Function at 0x468850
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4dac5e
mov eax, dword fs:[0]
push eax
sub esp, 0x778
mov eax, dword [0x50c620]
xor eax, esp
mov dword [esp + 0x770], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50c620]
xor eax, esp
push eax
lea eax, [esp + 0x78c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x79c]
mov dword [esp + 0x94], 0
mov dword [esp + 0x9c], eax
mov dword [esp + 0x90], eax
xor eax, eax
mov dword [esp + 0x410], 0
mov dword [esp + 0x414], 0
mov dword [esp + 0x414], 7
mov dword [esp + 0x410], 0
mov word [esp + 0x400], ax
mov dword [esp + 0x794], 1
mov dword [esp + 0x5bc], 0x330032
mov dword [esp + 0x5c0], 0x350034
mov dword [esp + 0x5c4], 0x610053
mov dword [esp + 0x5c8], 0x650066
mov dword [esp + 0x5cc], 0x720054
mov dword [esp + 0x5d0], 0x790061
mov dword [esp + 0x5d4], 0x65002e
mov dword [esp + 0x5d8], 0x650078
mov word [esp + 0x5dc], ax
mov dword [esp + 0x5e0], 0x330032
mov dword [esp + 0x5e4], 0x350034
mov dword [esp + 0x5e8], 0x540052
mov dword [esp + 0x5ec], 0x720050
mov dword [esp + 0x5f0], 0x74006f
mov dword [esp + 0x5f4], 0x630065
mov dword [esp + 0x5f8], 0x2e0074
mov dword [esp + 0x5fc], 0x780065
mov dword [esp + 0x600], 0x65
mov dword [esp + 0x46c], 0x510051
mov dword [esp + 0x470], 0x430050
mov dword [esp + 0x474], 0x540052
mov dword [esp + 0x478], 0x2e0050
mov dword [esp + 0x47c], 0x780065
mov dword [esp + 0x480], 0x65
mov dword [esp + 0x504], 0x510051
mov dword [esp + 0x508], 0x430050
mov dword [esp + 0x50c], 0x720054
mov dword [esp + 0x510], 0x790061
mov dword [esp + 0x514], 0x65002e
mov dword [esp + 0x518], 0x650078
mov word [esp + 0x51c], ax
mov dword [esp + 0x42c], 0x360033
mov dword [esp + 0x430], 0x730030
mov dword [esp + 0x434], 0x2e0064
mov dword [esp + 0x438], 0x780065
mov dword [esp + 0x43c], 0x65
mov dword [esp + 0x418], 0x360033
mov dword [esp + 0x41c], 0x720030
mov dword [esp + 0x420], 0x2e0070
mov dword [esp + 0x424], 0x780065
mov dword [esp + 0x428], 0x65
mov dword [esp + 0x484], 0x360033
mov dword [esp + 0x488], 0x740030
mov dword [esp + 0x48c], 0x610072
mov dword [esp + 0x490], 0x2e0079
mov dword [esp + 0x494], 0x780065
mov dword [esp + 0x498], 0x65
mov dword [esp + 0x49c], 0x610042
mov dword [esp + 0x4a0], 0x640069
mov dword [esp + 0x4a4], 0x410075
mov dword [esp + 0x4a8], 0x2e006e
mov dword [esp + 0x4ac], 0x780065
mov dword [esp + 0x4b0], 0x65
mov dword [esp + 0x53c], 0x610042
mov dword [esp + 0x540], 0x640069
mov dword [esp + 0x544], 0x410075
mov dword [esp + 0x548], 0x53006e
mov dword [esp + 0x54c], 0x630076
mov dword [esp + 0x550], 0x65002e
mov dword [esp + 0x554], 0x650078
mov word [esp + 0x558], ax
mov dword [esp + 0x454], 0x610042
mov dword [esp + 0x458], 0x640069
mov dword [esp + 0x45c], 0x530075
mov dword [esp + 0x460], 0x2e0064
mov dword [esp + 0x464], 0x780065
mov dword [esp + 0x468], 0x65
mov dword [esp + 0x59c], 0x610042
mov dword [esp + 0x5a0], 0x640069
mov dword [esp + 0x5a4], 0x530075
mov dword [esp + 0x5a8], 0x540064
mov dword [esp + 0x5ac], 0x610072
mov dword [esp + 0x5b0], 0x2e0079
mov dword [esp + 0x5b4], 0x780065
mov dword [esp + 0x5b8], 0x65
mov dword [esp + 0x4cc], 0x78006b
mov dword [esp + 0x4d0], 0x730065
mov dword [esp + 0x4d4], 0x6f0063
mov dword [esp + 0x4d8], 0x650072
mov dword [esp + 0x4dc], 0x65002e
mov dword [esp + 0x4e0], 0x650078
mov word [esp + 0x4e4], ax
mov dword [esp + 0x4b4], 0x78006b
mov dword [esp + 0x4b8], 0x740065
mov dword [esp + 0x4bc], 0x610072
mov dword [esp + 0x4c0], 0x2e0079
mov dword [esp + 0x4c4], 0x780065
mov dword [esp + 0x4c8], 0x65
mov dword [esp + 0x440], 0x53004b
mov dword [esp + 0x444], 0x660061
mov dword [esp + 0x448], 0x2e0065
mov dword [esp + 0x44c], 0x780065
mov dword [esp + 0x450], 0x65
mov dword [esp + 0x520], 0x53004b
mov dword [esp + 0x524], 0x660061
mov dword [esp + 0x528], 0x540065
mov dword [esp + 0x52c], 0x610072
mov dword [esp + 0x530], 0x2e0079
mov dword [esp + 0x534], 0x780065
mov dword [esp + 0x538], 0x65
mov dword [esp + 0x4e8], 0x690048
mov dword [esp + 0x4ec], 0x730070
mov dword [esp + 0x4f0], 0x720054
mov dword [esp + 0x4f4], 0x790061
mov dword [esp + 0x4f8], 0x65002e
mov dword [esp + 0x4fc], 0x650078
mov word [esp + 0x500], ax
mov dword [esp + 0x690], 0x510051
mov dword [esp + 0x694], 0x720042
mov dword [esp + 0x698], 0x77006f
mov dword [esp + 0x69c], 0x650073
mov dword [esp + 0x6a0], 0x2e0072
mov dword [esp + 0x6a4], 0x780065
mov dword [esp + 0x6a8], 0x65
mov dword [esp + 0x6ac], 0x730054
mov dword [esp + 0x6b0], 0x650053
mov dword [esp + 0x6b4], 0x760072
mov dword [esp + 0x6b8], 0x630069
mov dword [esp + 0x6bc], 0x2e0065
mov dword [esp + 0x6c0], 0x780065
mov dword [esp + 0x6c4], 0x65
mov dword [esp + 0x6e8], 0x330032
mov dword [esp + 0x6ec], 0x350034
mov dword [esp + 0x6f0], 0x780045
mov dword [esp + 0x6f4], 0x6c0070
mov dword [esp + 0x6f8], 0x72006f
mov dword [esp + 0x6fc], 0x720065
mov dword [esp + 0x700], 0x65002e
mov dword [esp + 0x704], 0x650078
mov word [esp + 0x708], ax
mov dword [esp + 0x648], 0x360033
mov dword [esp + 0x64c], 0x730030
mov dword [esp + 0x650], 0x2e0065
mov dword [esp + 0x654], 0x780065
mov dword [esp + 0x658], 0x65
mov dword [esp + 0x70c], 0x6f0053
mov dword [esp + 0x710], 0x6f0067
mov dword [esp + 0x714], 0x450075
mov dword [esp + 0x718], 0x700078
mov dword [esp + 0x71c], 0x6f006c
mov dword [esp + 0x720], 0x650072
mov dword [esp + 0x724], 0x2e0072
mov dword [esp + 0x728], 0x780065
mov dword [esp + 0x72c], 0x65
mov dword [esp + 0x65c], 0x680063
mov dword [esp + 0x660], 0x6f0072
mov dword [esp + 0x664], 0x65006d
mov dword [esp + 0x668], 0x65002e
mov dword [esp + 0x66c], 0x650078
mov word [esp + 0x670], ax
xorps xmm0, xmm0
mov dword [esp + 0x3f4], eax
movq qword [esp + 0x3ec], xmm0
mov dword [esp + 0x614], 0x720050
mov dword [esp + 0x618], 0x74006f
mov dword [esp + 0x61c], 0x630065
mov dword [esp + 0x620], 0x5f0074
mov dword [esp + 0x624], 0x330032
mov dword [esp + 0x628], 0x350034
mov dword [esp + 0x62c], 0x780045
mov dword [esp + 0x630], 0x6c0070
mov dword [esp + 0x634], 0x72006f
mov dword [esp + 0x638], 0x720065
mov dword [esp + 0x63c], 0x65002e
mov dword [esp + 0x640], 0x650078
mov word [esp + 0x644], ax
mov dword [esp + 0x754], 0x680053
mov dword [esp + 0x758], 0x650069
mov dword [esp + 0x75c], 0x64006c
mov dword [esp + 0x760], 0x32005f
mov dword [esp + 0x764], 0x340033
mov dword [esp + 0x768], 0x450035
mov dword [esp + 0x76c], 0x700078
mov dword [esp + 0x770], 0x6f006c
mov dword [esp + 0x774], 0x650072
mov dword [esp + 0x778], 0x2e0072
mov dword [esp + 0x77c], 0x780065
mov dword [esp + 0x780], 0x65
mov dword [esp + 0x57c], 0x330032
mov dword [esp + 0x580], 0x350034
mov dword [esp + 0x584], 0x610053
mov dword [esp + 0x588], 0x650066
mov dword [esp + 0x58c], 0x760053
mov dword [esp + 0x590], 0x2e0063
mov dword [esp + 0x594], 0x780065
mov dword [esp + 0x598], 0x65
mov dword [esp + 0x55c], 0x330032
mov dword [esp + 0x560], 0x350034
mov dword [esp + 0x564], 0x6f0053
mov dword [esp + 0x568], 0x740066
mov dword [esp + 0x56c], 0x760053
mov dword [esp + 0x570], 0x2e0063
mov dword [esp + 0x574], 0x780065
mov dword [esp + 0x578], 0x65
mov dword [esp + 0x730], 0x330032
mov dword [esp + 0x734], 0x350034
mov dword [esp + 0x738], 0x690050
mov dword [esp + 0x73c], 0x79006e
mov dword [esp + 0x740], 0x6e0069
mov dword [esp + 0x744], 0x760053
mov dword [esp + 0x748], 0x2e0063
mov dword [esp + 0x74c], 0x780065
mov dword [esp + 0x750], 0x65
mov dword [esp + 0x6c8], 0x6f0053
mov dword [esp + 0x6cc], 0x6f0067
mov dword [esp + 0x6d0], 0x430075
mov dword [esp + 0x6d4], 0x6f006c
mov dword [esp + 0x6d8], 0x640075
mov dword [esp + 0x6dc], 0x65002e
mov dword [esp + 0x6e0], 0x650078
mov word [esp + 0x6e4], ax
mov dword [esp + 0x674], 0x6f0053
mov dword [esp + 0x678], 0x6f0067
mov dword [esp + 0x67c], 0x530075
mov dword [esp + 0x680], 0x630076
mov dword [esp + 0x684], 0x65002e
mov dword [esp + 0x688], 0x650078
mov word [esp + 0x68c], ax
mov dword [esp + 0x604], 0x710071
mov dword [esp + 0x608], 0x65002e
mov dword [esp + 0x60c], 0x650078
mov word [esp + 0x610], ax
mov dword [esp + 0x3ec], eax
mov dword [esp + 0x3f0], eax
mov dword [esp + 0x3f4], eax
mov byte [esp + 0x794], 2
mov dword [esp + 0x74], eax
mov dword [esp + 0x5c], 1
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], eax
mov word [esp + 0x60], ax
cmp word [esp + 0x5bc], ax
jne 0x469293
xor ecx, ecx
jmp 0x4692af
lea ecx, [esp + 0x5bc]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4692a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x5c0]
push eax
lea ecx, [esp + 0x68]
call fcn.00402ad0
mov byte [esp + 0x794], 3
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], 0
mov word [esp + 0x78], ax
cmp word [esp + 0x5e0], ax
jne 0x46930a
xor ecx, ecx
jmp 0x469323
lea ecx, [esp + 0x5e0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469314
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x5e4]
push eax
lea ecx, [esp + 0x80]
call fcn.00402ad0
mov byte [esp + 0x794], 4
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 2
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x46c], ax
jne 0x46939f
xor ecx, ecx
jmp 0x4693bf
lea ecx, [esp + 0x46c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4693b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x470]
push eax
lea ecx, [esp + 0x34]
call fcn.00402ad0
mov byte [esp + 0x794], 5
xor eax, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
cmp word [esp + 0x504], ax
jne 0x46940e
xor ecx, ecx
jmp 0x46942f
lea ecx, [esp + 0x504]
lea edx, [ecx + 2]
jmp 0x469420
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469420
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x508]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402ad0
mov byte [esp + 0x794], 6
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x5c], 3
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
cmp word [esp + 0x484], ax
jne 0x4694a8
xor ecx, ecx
jmp 0x4694c1
lea ecx, [esp + 0x484]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4694b2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x488]
push eax
lea ecx, [esp + 0x68]
call fcn.00402ad0
mov byte [esp + 0x794], 7
xor eax, eax
push eax
mov dword [esp + 0x8c], 0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x90], 0
push 0x4ecf30
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], 0
mov word [esp + 0x80], ax
call fcn.00402ad0
mov byte [esp + 0x794], 8
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 4
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x42c], ax
jne 0x469587
xor ecx, ecx
jmp 0x4695a0
lea ecx, [esp + 0x42c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469591
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x430]
push eax
lea ecx, [esp + 0x34]
call fcn.00402ad0
mov byte [esp + 0x794], 9
xor eax, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
cmp word [esp + 0x418], ax
jne 0x4695ef
xor ecx, ecx
jmp 0x46960f
lea ecx, [esp + 0x418]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469600
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x41c]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402ad0
mov byte [esp + 0x794], 0xa
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x5c], 5
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
cmp word [esp + 0x4cc], ax
jne 0x469688
xor ecx, ecx
jmp 0x4696a1
lea ecx, [esp + 0x4cc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469692
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x4d0]
push eax
lea ecx, [esp + 0x68]
call fcn.00402ad0
mov byte [esp + 0x794], 0xb
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], 0
mov word [esp + 0x78], ax
cmp word [esp + 0x4b4], ax
jne 0x4696fc
xor ecx, ecx
jmp 0x469715
lea ecx, [esp + 0x4b4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469706
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x4b8]
push eax
lea ecx, [esp + 0x80]
call fcn.00402ad0
mov byte [esp + 0x794], 0xc
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 6
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x440], ax
jne 0x469791
xor ecx, ecx
jmp 0x4697af
lea ecx, [esp + 0x440]
lea edx, [ecx + 2]
jmp 0x4697a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4697a0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x444]
push eax
lea ecx, [esp + 0x34]
call fcn.00402ad0
mov byte [esp + 0x794], 0xd
xor eax, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
cmp word [esp + 0x520], ax
jne 0x4697fe
xor ecx, ecx
jmp 0x46981f
lea ecx, [esp + 0x520]
lea edx, [ecx + 2]
jmp 0x469810
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469810
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x524]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402ad0
mov byte [esp + 0x794], 0xe
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x5c], 7
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
cmp word [esp + 0x49c], ax
jne 0x469898
xor ecx, ecx
jmp 0x4698b1
lea ecx, [esp + 0x49c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4698a2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x4a0]
push eax
lea ecx, [esp + 0x68]
call fcn.00402ad0
mov byte [esp + 0x794], 0xf
xor eax, eax
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x8c], 7
mov dword [esp + 0x88], 0
mov word [esp + 0x78], ax
cmp word [esp + 0x53c], ax
jne 0x46990c
xor ecx, ecx
jmp 0x469925
lea ecx, [esp + 0x53c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469916
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x540]
push eax
lea ecx, [esp + 0x80]
call fcn.00402ad0
mov byte [esp + 0x794], 0x10
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 8
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x454], ax
jne 0x4699a1
xor ecx, ecx
jmp 0x4699bf
lea ecx, [esp + 0x454]
lea edx, [ecx + 2]
jmp 0x4699b0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4699b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x458]
push eax
lea ecx, [esp + 0x34]
call fcn.00402ad0
mov byte [esp + 0x794], 0x11
xor eax, eax
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], 0
mov word [esp + 0x44], ax
cmp word [esp + 0x59c], ax
jne 0x469a0e
xor ecx, ecx
jmp 0x469a2f
lea ecx, [esp + 0x59c]
lea edx, [ecx + 2]
jmp 0x469a20
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469a20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x5a0]
push eax
lea ecx, [esp + 0x4c]
call fcn.00402ad0
mov byte [esp + 0x794], 0x12
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x5c], 9
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], 0
mov word [esp + 0x60], ax
cmp word [esp + 0x4e8], ax
jne 0x469aa8
xor ecx, ecx
jmp 0x469ac1
lea ecx, [esp + 0x4e8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469ab2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x4ec]
push eax
lea ecx, [esp + 0x68]
call fcn.00402ad0
mov byte [esp + 0x794], 0x13
xor eax, eax
push eax
mov dword [esp + 0x8c], 0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x90], 0
push 0x4ecf30
mov dword [esp + 0x94], 7
mov dword [esp + 0x90], 0
mov word [esp + 0x80], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x14
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x3c], 0
push eax
mov dword [esp + 0x44], 0
lea ecx, [esp + 0x30]
push 0x4ecf30
mov dword [esp + 0x30], 0xa
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
mov word [esp + 0x34], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x15
xor eax, eax
push eax
mov dword [esp + 0x58], 0
lea ecx, [esp + 0x48]
mov dword [esp + 0x5c], 0
push 0x4ecf30
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], 0
mov word [esp + 0x4c], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x16
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0x124], 0
push eax
mov dword [esp + 0x12c], 0
lea ecx, [esp + 0x118]
push 0x4ecf30
mov dword [esp + 0x118], 0xb
mov dword [esp + 0x130], 7
mov dword [esp + 0x12c], 0
mov word [esp + 0x11c], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x17
xor eax, eax
push eax
mov dword [esp + 0x140], 0
lea ecx, [esp + 0x130]
mov dword [esp + 0x144], 0
push 0x4ecf30
mov dword [esp + 0x148], 7
mov dword [esp + 0x144], 0
mov word [esp + 0x134], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x18
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x110]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0xb4], 0
push eax
mov dword [esp + 0xbc], 0
lea ecx, [esp + 0xa8]
push 0x4ecf30
mov dword [esp + 0xa8], 0xc
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], 0
mov word [esp + 0xac], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x19
xor eax, eax
push eax
mov dword [esp + 0xd0], 0
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd4], 0
push 0x4ecf30
mov dword [esp + 0xd8], 7
mov dword [esp + 0xd4], 0
mov word [esp + 0xc4], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x1a
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0xa0]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xdc], 0xd
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], 0
mov word [esp + 0xe0], ax
cmp word [esp + 0x614], ax
jne 0x469de5
xor ecx, ecx
jmp 0x469dff
lea ecx, [esp + 0x614]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469df0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x618]
push eax
lea ecx, [esp + 0xe8]
call fcn.00402ad0
mov byte [esp + 0x794], 0x1b
xor eax, eax
push eax
mov dword [esp + 0x10c], 0
lea ecx, [esp + 0xfc]
mov dword [esp + 0x110], 0
push 0x4ecf30
mov dword [esp + 0x114], 7
mov dword [esp + 0x110], 0
mov word [esp + 0x100], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x1c
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0xdc]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xa0], 0xe
mov dword [esp + 0xb8], 7
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
cmp word [esp + 0x57c], ax
jne 0x469ee3
xor ecx, ecx
jmp 0x469eff
lea ecx, [esp + 0x57c]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469ef0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x580]
push eax
lea ecx, [esp + 0xac]
call fcn.00402ad0
mov byte [esp + 0x794], 0x1d
xor eax, eax
push eax
mov dword [esp + 0xd0], 0
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd4], 0
push 0x4ecf30
mov dword [esp + 0xd8], 7
mov dword [esp + 0xd4], 0
mov word [esp + 0xc4], ax
call fcn.00402ad0
mov byte [esp + 0x794], 0x1e
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0xa0]
call fcn.004687b0
xor eax, eax
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], 0
mov word [esp + 0xe0], ax
cmp word [esp + 0x55c], ax
jne 0x469fe3
xor ecx, ecx
jmp 0x469fff
lea ecx, [esp + 0x55c]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x469ff0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x560]
push eax
lea ecx, [esp + 0xe8]
call fcn.00402ad0
mov byte [esp + 0x794], 0x1f
lea ecx, [esp + 0xf8]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x20
lea eax, [esp + 0xdc]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0xdc]
call fcn.004687b0
lea eax, [esp + 0x730]
mov dword [esp + 0xa0], 0x10
push eax
lea ecx, [esp + 0xa8]
call fcn.00402470
mov byte [esp + 0x794], 0x21
lea ecx, [esp + 0xbc]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x22
lea eax, [esp + 0xa0]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0xa0]
call fcn.004687b0
lea eax, [esp + 0x6c8]
mov dword [esp + 0x110], 0x11
push eax
lea ecx, [esp + 0x118]
call fcn.00402470
mov byte [esp + 0x794], 0x23
lea ecx, [esp + 0x12c]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x24
lea eax, [esp + 0x110]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x110]
call fcn.004687b0
lea eax, [esp + 0x674]
mov dword [esp + 0x28], 0x12
push eax
lea ecx, [esp + 0x30]
call fcn.00402470
mov byte [esp + 0x794], 0x25
lea ecx, [esp + 0x44]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x26
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x28]
call fcn.004687b0
lea eax, [esp + 0x754]
mov dword [esp + 0x5c], 0x13
push eax
lea ecx, [esp + 0x64]
call fcn.00402470
mov byte [esp + 0x794], 0x27
lea ecx, [esp + 0x78]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x28
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x5c]
call fcn.004687b0
lea eax, [esp + 0x604]
mov dword [esp + 0x17c], 0x14
push eax
lea ecx, [esp + 0x184]
call fcn.00402470
mov byte [esp + 0x794], 0x29
lea ecx, [esp + 0x198]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x2a
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x17c]
call fcn.004687b0
lea eax, [esp + 0x6e8]
mov dword [esp + 0x1b0], 0x15
push eax
lea ecx, [esp + 0x1b8]
call fcn.00402470
mov byte [esp + 0x794], 0x2b
lea ecx, [esp + 0x1cc]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x2c
lea eax, [esp + 0x1b0]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x1b0]
call fcn.004687b0
lea eax, [esp + 0x690]
mov dword [esp + 0x218], 0x16
push eax
lea ecx, [esp + 0x220]
call fcn.00402470
mov byte [esp + 0x794], 0x2d
lea ecx, [esp + 0x234]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x2e
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x218]
call fcn.004687b0
lea eax, [esp + 0x70c]
mov dword [esp + 0x2e8], 0x17
push eax
lea ecx, [esp + 0x2f0]
call fcn.00402470
mov byte [esp + 0x794], 0x2f
lea ecx, [esp + 0x304]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x30
lea eax, [esp + 0x2e8]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x2e8]
call fcn.004687b0
lea eax, [esp + 0x65c]
mov dword [esp + 0x24c], 0x18
push eax
lea ecx, [esp + 0x254]
call fcn.00402470
mov byte [esp + 0x794], 0x31
lea ecx, [esp + 0x268]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x32
lea eax, [esp + 0x24c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x24c]
call fcn.004687b0
lea eax, [esp + 0x648]
mov dword [esp + 0x2b4], 0x19
push eax
lea ecx, [esp + 0x2bc]
call fcn.00402470
mov byte [esp + 0x794], 0x33
lea ecx, [esp + 0x2d0]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x34
lea eax, [esp + 0x2b4]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x2b4]
call fcn.004687b0
lea eax, [esp + 0x6ac]
mov dword [esp + 0x350], 0x1a
push eax
lea ecx, [esp + 0x358]
call fcn.00402470
mov byte [esp + 0x794], 0x35
lea ecx, [esp + 0x36c]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x36
lea eax, [esp + 0x350]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x350]
call fcn.004687b0
push str.iexplore.exe
lea ecx, [esp + 0x3c0]
mov dword [esp + 0x3bc], 0x1b
call fcn.00402470
mov byte [esp + 0x794], 0x37
lea ecx, [esp + 0x3d4]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x38
lea eax, [esp + 0x3b8]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x3b8]
call fcn.004687b0
push 0x4ecf30
lea ecx, [esp + 0x324]
mov dword [esp + 0x320], 0x1c
call fcn.00402470
mov byte [esp + 0x794], 0x39
lea ecx, [esp + 0x338]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x3a
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x31c]
call fcn.004687b0
push 0x4ecf30
lea ecx, [esp + 0x288]
mov dword [esp + 0x284], 0x1d
call fcn.00402470
mov byte [esp + 0x794], 0x3b
lea ecx, [esp + 0x29c]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x3c
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x280]
call fcn.004687b0
push 0x4ecf30
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x1e8], 0x1e
call fcn.00402470
mov byte [esp + 0x794], 0x3d
lea ecx, [esp + 0x200]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x3e
lea eax, [esp + 0x1e4]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x1e4]
call fcn.004687b0
push 0x4ecf30
lea ecx, [esp + 0x38c]
mov dword [esp + 0x388], 0x1f
call fcn.00402470
mov byte [esp + 0x794], 0x3f
lea ecx, [esp + 0x3a0]
push 0x4ecf30
call fcn.00402470
mov byte [esp + 0x794], 0x40
lea eax, [esp + 0x384]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x384]
call fcn.004687b0
push 0x4ecf30
lea ecx, [esp + 0x150]
mov dword [esp + 0x14c], 0x20
call fcn.00402470
mov byte [esp + 0x794], 0x41
push 0x4ecf30
lea ecx, [esp + 0x168]
call fcn.00402470
mov byte [esp + 0x794], 0x42
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0x3f0]
call fcn.0046e000
mov byte [esp + 0x794], 2
lea ecx, [esp + 0x148]
call fcn.004687b0
xorps xmm0, xmm0
mov dword [esp + 0x24], 0
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x794], 0x43
lea eax, [esp + 0x1c]
push eax
call fcn.0041b470
add esp, 4
xorps xmm0, xmm0
movq qword [esp + 0x3f8], xmm0
mov dword [esp + 0x3f8], 0
mov dword [esp + 0x3fc], 0
call fcn.0045be00
mov dword [esp + 0x3f8], eax
mov byte [esp + 0x794], 0x48
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub edi, eax
sar edi, 5
test edi, edi
je 0x46a7cb
mov esi, eax
lea esp, [esp]
mov ecx, esi
call fcn.00417190
movzx eax, byte [0x50f8ef]
push eax
push esi
push ecx
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x408]
call fcn.0045beb0
add esi, 0x20
dec edi
jne 0x46a7a0
mov ecx, dword [esp + 0x3f0]
mov eax, 0x4ec4ec4f
mov ebx, dword [esp + 0x3ec]
xor edi, edi
sub ecx, ebx
imul ecx
sar edx, 4
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov dword [esp + 0x98], ebp
je 0x46a820
lea esi, [ebx + 0x1c]
lea ebx, [ebx]
lea ecx, [esi - 0x18]
call fcn.00417190
mov ecx, esi
call fcn.00417190
inc edi
cmp dword [esi - 0x1c], edi
jne 0x46a8a0
add esi, 0x34
cmp edi, ebp
jb 0x46a800
mov eax, dword [esp + 0x410]
cmp eax, 0x20
jae 0x46a84f
lea esp, [esp]
push 1
push 0x4ecf34
lea ecx, [esp + 0x408]
call fcn.004060f0
mov eax, dword [esp + 0x410]
cmp eax, 0x20
jb 0x46a830
cmp ebp, eax
je 0x46a962
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x400]
push eax
mov ecx, edi
call fcn.00405650
mov dword [esp + 0x94], 1
mov byte [esp + 0x794], 0x4e
lea ecx, [esp + 0x3f8]
mov eax, dword [esp + 0x3f8]
push eax
push dword [eax]
lea eax, [esp + 0xa0]
push eax
call fcn.0045b200
jmp 0x46a8e7
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x400]
push eax
mov ecx, edi
call fcn.00405650
mov dword [esp + 0x94], 1
mov byte [esp + 0x794], 0x4a
lea ecx, [esp + 0x3f8]
mov eax, dword [esp + 0x3f8]
push eax
push dword [eax]
lea eax, [esp + 0xa0]
push eax
call fcn.0045b200
mov byte [esp + 0x794], 0x43
push dword [esp + 0x3f8]
call fcn.004b17b6
add esp, 4
mov byte [esp + 0x794], 2
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x46a946
push dword [esp + 0x90]
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esp + 0x28]
push eax
push esi
call fcn.004062a0
push esi
call fcn.004b17b6
add esp, 0x14
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x794], 1
test ebx, ebx
je 0x46ab44
push dword [esp + 0x90]
jmp 0x46ab0b
xor ebx, ebx
test ebp, ebp
je 0x46aa11
mov edi, dword [esp + 0x3ec]
add edi, 4
jmp 0x46a980
cmp dword [esp + 0x414], 8
lea eax, [esp + 0x400]
cmovae eax, dword [esp + 0x400]
cmp dword [edi + 0x10], 0
lea ebp, [eax + ebx*2]
je 0x46a9c0
mov esi, dword [esp + 0x3f8]
lea eax, [esp + 0x144]
push edi
push eax
lea ecx, [esp + 0x400]
call fcn.00434ca0
cmp dword [eax], esi
jne 0x46a9f0
cmp word [ebp], 0x31
je 0x46a9f9
cmp dword [edi + 0x28], 0
je 0x46a9f9
mov esi, dword [esp + 0x3f8]
lea eax, [edi + 0x18]
push eax
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x400]
call fcn.00434ca0
cmp dword [eax], esi
je 0x46a9f9
mov eax, 0x31
mov word [ebp], ax
inc ebx
add edi, 0x34
cmp ebx, dword [esp + 0x98]
jb 0x46a980
mov eax, dword [esp + 0x410]
cmp eax, 1
jbe 0x46aa4b
cmp dword [esp + 0x414], 8
lea esi, [esp + 0x400]
cmovae esi, dword [esp + 0x400]
cmp word [esi + 2], 0x31
jne 0x46aa4b
call fcn.0046b0b0
test al, al
mov eax, 0x32
jne 0x46aa47
mov eax, 0x33
mov word [esi + 2], ax
mov edi, dword [esp + 0x9c]
lea eax, [esp + 0x400]
push eax
mov ecx, edi
call fcn.00405650
mov dword [esp + 0x94], 1
mov byte [esp + 0x794], 0x52
lea ecx, [esp + 0x3f8]
mov eax, dword [esp + 0x3f8]
push eax
push dword [eax]
lea eax, [esp + 0xdc]
push eax
call fcn.0045b200
mov byte [esp + 0x794], 0x43
push dword [esp + 0x3f8]
call fcn.004b17b6
add esp, 4
mov byte [esp + 0x794], 2
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x46aaf1
push dword [esp + 0xd4]
lea eax, [esp + 0x1f]
push eax
mov eax, dword [esp + 0x28]
push eax
push esi
call fcn.004062a0
push esi
call fcn.004b17b6
add esp, 0x14
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov byte [esp + 0x794], 1
mov ebx, dword [esp + 0x3ec]
test ebx, ebx
je 0x46ab44
push dword [esp + 0xd4]
mov edx, dword [esp + 0x3f4]
push ecx
mov ecx, ebx
call fcn.0046e5b0
push ebx
call fcn.004b17b6
add esp, 0xc
mov dword [esp + 0x3ec], 0
mov dword [esp + 0x3f0], 0
mov dword [esp + 0x3f4], 0
mov byte [esp + 0x794], 0
cmp dword [esp + 0x414], 8
jb 0x46ab65
push dword [esp + 0x400]
call fcn.004b17b6
add esp, 4
xor eax, eax
mov dword [esp + 0x414], 7
mov dword [esp + 0x410], eax
mov word [esp + 0x400], ax
mov eax, edi
mov ecx, dword [esp + 0x78c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x770]
xor ecx, esp
call fcn.004b0ff2
add esp, 0x784
ret 4