004e3583
add esp, 0xc
mov dword [esi + 0x424], eax
push 0
mov dword [ebp - 0x20b8], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x20bc], eax
cmp eax, 0x80010106
je 0x41e293
test eax, eax
js 0x41e2cb
lea ecx, [ebp - 0x20b8]
call fcn.00413fa0
test eax, eax
js 0x41e2cb
push 0xff
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ecx
mov ecx, dword [ebp - 0x20b8]
lea edx, [ebp - 0x218]
call fcn.00414300
add esp, 4
mov ecx, dword [ebp - 0x20b8]
test ecx, ecx
je 0x41e2db
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x20bc], 0
jl 0x41e2ea
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.004594a0
lea ecx, [ebp - 0x13c]
mov byte [ebp - 0x20b1], 0
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
call fcn.0044fd40
push 8
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], reloc.WS2_32.dll_bind
mov dword [ebp - 0x138], 7
call fcn.00450b00
cmp byte [ebp - 0x20], 0
lea eax, [ebp - 0x130]
movups xmm0, xmmword [str.MACHINE]
cmove eax, dword [ebp - 0x134]
movups xmmword [eax + 4], xmm0
push 1
push 0
push 0
push str.SoftwareSogouInput
lea eax, [ebp - 0x20c8]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0x148]
call fcn.0044f620
test al, al
jne 0x41e403
lea ecx, [ebp - 0x20c8]
call fcn.00450c80
push 0x5a09d0
push 0x5971f4
push eax
call fcn.00450580
mov byte [ebp - 4], 2
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x41e3b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x20], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x41e47b
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x130]
cmp eax, ecx
je 0x41e47b
push eax
call fcn.004e1b56
add esp, 4
lea ecx, [ebp - 0x20c8]
call fcn.00450cd0
jmp 0x41e4f1
push 0x80
lea eax, [ebp - 0x2a0]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
mov dword [ebp - 0x20bc], 0x80
lea eax, [ebp - 0x20bc]
lea ecx, [ebp - 0x148]
push 1
push str.Version
push eax
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x20c8]
push eax
call fcn.0044f780
test al, al
jne 0x41e488
lea ecx, [ebp - 0x20c8]
call fcn.00450c80
push 0x5a09b4
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x148]
call fcn.0044f5d0
lea ecx, [ebp - 0x20c8]
call fcn.00450cd0
jmp 0x41e4f1
call fcn.004602e0
lea ecx, [ebp - 0x2a0]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41e4b9
test dx, dx
je 0x41e4b5
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41e4b9
add ecx, 4
add eax, 4
test dx, dx
jne 0x41e493
xor ecx, ecx
jmp 0x41e4be
sbb ecx, ecx
or ecx, 1
movzx eax, byte [ebp - 0x20b1]
test ecx, ecx
mov ecx, 1
mov byte [ebp - 4], 2
cmove eax, ecx
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x20bc], eax
call fcn.0044f5d0
cmp byte [ebp - 0x20bc], 0
jne 0x41e573
push str.bImeVersionSameToReg_false
lea ecx, [ebp - 0x1ac0]
call fcn.0041f230
call fcn.00420710
mov eax, dword [esi]
test eax, 0x104
jne 0x41e556
cmp eax, 0x201
jne 0x41e53d
mov ecx, 3
call fcn.004192d0
lea ecx, [ebp - 0x20c8]
mov dword [edi], 7
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
cmp eax, 1
jne 0x41e573
push 0
push 0x5945a4
push 0x594848
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x20c8]
mov dword [edi], 7
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
test byte [esi], 0x80
je 0x41e5aa
push str.p_startUpInfo.m_dwStartupFlag__START_FLAG_FIREWALL
lea ecx, [ebp - 0x1ac0]
mov dword [edi], 8
call fcn.0041f230
call fcn.00420710
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 0x20b1], 1
call fcn.00450c20
jmp 0x41ec8a
lea eax, [ebp - 0x20bc]
mov dword [ebp - 0x20bc], 0
push eax
mov edx, esi
call fcn.0041d310
add esp, 4
test al, al
jne 0x41e5d9
mov dword [edi], 6
push str.InitPyCore_failed
jmp 0x41e987
movups xmm0, xmmword [str.5E7CCEC5_2A10_4717_A11E_97E922791046]
mov ax, word [0x594968]
push 0x1be
movups xmmword [ebp - 0x220], xmm0
mov word [ebp - 0x1d8], ax
lea eax, [ebp - 0x1d6]
movups xmm0, xmmword [0x594930]
push 0
push eax
movups xmmword [ebp - 0x210], xmm0
movups xmm0, xmmword [0x594940]
movups xmmword [ebp - 0x200], xmm0
movups xmm0, xmmword [0x594950]
movups xmmword [ebp - 0x1f0], xmm0
movq xmm0, qword [0x594960]
movq qword [ebp - 0x1e0], xmm0
call fcn.004d9fe0
mov eax, dword [0x5df850]
add esp, 0xc
test al, 1
jne 0x41e698
or eax, 1
mov dword [0x5df858], 0
mov dword [0x5df850], eax
lea eax, [ebp - 0x220]
push eax
push 0x104
push 0x5df85e
mov word [0x5dfa66], 0
call fcn.004e1af2
add esp, 0xc
mov ecx, 0x5df858
call fcn.00460910
push 0x537cd0
call fcn.004d7173
add esp, 4
mov eax, dword [esi]
cmp eax, 4
je 0x41e7d7
cmp eax, 0x100
je 0x41e7d7
push ecx
push 0
push str.701AADFD_9D5C_495f_94B4_70362B36C1AC
lea ecx, [ebp - 0x1f20]
call fcn.004608a0
mov byte [ebp - 4], 0x17
cmp byte [0x5df85c], 0
je 0x41e763
cmp byte [ebp - 0x1f1c], 0
jne 0x41e763
mov eax, dword [esi]
cmp eax, 0x201
jne 0x41e6f4
mov ecx, 1
call fcn.004192d0
jmp 0x41e726
test al, 4
je 0x41e712
push 0x59496c
push 0x5d50d8
call fcn.00414600
add esp, 8
mov dword [edi], 5
jmp 0x41e72c
push 0
push 0x594a24
push 0x59496c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [edi], 4
push str.pChecker__AnotherAppIsRunning__
lea ecx, [ebp - 0x1ac0]
call fcn.0041f230
call fcn.00420710
lea ecx, [ebp - 0x1f20]
call fcn.004608e0
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
lea ecx, [ebp - 0x1f20]
mov byte [ebp - 4], 2
call fcn.004608e0
push str.IME_INSTALLING_MUTEX
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x20c0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x20c0], 0
je 0x41e7a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x41e7a8
call fcn.00438bd0
mov eax, dword [ebp - 0x20c0]
test eax, eax
je 0x41e7b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 4
jne 0x41e802
call fcn.0041d790
test al, al
je 0x41e802
mov dword [edi], 3
push str.p_startUpInfo.m_dwStartupFlag__START_FLAG_SILENT__needReboot__
jmp 0x41e987
cmp byte [0x5df85c], 0
je 0x41e772
push 0x59496c
push 0x5d50d8
call fcn.00414600
add esp, 8
mov dword [edi], 5
push str.pChecker__AnotherAppIsRunning__
jmp 0x41e987
cmp dword [esi], 1
jne 0x41e9ae
call fcn.0041d790
test al, al
je 0x41e838
push 0
push 0x594ae8
push 0x594afc
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [edi], 2
push str.needReboot__
jmp 0x41e987
push 0x110
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], 0x114
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
lea eax, [ebp - 0x20b8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41e94e
lea eax, [ebp - 0x20bc]
mov dword [ebp - 0x20bc], 0
push eax
push 0x800
lea eax, [ebp - 0xaa0]
push eax
push 2
push dword [ebp - 0x20b8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x41e8b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41e94e
push dword [ebp - 0x20b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20d0]
mov dword [ebp - 0x1aa8], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x1aa8]
mov word [ebp - 0x1aa4], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41e94e
xor esi, esi
mov byte [ebp - 0x20b1], 0
cmp dword [ebp - 0xaa0], esi
jle 0x41e939
nop dword [eax]
push dword [ebp + esi*8 - 0xa9c]
push dword [ebp - 0x20d0]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41e932
inc esi
cmp esi, dword [ebp - 0xaa0]
jl 0x41e910
jmp 0x41e939
mov byte [ebp - 0x20b1], 1
push dword [ebp - 0x20d0]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [ebp - 0x20b1], 0
jne 0x41e9ae
xor edx, edx
lea ecx, [ebp - 0x130]
call fcn.0045e9f0
test al, al
je 0x41e9ae
cmp dword [ebp - 0x12c], 6
jae 0x41e9ae
push 0
push 0x594ae8
push 0x594b38
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [edi], 1
push str.CurrentUserIsAdmin_failed
lea ecx, [ebp - 0x1ac0]
call fcn.0041f230
call fcn.00420710
lea ecx, [ebp - 0x20c8]
mov byte [ebp - 0x20b1], 0
call fcn.00450c20
jmp 0x41ec8a
lea ecx, [ebp - 0x1be8]
call fcn.0044fd40
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1be0]
push 6
mov dword [ebp - 0x1be4], 5
call fcn.00450b00
cmp byte [ebp - 0x1acc], 0
lea ecx, [ebp - 0x1bdc]
movq xmm0, qword [str.YYID]
cmove ecx, dword [ebp - 0x1be0]
movq qword [ecx + 4], xmm0
mov eax, dword [0x594ba8]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x20cc]
call fcn.004369c0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0x1be8]
push dword [ebp - 0x20cc]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x1be8]
push str._path___expiresThu__07_Mar_43_09:14:07_GMT__domain.sogou.com
push 0x5971f4
push eax
call fcn.00450580
cmp byte [ebp - 0x1acc], 0
lea eax, [ebp - 0x1bdc]
mov ecx, str.http:__sogou.com
cmove eax, dword [ebp - 0x1be0]
add esp, 4
add eax, 4
push eax
call fcn.0041de30
add esp, 0xc
mov dword [ebp - 0x1be4], 5
lea ecx, [ebp - 0x1be0]
push 6
call fcn.00450b00
cmp byte [ebp - 0x1acc], 0
lea ecx, [ebp - 0x1bdc]
movq xmm0, qword [str.YYID]
cmove ecx, dword [ebp - 0x1be0]
movq qword [ecx + 4], xmm0
mov eax, dword [0x594ba8]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x1be8]
push dword [ebp - 0x20cc]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x1be8]
push str._path___expiresThu__07_Mar_43_09:14:07_GMT__domain.sohu.com
push 0x5971f4
push eax
call fcn.00450580
cmp byte [ebp - 0x1acc], 0
lea eax, [ebp - 0x1bdc]
mov ecx, str.http:__sohu.com
cmove eax, dword [ebp - 0x1be0]
add esp, 4
add eax, 4
push eax
call fcn.0041de30
add esp, 0xc
mov dword [ebp - 0x1be4], 5
lea ecx, [ebp - 0x1be0]
push 6
call fcn.00450b00
cmp byte [ebp - 0x1acc], 0
lea ecx, [ebp - 0x1bdc]
movq xmm0, qword [str.YYID]
cmove ecx, dword [ebp - 0x1be0]
movq qword [ecx + 4], xmm0
mov eax, dword [0x594ba8]
mov dword [ecx + 0xc], eax
push dword [ebp - 0x20cc]
lea eax, [ebp - 0x1be8]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x1be8]
push str._path___expiresThu__07_Mar_43_09:14:07_GMT__domain.soso.com
push 0x5971f4
push eax
call fcn.00450580
cmp byte [ebp - 0x1acc], 0
lea eax, [ebp - 0x1bdc]
mov ecx, str.http:__soso.com
cmove eax, dword [ebp - 0x1be0]
add esp, 4
add eax, 4
push eax
call fcn.0041de30
add esp, 0xc
lea ecx, [ebp - 0x1d10]
push str.IMEVER
call fcn.0044fe90
mov byte [ebp - 4], 0x1a
call fcn.004602e0
push eax
lea eax, [ebp - 0x1d10]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x1d10]
push str._path___expiresThu__07_Mar_43_09:14:07_GMT__domain.sogou.com
push 0x5971f4
push eax
call fcn.00450580
cmp byte [ebp - 0x1bf4], 0
lea eax, [ebp - 0x1d04]
mov ecx, str.http:__sogou.com
cmove eax, dword [ebp - 0x1d08]
add esp, 4
add eax, 4
push eax
call fcn.0041de30
mov eax, dword [ebp - 0x20d4]
add esp, 0xc
cmp dword [eax], 4
jne 0x41ec16
push str.www.sogou.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
push str.______Init_End______
lea ecx, [ebp - 0x1ac0]
mov dword [edi], 0
call fcn.0041f230
call fcn.00420710
lea ecx, [ebp - 0x1d10]
mov byte [ebp - 0x20b1], 1
call fcn.00424a60
lea ecx, [ebp - 0x20cc]
call fcn.00413c80
lea ecx, [ebp - 0x1be8]
call fcn.00424a60
lea ecx, [ebp - 0x20c8]
call fcn.00450c20
jmp 0x41ec8a
push 0x19
mov dword [edi], 0xc
push str._CurrentUserIsSystem_True
lea ecx, [ebp - 0x1ac0]
call fcn.00413520
call fcn.00420710
mov byte [ebp - 0x20b1], 0
lea ecx, [ebp - 0x20dc]
call fcn.00450c20
lea ecx, [ebp - 0x1ac0]
call fcn.004134c0
mov al, byte [ebp - 0x20b1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret