Function at 0x1009cd0
Capabilities:
Create directory
Get common file path
Query environment variable
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019f2a
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1d18
call fcn.0100c6e0
mov eax, dword [0x101d6a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c94], eax
xor eax, eax
mov edi, 0x104
push edi
push eax
mov dword [ebp - 0x1ca0], eax
mov dword [ebp - 0x1c80], eax
mov dword [ebp - 0x1c9c], eax
mov dword [ebp - 0x1cd0], eax
mov dword [ebp - 0x1c88], eax
mov dword [ebp - 0x1c7c], eax
lea eax, [ebp - 0x118]
push eax
call fcn.0100b750
xor ebx, ebx
inc ebx
add esp, 0xc
cmp dword [ebp + 8], ebx
jle 0x100a031
mov eax, dword [ebp - 0x1c94]
lea esi, [eax + ebx*4]
push 3
push dword [esi]
push 0x100210c
call fcn.0100c66e
add esp, 0xc
test eax, eax
je 0x1009fdd
push 6
push dword [esi]
push 0x1002104
call fcn.0100c66e
add esp, 0xc
test eax, eax
je 0x1009fdd
push 6
push dword [esi]
push 0x10020fc
call fcn.0100c66e
add esp, 0xc
test eax, eax
je 0x1009fdd
push 9
push dword [esi]
push 0x10020f0
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009dd1
mov dword [0x101d004], 7
jmp 0x1009ece
push 7
push dword [esi]
push 0x10020e8
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009df1
and dword [0x101d004], eax
jmp 0x1009ece
push 8
push dword [esi]
push 0x10020e0
call fcn.0100c66e
add esp, 0xc
test eax, eax
je 0x1009f09
push 0xa
push dword [esi]
push 0x10020d4
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009e2e
mov dword [ebp - 0x1c80], 1
jmp 0x1009ece
push 3
push dword [esi]
push 0x10020d0
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009e4f
mov dword [ebp - 0x1ca0], 1
jmp 0x1009ece
push 7
push dword [esi]
push 0x10020c8
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009e91
inc ebx
cmp dword [ebp + 8], ebx
je 0x1009fdd
push dword [esi + 4]
call fcn.0100c4c1
pop ecx
mov dword [ebp - 0x1c88], eax
test eax, eax
jbe 0x1009fdd
mov dword [ebp - 0x1c9c], 1
jmp 0x1009ece
push 5
push dword [esi]
push 0x10020c0
call fcn.0100c66e
add esp, 0xc
test eax, eax
jne 0x1009fdd
mov eax, dword [ebp + 8]
lea ecx, [ebx + 1]
cmp ecx, eax
je 0x1009fdd
lea ecx, [eax - 2]
cmp ebx, ecx
jne 0x1009fdd
mov ecx, dword [esi + 4]
mov dword [ebp - 0x1c7c], ecx
mov ebx, eax
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x1009d59
xor eax, eax
cmp dword [ebp - 0x1c80], eax
je 0x100a016
cmp dword [ebp + 8], 2
jne 0x1009fdd
mov dword [ebp - 4], eax
call fcn.0100ac07
mov dword [ebp - 0x1c8c], eax
mov eax, dword [ebp - 0x1c8c]
jmp 0x100aa2c
push edi
lea eax, [ebp - 0x118]
xor esi, esi
push eax
inc esi
xor ebx, ebx
push 0x10020a8
mov dword [ebp - 0x1cd0], esi
mov dword [0x101d004], ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, ebx
je 0x1009fea
cmp eax, edi
ja 0x1009fea
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1009f60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1009fea
lea eax, [ebp - 0x118]
push eax
push 0x10020a0
lea eax, [ebp - 0x938]
push edi
push eax
call fcn.01005af0
add esp, 0x10
push 0x1002088
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x1009fad
push 0x1002070
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1009fa6
lea ecx, [ebp - 0x938]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1002060
push edi
lea eax, [ebp - 0x118]
push eax
call fcn.01005a38
test eax, eax
jl 0x1009fe2
lea eax, [ebp - 0x118]
mov dword [ebp - 0x1c7c], eax
mov dword [ebp - 0x1ca0], ebx
mov dword [ebp - 0x1c9c], ebx
jmp 0x100a031
call fcn.01006d43
xor eax, eax
inc eax
jmp 0x100aa2c
mov eax, esi
jmp 0x100aa2c
cmp dword [ebp - 0x1c9c], eax
je 0x100a031
mov eax, dword [ebp - 0x1c88]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1d00]
call fcn.01009b15
lea ecx, [ebp - 0x1810]
mov dword [ebp - 4], 2
call fcn.01007ecc
xor esi, esi
lea ecx, [ebp - 0x1ce8]
mov byte [ebp - 4], 3
mov dword [ebp - 0x13b0], 0x1001a84
mov dword [ebp - 0xaf4], 0x100148c
mov dword [ebp - 0x1cf0], 0xe
mov dword [ebp - 0x1c90], esi
mov dword [ebp - 0x1ca4], esi
mov dword [ebp - 0x1c88], esi
mov dword [ebp - 0x1c98], esi
mov dword [ebp - 0x1c94], esi
call fcn.0100764b
mov dword [ebp - 0x1ce4], eax
mov dword [ebp - 0x1ce0], esi
push 4
pop ebx
lea ecx, [ebp - 0x1cb0]
mov byte [ebp - 4], bl
mov byte [ebp - 0x1c75], 0
call fcn.0100762d
mov dword [ebp - 0x1cac], eax
mov dword [ebp - 0x1ca8], esi
xor eax, eax
mov dword [ebp - 0x1cdc], esi
lea edi, [ebp - 0x1cd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1ccc]
push eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c8c], esi
mov dword [ebp - 0x1cec], esi
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x528]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x100a128
push 0x100203c
push ebx
call fcn.01005bd8
pop ecx
pop ecx
mov byte [ebp - 0x1c75], 1
jmp 0x100a922
xor edi, edi
cmp dword [ebp - 0x1c7c], edi
je 0x100a14f
push dword [ebp - 0x1c7c]
lea eax, [ebp - 0x320]
push 0x10020a0
push esi
push eax
call fcn.01005af0
add esp, 0x10
jmp 0x100a1ae
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [ebp - 0x1cc0]
push eax
movzx eax, word [ebp - 0x1cc2]
push eax
movzx eax, word [ebp - 0x1cc4]
push eax
movzx eax, word [ebp - 0x1cc6]
push eax
movzx eax, word [ebp - 0x1cca]
push eax
movzx eax, word [ebp - 0x1ccc]
push eax
push 0x1002028
lea eax, [ebp - 0x528]
push eax
push 0x1001fd0
lea eax, [ebp - 0x320]
push esi
push eax
call fcn.01005af0
add esp, 0x34
lea ecx, [ebp - 0x1cfc]
call fcn.010099ad
mov esi, 0x348
push esi
lea eax, [ebp - 0xe3c]
push edi
push eax
call fcn.0100b750
add esp, 0xc
lea eax, [ebp - 0x1ce8]
push eax
push 0x1009949
push edi
push edi
mov dword [ebp - 0xe3c], esi
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
test eax, eax
jne 0x100a1fc
push 0x1001e54
call fcn.0100b6b5
jmp 0x100a11b
push edi
lea eax, [ebp - 0xe3c]
push eax
push edi
push edi
mov dword [ebp - 0x1c80], edi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x100a5b9
mov ebx, 0xdc
test dword [ebp - 0xcf8], 8
jne 0x100a58f
lea ecx, [ebp - 0x13dc]
call fcn.01007776
lea ecx, [ebp - 0x13cc]
call fcn.01007776
lea ecx, [ebp - 0x13bc]
call fcn.01007776
and dword [ebp - 0x14c4], 0
push ebx
lea eax, [ebp - 0x14bc]
push 0
mov ecx, 0xd2
lea esi, [ebp - 0xe3c]
lea edi, [ebp - 0x180c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0100b750
push ebx
lea eax, [ebp - 0xa14]
push 0
push eax
call fcn.0100b750
add esp, 0x18
test byte [ebp - 0xcf8], 1
mov eax, ebx
mov word [ebp - 0x9d0], ax
je 0x100a2e4
push 6
lea eax, [ebp - 0xa14]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xe38]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
test eax, eax
je 0x100a2d6
push 0x37
pop ecx
lea esi, [ebp - 0xa14]
lea edi, [ebp - 0x14bc]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14c4], 1
jmp 0x100a2e4
push 0x1001fac
push 4
call fcn.01005bd8
pop ecx
pop ecx
push 1
lea eax, [ebp - 0x1c74]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0xe38]
push eax
mov dword [ebp - 0x1c74], 0x348
mov dword [ebp - 0x1c7c], esi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x100a47f
push 0x348
xor esi, esi
lea eax, [ebp - 0x13ac]
push esi
push eax
call fcn.0100b750
push 0x68
lea eax, [ebp - 0x1060]
push esi
push eax
call fcn.0100b750
add esp, 0x18
mov eax, 0xffff
push 0x1001fa8
mov word [ebp - 0xe50], ax
push 0xcb
lea eax, [ebp - 0xff8]
push eax
mov dword [ebp - 0x1064], esi
mov dword [ebp - 0xe44], esi
mov dword [ebp - 0xe5c], esi
mov dword [ebp - 0xe60], esi
mov dword [ebp - 0xe58], esi
mov dword [ebp - 0xe54], esi
mov dword [ebp - 0xe4c], esi
mov dword [ebp - 0xe48], esi
mov dword [ebp - 0xe40], esi
call fcn.010059af
test byte [ebp - 0xcf8], 1
mov ecx, 0xd2
lea esi, [ebp - 0x1c74]
lea edi, [ebp - 0x13ac]
rep movsd dword es:[edi], dword [esi]
je 0x100a3e3
test byte [ebp - 0x1b30], 2
je 0x100a3e3
test byte [ebp - 0x1b30], 1
je 0x100a3e3
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x13b0]
push eax
lea eax, [ebp - 0x1ce8]
push eax
call fcn.01007925
test eax, eax
je 0x100a5f3
push 0xcb
lea eax, [ebp - 0xff8]
push eax
lea eax, [ebp - 0x1264]
push eax
call fcn.010053e3
test eax, eax
je 0x100a43b
lea eax, [ebp - 0x13b0]
push eax
call fcn.01007355
lea eax, [ebp - 0x13b0]
push eax
call fcn.01008427
lea eax, [ebp - 0x13b0]
push eax
call fcn.01007104
lea eax, [ebp - 0x13b0]
push eax
call fcn.01007232
lea eax, [ebp - 0x13b0]
push eax
call fcn.01007459
lea eax, [ebp - 0x13b0]
push eax
push dword [ebp - 0x13d8]
lea ecx, [ebp - 0x13dc]
call fcn.010081de
inc dword [ebp - 0x1c7c]
push 1
lea eax, [ebp - 0x1c74]
push eax
push dword [ebp - 0x1c7c]
lea eax, [ebp - 0xe38]
push eax
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x100a315
xor esi, esi
push ebx
lea eax, [ebp - 0xa14]
push esi
push eax
mov dword [ebp - 0x1c7c], esi
call fcn.0100b750
add esp, 0xc
mov eax, ebx
mov word [ebp - 0x9d0], ax
push 6
lea eax, [ebp - 0xa14]
push eax
push esi
jmp 0x100a4e9
push 0x37
pop ecx
lea eax, [ebp - 0xaf4]
push eax
push dword [ebp - 0x13c8]
lea esi, [ebp - 0xa14]
lea edi, [ebp - 0xaf0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x13cc]
call fcn.01008217
inc dword [ebp - 0x1c7c]
push 6
lea eax, [ebp - 0xa14]
push eax
push dword [ebp - 0x1c7c]
lea eax, [ebp - 0xe38]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
test eax, eax
jne 0x100a4ab
xor esi, esi
push ebx
lea eax, [ebp - 0xa14]
push esi
push eax
mov dword [ebp - 0x1c7c], esi
call fcn.0100b750
add esp, 0xc
mov eax, ebx
mov word [ebp - 0x9d0], ax
push 4
lea eax, [ebp - 0xa14]
push eax
push esi
jmp 0x100a566
push 0x37
pop ecx
lea eax, [ebp - 0xaf4]
push eax
push dword [ebp - 0x13b8]
lea esi, [ebp - 0xa14]
lea edi, [ebp - 0xaf0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x13bc]
call fcn.01008217
inc dword [ebp - 0x1c7c]
push 4
lea eax, [ebp - 0xa14]
push eax
push dword [ebp - 0x1c7c]
lea eax, [ebp - 0xe38]
push eax
call dword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
test eax, eax
jne 0x100a528
lea eax, [ebp - 0x1810]
push eax
push dword [ebp - 0x1cf8]
lea ecx, [ebp - 0x1cfc]
call fcn.01009c97
inc dword [ebp - 0x1c80]
push 0
lea eax, [ebp - 0xe3c]
push eax
push dword [ebp - 0x1c80]
push 0
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x100a21f
push 4
pop ebx
xor edi, edi
cmp dword [ebp - 0x1cd0], edi
je 0x100a605
push edi
lea eax, [ebp - 0x1cd8]
push eax
push 1
push 0x1001f94
mov dword [ebp - 0x1cdc], 0xc
mov dword [ebp - 0x1cd4], edi
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA
test eax, eax
jne 0x100a5fd
push 0x1001f68
jmp 0x100a114
push 0x1001f40
jmp 0x100a1f2
lea eax, [ebp - 0x1cdc]
jmp 0x100a60b
mov eax, dword [ebp - 0x1cec]
push edi
push edi
push 2
push eax
push 3
push 0xc0000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c80], eax
cmp eax, 0xffffffff
jne 0x100a639
push 0x1001e30
jmp 0x100a114
lea eax, [ebp - 0x320]
push eax
push 0x1001f30
push 1
call fcn.01005bd8
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
and dword [ebp - 0x1c84], 0
add esp, 0xc
push 0
lea eax, [ebp - 0x1c84]
push eax
push ebx
lea eax, [ebp - 0x1cf0]
push eax
push dword [ebp - 0x1c80]
call esi
test eax, eax
jne 0x100a683
push 0x100158c
jmp 0x100a114
xor eax, eax
lea edi, [ebp - 0x1cbc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1cbc]
push eax
lea eax, [ebp - 0x1c98]
push eax
lea eax, [ebp - 0x1c88]
push eax
lea eax, [ebp - 0x1d28]
push eax
lea eax, [ebp - 0x1c90]
push eax
lea eax, [ebp - 0x1cb0]
push eax
lea eax, [ebp - 0x192c]
push eax
call fcn.0100867a
test eax, eax
jl 0x100a901
lea eax, [ebp - 0x1c94]
push eax
push 0x7fffffff
push dword [ebp - 0x1c90]
call fcn.01005b8a
test eax, eax
jl 0x100a11c
mov eax, dword [ebp - 0x1c94]
cmp eax, 0xffffffff
ja 0x100a11c
mov edi, dword [ebp - 0x1c80]
push 0
mov dword [ebp - 0x1ca4], eax
lea eax, [ebp - 0x1c84]
push eax
push ebx
lea eax, [ebp - 0x1ca4]
push eax
push edi
call esi
test eax, eax
je 0x100a679
push 0
lea eax, [ebp - 0x1c84]
push eax
push dword [ebp - 0x1ca4]
push dword [ebp - 0x1c90]
push edi
call esi
test eax, eax
je 0x100a679
push 0
lea eax, [ebp - 0x1c84]
push eax
push 0x11c
lea eax, [ebp - 0x192c]
push eax
push edi
call esi
test eax, eax
je 0x100a679
push 0
lea eax, [ebp - 0x1c84]
push eax
push 0x24
lea eax, [ebp - 0x1d28]
push eax
push edi
call esi
test eax, eax
je 0x100a679
push dword [ebp - 0x1cbc]
push edi
call fcn.01006282
test eax, eax
jl 0x100a679
push dword [ebp - 0x1cb8]
push edi
call fcn.01006282
test eax, eax
jl 0x100a679
push dword [ebp - 0x1cb4]
push edi
call fcn.01006282
test eax, eax
jl 0x100a679
mov eax, dword [ebp - 0x1ca8]
push 0
mov dword [ebp - 0x1c8c], eax
lea eax, [ebp - 0x1c84]
push eax
push ebx
lea eax, [ebp - 0x1c8c]
push eax
push edi
call esi
test eax, eax
je 0x100a679
mov eax, dword [ebp - 0x1cac]
mov ecx, dword [eax]
mov dword [ebp - 0x1c80], ecx
cmp ecx, eax
je 0x100a822
mov eax, dword [ebp - 0x1c80]
push dword [eax + 8]
push edi
call fcn.0100633f
test eax, eax
je 0x100a679
mov eax, dword [ebp - 0x1c80]
mov eax, dword [eax]
mov dword [ebp - 0x1c80], eax
cmp eax, dword [ebp - 0x1cac]
jne 0x100a7f5
push 0
lea eax, [ebp - 0x1c84]
push eax
push ebx
lea eax, [ebp - 0x1c98]
push eax
push edi
call esi
test eax, eax
je 0x100a679
cmp dword [ebp - 0x1c98], 0
jbe 0x100a867
push 0
lea eax, [ebp - 0x1c84]
push eax
push dword [ebp - 0x1c98]
push dword [ebp - 0x1c88]
push edi
call esi
test eax, eax
je 0x100a679
push edi
lea ecx, [ebp - 0x1d00]
call fcn.010079bd
cmp dword [ebp - 0x1ca0], 0
je 0x100a8eb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [ebp - 0x1cc0]
push eax
movzx eax, word [ebp - 0x1cc2]
push eax
movzx eax, word [ebp - 0x1cc4]
push eax
movzx eax, word [ebp - 0x1cc6]
push eax
movzx eax, word [ebp - 0x1cca]
push eax
movzx eax, word [ebp - 0x1ccc]
push eax
push 0x1002028
lea eax, [ebp - 0x528]
push eax
push 0x1001ed8
lea eax, [ebp - 0x730]
push 0x104
push eax
call fcn.01005af0
add esp, 0x34
lea eax, [ebp - 0x730]
push eax
call fcn.010097c5
push edi
call fcn.0100968e
test eax, eax
jl 0x100a11c
push edi
call fcn.01009333
jmp 0x100a91b
push 0x1001e90
push ebx
call fcn.01005bd8
mov edi, dword [ebp - 0x1c80]
pop ecx
pop ecx
mov byte [ebp - 0x1c75], 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [ebp - 0x1cd8], ebx
je 0x100a938
push dword [ebp - 0x1cd8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1cbc], ebx
je 0x100a94c
push dword [ebp - 0x1cbc]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x1cb8], ebx
je 0x100a960
push dword [ebp - 0x1cb8]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x1cb4], ebx
je 0x100a974
push dword [ebp - 0x1cb4]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x1c88], ebx
je 0x100a988
push dword [ebp - 0x1c88]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x1c90], ebx
je 0x100a99c
push dword [ebp - 0x1c90]
call fcn.0100ae38
pop ecx
mov eax, dword [ebp - 0x1ca8]
mov edi, dword [ebp - 0x1cac]
mov dword [ebp - 0x1c8c], eax
mov esi, dword [edi]
jmp 0x100a9bd
push dword [esi + 8]
call fcn.0100ae38
mov esi, dword [esi]
pop ecx
cmp esi, edi
jne 0x100a9b2
lea ecx, [ebp - 0x1cb0]
call fcn.01007776
lea ecx, [ebp - 0x1cfc]
call fcn.010099ad
cmp dword [ebp - 0x1c9c], ebx
je 0x100a9f5
push 3
pop esi
push 0x1f4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Beep]
dec esi
jne 0x100a9e2
lea ecx, [ebp - 0x1cb0]
call fcn.010075f1
lea ecx, [ebp - 0x1ce8]
call fcn.010075f1
lea ecx, [ebp - 0x1810]
call fcn.01007ce5
lea ecx, [ebp - 0x1cfc]
call fcn.010099e9
xor eax, eax
cmp byte [ebp - 0x1c75], al
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0100b6a0
leave
ret