Function at 0x4054d0
Capabilities:
Check os version
Get common file path
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x42f060]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x654], ecx
mov eax, dword [ebp - 0x654]
mov byte [eax + 0x218], 1
mov ecx, dword [ebp - 0x654]
cmp dword [ecx + 0x107c], 0
je 0x405616
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x107c]
mov ecx, dword [ebp - 0x654]
mov ecx, dword [ecx + 0x107c]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x1084], eax
mov byte [ebp - 0xa1], 0
mov dword [ebp - 0xa8], 1
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x107c]
mov ecx, dword [ebp - 0x654]
mov ecx, dword [ecx + 0x107c]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x658], eax
lea ecx, [ebp - 0xa8]
push ecx
lea edx, [ebp - 0xa1]
push edx
push str.KxClientProfile
mov eax, dword [ebp - 0x658]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x658]
mov eax, dword [edx + 0x1cc]
call eax
movzx ecx, al
test ecx, ecx
je 0x4055b6
movzx edx, byte [ebp - 0xa1]
neg edx
sbb edx, edx
add edx, 1
mov eax, dword [ebp - 0x654]
mov byte [eax + 0x105e], dl
jmp 0x405614
mov ecx, dword [ebp - 0x654]
mov byte [ecx + 0x105e], 0
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x107c]
mov ecx, dword [ebp - 0x654]
mov ecx, dword [ecx + 0x107c]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x65c], eax
push 1
push 3
mov ecx, dword [ebp - 0x654]
add ecx, 0x105e
push ecx
push str.KxClientProfile
mov edx, dword [ebp - 0x65c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x65c]
mov edx, dword [eax + 0x1c8]
call edx
jmp 0x405626
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x1084], 0
push 0x94
push 0
lea ecx, [ebp - 0xa0]
push ecx
call fcn.00416110
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea edx, [ebp - 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40567e
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40567e
xor eax, eax
jmp 0x406311
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x660], ecx
cmp dword [ebp - 0x660], 1
je 0x405733
cmp dword [ebp - 0x660], 2
je 0x4056a5
jmp 0x405799
cmp dword [ebp - 0x9c], 4
ja 0x4056be
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x210], 0x11
cmp dword [ebp - 0x9c], 5
jne 0x4056e0
cmp dword [ebp - 0x98], 0
jne 0x4056e0
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x210], 0x12
cmp dword [ebp - 0x9c], 5
jne 0x405702
cmp dword [ebp - 0x98], 1
jne 0x405702
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x210], 0x13
cmp dword [ebp - 0x9c], 5
jne 0x405724
cmp dword [ebp - 0x98], 2
jne 0x405724
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x210], 0x14
mov eax, dword [ebp - 0x654]
mov byte [eax + 0x218], 0
jmp 0x405799
cmp dword [ebp - 0x9c], 4
jne 0x405755
cmp dword [ebp - 0x98], 0
jne 0x405755
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x210], 1
cmp dword [ebp - 0x9c], 4
jne 0x405777
cmp dword [ebp - 0x98], 0xa
jne 0x405777
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x210], 2
cmp dword [ebp - 0x9c], 4
jne 0x405799
cmp dword [ebp - 0x98], 0x5a
jne 0x405799
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x210], 3
mov ecx, dword [ebp - 0x654]
cmp dword [ecx + 0x214], 0
jne 0x4058b4
push 0xa
lea edx, [ebp - 0xb4]
push edx
push 9
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0x654]
call fcn.00406410
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x214], eax
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x214]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0xc04
jg 0x405824
cmp dword [ebp - 0x664], 0xc04
je 0x405862
cmp dword [ebp - 0x664], 0x404
je 0x40583e
cmp dword [ebp - 0x664], 0x804
je 0x405850
jmp 0x405896
cmp dword [ebp - 0x664], 0x1004
je 0x405874
cmp dword [ebp - 0x664], 0x1404
je 0x405886
jmp 0x405896
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x214], 0x4c1
jmp 0x405896
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x214], 0x8c0
jmp 0x405896
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x214], 0xcc1
jmp 0x405896
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x214], 0x10c0
jmp 0x405896
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x214], 0x14c1
mov eax, dword [ebp - 0x654]
mov ecx, dword [eax + 0x214]
and ecx, 0xff
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x214], ecx
cmp dword [ebp + 8], 0
je 0x406081
mov eax, dword [ebp - 0x654]
movzx ecx, byte [eax + 0x218]
test ecx, ecx
je 0x40592a
mov edx, dword [ebp + 8]
push edx
push 0x429c40
mov eax, dword [ebp - 0x654]
add eax, 0xa36
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov ecx, dword [ebp - 0x654]
add ecx, 0xa36
push ecx
mov edx, dword [ebp - 0x654]
add edx, 0xc3e
push edx
call fcn.00416a40
add esp, 8
mov eax, dword [ebp - 0x654]
add eax, 0xa36
push eax
push str.m_tszPrinterName___s_n
call fcn.00413880
add esp, 8
jmp 0x40597e
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x654]
add edx, 0x226
push edx
call fcn.00415af0
add esp, 8
mov eax, dword [ebp - 0x654]
add eax, 0x226
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 0x42e
push ecx
call fcn.00415af0
add esp, 8
mov edx, dword [ebp - 0x654]
add edx, 0x226
push edx
push str.m_wszPrinterName___s_n
call fcn.004139d0
add esp, 8
mov eax, dword [ebp - 0x654]
cmp dword [eax + 0x107c], 0
je 0x405a1c
mov ecx, dword [ebp - 0x654]
mov edx, dword [ecx + 0x107c]
mov eax, dword [ebp - 0x654]
mov ecx, dword [eax + 0x107c]
mov edx, dword [edx]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x668], eax
mov ecx, dword [ebp - 0x668]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x668]
mov eax, dword [edx + 0xd0]
call eax
movzx ecx, al
test ecx, ecx
je 0x405a00
mov edx, dword [ebp - 0x654]
movzx eax, byte [edx + 0x105e]
test eax, eax
jne 0x405a00
mov ecx, dword [ebp - 0x654]
mov byte [ecx + 0x219], 1
push str.m_bClient__true_n
call fcn.00413880
add esp, 4
jmp 0x405a1a
mov edx, dword [ebp - 0x654]
mov byte [edx + 0x219], 0
push str.m_bClient__false_n
call fcn.00413880
add esp, 4
jmp 0x405a36
push str.m_pCtrlCollection_is_NULL____n
call fcn.00413880
add esp, 4
mov eax, dword [ebp - 0x654]
mov byte [eax + 0x219], 0
mov ecx, dword [ebp - 0x654]
cmp dword [ecx + 0x220], 0xffffffff
jne 0x405b80
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0xc8], 0
mov edx, dword [ebp - 0x654]
movzx eax, byte [edx + 0x218]
test eax, eax
je 0x405ab3
push 0xc
push 0
lea ecx, [ebp - 0xd4]
push ecx
call fcn.00416110
add esp, 0xc
mov dword [ebp - 0xcc], 0xf000c
lea edx, [ebp - 0xd4]
push edx
lea eax, [ebp - 0xc4]
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 0xa36
push ecx
call sub.WINSPOOL.DRV_OpenPrinterA
mov dword [ebp - 0xc8], eax
jmp 0x405af6
push 0xc
push 0
lea edx, [ebp - 0xe0]
push edx
call fcn.00416110
add esp, 0xc
mov dword [ebp - 0xd8], 0xf000c
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0x654]
add edx, 0x226
push edx
call sub.WINSPOOL.DRV_OpenPrinterW
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x405b20
mov eax, dword [ebp - 0x654]
mov ecx, dword [ebp - 0xc4]
mov dword [eax + 0x220], ecx
mov edx, dword [ebp - 0x654]
mov byte [edx + 0x224], 1
jmp 0x405b80
mov eax, dword [ebp - 0x654]
cmp dword [eax + 0x107c], 0
je 0x405b80
mov ecx, dword [ebp - 0x654]
mov edx, dword [ecx + 0x107c]
mov eax, dword [ebp - 0x654]
mov ecx, dword [eax + 0x107c]
mov edx, dword [edx]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x66c], eax
mov ecx, dword [ebp - 0x66c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x66c]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x220], eax
mov edx, dword [ebp - 0x654]
mov byte [edx + 0x224], 0
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x21c], 0
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0xc0], 0
mov byte [ebp - 0xb9], 0
mov ecx, dword [ebp - 0x654]
cmp dword [ecx + 0x220], 0xffffffff
je 0x405bdf
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x220]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], 1
mov byte [ebp - 0xb9], 1
jmp 0x405c33
mov ecx, dword [ebp - 0x654]
movzx edx, byte [ecx + 0x218]
test edx, edx
je 0x405c13
push 0
lea eax, [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 0xa36
push ecx
call sub.WINSPOOL.DRV_OpenPrinterA
mov dword [ebp - 0xc0], eax
jmp 0x405c33
push 0
lea edx, [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0x654]
add eax, 0x226
push eax
call sub.WINSPOOL.DRV_OpenPrinterW
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x405c9a
mov ecx, dword [ebp - 0x654]
cmp dword [ecx + 0x107c], 0
je 0x405c9a
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x107c]
mov ecx, dword [ebp - 0x654]
mov ecx, dword [ecx + 0x107c]
mov edx, dword [eax]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x670]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x670]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xc0], 1
mov byte [ebp - 0xb9], 1
cmp dword [ebp - 0xc0], 0
je 0x405f8a
mov dword [ebp - 0xe4], 0
lea ecx, [ebp - 0xe4]
push ecx
push 0
push 0
push 2
mov edx, dword [ebp - 0xb8]
push edx
call sub.WINSPOOL.DRV_GetPrinterA
cmp dword [ebp - 0xe4], 0
je 0x405dba
mov eax, dword [ebp - 0xe4]
push eax
call fcn.00415b79
add esp, 4
mov dword [ebp - 0x638], eax
mov ecx, dword [ebp - 0x638]
mov dword [ebp - 0xe8], ecx
cmp dword [ebp - 0xe8], 0
je 0x405dba
lea edx, [ebp - 0xe4]
push edx
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0xe8]
push ecx
push 2
mov edx, dword [ebp - 0xb8]
push edx
call sub.WINSPOOL.DRV_GetPrinterA
push 2
push 0x429cd4
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00416b69
add esp, 0xc
test eax, eax
jne 0x405d55
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x21c], 1
push 4
push str.http
mov eax, dword [ebp - 0xe8]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00416b69
add esp, 0xc
test eax, eax
je 0x405d8f
push 3
push 0x429ce0
mov edx, dword [ebp - 0xe8]
mov eax, dword [edx + 0xc]
push eax
call fcn.00416b69
add esp, 0xc
test eax, eax
jne 0x405d9f
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x21c], 1
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x63c], edx
mov eax, dword [ebp - 0x63c]
push eax
call fcn.00415ab7
add esp, 4
mov byte [ebp - 0xe9], 0
mov ecx, dword [ebp - 0x654]
movzx edx, byte [ecx + 0x218]
test edx, edx
je 0x405de8
push str.Windows_4.0
lea eax, [ebp - 0x1f8]
push eax
call fcn.00416a40
add esp, 8
jmp 0x405dfc
push str.Windows_NT_x86
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.00416a40
add esp, 8
call fcn.00415530
test eax, eax
je 0x405e19
push str.Windows_x64
lea edx, [ebp - 0x1f8]
push edx
call fcn.00416a40
add esp, 8
mov dword [ebp - 0xe4], 0
lea eax, [ebp - 0xe4]
push eax
push 0
push 0
push 2
lea ecx, [ebp - 0x1f8]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
call sub.WINSPOOL.DRV_GetPrinterDriverA
cmp dword [ebp - 0xe4], 0
je 0x405f3b
mov eax, dword [ebp - 0xe4]
push eax
call fcn.00415b79
add esp, 4
mov dword [ebp - 0x640], eax
mov ecx, dword [ebp - 0x640]
mov dword [ebp - 0x1fc], ecx
cmp dword [ebp - 0x1fc], 0
je 0x405f3b
lea edx, [ebp - 0xe4]
push edx
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0x1fc]
push ecx
push 2
lea edx, [ebp - 0x1f8]
push edx
mov eax, dword [ebp - 0xb8]
push eax
call sub.WINSPOOL.DRV_GetPrinterDriverA
mov ecx, dword [ebp - 0x1fc]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x654]
add eax, 0xf4a
push eax
call fcn.00416a40
add esp, 8
mov ecx, dword [ebp - 0x654]
add ecx, 0xf4a
push ecx
call fcn.004182d0
add esp, 4
cmp eax, 3
jbe 0x405f20
mov dword [ebp - 0x200], 0
push 0x5c
mov edx, dword [ebp - 0x654]
add edx, 0xf4a
push edx
call fcn.004051e0
add esp, 8
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
je 0x405f20
mov eax, dword [ebp - 0x200]
mov byte [eax], 0
mov byte [ebp - 0xe9], 1
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp - 0x644], ecx
mov edx, dword [ebp - 0x644]
push edx
call fcn.00415ab7
add esp, 4
movzx eax, byte [ebp - 0xe9]
test eax, eax
jne 0x405f73
push 0x104
lea ecx, [ebp - 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0x308]
push edx
mov eax, dword [ebp - 0x654]
add eax, 0xf4a
push eax
call fcn.00416a40
add esp, 8
movzx ecx, byte [ebp - 0xb9]
test ecx, ecx
jne 0x405f8a
mov edx, dword [ebp - 0xb8]
push edx
call sub.WINSPOOL.DRV_ClosePrinter
mov eax, dword [ebp - 0x654]
cmp dword [eax + 0x21c], 1
jne 0x406054
mov ecx, dword [ebp - 0x654]
movzx edx, byte [ecx + 0x218]
test edx, edx
je 0x405fff
mov eax, dword [ebp - 0x654]
add eax, 0xc3e
mov dword [ebp - 0x30c], eax
push 0x5c
mov ecx, dword [ebp - 0x30c]
push ecx
call fcn.004051c0
add esp, 8
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
je 0x405ff4
mov edx, dword [ebp - 0x310]
mov byte [edx], 0x2c
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x310], 0
jne 0x405fbf
jmp 0x406054
mov ecx, dword [ebp - 0x654]
add ecx, 0x42e
mov dword [ebp - 0x318], ecx
push 0x5c
mov edx, dword [ebp - 0x318]
push edx
call fcn.00405220
add esp, 8
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
je 0x40604b
mov eax, 0x2c
mov ecx, dword [ebp - 0x314]
mov word [ecx], ax
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], edx
cmp dword [ebp - 0x314], 0
jne 0x406011
mov eax, dword [ebp - 0x654]
movzx ecx, byte [eax + 0x219]
test ecx, ecx
je 0x406074
push str.Client_mode_enabled_n
call fcn.00413880
add esp, 4
jmp 0x406081
push str.Client_mode_disabled_n
call fcn.00413880
add esp, 4
mov edx, dword [ebp - 0x654]
movzx eax, byte [edx + 0x218]
test eax, eax
je 0x406139
push 2
push 0x429cd4
mov ecx, dword [ebp - 0x654]
add ecx, 0xc3e
push ecx
call fcn.00416b69
add esp, 0xc
test eax, eax
jne 0x40611a
mov dword [ebp - 0x31c], 0
push 0x5c
mov edx, dword [ebp - 0x654]
add edx, 0xc3e
push edx
call fcn.004051e0
add esp, 8
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
je 0x4060ff
mov eax, dword [ebp - 0x31c]
add eax, 1
push eax
lea ecx, [ebp - 0x428]
push ecx
call fcn.00416a40
add esp, 8
lea edx, [ebp - 0x428]
push edx
mov eax, dword [ebp - 0x654]
add eax, 0xc3e
push eax
call fcn.00416a40
add esp, 8
mov ecx, dword [ebp - 0x654]
add ecx, 0xc3e
push ecx
push str.m_tszRegistryName___s_n
call fcn.00413880
add esp, 8
jmp 0x4061f5
push 2
push 0x428ee8
mov edx, dword [ebp - 0x654]
add edx, 0x42e
push edx
call fcn.0041618a
add esp, 0xc
test eax, eax
jne 0x4061bd
mov dword [ebp - 0x634], 0
push 0x5c
mov eax, dword [ebp - 0x654]
add eax, 0x42e
push eax
call fcn.004017a0
add esp, 8
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
je 0x4061a1
mov ecx, dword [ebp - 0x634]
add ecx, 2
push ecx
lea edx, [ebp - 0x630]
push edx
call fcn.00415af0
add esp, 8
lea eax, [ebp - 0x630]
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 0x42e
push ecx
call fcn.00415af0
add esp, 8
mov edx, dword [ebp - 0x654]
add edx, 0x42e
push edx
push str.m_wszRegistryName___s_n
call fcn.004139d0
add esp, 8
mov eax, dword [ebp - 0x654]
add eax, 0x42e
push eax
mov ecx, dword [ebp - 0x654]
add ecx, 4
push ecx
call fcn.00415af0
add esp, 8
mov edx, dword [ebp - 0x654]
mov byte [edx + 0xe46], 0
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x1064], 0
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x1060], 0
xor edx, edx
mov eax, dword [ebp - 0x654]
mov word [eax + 0x105c], dx
mov ecx, dword [ebp - 0x654]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x654]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0x654]
mov dword [ecx + 0x1060], eax
mov edx, dword [ebp - 0x654]
mov eax, dword [edx + 0x1060]
push eax
call fcn.00415b79
add esp, 4
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x654]
mov edx, dword [ebp - 0x648]
mov dword [ecx + 0x1064], edx
mov eax, dword [ebp - 0x654]
mov ecx, dword [eax + 0x1064]
push ecx
mov ecx, dword [ebp - 0x654]
call fcn.00406b20
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x1068], 0
mov eax, dword [ebp - 0x654]
mov dword [eax + 0x1070], 0
push 0x90
call fcn.00415b79
add esp, 4
mov dword [ebp - 0x64c], eax
mov ecx, dword [ebp - 0x654]
mov edx, dword [ebp - 0x64c]
mov dword [ecx + 0x1054], edx
push 0x2bc
call fcn.00415b79
add esp, 4
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x654]
mov ecx, dword [ebp - 0x650]
mov dword [eax + 0x106c], ecx
mov edx, dword [ebp - 0x654]
mov dword [edx + 0x1058], 0
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415aa8
mov esp, ebp
pop ebp
ret 4