Function at 0x4036e0
Capabilities:
Acquire debug privileges
Check os version
Enumerate gui resources
Get common file path
Get disk information
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43c65c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20fc
call fcn.00429100
mov eax, dword [0x44e6d0]
xor eax, esp
mov dword [esp + 0x20f8], eax
push ebx
push esi
push edi
mov eax, dword [0x44e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x2110]
mov dword fs:[0], eax
mov eax, dword [0x45ecb0]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x452950
push eax
push str.bFakeName
push 0x44fa30
mov dword [esp + 0x3c], ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x45ecb0], eax
test eax, eax
je 0x40376d
call ebx
push eax
call fcn.004253fe
add esp, 4
push 0
push 0x403460
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x45eca8], 0
mov dword [esp + 0x30], 0
jne 0x40379e
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45eca8], eax
test eax, eax
je 0x4037b0
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x45eca8]
mov edx, dword [esp + 0x30]
push 0x452950
push 0
push str.bFixedName
push 0x44fa30
mov dword [0x45ecac], edx
call esi
push 0x443dd8
push 0
mov dword [0x453950], eax
call fcn.004257f6
add esp, 8
push 0x1000
push 0x459a78
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x459a78
call fcn.00425bd7
add esp, 4
push 0x5c
push 0x459a78
call fcn.00425558
add esp, 8
test eax, eax
je 0x403818
xor ecx, ecx
mov word [eax], cx
call fcn.00402b30
xor eax, eax
nop
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x458a78], cx
add eax, 2
test cx, cx
jne 0x403820
mov edi, 0x458a78
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403840
mov edx, dword [0x443f70]
mov eax, 0x458a78
mov dword [edi], edx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403860
mov ecx, dword [str.modz]
mov dword [eax], ecx
mov ecx, dword [0x444384]
mov dword [eax + 4], ecx
mov cx, word [0x444388]
mov word [eax + 8], cx
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x457a78], cx
add eax, 2
test cx, cx
jne 0x403890
mov edi, 0x457a78
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4038b0
mov eax, 0x457a78
mov dword [edi], edx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4038c6
mov ecx, dword [str.uvsz]
mov dword [eax], ecx
mov ecx, dword [0x444390]
mov dword [eax + 4], ecx
mov cx, word [0x444394]
mov word [eax + 8], cx
xor eax, eax
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x455a78], cx
add eax, 2
test cx, cx
jne 0x4038f0
mov edi, 0x455a78
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403910
mov eax, 0x455a78
mov dword [edi], edx
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403926
mov edx, dword [str.usvc]
mov ecx, dword [0x44439c]
mov dword [eax], edx
mov dx, word [0x4443a0]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
call ebx
inc eax
push eax
call fcn.004253fe
add esp, 4
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x454a78], cx
add eax, 2
test cx, cx
jne 0x403960
mov edi, 0x454a78
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403980
mov eax, dword [0x443f70]
mov dword [edi], eax
xor eax, eax
jmp 0x4039a0
movzx ecx, word [eax + 0x454a78]
mov word [eax + 0x453a78], cx
add eax, 2
test cx, cx
jne 0x4039a0
cmp dword [0x453950], 0
je 0x4039d7
xor eax, eax
movzx ecx, word [eax + str.uvsstd]
mov word [esp + eax + 0x3c], cx
add eax, 2
test cx, cx
jne 0x4039c1
jmp 0x403a02
xor esi, esi
lea esp, [esp]
call fcn.00425410
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add edx, 0x61
cmp esi, 6
mov word [esp + esi*2 + 0x3a], dx
jl 0x4039e0
xor edx, edx
mov word [esp + 0x48], dx
lea eax, [esp + 0x3c]
mov edx, eax
jmp 0x403a10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a10
mov edi, 0x454a78
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403a25
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [0x453950], 0
rep movsb byte es:[edi], byte [esi]
je 0x403a66
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.uvssvc]
mov word [esp + eax + 0x3c], cx
add eax, 2
test cx, cx
jne 0x403a50
jmp 0x403a8a
xor esi, esi
call fcn.00425410
cdq
mov ecx, 0x1a
idiv ecx
inc esi
add edx, 0x61
cmp esi, 6
mov word [esp + esi*2 + 0x3a], dx
jl 0x403a68
xor edx, edx
mov word [esp + 0x48], dx
lea eax, [esp + 0x3c]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403a90
mov edi, 0x453a78
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403aa5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004031c0
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.004089e4
cmp dword [0x45ecb0], 0
mov ecx, esi
je 0x403ae3
push 0x45ecb8
jmp 0x403ae8
push 0x4443c4
call fcn.0040f7e3
mov edi, esi
mov eax, dword [edi + 0x20]
mov dword [0x45eca0], eax
call fcn.00403360
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
test bl, 1
je 0x403b1b
mov ecx, dword [edi + 0xec]
push 0
push 1
push 0xf1
push ecx
call esi
test bl, 2
je 0x403b32
mov edx, dword [edi + 0x98]
push 0
push 1
push 0xf1
push edx
call esi
test ebx, 0x100
je 0x403b4c
mov eax, dword [edi + 0x394]
push 0
push 1
push 0xf1
push eax
call esi
test ebx, 0x200
je 0x403b66
mov ecx, dword [edi + 0x3ec]
push 0
push 1
push 0xf1
push ecx
call esi
test bl, 0x10
je 0x403b72
push 0x41e
jmp 0x403b83
test bl, 0x20
je 0x403b7e
push 0x41f
jmp 0x403b83
push 0x41d
push 0x41f
push 0x41d
mov ecx, edi
call fcn.0040f6d4
lea edx, [esp + 0x18]
push edx
push 0x28
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403e25
lea eax, [esp + 0x10]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, 1
lea ebx, [edi + 1]
test eax, eax
je 0x403c08
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403c4a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeBackupPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403c8c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
lea eax, [esp + 0x10]
push eax
push str.SeSecurityPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403cce
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push str.SeTcbPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d10
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeImpersonatePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d52
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
lea eax, [esp + 0x10]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403d94
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call esi
lea edx, [esp + 0x10]
push edx
push 0x4444f0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403dd6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ebx
call esi
lea ecx, [esp + 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x403e18
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x28]
push 0
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ebx
call esi
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403e2f
mov ebx, 2
mov edi, 1
push 0x453958
mov dword [0x45eca4], edi
mov dword [0x453958], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x453a6c
push 0x453960
push 0x45395c
call fcn.00402ff0
add esp, 0xc
xor eax, eax
cmp dword [0x45395c], 6
jb 0x403ee0
lea esp, [esp]
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x456a78], cx
add eax, ebx
test cx, cx
jne 0x403e70
mov edi, 0x456a78
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403e90
mov ecx, dword [0x443f70]
mov eax, 0x456a78
mov dword [edi], ecx
add eax, 0xfffffffe
lea esp, [esp]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403eb0
mov edx, dword [str.uvsv]
mov ecx, dword [0x44454c]
mov dword [eax], edx
mov dx, word [0x444550]
mov dword [eax + 4], ecx
mov word [eax + 8], dx
jmp 0x403f48
movzx ecx, word [eax + 0x459a78]
mov word [eax + 0x456a78], cx
add eax, ebx
test cx, cx
jne 0x403ee0
mov edi, 0x456a78
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403f00
mov eax, dword [0x443f70]
mov dword [edi], eax
mov eax, 0x456a78
add eax, 0xfffffffe
jmp 0x403f20
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x403f20
mov ecx, dword [str.uvsz]
mov edx, dword [0x444390]
mov dword [eax], ecx
mov cx, word [0x444394]
mov dword [eax + 4], edx
mov word [eax + 8], cx
push 0x45ec90
mov edx, 0x454a78
mov ecx, 0x456a78
call fcn.00402960
add esp, 4
or ebx, 0xffffffff
test eax, eax
jne 0x403fdd
lea edx, [esp + 0x34]
push edx
mov edi, 0x302
call fcn.00402440
add esp, 4
mov esi, dword [esp + 0x2c]
push 0x10
mov dword [esp + 0x211c], 0
mov eax, dword [eax]
push 0x454a78
push eax
mov ecx, esi
call fcn.0040af69
mov dword [esp + 0x2118], ebx
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403fbe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x20]
push 0
push 2
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x45eca4], 0
jmp 0x403fe1
mov esi, dword [esp + 0x2c]
push 0x45ec94
mov edx, 0x453a78
mov ecx, 0x455a78
call fcn.00402960
add esp, 4
test eax, eax
jne 0x404070
lea edx, [esp + 0x34]
push edx
mov edi, 0x303
call fcn.00402440
add esp, 4
push 0x10
mov dword [esp + 0x211c], 1
mov eax, dword [eax]
push 0x453a78
push eax
mov ecx, esi
call fcn.0040af69
mov dword [esp + 0x2118], ebx
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x40404e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x20]
push 0
push 2
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [0x45eca4], 0
jmp 0x4043a6
cmp dword [0x45eca4], 0
je 0x4043a6
mov eax, dword [0x45395c]
cmp eax, 6
ja 0x404096
jne 0x404092
cmp dword [0x453960], 2
jae 0x404096
push 0
jmp 0x404098
push 1
lea ecx, [esi + 0x420]
mov dword [esp + 0x38], ecx
call fcn.0040f8c7
mov esi, dword [esp + 0x2c]
lea ebx, [esi + 0x174]
mov ecx, ebx
call fcn.0040f8ee
cmp dword [0x45aa80], 0
je 0x40412d
lea edx, [esp + 0x30]
push edx
mov edi, 0x304
call fcn.00402440
add esp, 4
mov dword [esp + 0x2118], 2
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.0040f7e3
mov dword [esp + 0x2118], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404113
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
lea ecx, [esi + 0x21c]
call fcn.0040f8c7
push 0
lea ecx, [esi + 0x31c]
call fcn.0040f8c7
push 0x800
lea ecx, [esp + 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x104]
xor edx, edx
push eax
mov word [esp + 0x10c], dx
call fcn.00425bd7
add esp, 4
lea ecx, [esp + 0x104]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [esp + 0x30], 1
cmp eax, 5
je 0x4041fc
cmp word [esp + 0x104], 0x58
je 0x4041fc
cmp dword [0x45395c], 6
jb 0x404196
call fcn.004033f0
test eax, eax
jne 0x4041a2
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x4041dd
push 0
lea ecx, [esi + 0x120]
call fcn.0040f8c7
mov ecx, ebx
call fcn.0040f8ee
mov edx, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push edx
mov dword [esp + 0x40], 2
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
jmp 0x404307
mov eax, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [esp + 0x2c]
jmp 0x404307
mov ecx, dword [esp + 0x34]
push 0
call fcn.0040f8c7
mov edi, dword [esp + 0x2c]
lea ecx, [edi + 0x1c8]
call fcn.0040f8ee
push 0
lea ecx, [edi + 0x120]
call fcn.0040f8c7
lea esi, [esp + 0x1104]
mov dword [esp + 0x30], 0
call fcn.00403630
test eax, eax
jle 0x4042ef
xor eax, eax
movzx ecx, word [esp + eax + 0x1104]
mov word [eax + 0x45dc90], cx
add eax, 2
test cx, cx
jne 0x404241
lea ecx, [esp + 0x38]
push ecx
mov edi, 0x30b
call fcn.00402440
add esp, 4
push 0x45dc90
lea ecx, [esp + 0x3c]
mov dword [esp + 0x211c], 3
call fcn.00406930
push 0x444554
lea ecx, [esp + 0x3c]
call fcn.00406930
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
push edx
lea ecx, [esi + 0x1c8]
call fcn.0040f7e3
mov eax, dword [esi + 0x20]
push 0
push 0x413
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, ebx
call fcn.0040f8ee
mov dword [esp + 0x2118], 0xffffffff
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404307
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x404307
mov ecx, dword [edi + 0x20]
push 0
push 0x416
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, edi
mov eax, dword [0x45dc88]
test eax, eax
jle 0x404315
cmp eax, 4
jne 0x404329
cmp dword [0x45dc8c], 0
je 0x40439a
cmp dword [esp + 0x30], 0
je 0x40439a
push 0
mov ecx, esi
call fcn.0040f885
cmp dword [0x45dc8c], 0
je 0x404368
cmp dword [0x45dc88], 0
jne 0x40434e
mov edx, dword [esp + 0x30]
mov dword [0x45dc88], edx
push 0x452950
push 0x444558
push 0x44455c
push 0x44fa30
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [0x45dc88]
cmp eax, 1
jne 0x40437b
mov ecx, esi
call fcn.00404480
jmp 0x404395
cmp eax, 2
jne 0x404389
mov ecx, esi
call fcn.00404a90
jmp 0x404395
cmp eax, 3
jne 0x40439a
mov ecx, esi
call fcn.00404eb0
mov eax, dword [0x45dc88]
cmp eax, 4
jne 0x4043a6
mov ecx, esi
call fcn.00405fd0
xor eax, eax
mov ecx, dword [esp + 0x2110]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20f8]
xor ecx, esp
call fcn.00425186
mov esp, ebp
pop ebp
ret