Function at 0x4032e0
Capabilities:
Create directory
Create process on windows
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x411f57
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x42ec
call fcn.004054c0
mov eax, dword [0x41788c]
xor eax, esp
mov dword [esp + 0x42e8], eax
push ebx
push esi
push edi
mov eax, dword [0x41788c]
xor eax, esp
push eax
lea eax, [esp + 0x4300]
mov dword fs:[0], eax
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x418f78], 1
jne 0x40333e
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
xor ebx, ebx
push 0x3000
lea eax, [esp + 0x12f8]
push ebx
push eax
mov dword [esp + 0x38], 0xa0d2c
mov dword [esp + 0x2c], ebx
call fcn.00405440
push 0x1000
lea ecx, [esp + 0x304]
push ebx
push ecx
call fcn.00405440
mov edx, dword [0x418b04]
add esp, 0x18
push ebx
push 2
push 0x80000000
push str.pub_1003b_Patch_Patch_List_index_list.txt
push edx
call dword [sym.imp.WININET.dll_FtpOpenFileA]
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x4033ae
push ebx
push str.Notice
push str.Cant_find_version_List_Index_file_at_Server.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404038
lea ecx, [esp + 0x24]
push ecx
push 0x1000
lea edx, [esp + 0x12fc]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x12fc]
push edx
call fcn.004054eb
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x4034a4
jmp 0x4033f0
mov eax, esi
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403410
sub eax, ecx
push eax
push esi
lea ecx, [esp + 0xd8]
call fcn.004025c0
mov eax, dword [0x418f94]
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0xd0]
push ecx
push edx
push eax
mov ecx, 0x418f80
mov dword [esp + 0x4314], ebx
call fcn.00403240
push 1
mov ecx, 0x418f80
mov esi, eax
call fcn.00402950
mov dword [edi], esi
mov eax, dword [esi + 4]
mov dword [eax], esi
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
call fcn.004054eb
add esp, 0xc
cmp dword [esp + 0xe8], 0x10
mov esi, eax
mov dword [esp + 0x4308], 0xffffffff
jb 0x40349c
mov edx, dword [esp + 0xd4]
push edx
call fcn.0040474e
add esp, 4
cmp esi, ebx
jne 0x4033f0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3000
lea ecx, [esp + 0x12f8]
push ebx
push ecx
call fcn.00405440
mov eax, dword [0x418f80]
mov edx, dword [0x418f94]
mov esi, dword [edx]
add esp, 0xc
cmp eax, ebx
jne 0x40351c
call fcn.0040518b
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4034e7
call fcn.0040518b
push 0xffffffffffffffff
lea eax, [esi + 8]
push ebx
push eax
mov ecx, 0x4177e4
call fcn.004024e0
mov edi, dword [0x418f80]
mov esi, dword [0x418f94]
mov dword [esp + 0x34], esi
cmp edi, ebx
jne 0x403511
call fcn.0040518b
mov esi, dword [esi + 4]
cmp edi, ebx
je 0x403520
mov eax, dword [edi]
jmp 0x403522
mov eax, dword [eax]
jmp 0x4034dd
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x40352c
call fcn.0040518b
cmp edi, ebx
jne 0x403669
call fcn.0040518b
xor edi, edi
cmp esi, dword [edi + 0x14]
jne 0x403545
call fcn.0040518b
push 0xffffffffffffffff
lea eax, [esi + 8]
push ebx
mov edi, 0xf
push eax
lea ecx, [esp + 0xc0]
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
call fcn.004024e0
mov eax, 0x418b20
mov dword [esp + 0x4308], 1
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
lea ecx, [eax + 1]
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4035a0
sub eax, ecx
push eax
push 0x418b20
lea ecx, [esp + 0xa0]
call fcn.004025c0
mov eax, dword [0x418f94]
mov ecx, dword [0x418f80]
mov edx, dword [eax]
lea esi, [esp + 0x98]
push esi
push eax
push ecx
push edx
push ecx
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0x4320], 2
call fcn.00402830
mov eax, dword [esp + 0x2c]
mov esi, dword [0x418f94]
add esp, 0x18
cmp eax, ebx
je 0x4035ff
cmp eax, dword [0x418f80]
je 0x403604
call fcn.0040518b
push ebx
cmp dword [esp + 0x1c], esi
jne 0x403670
push str.Notice
push str.Cant_find_Matched_version.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 0x10
cmp dword [esp + 0xb0], esi
jb 0x40363a
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.0040474e
add esp, 4
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
cmp dword [esp + 0xcc], esi
jb 0x404038
mov edx, dword [esp + 0xb8]
push edx
jmp 0x404030
mov edi, dword [edi]
jmp 0x40353b
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
call fcn.00401ee0
lea ecx, [esp + 0x14]
call fcn.00401eb0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
call fcn.004024e0
mov byte [esp + 0x4308], 3
mov eax, dword [esp + 0x80]
mov esi, 0x10
cmp dword [esp + 0x94], esi
jae 0x4036d0
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0xf0]
push str.pub_1003b_Patch_Patch_List_Patch__s.txt
push ecx
call fcn.004017b0
mov eax, dword [0x418b04]
add esp, 0xc
push ebx
push 2
push 0x80000000
lea edx, [esp + 0xf8]
push edx
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileA]
mov dword [esp + 0x1c], eax
cmp eax, ebx
je 0x403997
lea ecx, [esp + 0x24]
push ecx
push 0x1000
lea edx, [esp + 0x12fc]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
xor edi, edi
mov dword [esp + 0x28], edi
cmp dword [esp + 0x24], ebx
jbe 0x403872
mov ecx, dword [esp + 0x20]
jmp 0x403740
mov al, byte [esp + edi + 0x12f4]
cmp al, 0xd
je 0x40375c
cmp al, 0xa
je 0x40375c
mov byte [esp + ecx + 0x2f4], al
inc ecx
jmp 0x40385f
mov byte [esp + ecx + 0x2f4], bl
cmp byte [esp + 0x2f4], bl
je 0x40385d
lea eax, [esp + 0x2f4]
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403793
sub eax, ecx
push eax
lea ecx, [esp + 0x2f8]
push ecx
lea ecx, [esp + 0xd8]
call fcn.004025c0
mov eax, dword [0x418fb0]
mov ecx, dword [0x418f9c]
mov edx, dword [eax]
lea esi, [esp + 0xd0]
push esi
push eax
push ecx
push edx
push ecx
lea edx, [esp + 0x44]
push edx
mov byte [esp + 0x4320], 4
call fcn.00402830
mov edx, dword [esp + 0x48]
mov eax, dword [0x418fb0]
mov ecx, dword [0x418f9c]
add esp, 0x18
mov esi, eax
cmp edx, ebx
je 0x4037f8
cmp edx, ecx
je 0x403802
call fcn.0040518b
mov eax, dword [0x418fb0]
cmp dword [esp + 0x34], esi
jne 0x40383b
mov edx, dword [eax + 4]
lea edi, [eax + 4]
lea ecx, [esp + 0xd0]
push ecx
push edx
push eax
mov ecx, 0x418f9c
call fcn.00403240
push 1
mov ecx, 0x418f9c
mov esi, eax
call fcn.00402950
mov dword [edi], esi
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x28]
mov dword [eax], esi
cmp dword [esp + 0xe8], 0x10
mov byte [esp + 0x4308], 3
jb 0x40385d
mov eax, dword [esp + 0xd4]
push eax
call fcn.0040474e
add esp, 4
xor ecx, ecx
inc edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], edi
cmp edi, dword [esp + 0x24]
jb 0x403740
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [esp + 0xcc], 0x10
mov edx, dword [esp + 0xb8]
jae 0x403895
lea edx, [esp + 0xb8]
mov esi, dword [esp + 0x90]
mov edi, dword [esp + 0xc8]
mov eax, esi
cmp esi, edi
jb 0x4038ab
mov eax, edi
cmp dword [esp + 0x94], 0x10
mov ecx, dword [esp + 0x80]
jae 0x4038c3
lea ecx, [esp + 0x80]
push eax
push edx
push ecx
call fcn.004015a0
add esp, 0xc
cmp eax, ebx
jne 0x4038df
cmp esi, edi
jb 0x4038e5
xor eax, eax
cmp esi, edi
setne al
cmp eax, ebx
jge 0x4039dc
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
jne 0x40398c
call fcn.0040518b
mov ecx, dword [esp + 0x14]
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x14]
jne 0x40390e
call fcn.0040518b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov dword [esp + 0x18], edx
cmp ecx, ebx
jne 0x403993
call fcn.0040518b
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x14]
jne 0x403931
call fcn.0040518b
mov edx, dword [esp + 0x18]
push 0xffffffffffffffff
push ebx
add edx, 8
push edx
lea ecx, [esp + 0x88]
call fcn.004024e0
cmp dword [esp + 0x94], 0x10
mov eax, dword [esp + 0x80]
jae 0x403960
lea eax, [esp + 0x80]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0xc8]
push ecx
push eax
push edx
push ebx
lea ecx, [esp + 0xc4]
call fcn.00401e40
test eax, eax
jl 0x4039dc
mov edi, 0xf
jmp 0x4036b4
mov eax, dword [ecx]
jmp 0x4038fc
mov eax, dword [ecx]
jmp 0x403923
push ebx
push str.Notice
push str.Cant_find_patch_list_file_at_Server.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x94], esi
jb 0x4039c2
mov eax, dword [esp + 0x80]
push eax
call fcn.0040474e
add esp, 4
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
jmp 0x403621
push ebx
push 0x413670
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [0x4177fc], 0x10
mov esi, dword [0x418fb4]
mov eax, dword [0x4177e8]
mov dword [esp + 0x20], esi
jae 0x403a05
mov eax, 0x4177e8
push eax
mov eax, dword [0x418b04]
push eax
call dword [sym.imp.WININET.dll_FtpSetCurrentDirectoryA]
mov ecx, dword [0x418e94]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x64
push 1
push 0x406
push ecx
call edi
mov edx, dword [0x418e94]
push ebx
push 1
push 0x402
push edx
call edi
mov eax, dword [0x418fb0]
mov ecx, dword [eax]
mov edx, dword [0x418f9c]
xor edi, edi
cmp esi, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edi
jle 0x403c6c
fild dword [esp + 0x20]
fstp dword [esp + 0x28]
fild dword [esp + 0x1c]
fdiv dword [esp + 0x28]
fmul qword [0x413668]
call fcn.00405660
mov esi, eax
mov eax, dword [esp + 0x20]
push esi
push eax
inc edi
push edi
lea ecx, [esp + 0x280]
push str.Total____d____d___d____
push ecx
call fcn.004017b0
mov edx, dword [0x418e94]
add esp, 0x14
push ebx
push esi
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x274]
push eax
push 0x80
push 0x418e00
call fcn.0040519b
mov ecx, dword [0x418f0c]
add esp, 0xc
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0xc0c0c0
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edx, dword [0x418ea0]
push edx
push 0x417090
push esi
call dword [sym.imp.USER32.dll_FillRect]
push 0xff0000
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, 0x418e00
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x403b08
sub eax, ecx
push eax
push 0x418e00
push 0xf0
push 2
push esi
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [0x418f0c]
push esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [0x418f0c]
push ebx
push ebx
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [0x418fb0]
cmp dword [esp + 0x14], ebx
je 0x403b59
mov eax, dword [esp + 0x14]
cmp eax, dword [0x418f9c]
je 0x403b62
call fcn.0040518b
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
je 0x403d50
cmp eax, ebx
jne 0x403c2c
call fcn.0040518b
xor eax, eax
mov edx, dword [esp + 0x18]
cmp edx, dword [eax + 0x14]
jne 0x403b89
call fcn.0040518b
mov esi, dword [esp + 0x18]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
add esi, 8
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push esi
mov byte [ecx + 4], bl
call fcn.004024e0
call fcn.00402160
add esp, 0x1c
cmp eax, ebx
mov eax, dword [esp + 0x14]
jne 0x403c3b
cmp eax, ebx
jne 0x403c33
call fcn.0040518b
xor eax, eax
mov ecx, dword [esp + 0x18]
cmp ecx, dword [eax + 0x14]
jne 0x403bd8
call fcn.0040518b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push esi
mov byte [ecx + 4], bl
call fcn.004024e0
call fcn.00402b40
add esp, 0x1c
cmp eax, ebx
je 0x403cc9
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x403c37
call fcn.0040518b
xor eax, eax
mov esi, dword [esp + 0x18]
cmp esi, dword [eax + 0x14]
jne 0x403c24
call fcn.0040518b
mov edx, dword [esi]
mov dword [esp + 0x18], edx
jmp 0x403c5e
mov eax, dword [eax]
jmp 0x403b7b
mov eax, dword [eax]
jmp 0x403bca
mov eax, dword [eax]
jmp 0x403c16
cmp eax, ebx
jne 0x403d49
call fcn.0040518b
xor eax, eax
mov esi, dword [esp + 0x18]
cmp esi, dword [eax + 0x14]
jne 0x403c58
call fcn.0040518b
mov eax, dword [esi]
mov dword [esp + 0x18], eax
cmp edi, dword [esp + 0x20]
mov dword [esp + 0x1c], edi
jl 0x403a66
mov ecx, dword [0x418b04]
push 0x413648
push ecx
call dword [sym.imp.WININET.dll_FtpSetCurrentDirectoryA]
push 0x3000
lea edx, [esp + 0x12f8]
push ebx
push edx
call fcn.00405440
mov eax, dword [0x418b04]
add esp, 0xc
push ebx
push 2
push 0x80000000
push str.pub_1003b_Patch_Version_version.dat
push eax
call dword [sym.imp.WININET.dll_FtpOpenFileA]
mov esi, eax
push ebx
cmp esi, ebx
jne 0x403dd1
push str.Notice
push str.Cant_find_version_info_file_at_Server.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 0x10
cmp dword [esp + 0x94], esi
jb 0x403ce7
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0040474e
add esp, 4
mov edi, 0xf
mov byte [esp + 0x80], bl
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], edi
cmp dword [esp + 0xb0], esi
jb 0x403d1a
mov edx, dword [esp + 0x9c]
push edx
call fcn.0040474e
add esp, 4
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
cmp dword [esp + 0xcc], esi
jb 0x404038
mov eax, dword [esp + 0xb8]
push eax
jmp 0x404030
mov eax, dword [eax]
jmp 0x403c4a
cmp dword [esp + 0x94], 0x10
jb 0x403d6a
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0040474e
add esp, 4
cmp dword [esp + 0xb0], 0x10
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
jb 0x403d9d
mov edx, dword [esp + 0x9c]
push edx
call fcn.0040474e
add esp, 4
cmp dword [esp + 0xcc], 0x10
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
jb 0x404038
mov eax, dword [esp + 0xb8]
push eax
jmp 0x404030
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push str.version.dat
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [esp + 0x24]
push ecx
push 0x100
lea edx, [esp + 0x12fc]
push edx
push esi
mov edi, eax
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x24]
push ebx
lea eax, [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x1300]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x103
lea eax, [esp + 0x171]
push ebx
push eax
mov byte [esp + 0x178], bl
call fcn.00405440
lea ecx, [esp + 0x178]
push ecx
push 0x104
call fcn.004016d0
add esp, 0x14
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x403ecd
push 0x3c
lea edx, [esp + 0x44]
push ebx
push edx
call fcn.00405440
mov eax, dword [0x418f0c]
add esp, 0xc
lea edx, [esp + 0x40]
lea ecx, [esp + 0x16c]
push edx
mov dword [esp + 0x44], 0x3c
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0x500
mov dword [esp + 0x50], str.runas
mov dword [esp + 0x54], str.Patcher.exe
mov dword [esp + 0x58], 0x418d40
mov dword [esp + 0x60], 1
mov dword [esp + 0x5c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
jmp 0x403ee7
mov eax, dword [0x418f0c]
push 1
push ebx
push 0x418d40
push str.Patcher.exe
push str.open
push eax
call esi
cmp eax, 2
je 0x403f82
cmp eax, 3
je 0x403f82
mov esi, 0x10
cmp dword [esp + 0x94], esi
jb 0x403f17
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0040474e
add esp, 4
mov edi, 0xf
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
cmp dword [esp + 0xb0], esi
jb 0x403f4a
mov edx, dword [esp + 0x9c]
push edx
call fcn.0040474e
add esp, 4
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
cmp dword [esp + 0xcc], esi
jb 0x403f78
mov eax, dword [esp + 0xb8]
push eax
call fcn.0040474e
add esp, 4
mov eax, 1
jmp 0x40403a
mov ecx, dword [0x418f0c]
push 1
push ebx
push 0x418d40
push str.game.exe
push str.open
push ecx
call esi
cmp eax, 2
je 0x403fa7
cmp eax, 3
jne 0x403fb9
push ebx
push str.Notice
push str.Cant_find_game_execute_file.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esi, 0x10
cmp dword [esp + 0x94], esi
jb 0x403fd7
mov edx, dword [esp + 0x80]
push edx
call fcn.0040474e
add esp, 4
mov edi, 0xf
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], ebx
mov byte [esp + 0x80], bl
cmp dword [esp + 0xb0], esi
jb 0x40400a
mov eax, dword [esp + 0x9c]
push eax
call fcn.0040474e
add esp, 4
mov dword [esp + 0xb0], edi
mov dword [esp + 0xac], ebx
mov byte [esp + 0x9c], bl
cmp dword [esp + 0xcc], esi
jb 0x404038
mov ecx, dword [esp + 0xb8]
push ecx
call fcn.0040474e
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x4300]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x42e8]
xor ecx, esp
call fcn.00404e58
mov esp, ebp
pop ebp
ret