Function at 0x4176ed
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0xc
call fcn.0043359f
add esp, 4
mov dword [ebp - 0x24], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx], 0x4e0039
push ebx
add ebx, 8
push ebx
push 8
call fcn.0043359f
add esp, 4
pop ebx
push ebx
mov dword [ebx], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
pop ebx
pop ebx
push ebx
mov eax, esp
push eax
call fcn.0040dbb0
pop ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
call fcn.0040a6f7
mov dword [ebp - 0x30], eax
push VariantClear
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x4177b9
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x434490
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x4177e2
push ebx
call fcn.00433599
add esp, 4
fild qword [ebp - 0x38]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fsub qword [0x4df8a3]
fstp qword [ebp - 0x48]
push 0x80000601
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
mov ebx, 0x435110
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x417828
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov eax, 0x4df87e
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.00407c69
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x41786b
push ebx
call fcn.00433599
add esp, 4
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x417880
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x4178ab
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x40], eax
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x4178d6
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push str.sbh96darkModefalsedid
mov ebx, dword [ebp + 0x18]
push dword [ebx]
push str.sw1080fttapptype22abiarm64userRecoBit3device_abiarm64totalMemory5644grant_browse_typeAUTHORIZEDiuidrdid
push dword [ebp - 0x44]
push str.sh2400deviceBit1browseType3ddpi440socNameMediaTek_20MT6833Pis_background0c
push dword [ebp - 0x40]
push str.oc
push dword [ebp - 4]
push str.keyconfig_state2cdid_tag7sysANDROID_11max_memory256cold_launch_time_ms
push dword [ebp - 4]
push str.androidApiLevel30slh0country_codecnnbh44hotfix_verdid_gt
push dword [ebp - 0x3c]
push str.android_os0boardPlatformmt6833kpnNEBULAnewOc
mov ebx, dword [ebp + 0x30]
push dword [ebx]
push str.thermal10000netWIFIkcv1506app0kpfANDROID_PHONEbottom_navigationtruever11.4oDid
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push str.did_tag0egid
push dword [ebp - 0x38]
push str.appver11.4.20.5583ispCTCClanguagezh_cnud
mov ebx, dword [ebp + 0x2c]
push dword [ebx]
mov ebx, dword [ebp + 0x24]
push dword [ebx]
push str.https:__apijs.ksapisrv.com_rest_nebula_photo_comment_add_earphoneMode1mod
mov ecx, 0x17
call fcn.00401243
add esp, 0x5c
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x417973
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x417983
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x417993
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x4179a3
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x48]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4179b7
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0xffffffffffffffff
push 8
push 0x16013442
push 0x52010001
call fcn.004335c3
add esp, 0x10
mov dword [ebp - 0x2c], eax
push 1
push 1
push 1
push 1
lea eax, [ebp - 0x2c]
push eax
call fcn.0040abe3
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x4179fe
push ebx
call fcn.00433599
add esp, 4
push str.uQaTag219_23
mov ebx, dword [ebp + 0x28]
push dword [ebx]
push str.csfalseclient_key2ac2a76dkuaishou.api_st
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push str._7C_7B_5C_22pg_5C_22_3A_5C_22sl_5C_22_7D_7C_7B_5C_22r_5C_22_3A140_2C_5C_22mix_5C_22_3A_5C_221_1_0_0_0_5C_22_7D_22_7D_7DvideoModelCrowdTag1_5osandroidtoken
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push str._7C_7B_5C_22pg_5C_22_3A_5C_22sl_5C_22_7D_7C_7B_5C_22r_5C_22_3A140_2C_5C_22mix_5C_22_3A_5C_221_1_0_0_0_5C_22_7D_22_2C_22st_reco_stgy_id_22_3A_221_7C2006007228839152433_7Cphoto_3A
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push str._7C1_i_2F2006007228839152433_sl140blexpTagListCk4KSWZlZWRfcGhvdG98NTE5MDk2MTYyMDYwNDI5NDU2M3wxOTI5NjM4NTE2fDFfaS8yMDA2MDA3MjI4ODM5MTUyNDMzX3NsMTQwYmwSATE_3DcommentReportParams_7B_22commentRelativeTime_22_3A14838_2C_22playCnt_22_3A0_7DisCopyAtfalseinner_log_ctx_7B_22stid_container_22_3A_7B_22st_reco_id_22_3A_221_7C2006007228839152433_7Cphoto_3A
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x4dfc64
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push str.isQuickfalseexpTag1_i_2F2006007228839152433_sl140blpictureTokensserverExpTagfeed_photo_7C
mov ebx, dword [ebp + 0x38]
push dword [ebx]
push str.reply_toreplyToCommentIdcopy0emotionId
push dword [ebp - 0x30]
push str._2F3_2F1_i_2F2006007228839152433_sl140bl_23addcommentcontent
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0x4dfb9a
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.refererks_3A_2F_2Fphoto_2F
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0x4dfb5f
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push str.photo_id
mov ecx, 0x19
call fcn.00401243
add esp, 0x64
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x417a99
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x417aad
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov eax, 0x4dffdb
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00407c69
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x417af1
push ebx
call fcn.00433599
add esp, 4
mov dword [ebp - 0x3c], esp
push dword [ebp - 0xc]
push dword [ebp - 0x38]
mov eax, 0x21
call fcn.004335b7
cmp dword [ebp - 0x3c], esp
je 0x417b20
push 0xa1b
push 0x401348e
push 6
call fcn.004335ab
add esp, 0xc
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x417b33
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x417b4f
push eax
mov ebx, eax
call fcn.004011d8
inc eax
push eax
call fcn.0043359f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x417b60
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], esp
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0x20]
push dword [ebx]
mov eax, 0x22
call fcn.004335b7
cmp dword [ebp - 0x2c], esp
je 0x417b95
push 0xa73
push 0x401348e
push 6
call fcn.004335ab
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x417bb4
push eax
mov ebx, eax
call fcn.004011d8
inc eax
push eax
call fcn.0043359f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x417bc5
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], esp
push dword [ebp - 0x10]
push str._rest_nebula_photo_comment_add
mov eax, 0x23
call fcn.004335b7
cmp dword [ebp - 0x2c], esp
je 0x417bfa
push 0xaae
push 0x401348e
push 6
call fcn.004335ab
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x417c19
push eax
mov ebx, eax
call fcn.004011d8
inc eax
push eax
call fcn.0043359f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x417c2a
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov eax, 0x4df87e
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call fcn.00407c69
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x417c6d
push ebx
call fcn.00433599
add esp, 4
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x417c82
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x3c], eax
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x417cad
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x40], eax
push VariantClear
push 0
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebx]
test eax, eax
jne 0x417cd8
mov eax, 0x4df369
push eax
push 1
mov ebx, 0x433fc0
call fcn.004335a5
add esp, 0x10
mov dword [ebp - 0x44], eax
push dword [ebp - 0x14]
push str.__NStokensig
push dword [ebp - 0x10]
push str.sig
push dword [ebp - 0x18]
push str.__NS_sig3
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push str.sbh96darkModefalsedid
mov ebx, dword [ebp + 0x18]
push dword [ebx]
push str.sw1080fttapptype22abiarm64userRecoBit3device_abiarm64totalMemory5644grant_browse_typeAUTHORIZEDiuidrdid
push dword [ebp - 0x44]
push str.sh2400deviceBit1browseType3ddpi440socNameMediaTek_20MT6833Pis_background0c
push dword [ebp - 0x40]
push str.oc
push dword [ebp - 4]
push str.keyconfig_state2cdid_tag7sysANDROID_11max_memory256cold_launch_time_ms
push dword [ebp - 4]
push str.androidApiLevel30slh0country_codecnnbh44hotfix_verdid_gt
push dword [ebp - 0x3c]
push str.android_os0boardPlatformmt6833kpnNEBULAnewOc
mov ebx, dword [ebp + 0x30]
push dword [ebx]
push str.thermal10000netWIFIkcv1506app0kpfANDROID_PHONEbottom_navigationtruever11.4oDid
mov ebx, dword [ebp + 0x1c]
push dword [ebx]
push str.did_tag0egid
push dword [ebp - 0x38]
push str.appver11.4.20.5583ispCTCClanguagezh_cnud
mov ebx, dword [ebp + 0x2c]
push dword [ebx]
mov ebx, dword [ebp + 0x24]
push dword [ebx]
push str.https:__apijs.ksapisrv.com_rest_nebula_photo_comment_add_earphoneMode1mod
mov ecx, 0x1d
call fcn.00401243
add esp, 0x74
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x417d8d
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x417d9d
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x417dad
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x417dbd
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x48]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x417dd1
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
push 8
call fcn.0043359f
add esp, 4
mov dword [ebp - 0x38], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
push 1
push dword [ebp + 0x34]
mov dword [ebp - 0x4c], 0
push 0
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x58], 0
push 0
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x5c], 0
push 0
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x60], 0
push 0
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x64], 0
push 0
lea eax, [ebp - 0x64]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push 1
push 1
lea eax, [ebp - 8]
push eax
call fcn.0040b4af
mov dword [ebp - 0x68], eax
mov ebx, dword [ebp - 0x64]
test ebx, ebx
je 0x417ed8
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x60]
test ebx, ebx
je 0x417ee8
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x5c]
test ebx, ebx
je 0x417ef8
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x58]
test ebx, ebx
je 0x417f08
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x4c]
test ebx, ebx
je 0x417f18
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x44]
test ebx, ebx
je 0x417f28
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x417f38
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x38]
push ebx
push 0x10030
push 0
push ebx
push 1
mov ebx, 0x436ff0
call fcn.004335a5
add esp, 0x10
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x68]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x417f6f
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040db6d
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x417f93
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push 0x20
call fcn.0043359f
add esp, 4
mov dword [ebp - 0x2c], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 8
rep stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0xc]
mov ebx, dword [ebp - 0x2c]
push ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x417fef
push ebx
call fcn.00433599
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x418003
push ebx
call fcn.00433599
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x418017
push ebx
call fcn.00433599
add esp, 4
pop ebx
add ebx, 8
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x41802b
push ebx
call fcn.00433599
add esp, 4
pop ebx
call fcn.00433599
add esp, 4
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
mov eax, str.result
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x41806f
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x418083
push ebx
call fcn.00433599
add esp, 4
pop eax
mov dword [ebp - 0x28], eax
push 0x4e0024
push dword [ebp - 0x28]
call fcn.00402506
add esp, 8
cmp eax, 0
jne 0x4180af
mov eax, 0x4e0026
jmp 0x4180f2
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
mov eax, str._error_msg_
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x4180ea
push ebx
call fcn.00433599
add esp, 4
mov eax, dword [ebp - 0x34]
jmp 0x4180f2
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x418103
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x418113
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x418123
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x418133
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x418143
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x418153
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x418163
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x418173
push ebx
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x24]
push ebx
mov eax, dword [ebx]
call dword [eax]
call fcn.00433599
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x418193
push ebx
call fcn.00433599
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x38