Function at 0x411de0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x42fa20
mov eax, dword fs:[0]
push eax
mov eax, 0x9008
call fcn.00419600
mov eax, dword [0x4490c0]
xor eax, esp
mov dword [esp + 0x9004], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4490c0]
xor eax, esp
push eax
lea eax, [esp + 0x901c]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x6b8]
call fcn.0040bd20
xor ebp, ebp
mov dword [esp + 0x9024], ebp
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x6b4], 0xf
mov dword [esp + 0x6b0], ebp
mov byte [esp + 0x6a0], 0
mov edi, dword [esp + 0x902c]
cmp edi, 0x1f
mov ebx, 1
mov byte [esp + 0x9024], bl
mov byte [esp + 0x704], 0
mov dword [esp + 0x1c], ebp
ja case.default.0x411e80
jmp dword [edi*4 + 0x412d78]
mov ecx, esi
call fcn.00411be0
lea eax, [esp + 0x584]
push eax
mov ecx, esi
call fcn.00405dc0
lea ecx, [esp + 0x62c]
push ecx
mov ecx, eax
mov byte [esp + 0x9028], 2
call fcn.00405dc0
lea edx, [esp + 0x300]
push edx
mov ecx, eax
mov byte [esp + 0x9028], 3
call fcn.004040c0
push eax
mov ecx, esi
mov byte [esp + 0x9028], 4
call fcn.00404f60
lea ecx, [esp + 0x300]
call fcn.004015b8
lea ecx, [esp + 0x62c]
mov byte [esp + 0x9024], 2
call fcn.00403e00
lea ecx, [esp + 0x584]
mov byte [esp + 0x9024], bl
call fcn.00403e00
jmp 0x412d00
mov ecx, esi
call fcn.00411be0
lea eax, [esp + 0x54c]
push eax
mov ecx, esi
call fcn.00405dc0
lea ecx, [esp + 0x5bc]
push ecx
mov ecx, eax
mov byte [esp + 0x9028], 5
call fcn.00405dc0
lea edx, [esp + 0x220]
push edx
mov ecx, eax
mov byte [esp + 0x9028], 6
call fcn.004040c0
push eax
mov ecx, esi
mov byte [esp + 0x9028], 7
call fcn.00404f60
lea ecx, [esp + 0x220]
call fcn.004015b8
lea ecx, [esp + 0x5bc]
mov byte [esp + 0x9024], 5
call fcn.00403e00
lea ecx, [esp + 0x54c]
mov byte [esp + 0x9024], bl
call fcn.00403e00
jmp 0x412d00
push str.CommonFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push str.HKLM
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 8
call fcn.00401a85
lea ecx, [esp + 0x2c8]
mov byte [esp + 0x9024], bl
call fcn.004015b8
lea ecx, [esp + 0x69c]
push ecx
mov ecx, esi
call fcn.00404f60
jmp 0x412d00
lea edx, [esp + 0x704]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0xb8]
call fcn.00401d59
lea ecx, [esp + 0xb4]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 9
call fcn.00404f60
lea ecx, [esp + 0xb4]
call fcn.004015b8
jmp 0x412d00
cmp byte [esp + 0x9030], 0
je 0x41211d
lea edx, [esp + 0x474]
push edx
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0xa
call fcn.00412f60
lea ecx, [esp + 0x474]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x4120dc
push str.Desktop
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x43f6fc
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0xb
call fcn.00401a85
lea ecx, [esp + 0x258]
jmp 0x41215c
push str.Common_Desktop
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKLM
lea ecx, [esp + 0x344]
push ecx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0xc
call fcn.00401a85
lea ecx, [esp + 0x338]
jmp 0x41215c
push str.Desktop
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKCU
lea edx, [esp + 0x29c]
push edx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0xd
call fcn.00401a85
lea ecx, [esp + 0x290]
mov byte [esp + 0x9024], bl
call fcn.004015b8
lea eax, [esp + 0x69c]
push eax
mov ecx, esi
call fcn.00404f60
jmp 0x412d00
push 0x104
lea ecx, [esp + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x704]
push edx
lea ecx, [esp + 0x160]
call fcn.00401d59
lea eax, [esp + 0x15c]
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0xe
call fcn.00404f60
lea ecx, [esp + 0x15c]
mov byte [esp + 0x9024], bl
call fcn.004015b8
lea ecx, [esp + 0x40c]
push ecx
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0xf
call fcn.00413000
lea ecx, [esp + 0x40c]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
sub esp, 0x1c
cmp byte [esp + 0x33], 0
mov ecx, esp
mov dword [esp + 0x34], esp
je 0x41226c
jmp 0x412343
push 0x104
lea edx, [esp + 0x708]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0x80]
call fcn.00401d59
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x10
call fcn.00404f60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Driver_Cachei386
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
push 0x104
lea edx, [esp + 0x708]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0x128]
call fcn.00401d59
lea ecx, [esp + 0x124]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x11
call fcn.00404f60
lea ecx, [esp + 0x124]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Driver_Cache_amd64
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
push 0x104
lea edx, [esp + 0x708]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0x2c]
call fcn.00401d59
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x12
call fcn.00404f60
lea ecx, [esp + 0x28]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Driver_Cachex64
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
push 0x104
lea edx, [esp + 0x708]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0x198]
call fcn.00401d59
lea ecx, [esp + 0x194]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x13
call fcn.00404f60
lea ecx, [esp + 0x194]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Fonts
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
mov ecx, esi
call fcn.00411be0
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
lea edx, [esp + 0x3a4]
push edx
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0x14
call fcn.00412f50
cmp eax, 4
lea ecx, [esp + 0x3a4]
sete byte [esp + 0x17]
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x412448
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43f7b4
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
lea eax, [esp + 0x370]
push eax
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0x15
call fcn.00412fc0
lea ecx, [esp + 0x370]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x412d00
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43f7b0
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
lea ecx, [esp + 0x20]
push ecx
push 0x104
lea edx, [esp + 0x70c]
push edx
push ebx
push ebp
push ebp
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryA
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0xf0]
call fcn.00401d59
lea ecx, [esp + 0xec]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x16
call fcn.00404f60
lea ecx, [esp + 0xec]
call fcn.004015b8
jmp 0x412d00
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push str.HKLM
lea edx, [esp + 0x1f4]
push edx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x17
call fcn.00401a85
lea ecx, [esp + 0x1e8]
jmp 0x41215c
push str.SendTo
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKCU
lea ecx, [esp + 0x210]
push ecx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x18
call fcn.00401a85
lea ecx, [esp + 0x204]
mov byte [esp + 0x9024], bl
call fcn.004015b8
lea edx, [esp + 0x69c]
push edx
mov ecx, esi
call fcn.00404f60
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
lea eax, [esp + 0x3d8]
push eax
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0x19
call fcn.00412f80
lea ecx, [esp + 0x3d8]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x412d00
lea ecx, [esp + 0x5f4]
push ecx
mov ecx, esi
call fcn.00405dc0
lea edx, [esp + 0x4dc]
push edx
mov ecx, eax
mov byte [esp + 0x9028], 0x1a
call fcn.00405dc0
lea ecx, [esp + 0x1cc]
push ecx
mov ecx, eax
mov byte [esp + 0x9028], 0x1b
call fcn.004040c0
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x1c
call fcn.00404f60
lea ecx, [esp + 0x1cc]
call fcn.004015b8
lea ecx, [esp + 0x4dc]
mov byte [esp + 0x9024], 0x1a
call fcn.00403e00
lea ecx, [esp + 0x5f4]
mov byte [esp + 0x9024], bl
call fcn.00403e00
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
lea edx, [esp + 0x440]
push edx
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0x1d
call fcn.00412f80
lea ecx, [esp + 0x440]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x412d00
lea eax, [esp + 0x664]
push eax
mov ecx, esi
call fcn.00405dc0
lea ecx, [esp + 0x23c]
push ecx
mov ecx, eax
mov byte [esp + 0x9028], 0x1e
call fcn.004040c0
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x1f
call fcn.00404f60
lea ecx, [esp + 0x23c]
call fcn.004015b8
lea ecx, [esp + 0x664]
mov byte [esp + 0x9024], bl
call fcn.00403e00
jmp 0x412d00
cmp byte [esp + 0x9030], 0
je 0x4127e3
lea edx, [esp + 0x4a8]
push edx
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x9024], 0x20
call fcn.00412f60
lea ecx, [esp + 0x4a8]
mov byte [esp + 0x17], al
mov byte [esp + 0x9024], bl
call fcn.00413020
cmp byte [esp + 0x17], 0
je 0x41279f
push str.Programs
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x43f6fc
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x21
call fcn.00401a85
lea ecx, [esp + 0x274]
jmp 0x41215c
push str.Common_Programs
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKLM
lea ecx, [esp + 0x2b8]
push ecx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x22
call fcn.00401a85
lea ecx, [esp + 0x2ac]
jmp 0x41215c
push str.Programs
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKCU
lea edx, [esp + 0x2f0]
push edx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x23
call fcn.00401a85
lea ecx, [esp + 0x2e4]
jmp 0x41215c
push 0x104
lea ecx, [esp + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x704]
push edx
lea ecx, [esp + 0x48]
call fcn.00401d59
lea eax, [esp + 0x44]
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x24
call fcn.00404f60
lea ecx, [esp + 0x44]
call fcn.004015b8
jmp 0x412d00
push 0x104
lea ecx, [esp + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0x704]
push edx
lea ecx, [esp + 0x64]
call fcn.00401d59
lea eax, [esp + 0x60]
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x25
call fcn.00404f60
lea ecx, [esp + 0x60]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43f778
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
push 0x104
lea ecx, [esp + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [esp + 0xf14]
push edx
lea eax, [esp + 0x910]
push eax
lea ecx, [esp + 0xa18]
push ecx
lea edx, [esp + 0x814]
push edx
lea eax, [esp + 0x714]
push eax
call fcn.004164b2
add esp, 0x14
lea ecx, [esp + 0x808]
push ecx
lea ecx, [esp + 0x9c]
call fcn.00401d59
lea edx, [esp + 0x98]
push edx
mov ecx, esi
mov byte [esp + 0x9028], 0x26
call fcn.00404f60
lea ecx, [esp + 0x98]
call fcn.004015b8
jmp 0x412d00
lea eax, [esp + 0x704]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x704]
push ecx
lea ecx, [esp + 0xd4]
call fcn.00401d59
lea edx, [esp + 0xd0]
push edx
mov ecx, esi
mov byte [esp + 0x9028], 0x27
call fcn.00404f60
lea ecx, [esp + 0xd0]
call fcn.004015b8
jmp 0x412d00
push 0x104
lea eax, [esp + 0x708]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x704]
push ecx
lea ecx, [esp + 0x10c]
call fcn.00401d59
lea edx, [esp + 0x108]
push edx
mov ecx, esi
mov byte [esp + 0x9028], 0x28
call fcn.00404f60
lea ecx, [esp + 0x108]
call fcn.004015b8
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
lea eax, [esp + 0x514]
push eax
mov ecx, esi
call fcn.00405dc0
lea ecx, [esp + 0x31c]
push ecx
mov ecx, eax
mov byte [esp + 0x9028], 0x29
call fcn.004040c0
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x2a
call fcn.00404f60
lea ecx, [esp + 0x31c]
call fcn.004015b8
lea ecx, [esp + 0x514]
mov byte [esp + 0x9024], bl
call fcn.00403e00
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Win40
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43ef98
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43f7b0
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
mov ecx, esi
call fcn.00411d20
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x43f7b4
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
push str.Common_AppData
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push str.HKLM
lea edx, [esp + 0x360]
push edx
lea ecx, [esp + 0x6c8]
call fcn.0040c270
push eax
lea ecx, [esp + 0x6a0]
mov byte [esp + 0x9028], 0x2b
call fcn.00401a85
lea ecx, [esp + 0x354]
jmp 0x41215c
mov ecx, esi
call fcn.00411b10
jmp 0x412d00
lea ecx, [esp + 0x1c]
push ecx
push 5
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x704]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea edx, [esp + 0x704]
push edx
lea ecx, [esp + 0x144]
call fcn.00401d59
lea eax, [esp + 0x140]
push eax
mov ecx, esi
mov byte [esp + 0x9028], 0x2c
call fcn.00404f60
lea ecx, [esp + 0x140]
call fcn.004015b8
jmp 0x412d00
push 0x7ffe
lea ecx, [esp + 0x101d]
push ebp
push ecx
mov byte [esp + 0x1024], 0
call fcn.004157e0
add esp, 0xc
push 0x7fff
lea edx, [esp + 0x101c]
push edx
push str._ALLUSERSPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, 0x7fff
ja 0x412bcb
cmp eax, ebp
jne 0x412bd3
mov byte [esp + 0x1018], 0
lea eax, [esp + 0x1018]
push eax
lea ecx, [esp + 0x17c]
call fcn.00401d59
lea ecx, [esp + 0x178]
push ecx
mov ecx, esi
mov byte [esp + 0x9028], 0x2d
call fcn.00404f60
lea ecx, [esp + 0x178]
call fcn.004015b8
jmp 0x412d00
push 0x3ff
lea edx, [esp + 0xb19]
push ebp
push edx
mov byte [esp + 0xb20], 0
call fcn.004157e0
add esp, 0xc
push 0x400
lea eax, [esp + 0xb18]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0xb14]
push ecx
lea ecx, [esp + 0x1b4]
call fcn.00401d59
lea edx, [esp + 0x1b0]
push edx
mov ecx, esi
mov byte [esp + 0x9028], 0x2e
call fcn.00404f60
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x9024], bl
call fcn.004015b8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.SysWOW64
call fcn.00401d59
mov ecx, esi
call fcn.00404fc0
jmp 0x412d00
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.SystemPath::SetPath
call fcn.00401d59
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push str..SystemPath.cpp
mov byte [esp + 0x9060], 0x2f
call fcn.00401d59
push 0x1c7
mov ecx, 0x44af08
mov byte [esp + 0x9060], bl
call fcn.004089c0
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push str.invalid_path_code__i
call fcn.00401d59
push ebp
push 0x44af08
call fcn.0040ab20
add esp, 0x28
cmp dword [esp + 0x6b4], 0x10
jb 0x412d1a
mov eax, dword [esp + 0x6a0]
push eax
call fcn.00413f2a
add esp, 4
lea ecx, [esp + 0x6b8]
mov dword [esp + 0x6b4], 0xf
mov dword [esp + 0x6b0], ebp
mov byte [esp + 0x6a0], 0
mov dword [esp + 0x9024], 0xffffffff
call fcn.0040b500
mov ecx, dword [esp + 0x901c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x9004]
xor ecx, esp
call fcn.004157c8
add esp, 0x9014
ret 8