Function at 0x4028c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get graphical window text

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rdi, [0x00422910]
mov qword [rsp + 0x68], 0
lea rbx, [rsp + 0xb0]
mov rsi, rcx
mov ecx, 0x10
call fcn.0041c890
lea r13, [rsp + 0x68]
xor r8d, r8d
lea rdx, [0x004028c0]
mov qword [rax], rdi
mov rcx, r13
mov qword [rax + 8], rdx
mov rdx, rbx
mov qword [rsp + 0xb0], rax
call fcn.00419960
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x402330
mov rax, qword [rcx]
call qword [rax + 8]
mov qword [rsp + 0x70], 0
mov ecx, 0x10
call fcn.0041c890
mov qword [rax], rdi
lea r12, [rsp + 0x70]
xor r8d, r8d
lea rdi, [0x00402150]
mov rcx, r12
mov qword [rsp + 0x78], rax
mov qword [rax + 8], rdi
lea rdx, [rsp + 0x78]
call fcn.00419960
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x40237b
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
mov ecx, 8
mov rdi, rbx
rep stosq qword [rdi], rax
lea rax, [0x0041f104]
mov qword [rsp + 0xc8], rsi
mov ecx, 0xf
mov qword [rsp + 0xf0], rax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
mov qword [rsp + 0xe0], rax
mov edx, 0x7f00
xor ecx, ecx
lea rax, [0x00401550]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0xd8], rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_RegisterClassA]
mov qword [rsp + 0x50], rsi
mov r9d, 0x10cf0000
xor ecx, ecx
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x58], 0
lea r8, str.Halo_2_Bounce_Tool
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x1b0
mov dword [rsp + 0x30], 0x1b0
mov dword [rsp + 0x28], 0x96
mov dword [rsp + 0x20], 0x96
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rbx, [rsp + 0x80]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
mov rdi, qword [sym.imp.USER32.dll_TranslateMessage]
mov rbp, qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40246a
mov rcx, rbx
call rdi
mov rcx, rbx
call rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x402460
mov rcx, r13
call fcn.00419a20
mov rcx, r12
call fcn.00419a20
cmp qword [rsp + 0x70], 0
mov rax, qword [rsp + 0x90]
jne 0x4024bb
cmp qword [rsp + 0x68], 0
jne 0x4024bb
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [rsp + 0x68], 0
je 0x402500
call fcn.0041c530
cmp qword [rsp + 0x70], 0
je 0x4024b3
jmp 0x4024bb
mov rcx, rax
call fcn.0040e1a0
nop
nop dword [rax]
push r15
mov eax, 0x21a8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0040ddb0
sub rsp, rax
mov r8d, ecx
mov qword [rsp + 0x21f8], rdx
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov r12, rax
je 0x402760
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0x44]
mov r8d, 0x2000
mov rcx, rax
lea r14, [rsp + 0x1a0]
mov rdx, r14
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x402741
test dword [rsp + 0x44], 0xfffffff8
je 0x402741
lea rax, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
lea rbp, [rsp + 0x90]
mov qword [rsp + 0x30], rax
jmp 0x4025c5
mov eax, dword [rsp + 0x44]
add rbx, 1
shr rax, 3
cmp rax, rbx
jbe 0x402741
mov rdx, qword [r14 + rbx*8]
mov r9d, 0x104
mov r8, rbp
mov rcx, r12
movsxd r15, ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
test eax, eax
je 0x4025b0
mov rax, qword [rsp + 0x30]
mov r8, rbp
mov qword [rsp + 0x50], rax
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4025ee
mov edx, eax
mov rcx, qword [rsp + 0x38]
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov edi, eax
cmove r8, rdx
add dil, al
mov rdx, rbp
sbb r8, 3
xor r9d, r9d
call fcn.00419f70
mov r13, qword [rsp + 0x58]
test r13, r13
je 0x402764
mov rdi, qword [rsp + 0x50]
lea rsi, [r13 - 1]
nop dword [rax + rax]
movsx edx, byte [rdi + rsi]
mov r8d, 2
lea rcx, [0x0041f14a]
call sub.msvcrt.dll_memchr
test rax, rax
jne 0x4027b0
sub rsi, 1
cmp rsi, 0xffffffffffffffff
jne 0x402650
mov rdx, rdi
lea rsi, [rsp + 0x70]
xor r9d, r9d
lea rax, [rsi + 0x10]
mov rcx, rsi
lea r8, [rdi + r13]
mov qword [rsp + 0x70], rax
call fcn.00419f70
mov rax, qword [rsp + 0x70]
lea rdx, [rsi + 0x10]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x78]
cmp rax, rdx
je 0x4027e1
cmp rdi, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x80]
je 0x4027c4
test rdi, rdi
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rdx
je 0x4027d3
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x78], 0
add rsi, 0x10
mov byte [rdi], 0
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x402711
call fcn.0041c870
mov rax, qword [rsp + 0x21f8]
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
cmp qword [rax + 8], r8
je 0x402770
cmp rsi, qword [rsp + 0x30]
je 0x4025b0
mov rcx, rsi
call fcn.0041c870
jmp 0x4025b0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x21a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x40274c
mov rdi, qword [rsp + 0x50]
jmp 0x402679
test r8, r8
je 0x402784
mov rdx, qword [rax]
mov rcx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x402729
mov rdx, qword [rsp + 0x38]
mov eax, dword [rsp + r15*8 + 0x1a0]
add rdx, 0x10
cmp rsi, rdx
je 0x40274c
mov rcx, rsi
mov dword [rsp + 0x30], eax
call fcn.0041c870
mov eax, dword [rsp + 0x30]
jmp 0x40274c
lea edx, [rsi + 1]
cmp rdx, r13
ja 0x402877
add rdx, rdi
jmp 0x40267c
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rdx
lea rdi, [rsi + 0x10]
mov qword [rsp + 0x70], rdi
jmp 0x4026f2
cmp rdi, qword [rsp + 0x30]
je 0x402864
mov rdx, qword [rsp + 0x60]
cmp r13, rdx
ja 0x402830
test r13, r13
je 0x402812
cmp r13, 1
mov rdx, qword [rsp + 0x70]
je 0x40286b
mov rcx, rdi
mov r8, r13
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x58], r13
mov byte [rdi + r13], 0
mov rdi, qword [rsp + 0x70]
jmp 0x4026f2
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], r13
call fcn.00401e20
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x30]
mov rdi, rax
je 0x402853
call fcn.0041c870
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rax
jmp 0x4027f2
mov edx, 0xf
jmp 0x4027ed
movzx eax, byte [rdx]
mov byte [rdi], al
mov rdi, qword [rsp + 0x50]
jmp 0x402812
lea rcx, [0x0041f168]
mov r8, rdx
mov r9, r13
lea rdx, [0x0041f14d]
call fcn.0041c490
mov rdx, qword [rsp + 0x38]
mov rbx, rax
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
cmp rcx, rdx
je 0x4028ab
call fcn.0041c870
mov rcx, rbx
call fcn.0040e1a0
nop
nop
nop word cs:[rax + rax]
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r12, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [sym.imp.USER32.dll_MessageBoxA]
lea rsi, [rsp + 0x40]
jmp 0x402be8
cmp byte [0x00429066], 0
je 0x402990
mov edx, dword [0x0041e01c]
mov byte [0x00429066], 0
add rdx, 4
cmp byte [0x00429067], 0
je 0x4030b0
mov r9d, 0x1e
mov rcx, rbx
mov dword [rsp + 0x3c], 0x1e
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], 0x3d088889
lea r8, str.Tickrate_30
mov qword [rsp + 0x20], 0
call rdi
mov edx, dword [0x0041e068]
mov r9d, 4
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x3c]
call rdi
mov edx, dword [0x0041e060]
mov r8, rsi
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov r9d, 4
call rdi
mov byte [0x00429058], 1
cmp byte [0x00429062], 0
jne 0x402f80
cmp byte [0x00429061], 0
je 0x402a17
mov edx, dword [0x0042904c]
mov byte [0x00429061], 0
mov r9d, 1
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e050]
add rdx, rax
cmp byte [0x00429064], 0
je 0x403105
lea r8, [0x0041f20f]
mov rcx, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rdi
mov edx, dword [0x0041e01c]
mov r9d, 0x32
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, str.Knockback_physics_ON
add rdx, 4
call rdi
mov byte [0x00429058], 1
cmp byte [0x00429060], 0
je 0x402ac9
mov edx, dword [0x0041e01c]
mov byte [0x00429060], 0
add rdx, 4
cmp byte [0x00429063], 0
je 0x403142
mov r9d, 0x1e
mov rcx, rbx
mov dword [rsp + 0x3c], 0x40800000
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], 0x41200000
lea r8, str.Warpfix_ON
mov qword [rsp + 0x20], 0
call rdi
mov edx, dword [0x0042904c]
mov r9d, 4
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e040]
lea r8, [rsp + 0x3c]
add rdx, rax
call rdi
mov edx, dword [0x0042904c]
mov r8, rsi
mov rcx, rbx
mov eax, dword [0x0041e03c]
mov r9d, 4
mov qword [rsp + 0x20], 0
add rdx, rax
call rdi
mov byte [0x00429058], 1
cmp byte [0x0042905c], 0
jne 0x402f10
cmp byte [0x0042905b], 0
jne 0x402df0
cmp byte [0x0042905f], 0
jne 0x402e32
cmp byte [0x00429059], 0
je 0x402b3e
cmp byte [0x0042905a], 1
mov r8, rsi
mov rcx, rbx
mov byte [0x00429059], 0
mov edx, dword [0x0042904c]
mov r9d, 2
mov qword [rsp + 0x20], 0
sbb eax, eax
and eax, 0x1e
add eax, 0x1e
mov word [rsp + 0x40], ax
mov eax, dword [0x0041e020]
add rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x00429056], 0
je 0x402b89
mov edx, dword [0x0042904c]
mov byte [0x00429056], 0
mov r9d, 2
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e018]
add rdx, rax
cmp byte [0x00429057], 0
je 0x403040
lea r8, [0x0041f323]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x00429054], 0
je 0x402bcb
cmp byte [0x00429055], 0
mov byte [0x00429054], 0
mov r9d, 1
mov qword [rsp + 0x20], 0
mov edx, dword [0x0041e014]
je 0x4030f0
lea r8, [0x0041f2c7]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x00429058], 0
jne 0x402fc0
mov rcx, rbx
call rbp
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x0042906b], 0
je 0x402bdd
lea rcx, str.halo2.exe
mov byte [0x0042906b], 0
call fcn.00401e90
lea r8, [0x0041f1a8]
mov rcx, rsi
xor r9d, r9d
mov dword [0x00429050], eax
lea rdx, [r8 - 9]
lea rax, [rsi + 0x10]
mov qword [rsp + 0x40], rax
call fcn.00419f70
mov ecx, dword [0x00429050]
mov rdx, rsi
call 0x402510
mov rcx, qword [rsp + 0x40]
mov dword [0x0042904c], eax
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x402c50
call fcn.0041c870
xor edx, edx
mov r8d, dword [0x00429050]
mov ecx, 0x1f0fff
call r12
test rax, rax
mov rbx, rax
je 0x403180
cmp byte [0x00429069], 0
je 0x402d1a
cmp byte [0x0042906a], 0
mov byte [0x00429069], 0
je 0x403055
mov r9d, 0x1000
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0xb
mov rcx, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [0x0041f1a9]
mov rdx, rax
mov qword [rsp + 0x20], 0
call rdi
mov r9d, 8
mov edx, 0x30002a2a
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f1b5]
call rdi
mov edx, dword [0x0042904c]
mov r9d, 1
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f1be]
add rdx, 0x7c11c
call rdi
cmp byte [0x00429068], 0
je 0x4028f0
mov rdx, rsi
mov r8d, 6
mov rcx, qword [0x00429040]
mov byte [0x00429068], 0
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rsi
call sub.msvcrt.dll_atof
mov eax, dword [0x0042904c]
lea r8, [rsp + 0x3c]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov r9d, 4
pxor xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rsp + 0x38], xmm1
lea edx, [rax + 0x479e70]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov rcx, rbx
mov r9d, 4
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], 0
lea edx, [rax + 0xe25228]
mov dword [rsp + 0x3c], edx
call rdi
mov edx, 0x32
mov ecx, 0x20
call fcn.00402070
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [rsp + 0x3c]
mov r9d, 4
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041e010]
call rdi
jmp 0x4028f0
mov edx, dword [0x0042904c]
mov byte [0x0042905b], 0
mov rcx, rbx
mov r9d, 1
mov eax, dword [0x0041e024]
lea r8, [0x0041f2c7]
mov qword [rsp + 0x20], 0
add rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [0x0042905f], 0
je 0x402af0
lea r8, [0x0041f2f8]
mov rcx, rsi
xor r9d, r9d
mov byte [0x0042905f], 0
lea rax, [rsi + 0x10]
lea rdx, [r8 - 9]
mov qword [rsp + 0x40], rax
call fcn.00419f70
mov ecx, dword [0x00429050]
mov rdx, rsi
call 0x402510
mov rcx, qword [rsp + 0x40]
mov edi, eax
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x402e7b
call fcn.0041c870
mov edx, dword [0x0041e034]
mov r9d, 5
mov qword [rsp + 0x20], 0
mov eax, dword [0x0042904c]
add rdx, rax
cmp byte [0x0042905e], 0
je 0x4031a0
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [0x0041f2f9]
call r14
mov edx, dword [0x0042904c]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e030]
mov r9d, 7
lea r8, [0x0041f2ff]
add rdx, rax
call r14
mov edx, dword [0x0041e02c]
mov r9d, 6
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f307]
add rdx, rdi
call r14
jmp 0x402af0
mov edx, dword [0x0042904c]
mov r9d, 1
mov rcx, rbx
mov byte [0x0042905c], 0
mov eax, dword [0x0041e028]
lea r8, [0x0041f2c7]
mov qword [rsp + 0x20], 0
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rdx, rax
call rdi
mov edx, dword [0x0041e01c]
mov r9d, 0x1e
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, str.Saved_state
add rdx, 4
call rdi
mov byte [0x00429058], 1
jmp 0x402ad6
mov edx, dword [0x0042904c]
mov r9d, 1
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e054]
lea r8, [0x00429065]
mov byte [0x00429062], 0
add rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x40299d
mov r8, rsi
mov rcx, rbx
mov edx, dword [0x0041e05c]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov byte [0x00429058], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8, rsi
mov rcx, rbx
mov edx, dword [0x0041e01c]
mov qword [rsp + 0x20], 0
mov r9d, 4
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rdi
mov edx, dword [0x0041e01c]
mov r9d, 4
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f329]
sub rdx, 0xffffffffffffff80
call rdi
jmp 0x402bd8
lea r8, [0x0041f326]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402b89
mov edx, dword [0x0042904c]
mov r9d, 1
mov rcx, rax
mov qword [rsp + 0x20], 0
lea r8, [0x0041f1c0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rdx, 0x7c11c
call rdi
mov r9d, 8
mov edx, 0x30002a2a
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f1c2]
call rdi
jmp 0x402d1a
mov r9d, 0x1e
mov rcx, rbx
mov dword [rsp + 0x3c], 0x3c
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], 0x3c888889
lea r8, str.Tickrate_60
mov qword [rsp + 0x20], 0
call rdi
jmp 0x40294d
lea r8, [0x0041f086]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402bcb
mov rcx, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [0x0041f086]
call rdi
mov edx, dword [0x0041e01c]
mov r9d, 0x32
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, str.Knockback_physics_OFF
add rdx, 4
call rdi
jmp 0x402a10
mov r9d, 0x1e
mov rcx, rbx
mov dword [rsp + 0x3c], 0x40200000
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x40], 0x40f00000
lea r8, str.Warpfix_OFF
mov qword [rsp + 0x20], 0
call rdi
jmp 0x402a74
xor r9d, r9d
mov rcx, qword [0x00429040]
lea r8, section..rdata
lea rdx, str.Halo_2_not_found
call r13
jmp 0x402bd8
mov rcx, rbx
mov r14, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [0x0041f30e]
call r14
mov edx, dword [0x0042904c]
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov eax, dword [0x0041e030]
mov r9d, 7
lea r8, [0x0041f314]
add rdx, rax
call r14
mov edx, dword [0x0041e02c]
mov r9d, 6
mov rcx, rbx
mov qword [rsp + 0x20], 0
lea r8, [0x0041f31c]
add rdx, rdi
call r14
jmp 0x402af0
sub rsp, 0x28
call fcn.0040c9e0
mov rax, qword [0x00421e40]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x00421e30]
mov r8, qword [rax]
mov rax, qword [0x00421e20]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x4022c0