Function at 0x48afd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bd05f
mov eax, dword fs:[0]
push eax
sub esp, 0x590
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x548], edi
mov dword [ebp - 4], 0
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b027
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x518], eax
mov byte [ebp - 4], 1
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b057
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x52c], eax
mov byte [ebp - 4], 2
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b087
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x530], eax
mov byte [ebp - 4], 3
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b0b7
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x544], eax
push 0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 4
call fcn.0047aa50
mov ecx, edi
call fcn.00488df0
push 0x1f4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
mov ebx, 0x1f4
call fcn.00488df0
mov ecx, esi
sub ecx, eax
cmp ecx, 2
je 0x48b131
cmp ebx, 0x1388
ja 0x48b131
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
add ebx, 0x1f4
call fcn.00488df0
mov edx, esi
sub edx, eax
cmp edx, 2
jne 0x48b108
push 0
push 1
lea eax, [ebp - 0x518]
push eax
push 0xfffffffffffffffd
push ecx
mov ecx, esp
mov dword [ebp - 0x534], esp
push str.MSI_CLEANUP
call fcn.00403380
lea ecx, [ebp + 8]
push ecx
lea ecx, [edi + 0xb8]
call fcn.0041c7b0
test eax, eax
je 0x48ba87
mov eax, dword [ebp - 0x518]
cmp dword [eax - 0xc], 0
jge 0x48b17e
push 0x80070057
call fcn.00401b60
cmp byte [eax], 0x3d
jne 0x48b192
push 1
push 0
lea ecx, [ebp - 0x518]
call fcn.00407710
lea ecx, [ebp - 0x518]
call fcn.00408a80
lea ecx, [ebp - 0x518]
call fcn.00408a00
mov eax, dword [ebp - 0x518]
cmp dword [eax - 0xc], 0
jl 0x48b241
push 0x5ce514
push eax
call fcn.0059a963
add esp, 8
test eax, eax
je 0x48b241
sub eax, dword [ebp - 0x518]
mov esi, eax
cmp esi, 0xffffffff
je 0x48b241
push esi
lea edx, [ebp - 0x524]
push edx
lea ecx, [ebp - 0x518]
call fcn.004024f0
push eax
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 5
call fcn.00402af0
mov eax, dword [ebp - 0x524]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b220
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x518]
push ecx
lea ecx, [ebp - 0x52c]
call fcn.00402af0
inc esi
push esi
push 0
lea ecx, [ebp - 0x52c]
call fcn.00407710
push 0x104
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x114]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x48b260
mov ecx, dword [str.TEMP_]
mov dx, word [0x5dcd7c]
mov dword [eax], ecx
mov cl, byte [0x5dcd7e]
mov word [eax + 4], dx
mov byte [eax + 6], cl
mov eax, dword [ebp - 0x530]
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x48b290
lea edi, [ebp - 0x114]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48b2a2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 1
lea edx, [ebp - 0x114]
rep movsb byte es:[edi], byte [esi]
push edx
lea ecx, [ebp - 0x535]
call fcn.00430380
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b2e6
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x528], eax
mov byte [ebp - 4], 6
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b316
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x514], eax
push 0xa
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 7
call fcn.004a7e5d
lea ecx, [ebp - 0x564]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 8
call fcn.0041ea40
mov eax, dword [ebp - 0x560]
test eax, eax
je 0x48b59f
mov ebx, eax
mov eax, ebx
test ebx, ebx
je 0x48b54d
mov ebx, dword [ebx]
add eax, 8
push eax
lea edx, [ebp - 0x524]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push edx
mov dword [ebp - 0x510], ebx
call fcn.00408ba0
add esp, 0xc
mov ecx, dword [eax]
mov esi, dword [ebp - 0x528]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 9
cmp eax, esi
je 0x48b3f5
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x48b3e5
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x48b3e5
push eax
call fcn.004022e0
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x48b3d4
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x528], ebx
mov ebx, dword [ebp - 0x510]
jmp 0x48b3f5
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x528]
call fcn.004026b0
mov eax, dword [ebp - 0x524]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b41b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str.DisplayName
lea ecx, [ebp - 0x520]
call fcn.00403380
lea ecx, [ebp - 0x514]
push ecx
push eax
lea edx, [ebp - 0x528]
push edx
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0xa
call fcn.0040b2d0
mov esi, eax
mov eax, dword [ebp - 0x520]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b471
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x48b543
mov eax, dword [ebp - 0x514]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48b01d
mov ecx, dword [ebp - 0x52c]
push eax
push ecx
call fcn.0059a822
add esp, 8
test eax, eax
jne 0x48b543
push str.UninstallString
lea ecx, [ebp - 0x51c]
call fcn.00403380
lea edx, [ebp - 0x514]
push edx
push eax
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0xb
call fcn.0040b2d0
mov esi, eax
mov eax, dword [ebp - 0x51c]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b4fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x48b543
lea ecx, [ebp - 0x514]
call fcn.004027d0
lea ecx, [ebp - 0x514]
call fcn.00408a80
lea ecx, [ebp - 0x514]
call fcn.00408a00
mov esi, dword [ebp - 0x514]
cmp dword [esi - 0xc], 0
jl 0x48b543
push str.MSIEXEC.EXE
push esi
call fcn.0059a963
add esp, 8
test eax, eax
je 0x48b543
sub eax, esi
je 0x48b552
test ebx, ebx
jne 0x48b364
jmp 0x48b59f
call fcn.004a6edd
push str.DisplayName
lea ecx, [ebp - 0x524]
call fcn.00403380
push eax
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0xc
call fcn.004872e0
mov eax, dword [ebp - 0x524]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48b59f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b5b9
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x520], eax
mov byte [ebp - 4], 0xd
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48b5e9
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x51c], ebx
push 0xa
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0xe
call fcn.004a7e5d
push 0xa
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0xf
call fcn.004a7e5d
push 0
push SysStringLen
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 0x10
call fcn.0047aa50
lea ecx, [ebp - 0x59c]
push ecx
push 0
lea ecx, [ebp - 0x50c]
call fcn.0041ea40
mov edi, dword [ebp - 0x598]
test edi, edi
je 0x48b9c8
mov eax, edi
test edi, edi
je 0x48b54d
mov edi, dword [edi]
add eax, 8
push str.SoftwareMicrosoftInstallerProducts
push eax
lea edx, [ebp - 0x53c]
push edx
mov dword [ebp - 0x524], edi
call fcn.004029d0
add esp, 0xc
mov ecx, dword [eax]
mov esi, dword [ebp - 0x520]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 0x11
cmp eax, esi
je 0x48b6ea
cmp dword [esi + 0xc], 0
jl 0x48b6da
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x48b6da
push eax
call fcn.004022e0
mov dword [ebp - 0x510], eax
add esp, 4
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x48b6c9
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x510]
add ecx, 0x10
mov dword [ebp - 0x520], ecx
jmp 0x48b6ea
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x520]
call fcn.004026b0
mov eax, dword [ebp - 0x53c]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48b710
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x520]
lea ecx, [ebp - 0x580]
push ecx
push edx
lea ecx, [ebp - 0x50c]
call fcn.0041ea40
mov eax, dword [ebp - 0x57c]
test eax, eax
je 0x48b9c0
mov edi, eax
lea esp, [esp]
push 0x5cd28c
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x534]
push ecx
call fcn.004029d0
add esp, 0xc
mov byte [ebp - 4], 0x12
mov ecx, edi
test edi, edi
je 0x48b54d
mov edi, dword [edi]
add ecx, 8
push ecx
push eax
lea edx, [ebp - 0x540]
push edx
mov dword [ebp - 0x510], edi
call fcn.00402910
add esp, 0xc
mov eax, dword [eax]
lea esi, [eax - 0x10]
add ebx, 0xfffffff0
mov byte [ebp - 4], 0x13
cmp esi, ebx
je 0x48b838
cmp dword [ebx + 0xc], 0
jl 0x48b828
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x48b828
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x48b7ca
cmp eax, dword [esi]
jne 0x48b7ca
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x48b7fe
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x48bb74
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0059aa3b
add esp, 0x10
lea eax, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x48b817
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
add edi, 0x10
mov dword [ebp - 0x51c], edi
mov edi, dword [ebp - 0x510]
jmp 0x48b838
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x51c]
call fcn.004026b0
mov eax, dword [ebp - 0x540]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b85e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x534]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b884
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.004a8620
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x48b01d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x510], eax
mov ecx, 0x5d078c
mov byte [ebp - 4], 0x14
test ecx, 0xffff0000
jne 0x48b8d9
mov edx, ecx
movzx esi, dx
push esi
call fcn.004a84e0
test eax, eax
je 0x48b8eb
push esi
push eax
lea ecx, [ebp - 0x510]
call fcn.00402570
jmp 0x48b8eb
push 0xb
push 0x5d078c
lea ecx, [ebp - 0x510]
call fcn.004026b0
lea eax, [ebp - 0x514]
push eax
lea ecx, [ebp - 0x510]
push ecx
lea edx, [ebp - 0x51c]
push edx
lea ecx, [ebp - 0x50c]
mov byte [ebp - 4], 0x15
call fcn.0040b2d0
mov esi, eax
mov eax, dword [ebp - 0x510]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48b937
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x514]
test esi, esi
je 0x48b964
xor eax, eax
test ecx, ecx
setne al
test eax, eax
je 0x48b01d
push ecx
mov ecx, dword [ebp - 0x52c]
push ecx
call fcn.0059a822
add esp, 8
test eax, eax
je 0x48b974
mov ebx, dword [ebp - 0x51c]
test edi, edi
jne 0x48b740
jmp 0x48b9ba
mov ebx, dword [ebp - 0x51c]
mov edx, dword [ebx - 0xc]
test edx, edx
js 0x48b174
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x48b9a8
push edx
lea ecx, [ebp - 0x51c]
call fcn.00402280
mov ebx, dword [ebp - 0x51c]
push 1
push 0
push 0
push ebx
lea ecx, [ebp - 0x50c]
call fcn.0047aeb0
mov edi, dword [ebp - 0x524]
test edi, edi
jne 0x48b655
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0xf
call fcn.004a8028
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0xe
call fcn.004a8028
add ebx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x48ba06
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov eax, dword [ebp - 0x520]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ba2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 7
call fcn.004a8028
mov eax, dword [ebp - 0x514]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ba61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x528]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48ba87
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x548]
add ecx, 0xaa00
call fcn.004021a0
mov eax, dword [ebp - 0x544]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48babe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x530]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48bae4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x52c]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48bb0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x518]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48bb30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48bb56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4
call fcn.00401f40
int3