Function at 0x412b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa2a2
mov eax, dword fs:[0]
push eax
sub esp, 0x96c
mov eax, dword [0x537474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x968], ebx
mov dword [ebp - 0x96c], ebx
mov dword [ebp - 0x964], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x900]
push 9
xor eax, eax
mov dword [ebp - 0x8ec], 7
push 0x526ee8
mov dword [ebp - 0x8f0], 0
mov word [ebp - 0x900], ax
call fcn.004041b0
mov dword [ebp - 0x8e8], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8e4]
push 0xa
xor eax, eax
mov dword [ebp - 0x8d0], 7
push str._INTERNET_
mov dword [ebp - 0x8d4], 0
mov word [ebp - 0x8e4], ax
call fcn.004041b0
mov dword [ebp - 0x8cc], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8c8]
push 0xa
xor eax, eax
mov dword [ebp - 0x8b4], 7
push str._PROGRAMS_
mov dword [ebp - 0x8b8], 0
mov word [ebp - 0x8c8], ax
call fcn.004041b0
mov dword [ebp - 0x8b0], 2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8ac]
push 0xa
xor eax, eax
mov dword [ebp - 0x898], 7
push str._CONTROLS_
mov dword [ebp - 0x89c], 0
mov word [ebp - 0x8ac], ax
call fcn.004041b0
mov dword [ebp - 0x894], 3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x890]
push 0xa
xor eax, eax
mov dword [ebp - 0x87c], 7
push str._PRINTERS_
mov dword [ebp - 0x880], 0
mov word [ebp - 0x890], ax
call fcn.004041b0
mov dword [ebp - 0x878], 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x874]
push 0xa
xor eax, eax
mov dword [ebp - 0x860], 7
push str._PERSONAL_
mov dword [ebp - 0x864], 0
mov word [ebp - 0x874], ax
call fcn.004041b0
mov dword [ebp - 0x85c], 5
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x858]
push 0xb
xor eax, eax
mov dword [ebp - 0x844], 7
push str._FAVORITES_
mov dword [ebp - 0x848], 0
mov word [ebp - 0x858], ax
call fcn.004041b0
mov dword [ebp - 0x840], 6
mov byte [ebp - 4], 8
push 9
xor eax, eax
mov dword [ebp - 0x828], 7
push str._STARTUP_
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x82c], 0
mov word [ebp - 0x83c], ax
call fcn.004041b0
mov dword [ebp - 0x824], 7
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x820]
push 8
xor eax, eax
mov dword [ebp - 0x80c], 7
push str._RECENT_
mov dword [ebp - 0x810], 0
mov word [ebp - 0x820], ax
call fcn.004041b0
mov dword [ebp - 0x808], 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x804]
push 8
xor eax, eax
mov dword [ebp - 0x7f0], 7
push str._SENDTO_
mov dword [ebp - 0x7f4], 0
mov word [ebp - 0x804], ax
call fcn.004041b0
mov dword [ebp - 0x7ec], 9
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7e8]
push 0xb
xor eax, eax
mov dword [ebp - 0x7d4], 7
push str._BITBUCKET_
mov dword [ebp - 0x7d8], 0
mov word [ebp - 0x7e8], ax
call fcn.004041b0
mov dword [ebp - 0x7d0], 0xa
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7cc]
push 0xb
xor eax, eax
mov dword [ebp - 0x7b8], 7
push str._STARTMENU_
mov dword [ebp - 0x7bc], 0
mov word [ebp - 0x7cc], ax
call fcn.004041b0
mov dword [ebp - 0x7b4], 0xb
push str._MYDOCUMENTS_
lea ecx, [ebp - 0x7b0]
mov byte [ebp - 4], 0xd
call fcn.00403160
mov dword [ebp - 0x798], 5
push str._MYMUSIC_
lea ecx, [ebp - 0x794]
mov byte [ebp - 4], 0xe
call fcn.00403160
mov dword [ebp - 0x77c], 0xd
push str._MYVIDEO_
lea ecx, [ebp - 0x778]
mov byte [ebp - 4], 0xf
call fcn.00403160
mov dword [ebp - 0x760], 0xe
push str._DESKTOPDIRECTORY_
lea ecx, [ebp - 0x75c]
mov byte [ebp - 4], 0x10
call fcn.00403160
mov dword [ebp - 0x744], 0x10
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x740]
push str._DRIVES_
call fcn.00403160
mov dword [ebp - 0x728], 0x11
push str._NETWORK_
lea ecx, [ebp - 0x724]
mov byte [ebp - 4], 0x12
call fcn.00403160
mov dword [ebp - 0x70c], 0x12
push str._NETHOOD_
lea ecx, [ebp - 0x708]
mov byte [ebp - 4], 0x13
call fcn.00403160
mov dword [ebp - 0x6f0], 0x13
push str._FONTS_
lea ecx, [ebp - 0x6ec]
mov byte [ebp - 4], 0x14
call fcn.00403160
mov dword [ebp - 0x6d4], 0x14
push str._TEMPLATES_
lea ecx, [ebp - 0x6d0]
mov byte [ebp - 4], 0x15
call fcn.00403160
mov dword [ebp - 0x6b8], 0x15
push str._COMMON_STARTMENU_
lea ecx, [ebp - 0x6b4]
mov byte [ebp - 4], 0x16
call fcn.00403160
mov dword [ebp - 0x69c], 0x16
push str._COMMON_PROGRAMS_
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], 0x17
call fcn.00403160
mov dword [ebp - 0x680], 0x17
push str._COMMON_STARTUP_
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 0x18
call fcn.00403160
mov dword [ebp - 0x664], 0x18
push str._COMMON_DESKTOPDIRECTORY_
lea ecx, [ebp - 0x660]
mov byte [ebp - 4], 0x19
call fcn.00403160
mov dword [ebp - 0x648], 0x19
push str._APPDATA_
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0x1a
call fcn.00403160
mov dword [ebp - 0x62c], 0x1a
push str._PRINTHOOD_
lea ecx, [ebp - 0x628]
mov byte [ebp - 4], 0x1b
call fcn.00403160
mov dword [ebp - 0x610], 0x1b
push str._LOCAL_APPDATA_
lea ecx, [ebp - 0x60c]
mov byte [ebp - 4], 0x1c
call fcn.00403160
mov dword [ebp - 0x5f4], 0x1c
push str._ALTSTARTUP_
lea ecx, [ebp - 0x5f0]
mov byte [ebp - 4], 0x1d
call fcn.00403160
mov dword [ebp - 0x5d8], 0x1d
push str._COMMON_ALTSTARTUP_
lea ecx, [ebp - 0x5d4]
mov byte [ebp - 4], 0x1e
call fcn.00403160
mov dword [ebp - 0x5bc], 0x1e
push str._COMMON_FAVORITES_
lea ecx, [ebp - 0x5b8]
mov byte [ebp - 4], 0x1f
call fcn.00403160
mov dword [ebp - 0x5a0], 0x1f
push str._INTERNET_CACHE_
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 0x20
call fcn.00403160
mov dword [ebp - 0x584], 0x20
push str._COOKIES_
lea ecx, [ebp - 0x580]
mov byte [ebp - 4], 0x21
call fcn.00403160
mov dword [ebp - 0x568], 0x21
push str._HISTORY_
lea ecx, [ebp - 0x564]
mov byte [ebp - 4], 0x22
call fcn.00403160
mov dword [ebp - 0x54c], 0x22
push str._COMMON_APPDATA_
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 0x23
call fcn.00403160
mov dword [ebp - 0x530], 0x23
push str._WINDOWS_
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0x24
call fcn.00403160
mov dword [ebp - 0x514], 0x24
push str._SYSTEM_
lea ecx, [ebp - 0x510]
mov byte [ebp - 4], 0x25
call fcn.00403160
mov dword [ebp - 0x4f8], 0x25
push str._PROGRAM_FILES_
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x26
call fcn.00403160
mov dword [ebp - 0x4dc], 0x26
push str._MYPICTURES_
lea ecx, [ebp - 0x4d8]
mov byte [ebp - 4], 0x27
call fcn.00403160
mov dword [ebp - 0x4c0], 0x27
push str._PROFILE_
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x28
call fcn.00403160
mov dword [ebp - 0x4a4], 0x28
push str._SYSTEMX86_
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 0x29
call fcn.00403160
mov dword [ebp - 0x488], 0x29
push str._PROGRAM_FILESX86_
lea ecx, [ebp - 0x484]
mov byte [ebp - 4], 0x2a
call fcn.00403160
mov dword [ebp - 0x46c], 0x2a
push str._PROGRAM_FILES_COMMON_
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x2b
call fcn.00403160
mov dword [ebp - 0x450], 0x2b
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x44c]
push str._PROGRAM_FILES_COMMONX86_
call fcn.00403160
mov dword [ebp - 0x434], 0x2c
push str._COMMON_TEMPLATES_
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0x2d
call fcn.00403160
mov dword [ebp - 0x418], 0x2d
push str._COMMON_DOCUMENTS_
lea ecx, [ebp - 0x414]
mov byte [ebp - 4], 0x2e
call fcn.00403160
mov dword [ebp - 0x3fc], 0x2e
push str._COMMON_ADMINTOOLS_
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 4], 0x2f
call fcn.00403160
mov dword [ebp - 0x3e0], 0x2f
push str._ADMINTOOLS_
lea ecx, [ebp - 0x3dc]
mov byte [ebp - 4], 0x30
call fcn.00403160
mov dword [ebp - 0x3c4], 0x30
push str._CONNECTIONS_
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 4], 0x31
call fcn.00403160
mov dword [ebp - 0x3a8], 0x31
push str._COMMON_MUSIC_
lea ecx, [ebp - 0x3a4]
mov byte [ebp - 4], 0x32
call fcn.00403160
mov dword [ebp - 0x38c], 0x35
push str._COMMON_PICTURES_
lea ecx, [ebp - 0x388]
mov byte [ebp - 4], 0x33
call fcn.00403160
mov dword [ebp - 0x370], 0x36
push str._COMMON_VIDEO_
lea ecx, [ebp - 0x36c]
mov byte [ebp - 4], 0x34
call fcn.00403160
mov dword [ebp - 0x354], 0x37
push str._RESOURCES_
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0x35
call fcn.00403160
mov dword [ebp - 0x338], 0x38
push str._RESOURCES_LOCALIZED_
lea ecx, [ebp - 0x334]
mov byte [ebp - 4], 0x36
call fcn.00403160
mov dword [ebp - 0x31c], 0x39
push str._COMMON_OEM_LINKS_
lea ecx, [ebp - 0x318]
mov byte [ebp - 4], 0x37
call fcn.00403160
mov dword [ebp - 0x300], 0x3a
push str._CDBURN_AREA_
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], 0x38
call fcn.00403160
mov dword [ebp - 0x2e4], 0x3b
push str._COMPUTERSNEARME_
lea ecx, [ebp - 0x2e0]
mov byte [ebp - 4], 0x39
call fcn.00403160
mov dword [ebp - 0x2c8], 0x3d
push str._FLAG_CREATE_
lea ecx, [ebp - 0x2c4]
mov byte [ebp - 4], 0x3a
call fcn.00403160
mov dword [ebp - 0x2ac], 0x8000
push str._FLAG_DONT_VERIFY_
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 0x3b
call fcn.00403160
mov dword [ebp - 0x290], 0x4000
push str._FLAG_DONT_UNEXPAND_
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0x3c
call fcn.00403160
mov dword [ebp - 0x274], 0x2000
push str._FLAG_NO_ALIAS_
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x3d
call fcn.00403160
mov dword [ebp - 0x258], 0x1000
push str._FLAG_PER_USER_INIT_
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 0x3e
call fcn.00403160
mov dword [ebp - 0x23c], 0x800
push str._FLAG_MASK_
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0x3f
call fcn.00403160
mov dword [ebp - 0x220], 0xff00
push 0x527644
lea ecx, [ebp - 0x948]
mov byte [ebp - 4], 0x40
call fcn.00403160
push 0x52764c
lea ecx, [ebp - 0x930]
mov byte [ebp - 4], 0x41
call fcn.00403160
push 0x527650
push str.shell32.dll
mov byte [ebp - 4], 0x42
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x208
mov dword [ebp - 0x968], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049d060
add esp, 0xc
lea esi, [ebp - 0x900]
xor edi, edi
cmp dword [esi + 0x14], 8
jb 0x413510
mov eax, dword [esi]
jmp 0x413512
mov eax, esi
push dword [esi + 0x10]
lea ecx, [ebp + 8]
push 0
push eax
call fcn.00412250
cmp eax, 0xffffffff
jne 0x41388f
inc edi
add esi, 0x1c
cmp edi, 0x3f
jb 0x413506
push dword [ebp - 0x938]
lea eax, [ebp - 0x918]
push 0
push eax
lea ecx, [ebp + 8]
call fcn.00412860
cmp dword [ebp - 0x934], 8
lea ecx, [ebp - 0x948]
cmovae ecx, dword [ebp - 0x948]
cmp dword [eax + 0x14], 8
lea edx, [eax + 0x10]
jb 0x413568
mov eax, dword [eax]
mov esi, dword [ebp - 0x938]
push esi
push ecx
push dword [edx]
push eax
call fcn.004124d0
mov edi, eax
add esp, 0x10
mov eax, dword [ebp - 0x904]
cmp eax, 8
jb 0x4135a1
inc eax
lea ecx, [ebp - 0x918]
push eax
push dword [ebp - 0x918]
call fcn.00404a60
mov esi, dword [ebp - 0x938]
lea eax, [ebp - 0x918]
lea ecx, [ebp + 8]
test edi, edi
jne 0x41370c
push 0xffffffffffffffff
push esi
push eax
call fcn.00412860
push eax
sub esp, 0x18
mov byte [ebp - 4], 0x45
push esp
call fcn.004129d0
add esp, 4
lea ecx, [ebp - 0x960]
call fcn.00412940
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0x46
mov ecx, ebx
call fcn.00412800
mov eax, dword [ebp - 0x94c]
add esp, 4
mov dword [ebp - 0x964], 1
cmp eax, 8
jb 0x413612
inc eax
lea ecx, [ebp - 0x960]
push eax
push dword [ebp - 0x960]
call fcn.00404a60
xor eax, eax
mov dword [ebp - 0x94c], 7
mov word [ebp - 0x960], ax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0x950], 0
cmp eax, 8
jb 0x41364d
inc eax
lea ecx, [ebp - 0x918]
push eax
push dword [ebp - 0x918]
call fcn.00404a60
xor eax, eax
mov dword [ebp - 0x904], 7
mov word [ebp - 0x918], ax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x908], 0
cmp eax, 8
jb 0x413688
inc eax
lea ecx, [ebp - 0x930]
push eax
push dword [ebp - 0x930]
call fcn.00404a60
xor eax, eax
mov dword [ebp - 0x91c], 7
mov word [ebp - 0x930], ax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x920], 0
cmp eax, 8
jb 0x4136c3
inc eax
lea ecx, [ebp - 0x948]
push eax
push dword [ebp - 0x948]
call fcn.00404a60
push fcn.00404b60
xor eax, eax
mov dword [ebp - 0x934], 7
push 0x3f
mov word [ebp - 0x948], ax
lea eax, [ebp - 0x900]
push 0x1c
push eax
mov dword [ebp - 0x938], 0
mov byte [ebp - 4], 1
call fcn.00498ba4
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
jb 0x413a5d
inc ecx
push ecx
jmp 0x413a52
push dword [ebp - 0x920]
push 0
push eax
call fcn.00412860
cmp dword [ebp - 0x91c], 8
lea ecx, [ebp - 0x930]
cmovae ecx, dword [ebp - 0x930]
cmp dword [eax + 0x14], 8
lea edx, [eax + 0x10]
jb 0x413739
mov eax, dword [eax]
mov esi, dword [ebp - 0x920]
push esi
push ecx
push dword [edx]
push eax
call fcn.004124d0
mov ecx, dword [ebp - 0x904]
add esp, 0x10
mov edi, eax
cmp ecx, 8
jb 0x413772
inc ecx
push ecx
push dword [ebp - 0x918]
lea ecx, [ebp - 0x918]
call fcn.00404a60
mov esi, dword [ebp - 0x920]
test edi, edi
jne 0x41383e
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp + 8]
call fcn.00412860
mov esi, eax
lea eax, [ebp - 0x918]
mov byte [ebp - 4], 0x47
push eax
call fcn.004129d0
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x48
mov ecx, ebx
call fcn.00412800
mov eax, dword [ebp - 0x904]
add esp, 4
mov dword [ebp - 0x964], 1
cmp eax, 8
jb 0x4137da
inc eax
lea ecx, [ebp - 0x918]
push eax
push dword [ebp - 0x918]
call fcn.00404a60
xor eax, eax
mov dword [ebp - 0x904], 7
lea ecx, [ebp - 0x960]
mov dword [ebp - 0x908], 0
mov word [ebp - 0x918], ax
call fcn.00404b60
lea ecx, [ebp - 0x930]
call fcn.00404b60
lea ecx, [ebp - 0x948]
call fcn.00404b60
push fcn.00404b60
push 0x3f
push 0x1c
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 1
push eax
call fcn.00498ba4
lea ecx, [ebp + 8]
call fcn.00404b60
jmp 0x413a5d
lea eax, [ebp + 8]
mov ecx, ebx
push eax
call fcn.00414180
lea ecx, [ebp - 0x930]
mov dword [ebp - 0x964], 1
call fcn.00404b60
lea ecx, [ebp - 0x948]
call fcn.00404b60
push fcn.00404b60
push 0x3f
push 0x1c
lea eax, [ebp - 0x900]
mov byte [ebp - 4], 1
push eax
call fcn.00498ba4
lea ecx, [ebp + 8]
call fcn.00404b60
jmp 0x413a5d
lea esi, [edi*8]
sub esi, edi
lea eax, [ebp - 0x218]
shl esi, 2
push 0
push dword [ebp + esi - 0x8e8]
push eax
push 0
call dword [ebp - 0x968]
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x968], esp
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov dword [edx + 0x14], 7
cmp dword [edx + 0x14], 8
mov dword [edx + 0x10], 0
jb 0x4138e4
mov eax, dword [edx]
jmp 0x4138e6
mov eax, edx
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x218], cx
je 0x41390f
lea ecx, [ebp - 0x218]
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413900
sub ecx, edi
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
mov ecx, edx
push eax
call fcn.004041b0
sub esp, 0x18
mov byte [ebp - 4], 0x43
mov ecx, esp
mov dword [ebp - 0x970], esp
lea edx, [ebp - 0x900]
add edx, esi
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], 0
jb 0x41395b
mov eax, dword [ecx]
jmp 0x41395d
mov eax, ecx
push 0xffffffffffffffff
xor esi, esi
push esi
push edx
mov word [eax], si
call fcn.00404360
sub esp, 0x18
mov byte [ebp - 4], 0x44
mov ecx, esp
mov dword [ecx + 0x10], esi
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x14], 7
cmp dword [ecx + 0x14], 8
mov dword [ecx + 0x10], esi
jb 0x41398e
mov eax, dword [ecx]
jmp 0x413990
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.00404360
mov ecx, ebx
mov byte [ebp - 4], 0x42
call fcn.00412360
add esp, 0x48
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x964], 1
cmp eax, 8
jb 0x4139d7
inc eax
lea ecx, [ebp - 0x930]
push eax
push dword [ebp - 0x930]
call fcn.00404a60
xor eax, eax
mov dword [ebp - 0x91c], 7
mov word [ebp - 0x930], ax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x920], 0
cmp eax, 8
jb 0x413a12
inc eax
lea ecx, [ebp - 0x948]
push eax
push dword [ebp - 0x948]
call fcn.00404a60
push fcn.00404b60
xor eax, eax
mov dword [ebp - 0x934], 7
push 0x3f
mov word [ebp - 0x948], ax
lea eax, [ebp - 0x900]
push 0x1c
push eax
mov dword [ebp - 0x938], 0
mov byte [ebp - 4], 1
call fcn.00498ba4
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x413a5d
inc eax
push eax
push dword [ebp + 8]
lea ecx, [ebp + 8]
call fcn.00404a60
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497ebf
mov esp, ebp
pop ebp
ret