Function at 0x48db90
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x39
push 0
push 0
dec ecx
jne 0x48db98
push ebx
push esi
push edi
mov eax, 0x48d7b0
call fcn.00405f7c
xor eax, eax
push ebp
push 0x48e98e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x490df8]
mov byte [eax], 0x2e
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402a1c
mov eax, dword [ebp - 0x14]
mov edx, 0x48e9a8
call fcn.0040446c
jne 0x48e631
xor eax, eax
push ebp
push 0x48e622
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
xor eax, eax
call fcn.0048a340
cmp al, 1
jne 0x48e615
call fcn.0048a250
cmp al, 1
jne 0x48e615
xor eax, eax
push ebp
push 0x48dc9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00421c48
mov dword [ebx + 0x18], 0x20019
xor ecx, ecx
mov edx, 0x48e9b8
mov eax, ebx
call fcn.00421cac
lea ecx, [ebp - 0x18]
mov edx, 0x48e9dc
mov eax, ebx
call fcn.00421e94
mov edx, dword [ebp - 0x18]
mov eax, 0x49203c
call fcn.004040b4
lea ecx, [ebp - 0x1c]
mov edx, 0x48e9ec
mov eax, ebx
call fcn.00421e94
mov edx, dword [ebp - 0x1c]
mov eax, 0x492038
call fcn.004040b4
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48dca5
lea eax, [ebp - 0x24]
push eax
mov edx, dword [0x492038]
mov eax, 0x48e9fc
call fcn.00404664
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x492038]
call fcn.00404580
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0040811c
mov edx, dword [ebp - 0x20]
mov eax, 0x492040
call fcn.004040b4
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
mov edx, dword [0x492038]
mov eax, 0x48e9fc
call fcn.00404664
inc eax
push eax
mov eax, dword [0x492038]
call fcn.00404320
mov ecx, eax
mov eax, dword [0x492038]
pop edx
call fcn.00404580
mov edx, dword [ebp - 0x30]
mov eax, 0x48e9fc
call fcn.00404664
dec eax
push eax
lea eax, [ebp - 0x34]
push eax
mov edx, dword [0x492038]
mov eax, 0x48e9fc
call fcn.00404664
inc eax
push eax
mov eax, dword [0x492038]
call fcn.00404320
mov ecx, eax
mov eax, dword [0x492038]
pop edx
call fcn.00404580
mov eax, dword [ebp - 0x34]
mov edx, 1
pop ecx
call fcn.00404580
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.0040811c
mov edx, dword [ebp - 0x28]
mov eax, 0x492044
call fcn.004040b4
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x492040]
call fcn.00404320
mov ebx, eax
mov eax, dword [0x492044]
call fcn.00404320
add ebx, eax
add ebx, 3
push ebx
mov eax, dword [0x492038]
call fcn.00404320
mov ecx, eax
mov eax, dword [0x492038]
pop edx
call fcn.00404580
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.0040811c
mov edx, dword [ebp - 0x38]
mov eax, 0x492048
call fcn.004040b4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x433710]
call fcn.00433bf8
mov ebx, eax
push 0x48ea08
push dword [0x492048]
push 0x48ea48
push dword [0x492040]
push 0x48ea5c
lea eax, [ebp - 0x44]
mov edx, 5
call fcn.004043e0
mov edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x40]
mov eax, ebx
call fcn.00433d78
mov edx, dword [ebp - 0x40]
mov eax, 0x492034
call fcn.004040b4
mov eax, ebx
call fcn.0040328c
push 0x104
push 0x492050
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x48]
mov eax, 0x492050
call fcn.00408df4
mov edx, dword [ebp - 0x48]
mov eax, 0x492158
call fcn.004040b4
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x492158]
call fcn.00404320
mov edx, eax
mov ecx, 1
mov eax, dword [0x492158]
call fcn.00404580
mov eax, dword [ebp - 0x4c]
mov edx, 0x48ea70
call fcn.0040446c
jne 0x48de96
push 0x492158
mov eax, dword [0x492158]
call fcn.00404320
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x492158]
call fcn.00404580
mov eax, 0x49215c
mov ecx, 0x48ea7c
mov edx, dword [0x492158]
call fcn.0040436c
lea edx, [ebp - 0x50]
mov eax, dword [0x492034]
call fcn.0040811c
mov edx, dword [ebp - 0x50]
mov eax, 0x48ea94
call fcn.00404664
test eax, eax
jle 0x48e39c
xor eax, eax
push ebp
push 0x48df37
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48e9b8
mov eax, ebx
call fcn.00421cac
xor ecx, ecx
mov edx, 0x48e9dc
mov eax, ebx
call fcn.00421e68
xor ecx, ecx
mov edx, 0x48e9ec
mov eax, ebx
call fcn.00421e68
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48df41
push 0
push 0
push 0x10
lea edx, [ebp - 0x54]
mov eax, 2
call fcn.00402a1c
mov eax, dword [ebp - 0x54]
call fcn.00408628
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [0x49215c]
call fcn.004089d4
test al, al
je 0x48e012
xor eax, eax
push ebp
push 0x48e008
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0xfffffffe
mov eax, dword [0x49215c]
call fcn.004089e4
lea edx, [ebp - 0x5c]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x5c]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x5c]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x58]
call fcn.00404258
mov eax, dword [ebp - 0x58]
mov edx, 0xfffffffe
call fcn.004089e4
lea edx, [ebp - 0x64]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x64]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x64]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x60]
call fcn.00404258
mov eax, dword [ebp - 0x60]
call fcn.00408a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e012
xor eax, eax
push ebp
push 0x48e0f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x49215c]
mov dl, 1
mov eax, dword [0x420b5c]
call fcn.00420c0c
mov ebx, eax
call fcn.0040a2a0
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x68]
call fcn.0040af08
mov eax, dword [ebp - 0x68]
push eax
mov ecx, 0x48eabc
mov edx, 0x48eacc
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [0x492038]
push eax
mov ecx, 0x48e9ec
mov edx, 0x48eacc
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
mov eax, dword [0x492034]
call fcn.0040811c
mov eax, dword [ebp - 0x70]
call fcn.00404320
push eax
lea edx, [ebp - 0x74]
mov eax, dword [0x492034]
call fcn.0040811c
mov edx, dword [ebp - 0x74]
mov eax, 0x48eae0
call fcn.00404664
add eax, 2
push eax
lea edx, [ebp - 0x78]
mov eax, dword [0x492034]
call fcn.0040811c
mov eax, dword [ebp - 0x78]
pop edx
pop ecx
call fcn.00404580
mov eax, dword [ebp - 0x6c]
push eax
mov ecx, 0x48eaec
mov edx, 0x48eacc
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 4]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x54]
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e0fa
xor eax, eax
push ebp
push 0x48e14f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x7c]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x7c]
mov edx, 0x48eaf8
call fcn.00404328
mov eax, dword [ebp - 0x7c]
call fcn.00404520
push eax
lea edx, [ebp - 0x80]
xor eax, eax
call fcn.00402a1c
mov eax, dword [ebp - 0x80]
call fcn.00404520
push eax
call sub.kernel32.dll_CopyFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e159
xor eax, eax
push ebp
push 0x48e1c8
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x88]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x88]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x88]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x84]
call fcn.00404258
mov eax, dword [ebp - 0x84]
mov edx, 3
call fcn.004089e4
mov edx, 3
mov eax, dword [0x49215c]
call fcn.004089e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e1d2
xor eax, eax
push ebp
push 0x48e29b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48eb0c
mov eax, ebx
call fcn.00421cac
push 0x48eb44
lea edx, [ebp - 0x194]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x194]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x194]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x190]
call fcn.00402d90
lea edx, [ebp - 0x190]
lea eax, [ebp - 0x90]
call fcn.004042c4
push dword [ebp - 0x90]
push 0x48eb50
lea eax, [ebp - 0x8c]
mov edx, 3
call fcn.004043e0
mov ecx, dword [ebp - 0x8c]
mov edx, 0x48eb64
mov eax, ebx
call fcn.00421e68
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e2a5
xor eax, eax
push ebp
push 0x48e388
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
lea edx, [ebp - 0x19c]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x19c]
mov edx, 0x48eb74
call fcn.00404328
mov eax, dword [ebp - 0x19c]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x198]
call fcn.00404258
mov ecx, dword [ebp - 0x198]
mov dl, 1
mov eax, dword [0x412dd0]
call fcn.00417920
mov esi, eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x433710]
call fcn.00433bf8
mov ebx, eax
mov ecx, esi
mov edx, 0x48eb8c
mov eax, ebx
call fcn.00433d20
mov eax, esi
call fcn.0040328c
mov eax, ebx
call fcn.0040328c
push 1
push 0x48ebc4
push 0x48ebc8
lea edx, [ebp - 0x1a0]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x1a0]
mov edx, 0x48eb74
call fcn.00404328
mov eax, dword [ebp - 0x1a0]
call fcn.00404520
push eax
push 0x48ebd4
push 0
call sub.shell32.dll_ShellExecuteA
push 0x2710
call sub.kernel32.dll_Sleep_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e392
call fcn.0048afbc
jmp 0x48e615
lea edx, [ebp - 0x1a4]
mov eax, dword [0x492034]
call fcn.0040811c
mov eax, dword [ebp - 0x1a4]
mov edx, 0x48ebe4
call fcn.0040446c
jne 0x48e51e
xor eax, eax
push ebp
push 0x48e50f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x48e42a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48eb0c
mov eax, ebx
call fcn.00421cac
mov edx, 0x48eb64
mov eax, ebx
call fcn.00421dd0
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e434
mov eax, dword [0x49215c]
call fcn.004089d4
test al, al
je 0x48e502
xor eax, eax
push ebp
push 0x48e4f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0xfffffffe
mov eax, dword [0x49215c]
call fcn.004089e4
lea edx, [ebp - 0x1ac]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x1ac]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x1ac]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x1a8]
call fcn.00404258
mov eax, dword [ebp - 0x1a8]
mov edx, 0xfffffffe
call fcn.004089e4
lea edx, [ebp - 0x1b4]
mov eax, dword [0x49215c]
call fcn.00408aa4
lea eax, [ebp - 0x1b4]
mov edx, 0x48eaa8
call fcn.00404328
mov eax, dword [ebp - 0x1b4]
call fcn.00404520
mov edx, eax
lea eax, [ebp - 0x1b0]
call fcn.00404258
mov eax, dword [ebp - 0x1b0]
call fcn.00408a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e502
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e615
lea edx, [ebp - 0x1b8]
mov eax, dword [0x492034]
call fcn.0040811c
mov eax, dword [ebp - 0x1b8]
mov edx, 0x48ebf8
call fcn.0040446c
jne 0x48e615
push 0
push 0
push 0x10
lea edx, [ebp - 0x1bc]
mov eax, 2
call fcn.00402a1c
mov eax, dword [ebp - 0x1bc]
call fcn.00408628
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
push ebp
push 0x48e5d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48e9b8
mov eax, ebx
call fcn.00421cac
xor ecx, ecx
mov edx, 0x48e9dc
mov eax, ebx
call fcn.00421e68
xor ecx, ecx
mov edx, 0x48e9ec
mov eax, ebx
call fcn.00421e68
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e5df
push 1
push 0x48ec04
push 0x48ec18
push 0
call sub.user32.dll_MessageBoxA_1
dec eax
jne 0x48e615
push 5
push 0
push 0
push 0x48ec8c
push 0x48ebd4
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e960
lea edx, [ebp - 0x1c0]
mov eax, 1
call fcn.00402a1c
mov eax, dword [ebp - 0x1c0]
mov edx, 0x48ecc4
call fcn.0040446c
jne 0x48e6c0
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.00477914
push 0xffffffffffffffec
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [0x490bcc]
mov eax, dword [eax]
xor edx, edx
call fcn.0047750c
mov ecx, dword [0x490e24]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x48c480]
call fcn.0047792c
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.004779ac
jmp 0x48e960
lea edx, [ebp - 0x1c4]
mov eax, 1
call fcn.00402a1c
mov eax, dword [ebp - 0x1c4]
mov edx, 0x48ecd4
call fcn.0040446c
jne 0x48e76b
xor eax, eax
push ebp
push 0x48e761
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48e9b8
mov eax, ebx
call fcn.00421cac
mov edx, 0x48ece4
mov eax, ebx
call fcn.0042202c
test al, al
je 0x48e749
mov edx, 0x48ece4
mov eax, ebx
call fcn.00421f20
test eax, eax
jne 0x48e749
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e960
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e76b
xor eax, eax
push ebp
push 0x48e7ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x421aa8]
call fcn.00421ba8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00421c48
mov cl, 1
mov edx, 0x48e9b8
mov eax, ebx
call fcn.00421cac
mov edx, 0x48ecf4
mov eax, ebx
call fcn.00421f20
mov dword [0x49204c], eax
mov eax, ebx
call fcn.00421c18
mov eax, ebx
call fcn.0040328c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e7d4
cmp dword [0x49204c], 1
je 0x48e823
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.00477914
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, 0x48ed04
call fcn.0047750c
mov ecx, dword [0x490bdc]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x48d3d8]
call fcn.0047792c
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.004779ac
jmp 0x48e960
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.00477914
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, 0x48ed04
call fcn.0047750c
mov ecx, dword [0x490d70]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x488db4]
call fcn.0047792c
mov ecx, dword [0x490dd0]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x486084]
call fcn.0047792c
mov ecx, dword [0x490b54]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x4869ec]
call fcn.0047792c
mov ecx, dword [0x490960]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x487180]
call fcn.0047792c
mov ecx, dword [0x490cb0]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x487f40]
call fcn.0047792c
mov ecx, dword [0x490c14]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x486564]
call fcn.0047792c
mov ecx, dword [0x490804]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x4867a8]
call fcn.0047792c
mov ecx, dword [0x490858]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x48c264]
call fcn.0047792c
mov ecx, dword [0x490c48]
mov eax, dword [0x490bcc]
mov eax, dword [eax]
mov edx, dword [0x488b44]
call fcn.0047792c
lea edx, [ebp - 0x1c8]
mov eax, 1
call fcn.00402a1c
mov eax, dword [ebp - 0x1c8]
mov edx, 0x48ed34
call fcn.0040446c
jne 0x48e954
mov eax, dword [0x490858]
mov eax, dword [eax]
mov dl, 5
call fcn.00471ee0
mov eax, dword [0x490858]
mov eax, dword [eax]
call fcn.00474414
mov eax, dword [0x490bcc]
mov eax, dword [eax]
call fcn.004779ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e995
lea eax, [ebp - 0x1c8]
mov edx, 0xe
call fcn.00404084
lea eax, [ebp - 0x90]
mov edx, 0x20
call fcn.00404084
ret