Function at 0x404020
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41ef6e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x264
mov eax, dword [0x42700c]
xor eax, ebp
mov dword [ebp - 0x24], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x160], 0xe24112bf
lea edx, [ecx + 1]
mov dword [ebp - 0x15c], 0x604e2550
xorps xmm0, xmm0
mov dword [ebp - 0x158], 0x1acadfc
mov dword [ebp - 0x154], 0x79a26981
mov dword [ebp - 0x80], 0xe24112bf
mov dword [ebp - 0x7c], 0x604e2550
mov dword [ebp - 0x78], 0x1acadfc
mov dword [ebp - 0x74], 0x79a26981
movaps xmm1, xmmword [ebp - 0x160]
pxor xmm1, xmmword [ebp - 0x80]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x13c], eax
movaps xmmword [ebp - 0x160], xmm1
movups xmmword [ebp - 0x98], xmm0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4040f0
sub ecx, edx
lea eax, [ebp - 0x160]
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.004035e0
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov edx, dword [eax + 0x18]
mov dword [ebp - 0x134], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 0x130], ecx
cmp ecx, edx
je 0x40419a
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x40419a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, edx
nop dword [eax + eax]
sub ecx, 4
dec edi
mov dword [ebp - 0x12c], ecx
mov esi, 0x811c9dc5
mov ecx, dword [ecx]
add ecx, edx
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x40418d
nop word [eax + eax]
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x404170
cmp esi, 0xbdcac9ce
je 0x40419e
mov ecx, dword [ebp - 0x12c]
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x404150
mov eax, dword [eax]
jmp 0x404120
mov eax, dword [ebp - 0x130]
mov edx, dword [ebp - 0x134]
push 0
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
mov dword [ebp - 0x60], 0xe24112bf
push 3
push 0
push 3
movzx eax, word [eax + edi*2]
mov dword [ebp - 0x5c], 0x604e2550
mov dword [ebp - 0x58], 0x1acadfc
mov dword [ebp - 0x54], 0x79a26981
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0xbe6f4ee3
add eax, edx
mov dword [ebp - 0x19c], 0x13374d00
mov dword [ebp - 0x198], 0x6dcdce95
mov dword [ebp - 0x194], 0xfcb1bc5
mov dword [ebp - 0x190], 0xa21c57dc
mov dword [ebp - 0x18c], 0x9af3f17e
mov dword [ebp - 0x188], 0x28370d8e
mov dword [ebp - 0x184], 0x1a988ef7
vmovdqu ymm0, ymmword [ebp - 0x1a0]
mov dword [ebp - 0x50], 0xa21c67b9
mov dword [ebp - 0x4c], 0x9af3f17e
mov dword [ebp - 0x48], 0x28370d8e
mov dword [ebp - 0x44], 0x1a988ef7
vpxor ymm0, ymm0, ymmword [ebp - 0x60]
push 0
vmovdqa ymmword [ebp - 0x1a0], ymm0
push ecx
vzeroupper
call eax
mov dword [ebp - 0x130], eax
xorps xmm0, xmm0
cmp eax, 0xffffffff
jne 0x4042b3
mov eax, dword [ebp - 0x144]
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
movups xmm0, xmmword [ebp - 0x98]
mov dword [eax + 0x14], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x88]
movq qword [eax + 0x10], xmm0
jmp 0x404c4d
mov eax, dword fs:[0x30]
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
movlpd qword [ebp - 0xb8], xmm0
mov dword [ebp - 0x64], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x138], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x12c], ecx
cmp ecx, esi
je 0x40435a
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x40435a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
nop
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x134], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x40434d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x404330
cmp esi, 0xb04cce94
je 0x40435e
mov ecx, dword [ebp - 0x134]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x404310
mov eax, dword [eax]
jmp 0x4042e3
mov eax, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x138]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x64]
push ecx
push 8
lea ecx, [ebp - 0xb8]
add eax, edx
push ecx
push 0xc
lea ecx, [ebp - 0x7c]
push ecx
push 0x2d1400
push dword [ebp - 0x130]
call eax
mov esi, dword [ebp - 0xb4]
push esi
mov dword [ebp - 0x13c], esi
call fcn.0041de85
add esp, 4
mov dword [ebp - 0x12c], eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword fs:[0x30]
add esp, 0xc
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx + 0xc]
mov esi, dword [ecx + 0x18]
mov dword [ebp - 0x140], esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov dword [ebp - 0x134], eax
cmp eax, esi
je 0x40444a
mov edi, dword [eax + 0x18]
test edi, edi
je 0x40444a
mov eax, dword [eax + 0x20]
lea eax, [eax + edi*4]
add eax, esi
nop
mov edx, dword [eax - 4]
sub eax, 4
add edx, esi
mov dword [ebp - 0x138], eax
dec edi
mov esi, 0x811c9dc5
mov al, byte [edx]
inc edx
test al, al
je 0x40443d
nop dword [eax + eax]
movsx eax, al
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0x1000193
mov al, byte [edx - 1]
test al, al
jne 0x404420
cmp esi, 0xb04cce94
je 0x40444e
mov eax, dword [ebp - 0x138]
mov esi, dword [ecx + 0x18]
test edi, edi
jne 0x404400
mov ecx, dword [ecx]
jmp 0x4043d3
mov eax, dword [ebp - 0x134]
mov edx, dword [ebp - 0x140]
push 0
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov edi, dword [ebp - 0x12c]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x64]
push ecx
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x7c]
add eax, edx
push edi
push 0xc
push ecx
push 0x2d1400
push dword [ebp - 0x130]
call eax
mov eax, dword [edi + 0x18]
test eax, eax
je 0x40452e
lea edx, [eax + edi]
mov dword [ebp - 0x1a8], 0
mov ecx, edx
mov dword [ebp - 0x1a4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1b8], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4044c4
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1b8]
call fcn.004035e0
lea eax, [ebp - 0x1b8]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x98]
call fcn.00403490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1a4]
cmp ecx, 0x10
jb 0x40452e
mov edx, dword [ebp - 0x1b8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404524
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404827
push ecx
push edx
call fcn.0041de77
add esp, 8
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4045ca
lea edx, [eax + edi]
mov dword [ebp - 0x1c0], 0
mov ecx, edx
mov dword [ebp - 0x1bc], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1d0], xmm0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404560
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1d0]
call fcn.004035e0
lea eax, [ebp - 0x1d0]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x98]
call fcn.00403490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1bc]
cmp ecx, 0x10
jb 0x4045ca
mov edx, dword [ebp - 0x1d0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4045c0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404827
push ecx
push edx
call fcn.0041de77
add esp, 8
mov eax, dword [edi + 0x10]
test eax, eax
je 0x40466a
lea edx, [edi + eax]
mov dword [ebp - 0x1d8], 0
mov ecx, edx
mov dword [ebp - 0x1d4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1e8], xmm0
lea esi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404600
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x1e8]
call fcn.004035e0
lea eax, [ebp - 0x1e8]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x98]
call fcn.00403490
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1d4]
cmp ecx, 0x10
jb 0x40466a
mov edx, dword [ebp - 0x1e8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404660
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404827
push ecx
push edx
call fcn.0041de77
add esp, 8
xor eax, eax
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
lea edi, [ebp - 0x3c]
mov dword [ebp - 0xa0], 0
mov dword [edi], eax
xorps xmm0, xmm0
mov eax, edi
mov dword [ebp - 0x9c], 0xf
movups xmmword [ebp - 0xb0], xmm0
mov byte [ebp - 0xb0], 0
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x38]
push 4
push eax
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x1f0], 0
movups xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0x1ec], 0
call fcn.004035e0
lea eax, [ebp - 0x200]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0xb0]
call fcn.00403490
mov edi, dword [ebp - 0x12c]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1ec]
cmp ecx, 0x10
jb 0x404733
mov edx, dword [ebp - 0x200]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404729
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404827
push ecx
push edx
call fcn.0041de77
add esp, 8
push 4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x208], 0
xorps xmm0, xmm0
mov dword [ebp - 0x204], 0
push eax
lea ecx, [ebp - 0x218]
movups xmmword [ebp - 0x218], xmm0
call fcn.004035e0
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xb0]
call fcn.00403490
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x204]
cmp ecx, 0x10
jb 0x4047b2
mov edx, dword [ebp - 0x218]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4047a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404827
push ecx
push edx
call fcn.0041de77
add esp, 8
push 4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x220], 0
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
push eax
lea ecx, [ebp - 0x230]
movups xmmword [ebp - 0x230], xmm0
call fcn.004035e0
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xb0]
call fcn.00403490
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x21c]
cmp ecx, 0x10
jb 0x404837
mov edx, dword [ebp - 0x230]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40482d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40482d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041de77
add esp, 8
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x264]
call fcn.00405300
push eax
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 8
call fcn.00403490
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x250]
cmp ecx, 0x10
jb 0x404899
mov edx, dword [ebp - 0x264]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40488f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40488f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041de77
add esp, 8
lea ecx, [ebp - 0x98]
call fcn.00403d60
push edi
call fcn.0041dbec
mov eax, dword fs:[0x30]
add esp, 4
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov esi, dword [eax + 0x18]
mov dword [ebp - 0x138], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 0x140], ecx
cmp ecx, esi
je 0x40493a
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x40493a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edi*4]
add ecx, esi
nop dword [eax + eax]
mov edx, dword [ecx - 4]
sub ecx, 4
add edx, esi
mov dword [ebp - 0x13c], ecx
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x40492d
nop dword [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x404910
cmp esi, 0xfaba0065
je 0x40493e
mov ecx, dword [ebp - 0x13c]
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x4048f0
mov eax, dword [eax]
jmp 0x4048c0
mov eax, dword [ebp - 0x140]
mov edx, dword [ebp - 0x138]
push dword [ebp - 0x130]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, edx
add eax, edx
movzx eax, word [eax + edi*2]
mov eax, dword [ecx + eax*4]
add eax, edx
call eax
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x178]
call fcn.00405300
mov byte [ebp - 4], 9
lea eax, [ebp - 0x178]
cmp dword [ebp - 0x164], 0x10
lea ecx, [ebp - 0x128]
push dword [ebp - 0x168]
cmovae eax, dword [ebp - 0x178]
push eax
mov byte [ebp - 0x128], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0x67452301
mov dword [ebp - 0xd8], 0xefcdab89
mov dword [ebp - 0xd4], 0x98badcfe
mov dword [ebp - 0xd0], 0x10325476
call fcn.00406410
cmp byte [ebp - 0x128], 0
jne 0x404adc
xor edx, edx
lea ecx, [ebp - 0xe3]
nop dword [eax]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0x2c], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0x2b], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0x2a], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0x29], al
add edx, 4
cmp edx, 8
jb 0x404a00
mov edx, dword [ebp - 0xe4]
mov ecx, 0x78
shr edx, 3
mov eax, 0x38
and edx, 0x3f
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
lea ecx, [ebp - 0x128]
push eax
push 0x427028
call fcn.00406410
push 8
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x128]
call fcn.00406410
xor edx, edx
lea ecx, [ebp - 0xdb]
nop word [eax + eax]
movzx eax, byte [ecx - 1]
lea ecx, [ecx + 4]
mov byte [ebp + edx - 0xcc], al
movzx eax, byte [ecx - 4]
mov byte [ebp + edx - 0xcb], al
movzx eax, byte [ecx - 3]
mov byte [ebp + edx - 0xca], al
movzx eax, byte [ecx - 2]
mov byte [ebp + edx - 0xc9], al
add edx, 4
cmp edx, 0x10
jb 0x404a80
push 0x40
lea eax, [ebp - 0x127]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov byte [ebp - 0x128], 1
add esp, 0xc
movq qword [ebp - 0xe4], xmm0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x128]
call fcn.004064c0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x164]
cmp ecx, 0x10
jb 0x404b2e
mov edx, dword [ebp - 0x178]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404b24
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404b24
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041de77
add esp, 8
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x164], 0xf
mov byte [ebp - 0x178], 0
mov esi, dword [ebp - 0x144]
lea eax, [ebp - 0x248]
push eax
mov edx, str.HWID:
mov byte [ebp - 4], 0xa
mov ecx, esi
call fcn.004056a0
mov ecx, dword [ebp - 0x234]
add esp, 4
cmp ecx, 0x10
jb 0x404ba3
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404b99
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c3b
push ecx
push edx
call fcn.0041de77
add esp, 8
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0xf
mov byte [ebp - 0x248], 0
cmp ecx, 0x10
jb 0x404bf4
mov edx, dword [ebp - 0xb0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404bea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404c3b
push ecx
push edx
call fcn.0041de77
add esp, 8
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0xf
mov byte [ebp - 0xb0], 0
cmp ecx, 0x10
jb 0x404c4b
mov edx, dword [ebp - 0x98]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x404c41
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404c41
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0041de77
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0041dbde
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4