Function at 0x101e3f5
Capabilities:
Accept command line arguments
Hide graphical window
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x10360ac]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
xor edi, edi
push edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push edi
mov dword [0x1036f88], eax
call esi
push edi
push edi
push edi
push edi
mov dword [0x1036fbc], eax
call esi
push edi
push edi
push edi
push edi
mov dword [0x1036fd4], eax
call esi
push 0x1036f50
mov dword [0x1036fd8], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0101544e
xor ebx, ebx
inc ebx
cmp eax, ebx
je 0x101f1f3
lea eax, [ebp - 0x398]
push eax
push 0x20019
push edi
mov esi, 0x1004c98
push esi
push 0x80000001
mov dword [0x1036090], ebx
mov dword [ebp - 0x39c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e4d0
lea eax, [ebp - 0x3a4]
push eax
push 0x1036090
lea eax, [ebp - 0x3a0]
push eax
push edi
push 0x1005334
push dword [ebp - 0x398]
mov dword [ebp - 0x3a0], edi
mov dword [ebp - 0x3a4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101e4c4
mov dword [ebp - 0x39c], ebx
push dword [ebp - 0x398]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x134]
mov edi, eax
call fcn.0100ca41
mov ax, word [edi]
cmp ax, 0x22
je 0x101e502
cmp ax, 0x20
jbe 0x101e51c
inc edi
inc edi
cmp word [edi], 0x20
ja 0x101e4f2
jmp 0x101e51c
cmp ax, 0x22
je 0x101e51a
inc edi
inc edi
mov ax, word [edi]
test ax, ax
jne 0x101e4fc
cmp ax, 0x22
jne 0x101e51c
jmp 0x101e51a
cmp ax, 0x20
ja 0x101e524
inc edi
inc edi
mov ax, word [edi]
test ax, ax
jne 0x101e514
mov ax, word [edi]
cmp ax, 0x2f
je 0x101e537
cmp ax, 0x2d
jne 0x101e6c7
lea ecx, [ebp - 0x9c]
call fcn.0100ca41
inc edi
push 0x10053f4
lea ecx, [ebp - 0x9c]
inc edi
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101e57b
and dword [0x1036050], eax
mov dword [0x1036fa8], ebx
jmp 0x101e5b0
push 0x10053e8
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101e5c9
mov dword [0x1036f68], ebx
mov dword [0x1036050], ebx
mov eax, dword [ebp - 0x8c]
lea ecx, [ebp - 0x9c]
lea edi, [edi + eax*2]
call fcn.0100b743
jmp 0x101e51c
push 0x10053d4
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101e5fa
mov dword [0x1036f6c], ebx
jmp 0x101e5aa
push 0x10053d0
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
je 0x101e64c
push 0x10053cc
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101e658
and dword [0x1036050], 0
jmp 0x101e5b0
push 0x10053b8
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101e689
and dword [0x1036090], eax
jmp 0x101e6bc
push 0x10053a8
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push edi
call fcn.01027ad7
add esp, 0xc
test eax, eax
jne 0x101f13d
mov dword [0x1036090], ebx
mov dword [0x1036fe8], ebx
jmp 0x101e5b0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x101e71e
and dword [0x1036050], 0
push edi
lea ecx, [ebp - 0x134]
call fcn.0100c70c
mov eax, dword [ebp - 0x124]
inc eax
push eax
push 0x2e
lea ecx, [ebp - 0x134]
call fcn.0100b6e5
test eax, eax
jge 0x101e71e
cmp dword [0x1036fa8], 0
lea ecx, [ebp - 0x134]
je 0x101e714
push 0x10052ec
jmp 0x101e719
push 0x100539c
call fcn.0100c744
xor edi, edi
cmp dword [ebp - 0x124], edi
jne 0x101e747
cmp dword [0x1036fa8], edi
lea ecx, [ebp - 0x134]
je 0x101e73d
push 0x1005304
jmp 0x101e742
push 0x100531c
call fcn.0100c70c
call fcn.01015ba4
test eax, eax
je 0x101e758
push edi
push 0x65
jmp 0x101e879
cmp dword [ebp - 0x39c], edi
jne 0x101e849
cmp dword [0x1036fe8], edi
jne 0x101e849
cmp dword [0x1036050], edi
je 0x101e849
cmp dword [0x1037200], edi
jne 0x101e849
lea ecx, [ebp - 0x264]
call fcn.0100ca41
lea ecx, [ebp - 0x1cc]
call fcn.0100ca41
push 0x104
lea eax, [ebp - 0x264]
push eax
push 0x64
push edi
call fcn.0101f429
push 0x200
lea eax, [ebp - 0x1cc]
push eax
push 0x73
push edi
call fcn.0101f429
add esp, 0x20
push 4
push dword [ebp - 0x258]
push dword [ebp - 0x1c0]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 6
neg eax
push edi
sbb eax, eax
inc eax
mov dword [0x1036090], eax
lea eax, [ebp - 0x398]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101e833
push 4
push 0x1036090
push 4
push edi
push 0x1005334
push dword [ebp - 0x398]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x398]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1cc]
call fcn.0100b743
lea ecx, [ebp - 0x264]
call fcn.0100b743
push dword [0x1036090]
mov edi, 0x1036ff0
mov ecx, edi
call fcn.0100d8f3
test eax, eax
jge 0x101e885
cmp eax, 0x80080001
push 0
jne 0x101e86c
push 0x70
jmp 0x101e879
cmp eax, 0x800401f8
jne 0x101e877
push 0x6f
jmp 0x101e879
push 0x71
call fcn.0101a99c
pop ecx
pop ecx
jmp 0x101f1e8
call fcn.010152f2
cmp dword [0x1036f6c], 0
je 0x101eaa3
cmp dword [0x1036070], 0
je 0x101e8fb
push 0
push ebx
push 0x2c2
push esi
mov ecx, 0x1004eac
mov edx, 0x1036f8c
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036070], eax
je 0x101e8fb
push ebx
push 0x1004eac
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010ea7
test eax, eax
jge 0x101e8ec
push eax
push 0x12c
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004eac
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036074], 0
je 0x101e95f
push 0
push ebx
push 0x2bc
push esi
mov ecx, 0x1004e80
mov edx, 0x1036f90
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036074], eax
je 0x101e95f
push ebx
push 0x1004e80
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01011e44
test eax, eax
jge 0x101e950
push eax
push 0x12c
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e80
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036078], 0
je 0x101e9c3
push 0
push ebx
push 0x2bd
push esi
mov ecx, 0x1004e54
mov edx, 0x1036f94
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036078], eax
je 0x101e9c3
push ebx
push 0x1004e54
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010f2a
test eax, eax
jge 0x101e9b4
push eax
push 0x12d
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e54
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x103607c], 0
je 0x101ea27
push 0
push ebx
push 0x2be
push esi
mov ecx, 0x1004e28
mov edx, 0x1036f98
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x103607c], eax
je 0x101ea27
push ebx
push 0x1004e28
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010fad
test eax, eax
jge 0x101ea18
push eax
push 0x132
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e28
push esi
call fcn.010151dd
add esp, 0xc
call fcn.0101c4d7
call fcn.0101cb57
lea ecx, [ebp - 0x1cc]
call fcn.0100ca41
lea ecx, [ebp - 0x264]
call fcn.0100ca41
mov esi, 0x104
push esi
lea eax, [ebp - 0x1cc]
push eax
push 0x64
xor edi, edi
push edi
call fcn.0101f429
push esi
lea eax, [ebp - 0x264]
push eax
push 0x1f7
push edi
call fcn.0101f429
add esp, 0x20
push edi
push dword [ebp - 0x1c0]
push dword [ebp - 0x258]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x264]
call fcn.0100b743
lea ecx, [ebp - 0x1cc]
call fcn.0100b743
jmp 0x101f0f2
cmp dword [0x1036050], 0
jne 0x101ec53
cmp dword [0x1036070], 0
je 0x101eb03
push 0
push ebx
push 0x2c2
push esi
mov ecx, 0x1004eac
mov edx, 0x1036f8c
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036070], eax
je 0x101eb03
push ebx
push 0x1004eac
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010ea7
push ebx
push 0x1004eac
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036074], 0
je 0x101eb67
push 0
push ebx
push 0x2bc
push esi
mov ecx, 0x1004e80
mov edx, 0x1036f90
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036074], eax
je 0x101eb67
push ebx
push 0x1004e80
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01011e44
test eax, eax
jge 0x101eb58
push eax
push 0x12c
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e80
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036078], 0
je 0x101ebcb
push 0
push ebx
push 0x2bd
push esi
mov ecx, 0x1004e54
mov edx, 0x1036f94
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036078], eax
je 0x101ebcb
push ebx
push 0x1004e54
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010f2a
test eax, eax
jge 0x101ebbc
push eax
push 0x12d
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e54
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x103607c], 0
je 0x101ec2f
push 0
push ebx
push 0x2be
push esi
mov ecx, 0x1004e28
mov edx, 0x1036f98
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x103607c], eax
je 0x101ec2f
push ebx
push 0x1004e28
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010fad
test eax, eax
jge 0x101ec20
push eax
push 0x132
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e28
push esi
call fcn.010151dd
add esp, 0xc
call fcn.0101c4d7
push 0x1036ff0
lea eax, [ebp - 0x134]
push eax
push dword [0x1036fa8]
call fcn.01026393
add esp, 0xc
jmp 0x101f0f2
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1036fb0], eax
cmp dword [0x103720c], 0
je 0x101ecde
call fcn.010152f2
mov ecx, edi
call fcn.0100d358
mov ecx, edi
call fcn.010122f7
mov ecx, edi
call fcn.01012355
mov ecx, edi
call fcn.0100d396
mov ecx, edi
call fcn.0100d3ff
mov ecx, edi
call fcn.0100d469
mov ecx, edi
call fcn.01012424
mov ecx, edi
call fcn.0100d4cd
mov ecx, edi
call fcn.0100d588
cmp dword [0x103721c], 0
je 0x101ecde
mov dword [0x1036070], ebx
mov dword [0x1036074], ebx
mov dword [0x1036078], ebx
mov dword [0x103607c], ebx
mov dword [0x1036080], ebx
mov dword [0x1036084], ebx
mov dword [0x1036088], ebx
cmp dword [0x1036070], 0
je 0x101ed31
push 0
push ebx
push 0x2c2
push esi
mov ecx, 0x1004eac
mov edx, 0x1036f8c
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036070], eax
je 0x101ed31
push ebx
push 0x1004eac
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010ea7
push ebx
push 0x1004eac
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036074], 0
je 0x101ed95
push 0
push ebx
push 0x2bc
push esi
mov ecx, 0x1004e80
mov edx, 0x1036f90
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036074], eax
je 0x101ed95
push ebx
push 0x1004e80
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01011e44
test eax, eax
jge 0x101ed86
push eax
push 0x12c
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e80
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x1036078], 0
je 0x101edf9
push 0
push ebx
push 0x2bd
push esi
mov ecx, 0x1004e54
mov edx, 0x1036f94
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x1036078], eax
je 0x101edf9
push ebx
push 0x1004e54
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010f2a
test eax, eax
jge 0x101edea
push eax
push 0x12d
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e54
push esi
call fcn.010151dd
add esp, 0xc
cmp dword [0x103607c], 0
je 0x101ee5d
push 0
push ebx
push 0x2be
push esi
mov ecx, 0x1004e28
mov edx, 0x1036f98
call fcn.0101a1c8
add esp, 0x10
test eax, eax
mov dword [0x103607c], eax
je 0x101ee5d
push ebx
push 0x1004e28
push esi
call fcn.0101514b
add esp, 0xc
push ebx
mov ecx, edi
call fcn.01010fad
test eax, eax
jge 0x101ee4e
push eax
push 0x132
call fcn.0101a99c
pop ecx
pop ecx
push ebx
push 0x1004e28
push esi
call fcn.010151dd
add esp, 0xc
and dword [0x1036fb4], 0
and dword [0x1036fac], 0
push 8
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov edx, dword [0x1036fac]
push 8
pop ecx
push ecx
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 7
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 6
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 5
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 4
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 3
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
mov ecx, dword [0x1036fac]
push 8
mov dword [eax], 2
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
call fcn.01026e50
test eax, eax
pop ecx
je 0x101f0f2
cmp dword [0x1036fb8], 0
mov ecx, dword [0x1036fac]
mov dword [eax], ebx
mov dword [eax + 4], ecx
mov dword [0x1036fac], eax
mov dword [0x1036fc8], ebx
jne 0x101efdb
lea eax, [ebp - 0x3a0]
push eax
xor eax, eax
push eax
push eax
push 0x101dee0
push eax
push eax
call fcn.01027a45
add esp, 0x18
mov dword [0x1036fb8], eax
jmp 0x101efd2
push 0
push dword [0x1036fb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x101efdb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x1036f70], 0
je 0x101efb5
push 0x1036f50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1036fac]
and dword [0x1036fc8], 0
test eax, eax
je 0x101effd
mov eax, dword [eax]
mov dword [0x1036fc8], eax
push 0x1036f50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x1036fc8], 0
je 0x101f088
push 0
push dword [0x1036fb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x101f088
push dword [0x1036fc8]
call fcn.0101ac31
mov dword [esp], 0x1036f50
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x1036fac]
xor ecx, ecx
jmp 0x101f056
mov edx, dword [eax]
cmp edx, dword [0x1036fc8]
je 0x101f05c
mov ecx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x101f047
jmp 0x101f078
test ecx, ecx
je 0x101f068
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
jmp 0x101f071
mov ecx, dword [eax + 4]
mov dword [0x1036fac], ecx
push eax
call fcn.01026ab6
pop ecx
push 0x1036f50
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x101efdb
cmp dword [0x103720c], 0
je 0x101f0b5
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x1036fb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x101ec5e
cmp dword [0x1036054], 0
jne 0x101f0d8
push 0x1415
push dword [0x1036f74]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push dword [0x1036fb8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x1036fb8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x1036fbc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x1036fd4]
call esi
push dword [0x1036fd8]
call esi
push 0x1036f50
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x101f12d
mov ecx, dword [eax + 4]
push eax
mov dword [0x1036fac], ecx
call fcn.01026ab6
pop ecx
mov eax, dword [0x1036fac]
test eax, eax
jne 0x101f11d
xor ebx, ebx
jmp 0x101f1e8
push edi
lea ecx, [ebp - 0x9c]
call fcn.0100c70c
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x20
lea ecx, [ebp - 0x9c]
call fcn.0100b6e5
cmp eax, 0xffffffff
jle 0x101f16f
push eax
lea ecx, [ebp - 0x9c]
call fcn.0100c774
lea ecx, [ebp - 0x2fc]
call fcn.0100ca41
lea ecx, [ebp - 0x394]
call fcn.0100ca41
push 0x104
lea eax, [ebp - 0x2fc]
push eax
push 0x64
xor esi, esi
push esi
call fcn.0101f429
push 0x200
lea eax, [ebp - 0x394]
push eax
push 0x66
push esi
call fcn.0101f429
add esp, 0x20
push 0x30
push dword [ebp - 0x2f0]
push dword [ebp - 0x388]
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x394]
call fcn.0100b743
lea ecx, [ebp - 0x2fc]
call fcn.0100b743
lea ecx, [ebp - 0x9c]
call fcn.0100b743
lea ecx, [ebp - 0x134]
call fcn.0100b743
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0102699e
leave
ret 0x10