Function at 0x5a9ff0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x298
push 0xffffffffffffffff
push 0x63d2f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x294], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 0x2a4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
wait
mov eax, dword [ebp + 0x2a0]
mov dword [edi + 0x4c0], eax
push eax
push str.SoftwareDownloadManager_ld
lea ecx, [ebp + 0x214]
push ecx
call fcn.005fb4cb
add esp, 0xc
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf003f
push 0
push 0x64f8bc
push 0
lea ecx, [ebp + 0x214]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x14], 4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.TPswitch
mov ecx, dword [ebp - 0x18]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
test eax, eax
je 0x5aa0be
mov dword [edi + 0x44], 1
jmp 0x5aa0c4
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0x44], edx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.nAggrV
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa0e8
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x330], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.nAggr2
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x5aa10c
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x328], ecx
cmp dword [edi + 0x328], 0
jne 0x5aa11e
cmp dword [edi + 0x330], 0x40
jne 0x5aa16d
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.bPFAV
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa145
cmp dword [ebp - 0x1c], eax
je 0x5aa145
mov byte [edi + 0x336], 1
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.nAATDID
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa16d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5aa16d
mov dword [edi + 0x324], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x6617f0
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
lea esi, [edi + 0x91c]
test eax, eax
je 0x5aa196
mov dword [esi], 0
jmp 0x5aa19b
mov edx, dword [ebp - 0x1c]
mov dword [esi], edx
mov eax, dword [esi]
cmp eax, 3
je 0x5aa1c2
test eax, eax
je 0x5aa1c2
mov dword [esi], 0
push 4
push esi
push 4
push 0
push 0x6617f0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esi]
push ecx
mov ecx, edi
call fcn.0059ae20
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x689f38
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
je 0x5aa1fa
mov eax, dword [edi + 0x44]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffc5
add eax, 0x50
mov dword [edi + 0x34], eax
jmp 0x5aa200
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0x34], edx
mov dword [ebp - 0x14], 8
lea esi, [edi + 0x4c8]
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push str.FileSize
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
je 0x5aa232
mov dword [esi], 0
mov dword [esi + 4], 0
mov edx, dword [esi]
or edx, dword [esi + 4]
jne 0x5aa2e1
mov eax, dword [edi + 0x44]
cmp eax, 4
je 0x5aa256
cmp eax, 5
je 0x5aa256
cmp dword [edi + 0x330], edx
je 0x5aa2e1
mov esi, 8
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 4]
push ecx
push 0
push 0
push str.Duration
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa282
fld qword [ebp + 4]
fstp qword [edi + 0x3b0]
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 4]
push ecx
push 0
push 0
push str.dwnlDuration
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa2a9
fld qword [ebp + 4]
fstp qword [edi + 0x4e0]
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x28]
push edx
push eax
push eax
push str.nExpectedSize
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x5aa2e6
mov ecx, dword [ebp - 0x28]
mov dword [edi + 0x110], ecx
mov edx, dword [ebp - 0x24]
mov dword [edi + 0x114], edx
jmp 0x5aa2e6
mov esi, 8
mov dword [ebp - 0x14], esi
lea esi, [edi + 0x4d0]
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push 0x6706dc
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
je 0x5aa314
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x14], 4
lea esi, [edi + 0x4e8]
lea edx, [ebp - 0x14]
push edx
push esi
push 0
push 0
push str.Speed
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
je 0x5aa33f
mov dword [esi], 0
mov dword [ebp - 0x14], 4
lea esi, [edi + 0x16c]
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.cFlags
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x5aa36a
mov dword [esi], 0
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.gpID
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa395
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0xaa8], eax
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x20]
cmp eax, 0x100
jae 0x5aa3c9
mov eax, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
inc eax
push eax
call fcn.005cfaa6
add esp, 4
mov esi, eax
test esi, esi
jne 0x5aa3e7
mov eax, 0x753b
wait
jmp 0x5aab1e
mov eax, dword [ebp - 0x14]
inc eax
push eax
push 0
push esi
call fcn.005f8cb0
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.FileName
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x5aa412
mov byte [esi], 0
lea ecx, [edi + 0x20]
push 0
push esi
call fcn.00425db0
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push 0x688998
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x5aa473
push str.Cannot_read_data_from_registry__n
lea ecx, [edi + 0x4f4]
call fcn.005547b0
push 1
mov ecx, edi
call fcn.0059b660
push esi
call fcn.005cfa9b
add esp, 4
mov eax, 0x7541
wait
jmp 0x5aab1e
push esi
lea ecx, [edi + 0x20]
call fcn.0044e240
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.Path
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x5aa4a8
mov byte [esi], 0
push esi
lea ecx, [edi + 0x20]
call fcn.0044e2b0
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push 0x662174
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
je 0x5aa4f7
mov eax, dword [str.anonymous]
mov dword [esi], eax
mov ecx, dword [0x65af38]
mov dword [esi + 4], ecx
mov dx, word [0x65af3c]
mov word [esi + 8], dx
jmp 0x5aa537
push str.anonymous
push esi
call fcn.005fa111
add esp, 8
test eax, eax
jne 0x5aa537
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
push ecx
push 0
push 0
push str.bUNRA
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa537
cmp dword [ebp - 0x24], eax
je 0x5aa537
mov byte [edi + 0x1b8], 1
push esi
lea ecx, [edi + 0x20]
call fcn.004ffdd0
mov dword [ebp - 0x24], eax
push esi
test eax, eax
jne 0x5aa6fd
push str.EncPassword
push 0x6705d4
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0059e3f0
add esp, 0x14
test eax, eax
jne 0x5aa596
cmp dword [edi + 0x44], eax
jne 0x5aa593
mov edx, dword [str.anonymous_r.com]
mov dword [esi], edx
mov eax, dword [0x689f00]
mov dword [esi + 4], eax
mov ecx, dword [0x689f04]
mov dword [esi + 8], ecx
mov edx, dword [0x689f08]
mov dword [esi + 0xc], edx
jmp 0x5aa596
mov byte [esi], 0
push esi
lea ecx, [edi + 0x20]
call fcn.004ffe30
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.LastModified
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa5dd
push eax
push esi
lea ecx, [edi + 0x20]
call fcn.005b4270
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.mdtm
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa605
push eax
push esi
lea ecx, [edi + 0x20]
call fcn.005b6130
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.lastResult
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa637
push esi
lea ecx, [edi + 0x20]
call fcn.0059a670
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x34]
push ecx
push 0
push 0
push str.dwnlrs
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa662
mov eax, dword [ebp - 0x34]
mov dword [edi + 0xa94], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x14]
push edx
push esi
push 0
push 0
push str.lastTryDate
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x5aa690
mov byte [esi + 0x2f], al
push esi
lea ecx, [edi + 0x64]
push ecx
call fcn.005fb4cb
add esp, 8
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push str.dateAdded
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa6c1
mov byte [esi + 0x2f], al
push esi
lea edx, [edi + 0x94]
push edx
call fcn.005fb4cb
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.Cookie
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa717
mov eax, dword [edi + 0x44]
cmp eax, 4
je 0x5aa70e
cmp eax, 5
je 0x5aa70e
push esi
lea ecx, [edi + 0x20]
call fcn.0044e1c0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x5aa717
push esi
call fcn.005cfa9b
add esp, 4
mov eax, dword [ebp - 0x24]
wait
jmp 0x5aab1e
push esi
lea ecx, [edi + 0x20]
call fcn.005b1270
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push 0x689eac
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa762
push esi
lea ecx, [edi + 0x1a0]
call fcn.00402fc0
mov byte [edi + 0x19c], 1
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5aa750
sub eax, edx
jne 0x5aa762
mov byte [edi + 0x343], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.PDCType
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa78c
push esi
lea ecx, [edi + 0xf0]
call fcn.00402fc0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push 0x689ea0
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa7b6
push esi
lea ecx, [edi + 0x1a4]
call fcn.00402fc0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0
push 0
push str.Referer
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa7e8
push esi
lea ecx, [edi + 0x20]
call fcn.0044e140
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov dword [ebp - 0x14], 0x208
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xc]
push ecx
push 0
push 0
push 0x65d364
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x5aa825
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x20]
call fcn.005b16d0
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [edi + 0x20]
call fcn.005b2a40
test eax, eax
jne 0x5aa8c4
mov eax, dword [edi + 0x328]
cmp eax, 4
je 0x5aa857
cmp eax, 8
je 0x5aa857
cmp dword [edi + 0x330], 0x40
je 0x5aa857
cmp eax, 0x40
jne 0x5aa860
cmp byte [edi + 0x336], 0
jne 0x5aa8c4
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 8], eax
xor edx, edx
mov word [ebp + 4], dx
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp]
push ecx
push eax
mov ecx, edi
call fcn.005a45d0
mov eax, dword [ebp]
test eax, eax
jne 0x5aa88a
lea eax, [ebp + 4]
push eax
lea ecx, [edi + 0x20]
call fcn.005b1480
mov dword [ebp - 0x24], eax
test eax, eax
je 0x5aa8b8
push esi
call fcn.005cfa9b
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004011f0
mov eax, dword [ebp - 0x24]
wait
jmp 0x5aab1e
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.004011f0
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push str.WDescription
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa8ff
push esi
lea ecx, [edi + 0x20]
call fcn.005aea90
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov byte [edi + 0x33e], 1
jmp 0x5aa937
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0x14]
push eax
push esi
push 0
push 0
push 0x6604c0
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa937
push esi
lea ecx, [edi + 0x20]
call fcn.005aea90
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x5aa6fc
mov byte [edi + 0x33e], al
mov dword [ebp - 0x14], 4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.fGDFB
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa962
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0xd4], edx
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.fGDFE
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aa98d
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0xd8], eax
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.needER
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x5aa9b8
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x310], ecx
mov dword [ebp - 0x14], 4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.noSyntRef
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aa9e7
cmp dword [ebp - 0x1c], 1
sete dl
mov byte [edi + 0x350], dl
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.categoryID
mov edx, dword [ebp - 0x18]
push edx
call ebx
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x1c]
mov dword [edi + 0x314], eax
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0
push str.CISBU
mov edx, dword [ebp - 0x18]
push edx
call ebx
test eax, eax
jne 0x5aaa42
cmp dword [ebp - 0x1c], eax
setne al
mov byte [edi + 0x347], al
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push str.queueID
mov eax, dword [ebp - 0x18]
push eax
call ebx
test eax, eax
jne 0x5aaa6f
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x4c4], ecx
jmp 0x5aaaae
cmp dword [ebp - 0x2c], 0
je 0x5aaaae
mov edx, dword [edi + 0x4c0]
push edx
mov ecx, dword [ebp - 0x2c]
call fcn.0048c320
test eax, eax
je 0x5aaa92
mov dword [edi + 0x4c4], 1
push 4
lea eax, [edi + 0x4c4]
push eax
push 4
push 0
push str.queueID
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x14], 4
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push str.kpsnSDCD
mov ecx, dword [ebp - 0x18]
push ecx
call ebx
test eax, eax
jne 0x5aaae3
cmp dword [ebp - 0x1c], eax
setne dl
mov byte [edi + 0xab5], dl
mov byte [edi + 0xab6], 1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.005cfa9b
add esp, 4
xor eax, eax
wait
jmp 0x5aab1e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x294]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x298
mov esp, ebp
pop ebp
ret 8