Function at 0x490dd0
Capabilities:
Check os version
Get common file path
Get program files directory
Get startup folder
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cf3b3
mov eax, dword fs:[0]
push eax
mov eax, 0x1158
call fcn.0055b970
mov eax, dword [0x6385e0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1128], ecx
mov eax, dword [0x607bd8]
mov dword [ebp - 0x43c], eax
mov ecx, dword [0x607bdc]
mov dword [ebp - 0x438], ecx
mov edx, dword [ebp - 0x1128]
add edx, 0x1d8
push edx
call fcn.00478ba0
mov ecx, eax
call fcn.00414060
push 0x104
lea eax, [ebp - 0xa54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0xa54]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x1f0
call fcn.004b38f0
push 0x104
lea edx, [ebp - 0x84c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ax, word [ebp - 0xa54]
mov word [ebp - 0x43c], ax
lea ecx, [ebp - 0x84c]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x1e4
call fcn.004b38f0
lea edx, [ebp - 0x434]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x208
call fcn.004b38f0
lea ecx, [ebp - 0x644]
push ecx
push 0
push 0
push 0x20
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x644]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x214
call fcn.004b38f0
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x220
call fcn.004b38f0
lea edx, [ebp - 0x22c]
push edx
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x22c
call fcn.004b38f0
lea ecx, [ebp - 0x22c]
push ecx
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x238
call fcn.004b38f0
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x244
call fcn.004b38f0
lea edx, [ebp - 0x22c]
push edx
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x22c]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x250
call fcn.004b38f0
lea ecx, [ebp - 0x22c]
push ecx
push 0
push 0
push 0x19
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [ebp - 0x22c]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x25c
call fcn.004b38f0
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x49105f
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0xeb8]
call fcn.004b3550
mov dword [ebp - 4], 0
lea edx, [ebp - 0xeb8]
push edx
lea eax, [ebp - 0xec4]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x198
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb8]
call fcn.004b3860
lea ecx, [ebp - 0x22c]
push ecx
push 0
push 0
push 0x1d
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4910c2
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0xed0]
call fcn.004b3550
mov dword [ebp - 4], 1
lea eax, [ebp - 0xed0]
push eax
lea ecx, [ebp - 0xedc]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x198
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xed0]
call fcn.004b3860
lea edx, [ebp - 0x22c]
push edx
push 0
push 0
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x491125
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0xee8]
call fcn.004b3550
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xee8]
push ecx
lea edx, [ebp - 0xef4]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x198
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xee8]
call fcn.004b3860
lea eax, [ebp - 0x22c]
push eax
push 0
push 0
push 0x1e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x491188
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0xf00]
call fcn.004b3550
mov dword [ebp - 4], 3
lea edx, [ebp - 0xf00]
push edx
lea eax, [ebp - 0xf0c]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x198
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf00]
call fcn.004b3860
push str.drivers
lea ecx, [ebp - 0xf18]
call fcn.004b3550
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xa54]
push ecx
lea ecx, [ebp - 0xf24]
call fcn.004b3550
mov byte [ebp - 4], 5
lea edx, [ebp - 0xf18]
push edx
lea eax, [ebp - 0xf24]
push eax
lea ecx, [ebp - 0xf30]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x112c], eax
mov edx, dword [ebp - 0x112c]
mov dword [ebp - 0x1130], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1130]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x1fc
call fcn.004b3890
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf30]
call fcn.004b3860
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf24]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf18]
call fcn.004b3860
lea ecx, [ebp - 0x1c]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileListS_1_5_19
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x491379
mov dword [ebp - 0xa58], 0x208
lea edx, [ebp - 0xa58]
push edx
lea eax, [ebp - 0xc64]
push eax
push 0
push 0
push str.ProfileImagePath
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x49136f
push 0x104
lea edx, [ebp - 0xe6c]
push edx
lea eax, [ebp - 0xc64]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x49136f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 0xe70], eax
mov ecx, dword [ebp - 0xe70]
and ecx, 0xffff
movzx edx, cx
and edx, 0xff
movzx eax, dl
mov dword [ebp - 0xe74], eax
cmp dword [ebp - 0xe74], 6
jb 0x491357
lea ecx, [ebp - 0xe6c]
push ecx
lea ecx, [ebp - 0xf3c]
call fcn.004b3550
mov dword [ebp - 4], 7
lea edx, [ebp - 0xf3c]
push edx
lea eax, [ebp - 0xf48]
push eax
call fcn.004131c0
add esp, 8
mov dword [ebp - 0x1134], eax
mov ecx, dword [ebp - 0x1134]
mov dword [ebp - 0x1138], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1138]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x268
call fcn.004b3890
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf48]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf3c]
call fcn.004b3860
jmp 0x49136f
lea eax, [ebp - 0xe6c]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x268
call fcn.004b38f0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x43c]
push edx
lea ecx, [ebp - 0xf54]
call fcn.004b3550
mov dword [ebp - 4], 9
lea eax, [ebp - 0xf54]
push eax
lea ecx, [ebp - 0xf60]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf54]
call fcn.004b3860
lea edx, [ebp - 0x84c]
push edx
lea ecx, [ebp - 0xf6c]
call fcn.004b3550
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0xf6c]
push eax
lea ecx, [ebp - 0xf78]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf6c]
call fcn.004b3860
lea edx, [ebp - 0xa54]
push edx
lea ecx, [ebp - 0xf84]
call fcn.004b3550
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0xf84]
push eax
lea ecx, [ebp - 0xf90]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf84]
call fcn.004b3860
mov edx, dword [ebp - 0x1128]
add edx, 0x1fc
push edx
lea eax, [ebp - 0xf9c]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
mov ecx, dword [ebp - 0x1128]
add ecx, 0x220
push ecx
lea edx, [ebp - 0xfa8]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
mov eax, dword [ebp - 0x1128]
add eax, 0x22c
push eax
lea ecx, [ebp - 0xfb4]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x138
call fcn.0042feb0
push str.WinDefender
lea ecx, [ebp - 0xfc0]
call fcn.004b3550
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0xfc0]
push edx
mov eax, dword [ebp - 0x1128]
add eax, 0x220
push eax
lea ecx, [ebp - 0xfcc]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x113c], eax
mov edx, dword [ebp - 0x113c]
mov dword [ebp - 0x1140], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1140]
push eax
lea ecx, [ebp - 0xfd8]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x158
call fcn.0042feb0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xfcc]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc0]
call fcn.004b3860
push str.AntiVirus_Pro
lea ecx, [ebp - 0xfe4]
call fcn.004b3550
mov dword [ebp - 4], 0xe
lea edx, [ebp - 0xfe4]
push edx
mov eax, dword [ebp - 0x1128]
add eax, 0x220
push eax
lea ecx, [ebp - 0xff0]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x1144], eax
mov edx, dword [ebp - 0x1144]
mov dword [ebp - 0x1148], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x1148]
push eax
lea ecx, [ebp - 0xffc]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x158
call fcn.0042feb0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xff0]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfe4]
call fcn.004b3860
push str.Rapid_Antivirus
lea ecx, [ebp - 0x1008]
call fcn.004b3550
mov dword [ebp - 4], 0x10
lea edx, [ebp - 0x1008]
push edx
mov eax, dword [ebp - 0x1128]
add eax, 0x220
push eax
lea ecx, [ebp - 0x1014]
push ecx
call fcn.00412f50
add esp, 0xc
mov dword [ebp - 0x114c], eax
mov edx, dword [ebp - 0x114c]
mov dword [ebp - 0x1150], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1150]
push eax
lea ecx, [ebp - 0x1020]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x158
call fcn.0042feb0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1014]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1008]
call fcn.004b3860
push str.TDSSSERV
lea ecx, [ebp - 0x102c]
call fcn.004b3550
mov dword [ebp - 4], 0x12
lea edx, [ebp - 0x102c]
push edx
lea eax, [ebp - 0x1038]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.004b3860
push str.SENEKA
lea ecx, [ebp - 0x1044]
call fcn.004b3550
mov dword [ebp - 4], 0x13
lea ecx, [ebp - 0x1044]
push ecx
lea edx, [ebp - 0x1050]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1044]
call fcn.004b3860
push str.QUADRASERV
lea ecx, [ebp - 0x105c]
call fcn.004b3550
mov dword [ebp - 4], 0x14
lea eax, [ebp - 0x105c]
push eax
lea ecx, [ebp - 0x1068]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x105c]
call fcn.004b3860
push str.DGMSERV
lea ecx, [ebp - 0x1074]
call fcn.004b3550
mov dword [ebp - 4], 0x15
lea edx, [ebp - 0x1074]
push edx
lea eax, [ebp - 0x1080]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1074]
call fcn.004b3860
push str.MSQPDXSERV
lea ecx, [ebp - 0x108c]
call fcn.004b3550
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x108c]
push ecx
lea edx, [ebp - 0x1098]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108c]
call fcn.004b3860
push str.UACD
lea ecx, [ebp - 0x10a4]
call fcn.004b3550
mov dword [ebp - 4], 0x17
lea eax, [ebp - 0x10a4]
push eax
lea ecx, [ebp - 0x10b0]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10a4]
call fcn.004b3860
push str.GAOPDX
lea ecx, [ebp - 0x10bc]
call fcn.004b3550
mov dword [ebp - 4], 0x18
lea edx, [ebp - 0x10bc]
push edx
lea eax, [ebp - 0x10c8]
push eax
mov ecx, dword [ebp - 0x1128]
add ecx, 0x178
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10bc]
call fcn.004b3860
mov dword [ebp - 0xe78], 0
jmp 0x491885
mov ecx, dword [ebp - 0xe78]
add ecx, 1
mov dword [ebp - 0xe78], ecx
cmp dword [ebp - 0xe78], 0x18
jae 0x4918e1
mov edx, dword [ebp - 0xe78]
mov eax, dword [edx*4 + 0x63e8c8]
push eax
lea ecx, [ebp - 0x10d4]
call fcn.004b3550
mov dword [ebp - 4], 0x19
lea ecx, [ebp - 0x10d4]
push ecx
lea edx, [ebp - 0x10e0]
push edx
mov ecx, dword [ebp - 0x1128]
add ecx, 0xf8
call fcn.0042feb0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10d4]
call fcn.004b3860
jmp 0x491876
lea ecx, [ebp - 0x18]
call fcn.004b34a0
mov dword [ebp - 4], 0x1a
lea eax, [ebp - 0x18]
push eax
push 0x140
mov ecx, dword [ebp - 0x1128]
mov ecx, dword [ecx + 4]
call fcn.00420c00
movzx edx, al
test edx, edx
je 0x491bac
lea ecx, [ebp - 0xea8]
call fcn.004b34a0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xe9c]
call fcn.004b34a0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xe90]
call fcn.004b34a0
mov byte [ebp - 4], 0x1d
push 0
lea ecx, [ebp - 0xe84]
call fcn.00430200
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0xe84]
push eax
push 0x5fc5bc
lea ecx, [ebp - 0x18]
call fcn.004b63d0
mov dword [ebp - 0xeac], 0
jmp 0x49197f
mov ecx, dword [ebp - 0xeac]
add ecx, 1
mov dword [ebp - 0xeac], ecx
lea ecx, [ebp - 0xe84]
call fcn.004b9730
cmp dword [ebp - 0xeac], eax
jge 0x491b70
lea edx, [ebp - 0xe9c]
push edx
lea eax, [ebp - 0xea8]
push eax
push 0x3d
mov ecx, dword [ebp - 0xeac]
push ecx
lea ecx, [ebp - 0xe84]
call fcn.00430700
mov ecx, eax
call fcn.004b6400
movzx edx, al
test edx, edx
je 0x491b6b
push 0x6009bc
lea ecx, [ebp - 0xe9c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x4919f8
lea ecx, [ebp - 0xa54]
push ecx
lea ecx, [ebp - 0xe90]
call fcn.004b38f0
jmp 0x491a82
push 0x6009b8
lea ecx, [ebp - 0xe9c]
call fcn.004b6880
movzx edx, al
test edx, edx
je 0x491a28
mov eax, dword [ebp - 0x1128]
add eax, 0x1fc
push eax
lea ecx, [ebp - 0xe90]
call fcn.004b3890
jmp 0x491a82
push 0x607d6c
lea ecx, [ebp - 0xe9c]
call fcn.004b6880
movzx ecx, al
test ecx, ecx
je 0x491a53
lea edx, [ebp - 0x84c]
push edx
lea ecx, [ebp - 0xe90]
call fcn.004b38f0
jmp 0x491a82
push 0x607d70
lea ecx, [ebp - 0xe9c]
call fcn.004b6880
movzx eax, al
test eax, eax
je 0x491a82
mov ecx, dword [ebp - 0x1128]
add ecx, 0x220
push ecx
lea ecx, [ebp - 0xe90]
call fcn.004b3890
push 1
push 0
lea ecx, [ebp - 0xe9c]
call fcn.004b5a90
lea edx, [ebp - 0xe90]
push edx
push 0
lea ecx, [ebp - 0xe9c]
call fcn.004b54c0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x10fc], esp
lea eax, [ebp - 0xe9c]
push eax
call fcn.004b34d0
mov dword [ebp - 0x1154], eax
mov ecx, dword [ebp - 0x1154]
mov dword [ebp - 0x1158], ecx
mov byte [ebp - 4], 0x1f
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x1100], esp
lea edx, [ebp - 0xea8]
push edx
call fcn.004b34d0
mov dword [ebp - 0x115c], eax
lea eax, [ebp - 0x1118]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00498fb0
add esp, 0x1c
mov dword [ebp - 0x1160], eax
mov ecx, dword [ebp - 0x1160]
mov dword [ebp - 0x1164], ecx
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x1164]
push edx
lea ecx, [ebp - 0x10f8]
call fcn.00499030
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x10f8]
push eax
lea ecx, [ebp - 0x1124]
push ecx
mov ecx, dword [ebp - 0x1128]
add ecx, 0x1b8
call fcn.00496610
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x10f8]
call fcn.00491be0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1118]
call fcn.00491be0
jmp 0x491970
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xe84]
call fcn.00430250
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xe90]
call fcn.004b3860
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xe9c]
call fcn.004b3860
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xea8]
call fcn.004b3860
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.004b3860
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0054d4f5
mov esp, ebp
pop ebp
ret