Function at 0x48f250
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f41e1
mov eax, dword fs:[0]
push eax
mov eax, 0x124c
call fcn.0055f460
mov eax, dword [0x66d060]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1160], edx
mov esi, ecx
mov dword [ebp - 0x113c], esi
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1154], edi
mov dword [ebp - 0x115c], eax
mov dword [ebp - 0x1158], ecx
mov byte [eax], 1
mov byte [ebp - 0x1135], 0
mov dword [ebp - 0xf8], 0xf
mov dword [ebp - 0xfc], 0
mov byte [ebp - 0x10c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], 0
mov byte [ebp - 0xf4], 0
xor al, al
mov byte [ebp - 4], 1
push 1
mov dword [ebp - 0x1144], eax
mov ecx, esi
mov byte [ebp - 0x114c], al
lea eax, [ebp - 0x1148]
push 0xffffffffffffffff
push eax
mov byte [ebp - 0x113d], 0
mov byte [ebp - 0x1148], 0x2e
call fcn.00477890
cmp eax, 0xffffffff
je 0x48f406
push 0xffffffffffffffff
inc eax
mov ecx, esi
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.004718a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4c]
cmp dword [0x67df40], 0x10
mov eax, 0x67df2c
push dword [0x67df3c]
cmovae eax, dword [0x67df2c]
push eax
push dword [ebp - 0x3c]
push 0
call fcn.0045fbf0
test eax, eax
jne 0x48f37c
mov byte [ebp - 0x113d], 1
jmp 0x48f3c2
cmp dword [0x67dcd0], 0x10
lea ecx, [ebp - 0x4c]
push dword [0x67dccc]
mov eax, 0x67dcbc
cmovae eax, dword [0x67dcbc]
push eax
push dword [ebp - 0x3c]
push 0
call fcn.0045fbf0
mov ecx, dword [ebp - 0x1144]
test eax, eax
movzx ecx, cl
mov edx, 1
cmove ecx, edx
mov dword [ebp - 0x1144], ecx
mov byte [ebp - 0x114c], cl
mov byte [ebp - 4], 1
cmp dword [ebp - 0x38], 0x10
jb 0x48f3d7
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
cmp byte [ebp - 0x113d], 0
jne 0x48f3e9
cmp byte [ebp - 0x1144], 0
je 0x48f406
push dword [ebp - 0x114c]
mov edx, dword [ebp - 0x1160]
push edi
push ecx
mov ecx, esi
call fcn.0048edb0
add esp, 0xc
jmp 0x48ff09
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x114c], eax
test eax, eax
je 0x48ff03
push 1
push 2
lea ecx, [ebp - 0x120c]
call fcn.00473e00
mov dword [ebp - 0xb0], 0xf
mov dword [ebp - 0xb4], 0
mov byte [ebp - 0xc4], 0
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 4
call fcn.00469600
test al, al
je 0x48f49f
push str.AUMInstallerResults.irpt
lea ecx, [ebp - 0x7c]
call fcn.0045e4d0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00571e5f
add esp, 0xc
lea ecx, [ebp - 0xc4]
push eax
call fcn.0045e5a0
lea ecx, [ebp - 0x2c]
call fcn.0045e5e0
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.0045e5e0
push 0x62bb00
lea eax, [ebp - 0x7c]
push 0x67dc20
push eax
call fcn.0047cd70
add esp, 0xc
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 6
push ecx
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00478920
add esp, 0xc
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 7
push eax
call fcn.005744b2
push eax
lea eax, [ebp - 0x120c]
mov byte [ebp - 4], 8
push eax
call fcn.00467fc0
add esp, 0x10
cmp dword [ebp - 0x38], 0x10
jb 0x48f503
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0x80], 0x10
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
jb 0x48f529
push dword [ebp - 0x94]
call fcn.00496180
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x68], 0x10
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], 0
mov byte [ebp - 0x94], 0
jb 0x48f556
push dword [ebp - 0x7c]
call fcn.00496180
add esp, 4
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0047e510
mov esi, eax
push 0x62bb00
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 9
push 0x67dc38
push eax
call fcn.0047cd70
add esp, 0xc
push esi
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x4c]
call fcn.00474170
add esp, 4
push eax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0xb
push eax
call fcn.005744b2
push eax
lea eax, [ebp - 0x120c]
mov byte [ebp - 4], 0xc
push eax
call fcn.00467fc0
add esp, 0x10
cmp dword [ebp - 0x80], 0x10
jb 0x48f5c8
push dword [ebp - 0x94]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0x38], 0x10
mov dword [ebp - 0x80], 0xf
mov dword [ebp - 0x84], 0
mov byte [ebp - 0x94], 0
jb 0x48f5f1
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0x68], 0x10
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x4c], 0
jb 0x48f614
push dword [ebp - 0x7c]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x68], 0xf
mov dword [ebp - 0x6c], 0
mov byte [ebp - 0x7c], 0
jb 0x48f637
push dword [ebp - 0x2c]
call fcn.00496180
add esp, 4
mov esi, dword [ebp - 0x114c]
lea eax, [ebp - 0x4c]
mov edi, esi
sub edi, eax
cmp word [esi], 0
jne 0x48f651
cmp word [esi + 2], 0
je 0x48f6a9
mov ax, word [esi]
mov ecx, 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 2
mov byte [eax + 2], 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x120c]
push eax
call fcn.00467fc0
add esp, 8
add esi, 2
add edi, 2
cmp dword [ebp - 0x38], 0x10
jb 0x48f644
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
jmp 0x48f644
mov ax, word [esi]
mov ecx, 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 2
mov byte [eax + 2], 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x120c]
push eax
call fcn.00467fc0
mov edi, dword [ebp - 0x1154]
add esp, 8
cmp dword [ebp - 0x38], 0x10
jb 0x48f6ff
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
mov ax, word [esi]
mov ecx, 0xf
mov byte [ebp - 0x4c], 0
cmp ecx, 0x10
mov word [ebp - 0x4c], ax
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], 2
mov byte [eax + 2], 0
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], cl
push eax
lea eax, [ebp - 0x120c]
push eax
call fcn.00467fc0
add esp, 8
cmp dword [ebp - 0x38], 0x10
jb 0x48f74e
push dword [ebp - 0x4c]
call fcn.00496180
add esp, 4
push 0x44
lea eax, [ebp - 0x1254]
xorps xmm0, xmm0
push 0
push eax
movdqu xmmword [ebp - 0x1170], xmm0
call fcn.005594a0
add esp, 0xc
mov dword [ebp - 0x1254], 0x44
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x64], 0
mov dword [ebp - 0xc8], 0xf
mov dword [ebp - 0xcc], 0
mov byte [ebp - 0xdc], 0
push 1
push 0x62cf84
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x11
call fcn.00460dd0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x113c]
lea ecx, [ebp - 0x64]
call fcn.0045f770
push 1
push 0x62cf84
lea ecx, [ebp - 0x64]
call fcn.0045f830
mov eax, dword [ebp - 0x1160]
lea ecx, [ebp - 0xdc]
cmp ecx, eax
je 0x48f7f1
push 0xffffffffffffffff
push 0
push eax
call fcn.0045f9d0
cmp dword [ebp - 0xcc], 0
jbe 0x48f837
push 0x62baf8
lea ecx, [ebp - 0x2c]
call fcn.0045e4d0
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x12
call fcn.0045f770
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
call fcn.0045e5e0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xdc]
push eax
lea ecx, [ebp - 0x64]
call fcn.0045f770
mov esi, dword [ebp - 0x1150]
cmp byte [esi], 0
je 0x48f952
lea ecx, [ebp - 0x1134]
call fcn.0047e3c0
xor eax, eax
mov dword [ebp - 0x1134], 0xc
cmp byte [ebp + 0x10], al
push 0x6232c8
sete al
add eax, 2
mov word [ebp - 0x112c], ax
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0047cd70
add esp, 0xc
mov ecx, eax
lea eax, [edi + 0x28]
mov byte [ebp - 4], 0x13
push eax
push ecx
lea eax, [ebp - 0x7c]
push eax
call fcn.00478920
add esp, 0xc
mov esi, eax
push 0x6232c8
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x14
call fcn.0045e4d0
cmp dword [esi + 0x14], 0x10
jb 0x48f8b7
mov esi, dword [esi]
mov ecx, dword [eax + 0x10]
mov edx, dword [edi + 0x20]
mov eax, dword [edi + 0x38]
inc edx
add eax, ecx
add edx, eax
je 0x48f8dd
cmp edx, 0x7fffffff
ja 0x48f8dd
push ecx
push esi
push ecx
lea ecx, [ebp - 0x110c]
call fcn.004914f0
lea ecx, [ebp - 0x2c]
call fcn.0045e5e0
lea ecx, [ebp - 0x7c]
call fcn.0045e5e0
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x11
call fcn.0045e5e0
lea eax, [ebp - 0x110c]
push eax
sub esp, 0x18
mov ecx, esp
push str.UpdateRefID__
call fcn.0045e4d0
push dword [0x6132e8]
call fcn.0057375e
add esp, 0x20
lea esi, [ebp - 0x1134]
mov eax, 0x1028
call fcn.0055f460
mov ecx, 0x40a
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.005d9cf0
mov edi, dword [ebp - 0x1154]
add esp, 0x1028
mov esi, dword [ebp - 0x1150]
jmp 0x48f97a
cmp byte [ebp + 0x20], 0
je 0x48f97a
sub esp, 0x18
mov ecx, esp
push str.Terminating_channel_before_proceeding_for_Boot_straper_launch.
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.00573800
add esp, 0x1c
call fcn.005d9d40
cmp dword [ebp - 0x50], 0x10
lea eax, [ebp - 0x64]
cmovae eax, dword [ebp - 0x64]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x113c], esp
push eax
call fcn.0045e4d0
sub esp, 0x18
mov byte [ebp - 4], 0x15
mov ecx, esp
push str.App_launched_is__UTF8__
call fcn.0045e4d0
push dword [0x6132e4]
mov byte [ebp - 4], 0x11
call fcn.00573602
add esp, 0x34
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.005744b2
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0xac]
cmp dword [ebp - 0x98], 0x10
cmovae eax, dword [ebp - 0xac]
sub esp, 0x10
mov ecx, esp
mov dword [ebp - 0x113c], esp
push eax
call fcn.0045e4d0
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
push str.App_launched_is__UTF16__
call fcn.0045e4d0
push dword [0x6132e4]
mov byte [ebp - 4], 0x16
call fcn.00573602
add esp, 0x34
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x120c]
push eax
call fcn.00473fe0
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
jb 0x48fa32
mov ecx, dword [ecx]
cmp dword [ebp - 0x98], 0x10
lea edx, [ebp - 0x1170]
push edx
lea edx, [ebp - 0x1254]
push edx
push 0
push ecx
push 0x400
push 0
push 0
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x113c], eax
jb 0x48fa88
push dword [ebp - 0x2c]
call fcn.00496180
mov eax, dword [ebp - 0x113c]
add esp, 4
test eax, eax
je 0x48fd8b
push 0xfa
push dword [ebp - 0x1170]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x48fb3d
jmp 0x48fab0
mov eax, dword [ebp - 0x1150]
cmp byte [eax], 0
jne 0x48fb10
cmp byte [ebp + 0x20], 0
jne 0x48fb10
add esi, 5
mov ecx, dword [edi + 0x88]
mov eax, 0xae147ae1
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
add esi, eax
movd xmm1, esi
cvtdq2ps xmm1, xmm1
movss dword [edi + 4], xmm1
test ecx, ecx
je 0x48fb10
movd xmm0, dword [edi + 0xc]
cvtdq2ps xmm0, xmm0
push edi
mulss xmm0, dword [0x63c400]
addss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [edi], eax
call fcn.00482ba0
mov ecx, dword [edi + 0x88]
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
call eax
mov byte [edi + 0x40], al
test al, al
jne 0x48fb3d
push 0xfa
push dword [ebp - 0x1170]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48fab0
lea eax, [ebp - 0x1144]
mov dword [ebp - 0x1144], 0
push eax
push dword [ebp - 0x1170]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x48fba7
mov eax, dword [ebp - 0x1144]
mov edi, dword [ebp - 0x1158]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [edi], eax
push str.LaunchInstaller_:_Exit_Status_code_of_the_patch_Installer_is_
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.005736a3
add esp, 0x20
cmp byte [ebp + 0x20], 0
je 0x48fc18
cmp dword [ebp - 0x1144], 0
sete byte [ebp - 0x1135]
jmp 0x48fc22
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x34]
push 0x62dc20
push eax
call fcn.0055358c
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
sub esp, 0x18
mov ecx, esp
push str.LaunchInstaller_::GetExitCodeProcess_failed_with_error_code_
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.0057375e
add esp, 0x20
cmp byte [ebp + 0x20], 0
je 0x48fc12
sub esp, 0x18
mov ecx, esp
push str.Assuming_Boot_Strapper_failed.___
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.00573800
mov edi, dword [ebp - 0x1158]
add esp, 0x1c
mov byte [ebp - 0x1135], 0
jmp 0x48fc22
mov edi, dword [ebp - 0x1158]
mov dword [ebp - 0x1144], 0
mov esi, dword [ebp - 0x1150]
cmp byte [esi], 0
je 0x48fca0
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi], 0
je 0x48fca0
sub esp, 0x18
mov ecx, esp
push str.LaunchInstaller_:_Sending_kID_Ack_after_getting_control_back_to_Update_Installer_after_installation.
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.00573800
add esp, 0x1c
lea ecx, [ebp - 0x1134]
call fcn.0047e3c0
mov ax, word [edi]
lea esi, [ebp - 0x1134]
mov word [ebp - 0x112c], ax
mov eax, 0x1028
mov dword [ebp - 0x1134], 0xf000
call fcn.0055f460
mov ecx, 0x40a
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.005d9cf0
mov esi, dword [ebp - 0x1150]
add esp, 0x1028
movzx eax, byte [esi]
push eax
sub esp, 0x18
mov ecx, esp
push str.After_Resumed_Pipe_connection_for_patch_install__bHasListner_
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.005736a3
add esp, 0x20
cmp byte [esi], 0
je 0x48fd75
lea ecx, [ebp - 0x1134]
call fcn.0047e3c0
lea eax, [ebp - 0x1134]
push eax
call fcn.005d9d20
add esp, 4
push dword [ebp - 0x1134]
sub esp, 0x18
mov ecx, esp
push str.Receive_before_while_loop_Packet_ID__.
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.005736a3
add esp, 0x20
push dword [ebp - 0x1134]
sub esp, 0x18
mov ecx, esp
push str.Receive_Expected_Packet_ID__.
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.005736a3
add esp, 0x20
cmp dword [ebp - 0x1134], 0xa
jne 0x48fd5b
mov ax, word [ebp - 0x112c]
mov byte [ebp - 0x1135], 0
cmp ax, 0x13
je 0x48fd67
mov ecx, 0xda
cmp ax, cx
je 0x48fd67
cmp ax, 8
jne 0x48fe16
mov byte [ebp - 0x1135], 1
jmp 0x48fe16
mov eax, dword [ebp - 0x115c]
mov byte [eax], 0
jmp 0x48fe16
cmp byte [ebp + 0x20], 0
jne 0x48fe16
mov byte [ebp - 0x1135], 0
jmp 0x48fe16
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x34]
push 0x62dc20
push eax
call fcn.0055358c
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
sub esp, 0x18
mov ecx, esp
push str.CreateProcess_failed_with_error_code_
call fcn.0045e4d0
push dword [0x6132e4]
call fcn.0057375e
add esp, 0x20
cmp byte [esi], 0
je 0x48fe16
lea ecx, [ebp - 0x1134]
call fcn.0047e3c0
mov dword [ebp - 0x1134], 0xa
xor ecx, ecx
mov al, byte [ebp + ecx - 0x34]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x110d], al
test al, al
jne 0x48fde0
mov eax, 0x1028
lea esi, [ebp - 0x1134]
call fcn.0055f460
mov ecx, 0x40a
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.005d9cf0
add esp, 0x1028
push dword [ebp - 0x114c]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
cmp dword [ebp - 0x98], 0x10
jb 0x48fe39
push dword [ebp - 0xac]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0xc8], 0x10
mov dword [ebp - 0x98], 0xf
mov dword [ebp - 0x9c], 0
mov byte [ebp - 0xac], 0
jb 0x48fe6b
push dword [ebp - 0xdc]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0x50], 0x10
mov dword [ebp - 0xc8], 0xf
mov dword [ebp - 0xcc], 0
mov byte [ebp - 0xdc], 0
jb 0x48fe97
push dword [ebp - 0x64]
call fcn.00496180
add esp, 4
cmp dword [ebp - 0xb0], 0x10
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x64], 0
jb 0x48fec0
push dword [ebp - 0xc4]
call fcn.00496180
add esp, 4
lea ecx, [ebp - 0x11bc]
mov dword [ebp - 0xb0], 0xf
mov dword [ebp - 0xb4], 0
mov byte [ebp - 0xc4], 0
mov byte [ebp - 4], 1
call fcn.00473f60
lea eax, [ebp - 0x11bc]
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
push eax
call fcn.005dde05
add esp, 4
mov al, byte [ebp - 0x1135]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055337c
mov esp, ebp
pop ebp
ret