Function at 0x41eca4
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44208b
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [str.GetTempPathA]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push esi
push edi
mov eax, dword [str.GetTempPathA]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
lea eax, [esi + 0xc]
mov byte [esp + 0xd8], 3
mov dword [esp + 0x14], ebx
call fcn.0041b49d
test eax, eax
jle 0x41eee9
jmp 0x41ed4b
mov esi, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], 0xf
call fcn.00408f84
lea edi, [esp + 0x7c]
call fcn.004160d1
mov eax, edi
push eax
lea eax, [esp + 0x64]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, esi
mov byte [esp + 0xe0], 5
call fcn.00416b22
mov eax, dword [esp + 0x7c]
and eax, 0xf
dec eax
je 0x41ee7e
dec eax
je 0x41ee67
dec eax
je 0x41ee2a
dec eax
je 0x41ee04
dec eax
je 0x41eded
dec eax
je 0x41edd6
dec eax
jne 0x41eeae
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41edbc
lea eax, [esp + 0x64]
push eax
push 0x405e60
mov esi, dword [0x449634]
call fcn.0040943c
lea esi, [esp + 0x24]
jmp 0x41eea2
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41ede5
lea eax, [esp + 0x64]
push eax
push 0x405e20
jmp 0x41edc2
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41edfc
lea eax, [esp + 0x64]
push eax
push 0x405de4
jmp 0x41edc2
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41ee13
lea eax, [esp + 0x64]
mov esi, dword [0x449634]
push eax
push 0x405da8
call fcn.0040943c
lea esi, [esp + 0x48]
jmp 0x41eea2
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41ee39
lea eax, [esp + 0x64]
mov esi, dword [0x449634]
push eax
push 0x405d6c
call fcn.0040943c
test byte [esp + 0x84], 0x30
pop ecx
pop ecx
lea eax, [esp + 0x60]
push eax
jne 0x41ee61
lea esi, [esp + 0x44]
jmp 0x41eea9
lea esi, [esp + 0x54]
jmp 0x41eea9
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41ee76
lea eax, [esp + 0x64]
push eax
push 0x405d34
jmp 0x41ee93
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x41ee8d
lea eax, [esp + 0x64]
push eax
push 0x405cfc
mov esi, dword [0x449634]
call fcn.0040943c
lea esi, [esp + 0x34]
pop ecx
pop ecx
lea eax, [esp + 0x60]
push eax
call fcn.0040fcab
lea esi, [esp + 0x7c]
call fcn.004160f7
push ebx
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0xe0], 3
call fcn.00408f39
mov eax, dword [esp + 0x18]
inc dword [esp + 0x14]
add eax, 0xc
call fcn.0041b49d
cmp dword [esp + 0x14], eax
jl 0x41ed47
mov edi, dword [esp + 0x3c]
push 0x412
lea edx, [esp + 0x44]
mov ecx, edi
call fcn.0041ebd7
lea edx, [esp + 0x54]
mov ecx, edi
mov dword [esp], 0x413
call fcn.0041ebd7
cmp byte [ebp + 8], bl
pop ecx
je 0x41ef20
cmp byte [edi + 0x98], bl
jne 0x41ef20
push 0x415
jmp 0x41ef25
push 0x414
lea edx, [esp + 0x30]
mov ecx, edi
call fcn.0041ebd7
pop ecx
push 0x416
lea edx, [esp + 0x20]
mov ecx, edi
call fcn.0041ebd7
pop ecx
lea esi, [esp + 0x2c]
call fcn.00416083
lea esi, [esp + 0x1c]
call fcn.00416083
lea esi, [esp + 0x50]
call fcn.00416083
lea esi, [esp + 0x40]
call fcn.00416083
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.0042b8b7
mov esp, ebp
pop ebp
ret