Function at 0x40be68
Capabilities:
Accept command line arguments
Delete registry value
Get file size
Get file version info
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46eb72
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a34
call fcn.00433730
mov eax, dword [0x4879c0]
xor eax, esp
mov dword [esp + 0x1a30], eax
push ebx
push esi
push edi
mov eax, dword [0x4879c0]
xor eax, esp
push eax
lea eax, [esp + 0x1a48]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push edi
push 0x2000
push 0x8000000
mov dword [esp + 0x40], eax
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push ebx
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
mov eax, 0x2001f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1a58], edi
call fcn.004011aa
cmp eax, edi
je 0x40bf04
push ebx
push esi
lea eax, [esp + 0x1c]
call fcn.0040aa44
cmp eax, edi
jne 0x40bf0d
lea esi, [esp + 0x14]
call fcn.0040a9ee
push ebx
mov esi, connect
push esi
mov eax, 0x2001f
lea ecx, [esp + 0x1c]
call fcn.004011aa
cmp eax, edi
je 0x40bf39
push ebx
push esi
lea eax, [esp + 0x1c]
call fcn.0040aa44
cmp eax, edi
jne 0x40c05b
push edi
lea ecx, [esp + 0x5c]
mov dword [esp + 0x74], 7
call fcn.00403e67
mov byte [esp + 0x1a50], 1
call fcn.0040662a
xor ebx, ebx
inc ebx
push str._XLInstallProgramXLGamebox.exe
lea ecx, [esp + 0x5c]
mov dword [eax], ebx
call fcn.0040378d
lea eax, [esp + 0x58]
push eax
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x58]
call fcn.00406725
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x40bf98
lea eax, [esp + 0x5c]
push eax
push str.DisplayIcon
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push 0x479650
push str.DisplayName
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
mov esi, str.http:__gamebox.niu.xunlei.com
push esi
push str.HelpLink
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push 0x4797e0
push str.Publisher
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push esi
push str.URLInfoAbout
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push esi
push str.URLUpdateInfo
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push str._XLInstalluninstaller.exe
lea ecx, [esp + 0x5c]
call fcn.0040378d
lea eax, [esp + 0x58]
push eax
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x58]
call fcn.00406725
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x40c040
lea eax, [esp + 0x5c]
push eax
push str.UninstallString
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push edi
push ebx
lea ecx, [esp + 0x60]
call fcn.00403f22
lea esi, [esp + 0x14]
call fcn.00401193
call fcn.00401193
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov esi, str.SoftwareThunder_NetworkGameXLGamebox
push esi
mov ebx, connect
push ebx
mov eax, 0x2001f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1a58], 2
call fcn.004011aa
cmp eax, edi
je 0x40c0bc
push esi
push ebx
lea eax, [esp + 0x1c]
call fcn.0040aa44
cmp eax, edi
je 0x40c0bc
lea esi, [esp + 0x14]
call fcn.00401193
mov eax, 0x80004005
jmp 0x40cba5
call fcn.0040662a
push str._XLInstallProgramXLGamebox.exe
lea ecx, [esp + 0x5c]
mov dword [eax], 1
call fcn.004036a3
lea eax, [esp + 0x58]
push eax
mov byte [esp + 0x1a54], 3
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x58]
call fcn.00406725
xor eax, eax
mov esi, 0x206
push esi
mov word [esp + 0x128], ax
lea eax, [esp + 0x12a]
push edi
push eax
call fcn.00431530
mov ecx, dword [esp + 0x68]
add esp, 0xc
cmp dword [esp + 0x70], 8
jae 0x40c12b
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x124]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x40c132
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.....
lea eax, [esp + 0x128]
push eax
call ebx
xor eax, eax
push esi
mov word [esp + 0x838], ax
lea eax, [esp + 0x83a]
push edi
push eax
call fcn.00431530
add esp, 0xc
push 0x104
lea eax, [esp + 0x838]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x834]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, 0xfe
push esi
mov dword [esp + 0x30], eax
lea eax, [esp + 0x63a]
push edi
push eax
call fcn.00431530
xor eax, eax
mov word [esp + 0x640], ax
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x838]
push eax
mov dword [esp + 0x2c], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0x20], eax
cmp eax, edi
jbe 0x40c26b
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042d95a
pop ecx
mov dword [esp + 0x1c], eax
cmp eax, edi
je 0x40c26b
push eax
push dword [esp + 0x24]
lea eax, [esp + 0x83c]
push dword [esp + 0x2c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40c261
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
push 0x477eb4
push dword [esp + 0x28]
mov dword [esp + 0x30], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40c261
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
lea eax, [esp + 0x644]
push str._d._d._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [esp + 0x1c]
call fcn.0042ea94
pop ecx
xor eax, eax
push 0x7fe
mov word [esp + 0x1240], ax
lea eax, [esp + 0x1242]
push edi
push eax
call fcn.00431530
add esp, 0xc
xor eax, eax
push 0x206
mov word [esp + 0x430], ax
lea eax, [esp + 0x432]
push edi
push eax
call fcn.00431530
mov ecx, dword [esp + 0x68]
add esp, 0xc
cmp dword [esp + 0x70], 8
jae 0x40c2ba
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x42c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x40c2c1
push 0x479544
lea eax, [esp + 0x430]
push eax
call ebx
lea ebx, [esp + 0x123c]
call fcn.0040b326
push 0x477e98
lea ecx, [esp + 0x78]
mov dword [esp + 0x2c], edi
call fcn.004036a3
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x1a54], 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ebx, ebx
inc ebx
cmp dword [esp + 0x28], ebx
mov dword [esp + 0x1c], eax
jle 0x40c39d
mov eax, dword [esp + 0x1c]
push dword [eax + ebx*4]
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.00404868
add esp, 0xc
push 0x4798c4
push eax
lea eax, [esp + 0x98]
push eax
mov byte [esp + 0x1a5c], 5
call fcn.00404868
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x1a5c], 6
call fcn.00403c9c
push edi
push 1
lea ecx, [esp + 0x98]
call fcn.00403f22
push edi
push 1
lea ecx, [esp + 0x44]
mov byte [esp + 0x1a58], 4
call fcn.00403f22
inc ebx
cmp ebx, dword [esp + 0x28]
jl 0x40c324
push dword [esp + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
push 0x76
mov word [esp + 0xb0], ax
lea eax, [esp + 0xb2]
push edi
push eax
call fcn.00431530
add esp, 0xc
call fcn.0040662a
lea eax, [esp + 0xac]
push eax
push 0x4798c8
call fcn.00406b4c
xor eax, eax
push esi
mov word [esp + 0x330], ax
lea eax, [esp + 0x332]
push edi
push eax
call fcn.00431530
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x738], ax
lea eax, [esp + 0x73a]
push edi
push eax
call fcn.00431530
add esp, 0xc
call fcn.0040662a
lea edx, [esp + 0x32c]
lea ecx, [esp + 0x734]
call fcn.00406d24
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, str.UninstPath
push esi
push dword [esp + 0x18]
call ebx
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x40c454
lea eax, [esp + 0x5c]
push eax
push str.Path
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
lea eax, [esp + 0x123c]
push eax
push str.PeerId
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
lea eax, [esp + 0x634]
push eax
push str.version
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
cmp dword [esp + 0x8c], 8
mov eax, dword [esp + 0x78]
jae 0x40c4a4
lea eax, [esp + 0x78]
push eax
push str.InstCmdLine
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push esi
mov esi, dword [esp + 0x18]
push esi
call ebx
push str.uninstall
push esi
call ebx
call fcn.0040b598
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x20], eax
cmp eax, 2
je 0x40c534
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
push str.InstallSrc
push esi
mov dword [esp + 0x28], edi
call ebx
lea eax, [esp + 0xac]
push eax
push str.InstallSrcEx
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
lea eax, [esp + 0x32c]
push eax
push str.ComeFrom
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
push str.StartupOnce
push esi
mov dword [esp + 0x28], edi
call ebx
jmp 0x40c59e
push 0x400
lea eax, [esp + 0xa40]
push edi
push eax
call fcn.00431530
add esp, 0xc
push str.ComeFrom
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
lea edi, [esp + 0xa44]
mov dword [esp + 0x18], 0x200
call fcn.004011e8
test eax, eax
jne 0x40c585
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c575
sub eax, edx
sar eax, 1
jne 0x40c59c
lea eax, [esp + 0x32c]
push eax
push str.ComeFrom
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
xor edi, edi
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
push str.PluginMode
push dword [esp + 0x28]
mov dword [esp + 0x28], 1
call ebx
push edi
call fcn.00430e4c
mov dword [esp + 0x38], eax
mov eax, dword [0x489b44]
pop ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
lea esi, [esp + 0x14]
mov byte [esp + 0x1a54], 7
call fcn.0040b106
mov byte [esp + 0x1a50], 8
push dword [eax]
lea eax, [esp + 0x20]
call fcn.004058d2
mov ecx, esi
call fcn.0040ded2
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push str.InstallTime
push eax
call fcn.0040aa85
cmp dword [esp + 0x20], 2
je 0x40c66c
cmp dword [esp + 0x20], 1
je 0x40c66c
lea eax, [esp + 0x124]
push eax
push str.InstDir
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push dword [esp + 0x2c]
lea eax, [esp + 0x18]
push str.PackageName
push eax
call fcn.0040aa85
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
push str.InstallType
push dword [esp + 0x28]
mov dword [esp + 0x28], edi
call ebx
jmp 0x40c73b
push 0x400
lea eax, [esp + 0xa40]
push edi
push eax
call fcn.00431530
add esp, 0xc
push str.InstDir
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x28]
lea edi, [esp + 0xa44]
mov dword [esp + 0x28], 0x200
call fcn.004011e8
test eax, eax
jne 0x40c6bd
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c6ad
sub eax, edx
sar eax, 1
jne 0x40c6d4
lea eax, [esp + 0x124]
push eax
push str.InstDir
lea eax, [esp + 0x1c]
push eax
call fcn.0040aa85
push 0x400
lea eax, [esp + 0xa40]
push 0
push eax
call fcn.00431530
add esp, 0xc
push str.PackageName
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x28]
lea edi, [esp + 0xa44]
mov dword [esp + 0x28], 0x200
call fcn.004011e8
test eax, eax
jne 0x40c726
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c716
sub eax, edx
sar eax, 1
jne 0x40c739
push dword [esp + 0x2c]
lea eax, [esp + 0x18]
push str.PackageName
push eax
call fcn.0040aa85
xor edi, edi
lea esi, [esp + 0x14]
call fcn.00401193
lea esi, [esp + 0x1c]
call fcn.00405c55
push edi
push 1
lea ecx, [esp + 0x7c]
call fcn.00403f22
push edi
push 1
lea ecx, [esp + 0x60]
call fcn.00403f22
or dword [esp + 0x1a50], 0xffffffff
lea esi, [esp + 0x14]
call fcn.00401193
lea eax, [esp + 0x28]
push eax
push 0x20006
push edi
mov esi, str.SoftwareThunder_NetworkXLGamebox
push esi
push connect
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x40c7bd
push edi
lea eax, [esp + 0x2c]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
jne 0x40c841
call fcn.0040662a
xor esi, esi
inc esi
push str._XLInstallProgramXLGamebox.exe
lea ecx, [esp + 0x78]
mov dword [eax], esi
call fcn.004036a3
lea eax, [esp + 0x74]
push eax
mov dword [esp + 0x1a54], 9
call fcn.0040662a
push eax
call fcn.00406828
call fcn.0040662a
lea ecx, [esp + 0x74]
call fcn.00406725
cmp dword [esp + 0x8c], 8
mov eax, dword [esp + 0x78]
jae 0x40c810
lea eax, [esp + 0x78]
mov ecx, dword [esp + 0x88]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push esi
push edi
push str.path
push dword [esp + 0x3c]
call ebx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push esi
lea ecx, [esp + 0x7c]
call fcn.00403f22
jmp 0x40c844
xor esi, esi
inc esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push connect
mov eax, 0x2001f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1a58], 0xa
call fcn.004011aa
cmp eax, edi
jne 0x40cb49
xor eax, eax
push 0x206
mov word [esp + 0x128], ax
lea eax, [esp + 0x12a]
push edi
push eax
mov dword [esp + 0x38], edi
call fcn.00431530
add esp, 0xc
push 0x104
lea eax, [esp + 0x128]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push edi
push 0x80
push 4
push edi
push esi
push connect
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x10], eax
cmp eax, edi
je 0x40c8ea
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [esp + 0x10]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x5c]
call fcn.004036a3
push esi
push 0xffffffffffffffff
lea eax, [esp + 0x18]
mov byte [esp + 0x1a58], 0xb
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], 0x5b
call fcn.00403dd6
push esi
mov dword [esp + 0x20], eax
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], 0x5d
call fcn.00403dd6
push esi
mov dword [esp + 0x28], eax
push 0xffffffffffffffff
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x1c], 0x2e
call fcn.00403dd6
cmp dword [esp + 0x1c], 0xffffffff
je 0x40ca1b
mov ecx, dword [esp + 0x24]
cmp ecx, 0xffffffff
je 0x40ca1b
cmp eax, 0xffffffff
je 0x40ca1b
cmp dword [esp + 0x1c], ecx
jae 0x40ca1b
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, eax
jne 0x40ca1b
push dword [esp + 0x1c]
lea eax, [esp + 0x94]
push edi
push eax
lea ecx, [esp + 0x64]
call fcn.004037b1
push 0xffffffffffffffff
mov byte [esp + 0x1a54], 0xc
push dword [esp + 0x14]
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x64]
call fcn.004037b1
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x1a5c], 0xd
call fcn.004048af
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x1a5c], 0xe
call fcn.00403c9c
push edi
push esi
lea ecx, [esp + 0x44]
call fcn.00403f22
push edi
push esi
lea ecx, [esp + 0x7c]
call fcn.00403f22
push edi
push esi
lea ecx, [esp + 0x98]
call fcn.00403f22
xor eax, eax
push 0x206
mov word [esp + 0x430], ax
lea eax, [esp + 0x432]
push edi
push eax
call fcn.00431530
mov ecx, dword [esp + 0x68]
add esp, 0xc
cmp dword [esp + 0x70], 8
jae 0x40ca4a
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x42c]
movzx eax, word [ecx]
inc ecx
mov word [edx], ax
inc ecx
inc edx
inc edx
cmp ax, di
jne 0x40ca51
lea eax, [esp + 0x42c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [esp + 0x24], eax
xor eax, eax
push 0x7fe
mov word [esp + 0x1240], ax
lea eax, [esp + 0x1242]
push edi
push eax
call fcn.00431530
add esp, 0xc
push dword [esp + 0x24]
lea eax, [esp + 0x1240]
push dword [esp + 0x30]
push str.SIGN.IE0_X__s
push eax
call fcn.00405867
xor eax, eax
push 0x7fe
mov word [esp + 0xa50], ax
lea eax, [esp + 0xa52]
push edi
push eax
call fcn.00431530
add esp, 0x1c
push dword [esp + 0x24]
lea eax, [esp + 0xa40]
push str.10C1A20
push str.SIGN.MEDIA_s__s
push eax
call fcn.00405867
add esp, 0x10
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
lea eax, [esp + 0x134]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x28], esi
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
lea eax, [esp + 0x124c]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x28], esi
call ebx
push 4
lea eax, [esp + 0x14]
push eax
push 4
push edi
lea eax, [esp + 0xa4c]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x28], esi
call ebx
push edi
push esi
lea ecx, [esp + 0x60]
call fcn.00403f22
lea esi, [esp + 0x14]
call fcn.00401193
or dword [esp + 0x1a50], 0xffffffff
call fcn.00401193
push 0x5c
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x477e98
call fcn.004036a3
sub esp, 0x1c
mov dword [esp + 0x1a8c], 0xf
mov ecx, esp
mov dword [esp + 0x60], esp
push 0x479ad0
call fcn.004036a3
mov edi, dword [esp + 0x6c]
or dword [esp + 0x1a8c], 0xffffffff
call fcn.0040bd61
xor eax, eax
mov ecx, dword [esp + 0x1a48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1a30]
xor ecx, esp
call fcn.0042ea9f
mov esp, ebp
pop ebp
ret 4