Function at 0x410d8b
Capabilities:
Contain obfuscated stackstrings
Get geographical location

Disassembly:
push ebp
sub esp, 0x58
push 0x154
mov eax, 0x45fe2b
call fcn.0044a6d8
mov esi, ecx
xor ebx, ebx
inc ebx
xor edi, edi
push ebx
lea ecx, [ebp - 0xd4]
mov dword [ebp + 4], edi
call fcn.0040eb4b
lea ecx, [ebp - 0xd4]
mov dword [ebp - 4], ebx
call fcn.0040f416
push str.mediagetInstaller
lea ecx, [ebp + 0x24]
call fcn.004088e0
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.0040ec97
push edi
push ebx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.file_name
lea ecx, [ebp + 0x24]
call fcn.004088e0
mov byte [ebp - 4], 3
call fcn.0041c685
push eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040eb94
push edi
push ebx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.bubbles_click
lea ecx, [ebp + 0x24]
call fcn.004088e0
lea eax, [esi + 0xbb4]
push eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.0040eb94
push edi
push ebx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.finish
lea ecx, [ebp + 0x40]
call fcn.004088e0
push str.action
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 5
call fcn.004088e0
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 6
call fcn.0040eb94
push edi
push ebx
lea ecx, [ebp + 0x24]
call fcn.00407efb
push edi
mov byte [ebp - 4], bl
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push 0x4668b0
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x92c]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 7
call fcn.0040f44b
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.statVersion
lea ecx, [ebp + 0x40]
call fcn.004088e0
push esi
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 8
call fcn.0040eb94
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.installerIsAlreadyRun
lea ecx, [ebp + 0x40]
call fcn.004088e0
movzx eax, byte [esi + 0x1c]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 9
call fcn.0040ebd9
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.mediagetIsAlreadyInstalled
lea ecx, [ebp + 0x40]
call fcn.004088e0
mov byte [ebp - 4], 0xa
call fcn.0040d4be
movzx eax, al
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040ebd9
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.incomplete
lea ecx, [ebp + 0x40]
call fcn.004088e0
mov byte [ebp - 4], 0xb
call fcn.00410b04
movzx eax, al
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040ebd9
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.error
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x978]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xc
call fcn.0040f44b
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.nonCriticalErrorsCount
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x9b0]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0xd
call fcn.0040f44b
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.installationStarted
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x9e4]
mov ecx, esi
push dword [esi + 0x9e0]
mov byte [ebp - 4], 0xe
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.downloadStarted
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x9ec]
mov ecx, esi
push dword [esi + 0x9e8]
mov byte [ebp - 4], 0xf
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.downloadFinished
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x9f4]
mov ecx, esi
push dword [esi + 0x9f0]
mov byte [ebp - 4], 0x10
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.extractStarted
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x9fc]
mov ecx, esi
push dword [esi + 0x9f8]
mov byte [ebp - 4], 0x11
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.extractFinished
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0xa04]
mov ecx, esi
push dword [esi + 0xa00]
mov byte [ebp - 4], 0x12
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.installationFinished
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0xa0c]
mov ecx, esi
push dword [esi + 0xa08]
mov byte [ebp - 4], 0x13
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.installerTerminated
lea ecx, [ebp + 0x40]
call fcn.004088e0
push edi
mov byte [ebp - 4], 0x14
call fcn.00449f15
pop ecx
push edx
push eax
mov ecx, esi
call fcn.0040aff5
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f5bf
mov byte [ebp - 4], bl
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push str.mediagetLaunched
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0x3c]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x15
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.errorMessage
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0x97c]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x16
call fcn.0040f500
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.desiredBundle
lea ecx, [ebp + 0x40]
call fcn.004088e0
mov byte [ebp - 4], 0x17
call fcn.00430441
mov ecx, eax
call fcn.0042fe9b
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push 0x466ab4
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x18
call fcn.00430441
mov ecx, eax
call fcn.0042fed2
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x19
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.bundleAccepted
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00430441
mov ecx, eax
call fcn.0042ffaa
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1b
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.bundleInstalled
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x1c
call fcn.00430441
mov ecx, eax
call fcn.00430086
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1d
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.city
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0x6ec]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1e
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.lastShownScreen
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0xa50]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1f
call fcn.0040f48f
push edi
mov byte [ebp - 4], bl
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push str.systemLang
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0x20
call fcn.0041ee9e
pop ecx
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x21
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
call fcn.00434c98
push eax
lea ecx, [ebp + 0x24]
call fcn.004088e0
push str.installerLang
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 0x22
call fcn.004088e0
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x23
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], bl
call fcn.00407efb
call fcn.004107a9
test al, al
mov eax, 0x465a24
jne 0x41145c
mov eax, 0x4659cc
push eax
lea ecx, [ebp + 0x24]
call fcn.004088e0
push str.hasDownloadPayload
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 0x24
call fcn.004088e0
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x25
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.cancel_screen
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x954]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x26
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.cancel_screen_try
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0x950]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x27
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
call fcn.00432f82
mov edx, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
call dword [edx + 0x18]
lea ecx, [esi + 0xa6c]
push eax
push ecx
mov byte [ebp - 4], 0x28
call fcn.0040e9e2
pop ecx
pop ecx
push edi
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00407efb
cmp byte [esi + 0x94], 0
je 0x411556
lea eax, [esi + 0xa6c]
push str._bad_mg_found
push eax
call fcn.0040e775
pop ecx
pop ecx
push str.info
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp - 0x28]
push eax
lea ecx, [esi + 0xa6c]
mov byte [ebp - 4], 0x29
call fcn.0040dd9c
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x2a
call fcn.0040f500
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.download_url
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x2b
call fcn.0040ec97
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.type
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0xbd0]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x2c
call fcn.0040eb94
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
lea eax, [esi + 0xbec]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f58b
push ebx
lea ecx, [ebp - 0xd4]
call fcn.0040ece1
push str.nonCriticalErrorsCategories
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2d
call fcn.0040ff62
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x2e
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.nonCriticalErrors
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [ebp - 0x28]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x2f
call fcn.0040d334
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x30
call fcn.0040f500
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.downloadErrorMessage
lea ecx, [ebp + 0x40]
call fcn.004088e0
lea eax, [esi + 0xb5c]
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x31
call fcn.0040f500
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.downloadNumber
lea ecx, [ebp + 0x40]
call fcn.004088e0
push dword [esi + 0xb78]
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x32
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
call fcn.00437300
push str.defaultBrowser
lea ecx, [ebp + 0x40]
mov dword [ebp], eax
call fcn.004088e0
push dword [ebp]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x33
call fcn.00437346
pop ecx
pop ecx
push eax
lea eax, [ebp + 0x40]
mov byte [ebp - 4], 0x34
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0x28]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], bl
call fcn.00407efb
push 0x46698c
lea ecx, [ebp - 0x28]
call fcn.004088e0
push str.SoftwareMedia_Get_LLCMediaGet2_systemScopemediaget_info
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 0x35
call fcn.004088e0
push str.antivirus
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 0x36
call fcn.004088e0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp - 0xf0]
push SysReAllocStringLen
push eax
mov byte [ebp - 4], 0x37
call fcn.0041c2f4
add esp, 0x10
push eax
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x38
call fcn.0040f500
push edi
push ebx
lea ecx, [ebp - 0xf0]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 0x24]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.os_version
lea ecx, [ebp - 0x10c]
call fcn.004088e0
lea eax, [esi + 0x644]
push eax
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x39
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.reseller
lea ecx, [ebp - 0x144]
call fcn.004088e0
lea eax, [esi + 0x7b0]
mov byte [ebp - 4], 0x3a
push eax
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.subid
lea ecx, [ebp - 0x128]
call fcn.004088e0
lea eax, [esi + 0x794]
push eax
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x3b
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], bl
call fcn.00407efb
push 0x46695c
lea ecx, [ebp - 0x160]
call fcn.004088e0
xor eax, eax
cmp dword [esi + 0x8b0], edi
lea ecx, [ebp - 0xd4]
setg al
mov byte [ebp - 4], 0x3c
push eax
lea eax, [ebp - 0x160]
push eax
call fcn.0040f5bf
push edi
push ebx
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], bl
call fcn.00407efb
push str.parent_process
lea ecx, [ebp + 8]
call fcn.004088e0
mov byte [ebp - 4], 0x3d
call fcn.0041fc12
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xd4]
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00407efb
cmp dword [esi + 0x81c], edi
je 0x411985
push str.download_ip
lea ecx, [ebp + 8]
call fcn.004088e0
lea ecx, [esi + 0x804]
mov byte [ebp - 4], 0x3e
call fcn.0040b727
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.0041c86b
pop ecx
pop ecx
push eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x3f
call fcn.0040f48f
push edi
push ebx
lea ecx, [ebp - 0xf0]
call fcn.00407efb
push edi
push ebx
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call fcn.00407efb
push edi
lea ecx, [ebp - 0xd4]
call fcn.0040ece1
lea ecx, [ebp - 0xd4]
call fcn.0040f42e
push dword [ebp + 0x64]
lea ecx, [ebp - 0xd4]
call fcn.0040e0ea
lea ecx, [ebp - 0xd4]
mov dword [ebp + 4], ebx
mov byte [ebp - 4], 0
call fcn.0040e101
mov eax, dword [ebp + 0x64]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x5c
leave
ret 4