Function at 0x1002ab4a
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x100a82b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x1002b6f7
test ecx, ecx
je 0x1002b6f7
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor eax, eax
push eax
push eax
push 0xffffffffffffffff
push dword [ebp - 0x2c]
mov edi, 0xfde9
push eax
push edi
mov word [ecx], ax
mov dword [ebp - 0x1c], eax
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x28], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10059bd9
mov ebx, eax
pop ecx
test ebx, ebx
je 0x1002b6f7
push dword [ebp - 0x28]
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x2c]
push 0
push edi
call esi
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1002abc9
sub eax, ecx
sar eax, 1
cmp eax, 1
jbe 0x1002abff
push 0x22
pop ecx
cmp cx, word [ebx]
jne 0x1002abff
cmp cx, word [ebx + eax*2 - 2]
jne 0x1002abff
add eax, 0xfffffffe
push eax
lea eax, [ebx + 2]
push eax
push dword [ebp - 0x28]
push ebx
call fcn.1005a527
add esp, 0x10
push 0x25
pop eax
cmp ax, word [ebx]
jne 0x1002ac43
lea eax, [ebx + 2]
movzx ecx, word [eax]
test cx, cx
je 0x1002b6ac
cmp cx, 0x25
je 0x1002ac26
inc eax
inc eax
movzx ecx, word [eax]
test cx, cx
jne 0x1002ac16
cmp word [eax], 0
je 0x1002b6ac
cmp word [eax + 2], 0
jne 0x1002b6ac
mov dword [ebp - 0x1c], ebx
jmp 0x1002b6ac
mov esi, 0x10087a08
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push str.FID_AdminTools
push ebx
movsd dword es:[edi], dword [esi]
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ac6a
mov esi, 0x10087758
jmp 0x1002b506
push str.FID_CDBurning
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ac85
mov esi, 0x10087818
jmp 0x1002b506
push str.FID_CommonAdminTools
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002aca0
mov esi, 0x10087768
jmp 0x1002b506
push str.FID_CommonOEMLinks
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002acbb
mov esi, 0x10087808
jmp 0x1002b506
push str.FID_CommonPrograms
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002acd6
mov esi, 0x100875c8
jmp 0x1002b506
push str.FID_CommonStartMenu
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002acf1
mov esi, 0x100875d8
jmp 0x1002b506
push str.FID_CommonStartup
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad0c
mov esi, 0x100875b8
jmp 0x1002b506
push str.FID_CommonTemplates
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad27
mov esi, 0x10087608
jmp 0x1002b506
push str.FID_Contacts
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad42
mov esi, str.THxV
jmp 0x1002b506
push str.FID_Cookies
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad5d
mov esi, 0x10087668
jmp 0x1002b506
push str.FID_Desktop
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad78
mov esi, 0x10087518
jmp 0x1002b506
push str.FID_DeviceMetadataStore
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ad93
mov esi, 0x100879b8
jmp 0x1002b506
push str.FID_DocumentsLibrary
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002adae
mov esi, 0x10087968
jmp 0x1002b506
push str.FID_Downloads
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002adc9
mov esi, 0x100878a8
jmp 0x1002b506
push str.FID_Favorites
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ade4
mov esi, 0x10087578
jmp 0x1002b506
push str.FID_Fonts
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002adff
mov esi, 0x10087508
jmp 0x1002b506
push str.FID_GameTasks
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ae1a
mov esi, 0x10087928
jmp 0x1002b506
push str.FID_History
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ae35
mov esi, 0x10087678
jmp 0x1002b506
push str.FID_ImplicitAppShortcuts
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ae50
mov esi, 0x100879f8
jmp 0x1002b506
push str.FID_InternetCache
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ae6b
mov esi, 0x10087658
jmp 0x1002b506
push str.FID_Libraries
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002ae86
mov esi, 0x100879c8
jmp 0x1002b506
push str.FID_Links
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002aea1
mov esi, 0x10087948
jmp 0x1002b506
push str.FID_LocalAppData
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002aec3
mov dword [ebp - 0x1c], str._LOCALAPPDATA_
mov esi, 0x10087638
jmp 0x1002b506
push str.FID_LocalAppDataLow
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002aede
mov esi, 0x10087648
jmp 0x1002b506
push str.FID_LocalizedResourcesDir
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002aef9
mov esi, 0x100877f8
jmp 0x1002b506
push str.FID_Music
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af14
mov esi, 0x10087778
jmp 0x1002b506
push str.FID_MusicLibrary
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af2f
mov esi, 0x10087978
jmp 0x1002b506
push str.FID_NetHood
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af4a
mov esi, 0x10087588
jmp 0x1002b506
push str.FID_OriginalImages
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af65
mov esi, 0x10087958
jmp 0x1002b506
push str.FID_PhotoAlbums
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af80
mov esi, 0x10087888
jmp 0x1002b506
push str.FID_PicturesLibrary
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002af9b
mov esi, 0x10087988
jmp 0x1002b506
push str.FID_Pictures
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002afb6
mov esi, 0x100876c8
jmp 0x1002b506
push str.FID_Playlists
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002afd1
mov esi, 0x10087838
jmp 0x1002b506
push str.FID_PrintHood
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002afec
mov esi, 0x10087598
jmp 0x1002b506
push str.FID_Profile
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b00e
mov dword [ebp - 0x1c], str._USERPROFILE_
mov esi, 0x100876b8
jmp 0x1002b506
push str.FID_ProgramData
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b030
mov dword [ebp - 0x1c], str._ALLUSERSPROFILE_
mov esi, 0x100875f8
jmp 0x1002b506
push str.FID_ProgramFiles
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b052
mov dword [ebp - 0x1c], str._ProgramFiles_
mov esi, 0x10087718
jmp 0x1002b506
push str.FID_ProgramFilesX64
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b074
mov dword [ebp - 0x1c], str._ProgramW6432_
mov esi, 0x100876f8
jmp 0x1002b506
push str.FID_ProgramFilesX86
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b096
mov dword [ebp - 0x1c], str._ProgramFiles_x86__
mov esi, 0x100876d8
jmp 0x1002b506
push str.FID_ProgramFilesCommon
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b0b8
mov dword [ebp - 0x1c], str._CommonProgramFiles_
mov esi, 0x10087728
jmp 0x1002b506
push str.FID_ProgramFilesCommonX64
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b0da
mov dword [ebp - 0x1c], str._CommonProgramW6432_
mov esi, 0x10087708
jmp 0x1002b506
push str.FID_ProgramFilesCommonX86
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b0fc
mov dword [ebp - 0x1c], str._CommonProgramFiles_x86__
mov esi, 0x100876e8
jmp 0x1002b506
push str.FID_Programs
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b117
mov esi, 0x10087538
jmp 0x1002b506
push str.FID_Public
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b139
mov dword [ebp - 0x1c], str._PUBLIC_
mov esi, 0x10087898
jmp 0x1002b506
push str.FID_PublicDesktop
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b154
mov esi, 0x100875e8
jmp 0x1002b506
push str.FID_PublicDocuments
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b16f
mov esi, 0x10087618
jmp 0x1002b506
push str.FID_PublicDownloads
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b18a
mov esi, 0x100878b8
jmp 0x1002b506
push str.FID_PublicGameTasks
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b1a5
mov esi, 0x10087918
jmp 0x1002b506
push str.FID_PublicLibraries
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b1c0
mov esi, 0x100879d8
jmp 0x1002b506
push str.FID_PublicMusic
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b1db
mov esi, 0x100877b8
jmp 0x1002b506
push str.FID_PublicPictures
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b1f6
mov esi, 0x100877a8
jmp 0x1002b506
push str.FID_PublicRingtones
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b211
mov esi, 0x100877d8
jmp 0x1002b506
push str.FID_PublicVideos
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b22c
mov esi, 0x100877c8
jmp 0x1002b506
push str.FID_QuickLaunch
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b247
mov esi, 0x100878d8
jmp 0x1002b506
push str.FID_Recent
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b262
mov esi, 0x10087558
jmp 0x1002b506
push str.FID_RecordedTVLibrary
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b27d
mov esi, 0x100879a8
jmp 0x1002b506
push str.FID_ResourceDir
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b298
mov esi, 0x100877e8
jmp 0x1002b506
push str.FID_Ringtones
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b2b3
mov esi, 0x10087798
jmp 0x1002b506
push str.FID_RoamingAppData
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b2d5
mov dword [ebp - 0x1c], str._APPDATA_
mov esi, 0x10087628
jmp 0x1002b506
push str.FID_SampleMusic
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b2f0
mov esi, 0x10087858
jmp 0x1002b506
push str.FID_SamplePictures
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b30b
mov esi, 0x10087868
jmp 0x1002b506
push str.FID_SamplePlaylists
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b326
mov esi, 0x10087848
jmp 0x1002b506
push str.FID_SampleVideos
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b341
mov esi, 0x10087878
jmp 0x1002b506
push str.FID_SavedGames
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b35c
mov esi, 0x10087938
jmp 0x1002b506
push str.FID_SavedSearches
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b377
mov esi, 0x100878c8
jmp 0x1002b506
push str.FID_SendTo
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b392
mov esi, 0x10087568
jmp 0x1002b506
push str.FID_SidebarDefaultParts
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b3ad
mov esi, str.Tn9
jmp 0x1002b506
push str.FID_SidebarParts
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b3c8
mov esi, 0x100878f8
jmp 0x1002b506
push str.FID_StartMenu
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b3e3
mov esi, 0x10087548
jmp 0x1002b506
push str.FID_Startup
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b3fe
mov esi, 0x10087528
jmp 0x1002b506
push str.FID_System
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b419
mov esi, 0x10087688
jmp 0x1002b506
push str.FID_SystemX86
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b434
mov esi, 0x10087698
jmp 0x1002b506
push str.FID_Templates
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b44f
mov esi, 0x100875a8
jmp 0x1002b506
push str.FID_UserPinned
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b46a
mov esi, 0x100879e8
jmp 0x1002b506
push str.FID_UserProfiles
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b485
mov esi, 0x10087828
jmp 0x1002b506
push str.FID_UserProgramFiles
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b49d
mov esi, 0x10087738
jmp 0x1002b506
push str.FID_UserProgramFilesCommon
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b4b5
mov esi, 0x10087748
jmp 0x1002b506
push str.FID_Videos
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b4cd
mov esi, 0x10087788
jmp 0x1002b506
push str.FID_VideosLibrary
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b4e5
mov esi, 0x10087998
jmp 0x1002b506
push str.FID_Windows
push ebx
call fcn.1005b3f9
pop ecx
pop ecx
test eax, eax
jne 0x1002b6f7
mov dword [ebp - 0x1c], str._windir_
mov esi, 0x100876a8
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
pop ecx
mov edi, 0x10087a08
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x1002b6ac
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1002b6ac
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002b6a3
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0x7000
lea ecx, [ebp - 0x18]
push ecx
call eax
test eax, eax
jne 0x1002b599
mov eax, dword [ebp - 0x28]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1002b567
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x1002b58b
push dword [ebp - 0x28]
push eax
push dword [ebp - 0x24]
call fcn.1005ab9a
add esp, 0xc
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1002b6a3
push 4
pop ecx
mov edi, 0x10087708
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002b5b3
mov dword [ebp - 0x2c], str.CommonW6432Dir
jmp 0x1002b5cf
push 4
pop ecx
mov edi, 0x100876f8
lea esi, [ebp - 0x18]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x1002b6a3
mov dword [ebp - 0x2c], str.ProgramW6432Dir
xor esi, esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push 0x20119
push esi
push esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002b695
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002b695
cmp dword [ebp - 0x20], esi
je 0x1002b695
test byte [ebp - 0x20], 1
jne 0x1002b695
add dword [ebp - 0x20], 2
push dword [ebp - 0x20]
call fcn.10059bd9
mov edi, eax
pop ecx
cmp edi, esi
je 0x1002b695
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push esi
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002b68e
cmp dword [ebp - 0x38], 1
jne 0x1002b68e
mov eax, dword [ebp - 0x20]
push esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
shr eax, 1
xor ecx, ecx
push edi
mov word [edi + eax*2 - 2], cx
call esi
mov ecx, 0x104
cmp eax, ecx
ja 0x1002b68c
push ecx
push dword [ebp - 0x24]
push edi
call esi
test eax, eax
jne 0x1002b68c
mov ecx, dword [ebp - 0x24]
mov word [ecx], ax
xor esi, esi
push edi
call fcn.1005a1d0
pop ecx
cmp dword [ebp - 0x30], esi
je 0x1002b6a3
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x24]
cmp word [eax], 0
jne 0x1002b6e4
cmp dword [ebp - 0x1c], 0
je 0x1002b6e4
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push dword [ebp - 0x1c]
call esi
mov ecx, 0x104
cmp eax, ecx
ja 0x1002b6e4
mov edi, dword [ebp - 0x24]
push ecx
push edi
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x1002b6e4
mov word [edi], ax
push ebx
call fcn.1005a1d0
mov eax, dword [ebp - 0x24]
cmp word [eax], 0
pop ecx
setne al
jmp 0x1002b6f9
xor al, al
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10059ccb
leave
ret