Function at 0x42b470
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6562
mov eax, dword fs:[0]
push eax
mov eax, 0x2240
call fcn.0059a600
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
call fcn.0046d4f0
test eax, eax
je 0x42b524
push ebx
push str.CDIFxUninstall::IsInbuildDriverExist_:_pszDeviceID___s_n
push 0x65b390
call fcn.00599ee3
mov eax, dword [str.ENTRY:]
mov ecx, dword [0x5ccf7c]
mov dword [0x65b290], eax
mov eax, 0x65b390
mov dword [0x65b294], ecx
add esp, 0xc
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42b4e0
mov edi, 0x65b290
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42b4f1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d500
push 0x65b290
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
xor esi, esi
push ebx
lea ecx, [ebp - 0x21e4]
mov dword [ebp - 0x21ec], esi
call fcn.00403380
mov dword [ebp - 4], esi
call fcn.004a8620
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x42b555
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21e8], eax
mov byte [ebp - 4], 1
call fcn.004a8620
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x42b585
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21d4], eax
mov byte [ebp - 4], 2
call fcn.004a8620
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x42b5b5
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x21f0], ebx
lea ecx, [ebp - 0x2230]
mov byte [ebp - 4], 3
call fcn.004a9ca8
xor esi, esi
push 0x5dc
lea ecx, [ebp - 0x20a8]
push 0x4b
push ecx
mov dword [ebp - 0x21d0], esi
mov dword [ebp - 0x21c8], esi
mov dword [ebp - 0x21c4], esi
mov dword [ebp - 0x21bc], esi
mov dword [ebp - 0x20ac], esi
call fcn.00599fb0
mov ecx, 0x5dc
xor eax, eax
lea edi, [ebp - 0x1acc]
rep stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x21b4], 0xffffffff
push 0xa
lea ecx, [ebp - 0x224c]
mov byte [ebp - 4], 5
call fcn.004a7e5d
lea ecx, [ebp - 0x21e4]
mov byte [ebp - 4], 6
call fcn.004027d0
push 0x104
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.DriverStoreFileRepository
lea ecx, [ebp - 0x21dc]
call fcn.00403380
mov edi, eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x21f4]
mov byte [ebp - 4], 7
call fcn.00403380
push edi
push eax
lea ecx, [ebp - 0x21d8]
push ecx
mov byte [ebp - 4], 8
call fcn.00402910
add esp, 0xc
push eax
lea ecx, [ebp - 0x21e8]
mov byte [ebp - 4], 9
call fcn.00402af0
mov eax, dword [ebp - 0x21d8]
add eax, 0xfffffff0
mov byte [ebp - 4], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42b6ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21f4]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b6f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21dc]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b716
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21e8]
push ecx
lea ecx, [ebp - 0x21dd]
call fcn.0042d020
cmp eax, esi
jne 0x42b809
push str.DRVSTORE
lea ecx, [ebp - 0x21d8]
call fcn.00403380
mov edi, eax
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x21f4]
mov byte [ebp - 4], 0xa
call fcn.00403380
push edi
push eax
lea eax, [ebp - 0x21dc]
push eax
mov byte [ebp - 4], 0xb
call fcn.00402910
add esp, 0xc
push eax
lea ecx, [ebp - 0x21e8]
mov byte [ebp - 4], 0xc
call fcn.00402af0
mov eax, dword [ebp - 0x21dc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b7a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21f4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b7c9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21d8]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b7ef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21e8]
push ecx
lea ecx, [ebp - 0x21dd]
call fcn.0042d020
cmp eax, esi
je 0x42be8d
push str..
lea edx, [ebp - 0x21e8]
push edx
lea eax, [ebp - 0x21dc]
push eax
call fcn.004029d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x21d4]
mov byte [ebp - 4], 0xd
call fcn.00402af0
mov eax, dword [ebp - 0x21dc]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b85a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21d4]
push esi
push ecx
lea ecx, [ebp - 0x2230]
call fcn.004a9d4c
cmp eax, esi
je 0x42be67
jmp 0x42b880
cmp dword [ebp - 0x21ec], esi
jne 0x42be67
lea ecx, [ebp - 0x2230]
call fcn.004a98fd
lea ecx, [ebp - 0x2230]
mov dword [ebp - 0x21fc], eax
call fcn.004a9c6d
test eax, eax
jne 0x42be5b
mov edx, dword [ebp - 0x2230]
mov eax, dword [edx + 0x38]
push 0x10
lea ecx, [ebp - 0x2230]
call eax
test eax, eax
je 0x42be5b
push 0x5cf6b4
lea ecx, [ebp - 0x220c]
call fcn.00403380
mov edi, eax
lea ecx, [ebp - 0x21f4]
push ecx
lea ecx, [ebp - 0x2230]
mov byte [ebp - 4], 0xe
call fcn.004a9f43
push edi
push eax
lea edx, [ebp - 0x21dc]
push edx
mov byte [ebp - 4], 0xf
call fcn.00402910
add esp, 0xc
push eax
lea ecx, [ebp - 0x21d4]
mov byte [ebp - 4], 0x10
call fcn.00402af0
mov eax, dword [ebp - 0x21dc]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b93e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21f4]
add eax, 0xfffffff0
mov byte [ebp - 4], 0xe
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b964
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x220c]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42b98a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [ebp - 0x21d4]
lea ecx, [ebp - 0x254]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x2208], eax
cmp eax, 0xffffffff
je 0x42be5b
lea ecx, [ecx]
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x2210]
call fcn.00403380
mov edi, eax
push 0x5cd28c
lea ecx, [ebp - 0x2204]
mov byte [ebp - 4], 0x11
call fcn.00403380
mov esi, eax
lea ecx, [ebp - 0x2200]
push ecx
lea ecx, [ebp - 0x2230]
mov byte [ebp - 4], 0x12
call fcn.004a9f43
push esi
push eax
lea edx, [ebp - 0x2214]
push edx
mov byte [ebp - 4], 0x13
call fcn.00402910
push edi
push eax
lea eax, [ebp - 0x21f8]
push eax
mov byte [ebp - 4], 0x14
call fcn.00402910
add esp, 0x18
mov ecx, dword [eax]
mov edi, dword [ebp - 0x21d4]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
mov byte [ebp - 4], 0x15
cmp eax, edi
je 0x42ba82
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x42ba72
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x42ba72
push eax
call fcn.004022e0
mov dword [ebp - 0x21d8], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42ba61
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov ecx, dword [ebp - 0x21d8]
add ecx, 0x10
mov dword [ebp - 0x21d4], ecx
jmp 0x42ba82
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x21d4]
call fcn.004026b0
mov eax, dword [ebp - 0x21f8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x14
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42baa8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2214]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x13
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bace
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2200]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42baf4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2204]
add eax, 0xfffffff0
mov byte [ebp - 4], 0x11
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bb1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x2210]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bb40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x21d4]
push ecx
lea ecx, [ebp - 0x21d0]
call fcn.0043ce60
lea ecx, [ebp - 0x224c]
call fcn.004a7fe2
lea edx, [ebp - 0x224c]
push edx
lea ecx, [ebp - 0x21d0]
call fcn.00428e90
test eax, eax
je 0x42be2d
mov eax, dword [ebp - 0x2248]
mov dword [ebp - 0x21d8], eax
test eax, eax
je 0x42be2d
jmp 0x42bb90
mov eax, dword [ebp - 0x21d8]
mov ecx, dword [eax]
mov eax, dword [eax + 8]
lea edi, [eax - 0x10]
lea esi, [ebx - 0x10]
mov dword [ebp - 0x21d8], ecx
cmp edi, esi
je 0x42bc4e
cmp dword [esi + 0xc], 0
jl 0x42bc38
mov ecx, dword [edi]
cmp ecx, dword [esi]
jne 0x42bc38
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x42bbe0
cmp eax, dword [edi]
jne 0x42bbe0
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x42bc14
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x42be74
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
inc eax
push eax
add edi, 0x10
push edi
push eax
lea ecx, [ebx + 0x10]
push ecx
call fcn.0059aa3b
add esp, 0x10
lea eax, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [eax], edx
dec edx
test edx, edx
jg 0x42bc2d
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0x10
mov dword [ebp - 0x21f0], ebx
jmp 0x42bc4e
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x21f0]
call fcn.004026b0
mov ebx, dword [ebp - 0x21f0]
mov edi, dword [ebx - 0xc]
test edi, edi
js 0x42be79
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edi
or eax, ecx
jge 0x42bc7c
push edi
lea ecx, [ebp - 0x21f0]
call fcn.00402280
mov ebx, dword [ebp - 0x21f0]
lea eax, [edi + 1]
push eax
push ebx
call fcn.0059a1fe
add esp, 8
cmp eax, 0x50
ja case.0x42bc99.0
movzx ecx, byte [eax + 0x42c02c]
jmp dword [ecx*4 + 0x42c01c]
cmp edi, dword [ebx - 8]
jg 0x42be79
mov dword [ebx - 0xc], edi
mov byte [edi + ebx], 0
mov eax, dword [ebp - 0x21e4]
test eax, eax
je 0x42bcdb
cmp dword [ebx - 0xc], 0
jl 0x42bcdb
push eax
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bcd5
sub eax, ebx
cmp eax, 0xffffffff
jne 0x42bd06
mov eax, dword [ebp - 0x21e4]
cmp dword [eax - 0xc], 0
jl 0x42bdad
push ebx
push eax
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bdad
sub eax, dword [ebp - 0x21e4]
cmp eax, 0xffffffff
je 0x42bdad
cmp dword [ebx - 0xc], 0
jl 0x42bdbc
push str.HDAUDIO
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bdbc
sub eax, ebx
cmp eax, 0xffffffff
je 0x42bdbc
cmp dword [ebx - 0xc], 0
jl 0x42bdad
push str.FUNC_01
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bd50
sub eax, ebx
cmp eax, 0xffffffff
jne 0x42bdbc
cmp dword [ebx - 0xc], 0
jl 0x42bdad
push str.FUNC_02
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bdad
sub eax, ebx
cmp eax, 0xffffffff
je 0x42bdad
cmp dword [ebx - 0xc], 0
jl 0x42bdad
push str.VEN_
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bdad
sub eax, ebx
cmp eax, 0xffffffff
je 0x42bdad
cmp dword [ebx - 0xc], 0
jl 0x42bdad
push str.DEV_
push ebx
call fcn.0059a963
add esp, 8
test eax, eax
je 0x42bdad
sub eax, ebx
cmp eax, 0xffffffff
jne 0x42bdbc
cmp dword [ebp - 0x21d8], 0
jne 0x42bb90
jmp 0x42be2d
call fcn.0046d4f0
test eax, eax
je 0x42bdef
mov edx, dword [ebp - 0x21d4]
push edx
push str.Found_Match_:__s_n
push 0x65b190
call fcn.00599ee3
add esp, 0xc
push 0x65b190
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4f0
test eax, eax
je 0x42be23
mov eax, dword [ebp - 0x21e4]
push eax
push ebx
push str.Found_csTestID___s__csDeviceID___s_n
push 0x65b090
call fcn.00599ee3
add esp, 0x10
push 0x65b090
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
mov dword [ebp - 0x21ec], 1
mov esi, dword [ebp - 0x2208]
lea ecx, [ebp - 0x254]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x42be52
cmp dword [ebp - 0x21ec], 0
je 0x42b9b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
cmp dword [ebp - 0x21fc], esi
jne 0x42b880
lea ecx, [ebp - 0x2230]
call fcn.004a9817
jmp 0x42bea7
call fcn.00401f40
push 0x80070057
call fcn.00401b60
call fcn.004a6ea5
call fcn.004a6edd
call fcn.0046d4f0
test eax, eax
je 0x42bea7
push str.FAILED_to_Find_Driver_Store_Folder_n
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d4f0
test eax, eax
je 0x42bf33
mov edx, dword [ebp - 0x21ec]
push edx
push str.CDIFxUninstall::IsInbuildDriverExist_:_bRetVal___d_n
push 0x65af90
call fcn.00599ee3
mov eax, dword [str.EXIT:]
mov ecx, dword [0x5ccefc]
mov dword [0x65ae90], eax
mov eax, 0x65af90
add esp, 0xc
mov dword [0x65ae94], ecx
mov esi, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bef0
mov edi, 0x65ae90
sub eax, esi
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x42bf00
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x65ae90
rep movsb byte es:[edi], byte [esi]
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d9d0
call fcn.0046d6a0
mov ecx, eax
call fcn.0046d510
lea ecx, [ebp - 0x224c]
mov byte [ebp - 4], 5
call fcn.004a8028
lea ecx, [ebp - 0x21d0]
mov byte [ebp - 4], 4
call fcn.004339c0
lea ecx, [ebp - 0x2230]
mov byte [ebp - 4], 3
call fcn.004a9cd7
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42bf80
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov eax, dword [ebp - 0x21d4]
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bfa6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21e8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bfcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21e4]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bff5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x21ec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4