Function at 0x41e307
Capabilities:
Check if file exists
Delete file
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1b854]
mov eax, 0x1b854
call fcn.00420e10
push 0xffffffffffffffff
push 0x437255
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x443620]
xor eax, ebp
mov dword [ebp + 0x1b850], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x1b860]
mov ecx, dword [ebp + 0x1b85c]
mov dword [ebp - 0x18], ecx
test eax, eax
je 0x41f017
push 0x1000
lea ecx, [ebp - 0x12]
push ecx
lea ecx, [ebp - 0x11]
push ecx
lea ecx, [ebp + 0x17050]
push ecx
lea ecx, [ebp + 0xe050]
push ecx
push eax
call fcn.0041ce3d
mov ecx, eax
mov dword [ebp - 0x1c], ecx
test ecx, ecx
je 0x41f017
mov ebx, dword [ebp + 0x1b864]
lea eax, [ebp + 0x17050]
push 6
lea esi, [ebp + 0x2050]
pop edi
push 0x1000
push esi
push eax
call fcn.0041c9b2
add esi, 0x2000
sub edi, 1
jne 0x41e39e
mov esi, edi
push dword [esi*4 + 0x44328c]
lea eax, [ebp + 0xe050]
push eax
call fcn.00413eb3
test eax, eax
je 0x41e3d9
inc esi
cmp esi, 0xe
jb 0x41e3b7
jmp case.default.0x41e3e2
cmp esi, 0xd
ja case.default.0x41e3e2
jmp dword [esi*4 + 0x41f043]
cmp ebx, 2
jne case.default.0x41e3e2
mov edi, 0x800
lea eax, [ebp + 0x15050]
push edi
push eax
call fcn.0041bf0d
push edi
lea eax, [ebp + 0x10050]
push eax
lea eax, [ebp + 0x17050]
push eax
lea eax, [ebp + 0x15050]
push eax
call fcn.0040da81
lea ecx, [ebp]
call fcn.0040c0c1
lea eax, [ebp + 0x10050]
xor ebx, ebx
push eax
lea ecx, [ebp]
mov dword [ebp - 4], ebx
call fcn.0040c1fb
lea ecx, [ebp + 0x1008]
call fcn.00407cdd
jmp 0x41e585
push ebx
lea eax, [ebp + 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [ebp + 0x2014], bl
je 0x41e505
push edi
lea eax, [ebp + 0x1a850]
push eax
lea eax, [ebp + 0x15050]
push eax
call fcn.0040d615
push edi
lea eax, [ebp + 0x1a850]
push eax
call fcn.0040d298
lea eax, [ebp + 0x15050]
push eax
call fcn.00425dc5
mov esi, eax
pop ecx
cmp esi, 4
jb 0x41e4ab
lea eax, [ebp + 0x1a850]
push eax
call fcn.00425dc5
pop ecx
cmp esi, eax
ja 0x41e4bf
lea eax, [ebp + 0x17050]
push eax
call fcn.0040da42
test al, al
jne 0x41e59d
lea eax, [ebp + 0x1008]
push eax
call fcn.00425dc5
xor ecx, ecx
push 0x1e
push ebx
mov word [ebp + eax*2 + 0x100a], cx
lea eax, [ebp - 0x48]
push eax
call fcn.00421ea0
add esp, 0x10
mov dword [ebp - 0x44], 3
push 0x14
pop eax
mov word [ebp - 0x38], ax
lea eax, [ebp + 0x1008]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
lea eax, [ebp + 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e585
lea eax, [ebp + 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41e585
mov esi, ebx
push ebx
jmp 0x41e52f
inc esi
push esi
lea eax, [ebp + 0x1008]
push eax
push str._s._d.tmp
lea eax, [ebp + 0x1a850]
push edi
push eax
call fcn.004049f0
add esp, 0x14
lea eax, [ebp + 0x1a850]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41e52d
lea eax, [ebp + 0x1a850]
push eax
lea eax, [ebp + 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x41e585
push 4
push ebx
lea eax, [ebp + 0x1a850]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
lea eax, [ebp + 0x1008]
push eax
lea ecx, [ebp]
call fcn.0040c14e
test al, al
jne 0x41e44b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0040c0d7
jmp case.default.0x41e3e2
test ebx, ebx
jne case.default.0x41e3e2
mov eax, dword [0x464c58]
test eax, eax
sete bl
test eax, eax
je 0x41e5d6
push str._br_
push eax
call fcn.0042ab00
mov eax, dword [0x464c58]
pop ecx
pop ecx
mov bh, byte [ebp - 0x11]
test bh, bh
je 0x41e5e5
lea esi, [ebp + 0x17050]
jmp 0x41e5f5
lea eax, [ebp - 0x1c]
push eax
call fcn.0041cfce
mov esi, eax
mov eax, dword [0x464c58]
test bl, bl
jne 0x41e602
push eax
call fcn.00425dc5
pop ecx
mov edi, eax
push esi
call fcn.00425dc5
add eax, edi
lea eax, [eax*2 + 0xa]
push eax
push dword [0x464c58]
call fcn.00426425
add esp, 0xc
test eax, eax
je 0x41e63b
mov dword [0x464c58], eax
test bl, bl
je 0x41e632
xor ecx, ecx
mov word [eax], cx
push esi
push eax
call fcn.0042ab00
pop ecx
pop ecx
test bh, bh
jne case.default.0x41e3e2
push esi
call fcn.0042640a
pop ecx
jmp case.default.0x41e3e2
test ebx, ebx
jne case.default.0x41e3e2
mov ebx, dword [ebp - 0x18]
lea eax, [ebp + 0x17050]
push eax
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp case.default.0x41e3e2
test ebx, ebx
jne case.default.0x41e3e2
cmp word [0x45682a], di
jne case.default.0x41e3e2
xor eax, eax
lea edi, [ebp + 0x17050]
push 0x22
mov word [ebp + 0x1a850], ax
pop eax
cmp word [ebp + 0x17050], ax
jne 0x41e6a3
lea edi, [ebp + 0x17052]
push edi
call fcn.00425dc5
mov esi, 0x800
pop ecx
cmp eax, esi
jae case.default.0x41e3e2
movzx eax, word [edi]
push 0x5c
pop ecx
cmp eax, 0x2e
jne 0x41e6e9
cmp word [edi + 2], cx
jne 0x41e6f2
add edi, 4
xor ebx, ebx
cmp word [edi], bx
je case.default.0x41e3e2
push esi
push edi
lea eax, [ebp + 0x1a850]
push eax
call fcn.004123db
jmp 0x41e7f4
cmp ax, cx
je 0x41e7e4
test ax, ax
je 0x41e702
cmp word [edi + 2], 0x3a
je 0x41e7e4
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e77a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x1000
push eax
lea eax, [ebp + 0x1a850]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
cmp eax, 0x7ff
jae 0x41e76b
add eax, eax
cmp eax, 0x1000
jae 0x41f03c
jmp 0x41e770
mov eax, 0xffe
xor ecx, ecx
mov word [ebp + eax + 0x1a850], cx
cmp word [ebp + 0x1a850], bx
je 0x41e7af
lea eax, [ebp + 0x1a850]
push eax
call fcn.00425dc5
pop ecx
push 0x5c
pop ecx
cmp word [ebp + eax*2 + 0x1a84e], cx
je 0x41e7af
push esi
push 0x439dbc
lea eax, [ebp + 0x1a850]
push eax
call fcn.004123b3
push edi
call fcn.00425dc5
mov esi, eax
lea eax, [ebp + 0x1a850]
push eax
call fcn.00425dc5
add esi, eax
pop ecx
cmp esi, 0x7ff
mov esi, 0x800
pop ecx
jae 0x41e7f4
push esi
push edi
lea eax, [ebp + 0x1a850]
push eax
call fcn.004123b3
jmp 0x41e7f4
push esi
push edi
lea eax, [ebp + 0x1a850]
push eax
call fcn.004123db
xor ebx, ebx
push 0x22
pop eax
push eax
lea eax, [ebp + 0x1a850]
push eax
call fcn.004243ae
pop ecx
pop ecx
test eax, eax
je 0x41e815
cmp word [eax + 2], bx
jne 0x41e815
xor ecx, ecx
mov word [eax], cx
push esi
lea eax, [ebp + 0x1a850]
mov edi, 0x45682a
push eax
push edi
call fcn.004123db
push esi
lea eax, [ebp + 0x1a850]
push eax
call fcn.0041cc86
push 0x66
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [ebp + 0x1a850]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
push ebx
push 0x143
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp + 0x1a850]
push eax
push edi
call fcn.00429d63
pop ecx
pop ecx
test eax, eax
je case.default.0x41e3e2
lea eax, [ebp + 0x1a850]
push eax
push ebx
push 0x143
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x41e3e2
cmp dword [0x456824], 1
je case.default.0x41e3e2
movzx eax, word [ebp + 0x17050]
push eax
call fcn.0041222f
test al, al
je 0x41e8c0
movzx eax, word [ebp + 0x17050]
sub eax, 0x30
mov dword [0x456824], eax
jmp case.default.0x41e3e2
mov dword [0x456824], 2
jmp case.default.0x41e3e2
movzx eax, word [ebp + 0x17050]
xor ebx, ebx
sub eax, ebx
je 0x41e909
sub eax, 0x30
je 0x41e8f8
sub eax, 1
je 0x41e909
sub eax, 1
jne case.default.0x41e3e2
mov byte [0x44d402], 1
jmp 0x41e8fe
mov byte [0x44d402], bl
mov byte [0x44d403], bl
jmp case.default.0x41e3e2
mov byte [0x44d402], bl
mov byte [0x44d403], 1
jmp case.default.0x41e3e2
movzx eax, word [ebp + 0x17050]
push eax
call fcn.0042acb1
pop ecx
cmp eax, 0x46
je 0x41e950
cmp eax, 0x55
je 0x41e944
xor eax, eax
mov byte [0x44d404], al
mov byte [0x44d405], al
jmp case.default.0x41e3e2
mov byte [0x44d405], 1
jmp case.default.0x41e3e2
mov byte [0x44d404], 1
jmp case.default.0x41e3e2
xor edi, edi
mov byte [0x463c4b], 1
inc edi
lea eax, [ebp + 0x17050]
cmp word [ebp + 0x17050], 0x3c
mov ebx, esi
mov dword [ebp - 0x10], eax
jne 0x41ea29
lea eax, [ebp + 0x17052]
push 0x3e
push eax
call fcn.0042409c
pop ecx
pop ecx
test eax, eax
je 0x41ea26
lea ecx, [eax + 2]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp + 0x1b788]
push 0x64
push eax
lea eax, [ebp + 0x17052]
push eax
call fcn.0041c9b2
mov dword [ebp - 0x24], eax
test eax, eax
je 0x41ea26
mov esi, eax
cmp word [ebp + 0x1b788], 0
je 0x41ea26
push 0x439dc0
lea eax, [ebp + 0x1b788]
push eax
call fcn.00413eb3
neg eax
push 0x439dcc
sbb eax, eax
and edi, eax
lea eax, [ebp + 0x1b788]
push eax
call fcn.00413eb3
test eax, eax
jne 0x41e9f9
push 3
pop edi
push 0x439dd4
lea eax, [ebp + 0x1b788]
push eax
call fcn.00413eb3
test eax, eax
jne 0x41ea11
push 6
pop edi
push 0x64
lea eax, [ebp + 0x1b788]
push eax
push esi
call fcn.0041c9b2
mov esi, eax
test esi, esi
jne 0x41e9c0
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 0x1b864], 5
jne 0x41ea3f
cmp ebx, 9
jne case.default.0x41e3e2
push 1
jmp 0x41ea58
cmp dword [ebp + 0x1b864], 4
jne case.default.0x41e3e2
cmp ebx, 6
jne case.default.0x41e3e2
xor ecx, ecx
push ecx
push edi
push eax
push dword [ebp - 0x18]
call fcn.0041f3fc
jmp case.default.0x41e3e2
mov byte [0x464c68], 1
cmp word [ebp + 0x17050], di
je case.default.0x41e3e2
lea eax, [ebp + 0x17050]
push eax
call fcn.00413e9f
mov dword [0x443270], eax
jmp case.default.0x41e3e2
cmp ebx, 1
jne 0x41ec1a
lea eax, [ebp + 0x15050]
mov edi, 0x800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp + 0x15050]
push eax
call fcn.0040d298
xor eax, eax
mov ebx, 0x455822
mov esi, eax
push eax
jmp 0x41eac8
inc esi
push esi
push dword [0x44326c]
lea eax, [ebp + 0x15050]
push eax
push str._s_s_u
push edi
push ebx
call fcn.004049f0
add esp, 0x18
push ebx
call fcn.0040ba3b
test al, al
jne 0x41eac6
push ebx
mov ebx, dword [ebp - 0x18]
push 0x66
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp word [ebp + 0x17050], 0
je case.default.0x41e3e2
cmp byte [0x463c49], 0
jne case.default.0x41e3e2
xor eax, eax
mov word [ebp + 0x1b450], ax
lea eax, [ebp + 0x17050]
push 0x2c
push eax
call fcn.0042409c
pop ecx
pop ecx
test eax, eax
jne 0x41eb8f
mov ax, word [ebp + 0x17050]
xor ecx, ecx
test ax, ax
je 0x41eb8f
movzx edx, ax
cmp dx, 0x40
je 0x41eb5c
movzx eax, word [ebp + ecx*2 + 0x17052]
inc ecx
mov edx, eax
test ax, ax
jne 0x41eb44
jmp 0x41eb8f
lea esi, [ecx + ecx]
push 0x200
lea eax, [ebp + 0x17052]
add eax, esi
push eax
lea eax, [ebp + 0x1b450]
push eax
call fcn.004123db
cmp esi, 0x2000
jae 0x41f03c
xor eax, eax
mov word [ebp + esi + 0x17050], ax
cmp word [ebp + 0x1b450], 0
jne 0x41ebc9
push 0x1000
lea eax, [ebp + 0x2050]
push eax
lea eax, [ebp + 0x17050]
push eax
call fcn.004123db
push 0x200
lea eax, [ebp + 0x4050]
push eax
lea eax, [ebp + 0x1b450]
push eax
call fcn.004123db
lea eax, [ebp + 0x17050]
push eax
call fcn.0041c6cc
xor eax, eax
mov word [ebp + 0x18050], ax
lea eax, [ebp + 0x1b450]
push 0x24
push eax
lea eax, [ebp + 0x17050]
push eax
push ebx
call fcn.0041c0a4
cmp eax, 6
je case.default.0x41e3e2
push 1
xor eax, eax
mov byte [0x44d407], 1
push ebx
mov word [0x455822], ax
call dword [sym.imp.USER32.dll_EndDialog]
jmp case.default.0x41e3e2
cmp ebx, 7
jne case.default.0x41e3e2
cmp dword [0x456824], edi
jne 0x41ec35
mov dword [0x456824], 2
mov byte [0x455820], 1
jmp case.default.0x41e3e2
cmp ebx, 3
jne 0x41ec6f
cmp word [ebp + 0x17050], di
je 0x41ec61
lea eax, [ebp + 0x17050]
push eax
call fcn.0042aaa1
pop ecx
mov dword [0x464c60], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041cfce
mov dword [0x464c5c], eax
mov byte [0x463c4a], 1
jmp case.default.0x41e3e2
cmp ebx, 6
jne case.default.0x41e3e2
xor eax, eax
mov word [ebp + 0x19050], ax
movzx eax, word [ebp + 0x2050]
push eax
call fcn.0042acb1
pop ecx
cmp eax, 0x50
je 0x41ecc1
cmp eax, 0x54
je 0x41ecb3
mov dword [ebp - 0x10], 0x10
mov eax, 0x45340a
jmp 0x41eccd
mov dword [ebp - 0x10], 7
mov eax, 0x45140a
jmp 0x41eccd
mov dword [ebp - 0x10], 2
mov eax, 0x45240a
mov esi, 0x800
push esi
push eax
lea eax, [ebp + 0x19050]
push eax
call fcn.004123db
xor eax, eax
mov word [ebp + 0x14050], ax
mov word [ebp + 0x1a050], ax
lea eax, [ebp + 0x4050]
push esi
push eax
lea eax, [ebp + 0x16050]
push eax
call fcn.004123db
push 0x22
pop ebx
cmp word [ebp + 0x16050], bx
jne 0x41ed5a
push esi
lea eax, [ebp + 0x4052]
push eax
lea eax, [ebp + 0x16050]
push eax
call fcn.004123db
lea eax, [ebp + 0x16052]
push ebx
push eax
call fcn.0042409c
pop ecx
pop ecx
test eax, eax
je 0x41ee37
xor ecx, ecx
mov word [eax], cx
add eax, 2
push 0x400
push eax
lea eax, [ebp + 0x1a050]
push eax
call fcn.004123db
jmp 0x41ee37
lea eax, [ebp + 0x16050]
push eax
call fcn.0040ba3b
test al, al
jne 0x41ee37
mov ax, word [ebp + 0x16050]
lea esi, [ebp + 0x16050]
mov ebx, edi
test ax, ax
je 0x41ee32
movzx edi, ax
push 0x20
pop eax
cmp di, ax
je 0x41ed99
push 0x2f
pop eax
cmp di, ax
jne 0x41ee11
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x16050]
push eax
call fcn.0040ba3b
test al, al
je 0x41ee0e
lea eax, [ebp + 0x16050]
push eax
call fcn.0040ba4d
push eax
call fcn.0040baae
test al, al
jne 0x41ee0e
push 0x2f
pop ecx
lea eax, [esi + 2]
mov ebx, esi
cmp di, cx
jne 0x41ede5
mov word [ebp + 0x1a050], cx
mov edx, 0x3ff
lea ecx, [ebp + 0x1a052]
jmp 0x41ee01
push 0x20
mov esi, eax
pop eax
jmp 0x41edef
add esi, 2
cmp word [esi], ax
je 0x41edec
lea ecx, [ebp + 0x1a050]
mov eax, esi
mov edx, 0x400
push edx
push eax
push ecx
call fcn.004123db
mov word [ebx], di
jmp 0x41ee11
mov word [esi], di
add esi, 2
movzx eax, word [esi]
mov edi, eax
test ax, ax
jne 0x41ed89
mov esi, 0x800
test ebx, ebx
je 0x41ee37
xor eax, eax
mov word [ebx], ax
jmp 0x41ee37
mov esi, 0x800
cmp word [ebp + 0xc050], 0
je 0x41ee55
push esi
lea eax, [ebp + 0x14050]
push eax
lea eax, [ebp + 0xc050]
push eax
call fcn.0040d2cc
push esi
lea eax, [ebp + 0x12050]
push eax
lea eax, [ebp + 0x16050]
push eax
call fcn.0040d2cc
cmp word [ebp + 0x19050], 0
jne 0x41ee82
push dword [ebp - 0x10]
lea eax, [ebp + 0x19050]
push eax
call fcn.0041cf65
push esi
lea eax, [ebp + 0x19050]
push eax
call fcn.0040d298
cmp word [ebp + 0x6050], 0
je 0x41eeba
push esi
lea eax, [ebp + 0x6050]
push eax
lea eax, [ebp + 0x19050]
push eax
call fcn.004123b3
push esi
lea eax, [ebp + 0x19050]
push eax
call fcn.0040d298
push esi
lea eax, [ebp + 0x19050]
push eax
lea eax, [ebp + 0x11050]
push eax
call fcn.004123db
cmp word [ebp + 0xa050], 0
lea eax, [ebp + 0xa050]
jne 0x41eee4
lea eax, [ebp + 0x4050]
push esi
push eax
call fcn.0040df71
push eax
lea eax, [ebp + 0x19050]
push eax
call fcn.004123b3
lea eax, [ebp + 0x19050]
push eax
call fcn.0040d5b1
test eax, eax
je 0x41ef17
push str..lnk
push eax
call fcn.00413eb3
test eax, eax
je 0x41ef29
push esi
push str..lnk
lea eax, [ebp + 0x19050]
push eax
call fcn.004123b3
xor ebx, ebx
lea eax, [ebp + 0x19050]
push ebx
push 1
push eax
call fcn.0040b861
push esi
lea eax, [ebp + 0x12050]
push eax
lea eax, [ebp + 0x13050]
push eax
call fcn.004123db
lea eax, [ebp + 0x13050]
push eax
call fcn.0040dfbb
movzx esi, word [ebp + 0x1a050]
lea eax, [ebp + 0x1a050]
movzx edx, word [ebp + 0x14050]
lea edi, [ebp + 0x13050]
movzx ecx, word [ebp + 0x8050]
neg esi
sbb esi, esi
and esi, eax
neg edx
lea eax, [ebp + 0x14050]
sbb edx, edx
and edx, eax
neg ecx
lea eax, [ebp + 0x8050]
sbb ecx, ecx
and ecx, eax
movzx eax, word [ebp + 0x13050]
push esi
neg eax
push edx
sbb eax, eax
push ecx
and eax, edi
push eax
lea eax, [ebp + 0x19050]
push eax
lea eax, [ebp + 0x12050]
push eax
push ebx
call fcn.0041bd4a
cmp word [ebp + 0x11050], bx
je case.default.0x41e3e2
push ebx
lea eax, [ebp + 0x11050]
push eax
push 5
push 0x1000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp case.default.0x41e3e2
cmp ebx, 7
jne case.default.0x41e3e2
mov byte [0x456828], 1
push 0x1000
lea eax, [ebp - 0x12]
push eax
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp + 0x17050]
push eax
lea eax, [ebp + 0xe050]
push eax
push dword [ebp - 0x1c]
call fcn.0041ce3d
mov dword [ebp - 0x1c], eax
test eax, eax
jmp 0x41e383
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1b850]
xor ecx, ebp
call fcn.00420983
add ebp, 0x1b854
leave
ret 0xc
call fcn.00420c83
mov edi, edi
jmp 0xae42322b