Function at 0x4033f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48a8b9
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 0x98]
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x428]
push 0
push 0x49ef1c
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
call fcn.004070d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x440]
push 0
push 0x49ef1c
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
call fcn.004070d0
push 0x400
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 8
push 0
push eax
call fcn.0046a2f0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x490], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4034d3
mov eax, dword [ecx]
jmp 0x4034d5
mov eax, ecx
push 6
push str.system
mov byte [eax], 0
call fcn.004070d0
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403513
mov eax, dword [ecx]
jmp 0x403515
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x20]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 8
call fcn.004468d0
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
add esp, 0x30
test al, al
jne 0x4036f3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403570
mov eax, dword [ecx]
jmp 0x403572
mov eax, ecx
push 8
push str.system32
mov byte [eax], 0
call fcn.004070d0
sub esp, 0x18
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4035b0
mov eax, dword [ecx]
jmp 0x4035b2
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x20]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 8
call fcn.004468d0
add esp, 0x30
test al, al
jne 0x4036f3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48c], esp
push str.syswow64
call fcn.00406e40
sub esp, 0x18
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40361a
mov eax, dword [ecx]
jmp 0x40361c
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x20]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 8
call fcn.004468d0
add esp, 0x30
test al, al
jne 0x4036f3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48c], esp
push str.local
call fcn.00406e40
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403684
mov eax, dword [ecx]
jmp 0x403686
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x20]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 8
call fcn.004468d0
add esp, 0x30
test al, al
lea eax, [ebp - 0x410]
push 0x400
push eax
push 0
je 0x4036c9
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
jmp 0x403705
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x410]
push eax
call edi
jmp 0x403705
push 0x400
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x410], 0
mov dword [ebp - 0x444], 0xf
mov dword [ebp - 0x448], 0
mov byte [ebp - 0x458], 0
jne 0x40372d
xor ecx, ecx
jmp 0x40373f
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403736
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x458]
call fcn.004070d0
mov byte [ebp - 4], 0xd
cmp byte [ebp - 0x410], 0
jne 0x403763
xor ecx, ecx
jmp 0x403779
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403770
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x440]
call fcn.004070d0
push 0x49ef5c
lea edx, [ebp + 0x38]
lea ecx, [ebp - 0x488]
call fcn.004077d0
lea ecx, [ebp + 0x80]
mov byte [ebp - 4], 0xe
push ecx
mov edx, eax
lea ecx, [ebp - 0x470]
call fcn.004078e0
add esp, 8
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x474]
cmp eax, 0x10
jb 0x4037dc
inc eax
lea ecx, [ebp - 0x488]
push eax
push dword [ebp - 0x488]
call fcn.00402390
cmp dword [ebp - 0x45c], 0x10
lea eax, [ebp - 0x470]
mov dword [ebp - 0x474], 0xf
cmovae eax, dword [ebp - 0x470]
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x478], 0
push eax
mov byte [ebp - 0x488], 0
call edi
cmp byte [ebp - 0x410], 0
jne 0x403822
xor ecx, ecx
jmp 0x403839
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403830
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x428]
call fcn.004070d0
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebp - 0x428]
cmovae ecx, dword [ebp - 0x428]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49ef60
push eax
call fcn.004465a0
add esp, 0xc
call fcn.004477f0
cmp dword [ebp - 0x414], 0x10
lea eax, [ebp - 0x428]
push 0
cmovae eax, dword [ebp - 0x428]
push eax
call fcn.004779bb
add esp, 0x20
test eax, eax
je 0x4038ce
push 0x10
push 0x49ef74
mov ecx, esi
call fcn.004070d0
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebp - 0x428]
cmovae ecx, dword [ebp - 0x428]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49ef88
jmp 0x403b23
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4038f9
mov eax, dword [ecx]
jmp 0x4038fb
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00401d80
mov ecx, ebx
call fcn.00403310
test al, al
je 0x403d3e
cmp dword [ebp + 0xac], 0
jne 0x4039bf
lea eax, [ebp + 0x9c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x40395c
mov eax, dword [ecx]
jmp 0x40395e
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00401d80
mov ecx, ebx
call fcn.004041a0
test eax, eax
je 0x40399e
lea eax, [ebp + 0x9c]
cmp esi, eax
je 0x403ea7
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00401d80
or esi, 0xffffffff
jmp 0x403eae
cmp dword [ebp + 0xb0], 0x10
lea ecx, [ebp + 0x9c]
cmovae ecx, dword [ebp + 0x9c]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49efa0
jmp 0x4039de
cmp dword [ebp + 0xb0], 0x10
lea ecx, [ebp + 0x9c]
cmovae ecx, dword [ebp + 0x9c]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49efb4
push eax
call fcn.004465a0
add esp, 0xc
call fcn.004477f0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403a20
mov eax, dword [ecx]
jmp 0x403a22
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x9c]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x11
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403a64
mov eax, dword [ecx]
jmp 0x403a66
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 0x10
call fcn.004066c0
test al, al
jne 0x403b3c
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebp - 0x428]
cmovae ecx, dword [ebp - 0x428]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49efcc
push eax
call fcn.004465a0
add esp, 0xc
call fcn.004477f0
add esp, 0x18
push esi
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403ae6
mov eax, dword [ecx]
jmp 0x403ae8
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00401d80
call fcn.00406320
test eax, eax
je 0x403b3c
cmp dword [ebp - 0x414], 0x10
lea ecx, [ebp - 0x428]
cmovae ecx, dword [ebp - 0x428]
sub esp, 0x18
mov eax, esp
push ecx
push 0x49efe8
push eax
call fcn.004465a0
add esp, 0xc
call fcn.004477f0
add esp, 0x18
or esi, 0xffffffff
jmp 0x403eae
cmp dword [ebp - 0x42c], 0x10
lea eax, [ebp - 0x440]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmovae eax, dword [ebp - 0x440]
push eax
call ebx
cmp dword [ebp + 0x7c], 0x10
lea edx, [ebp + 0x68]
lea ecx, [ebp + 0x50]
cmovae edx, dword [ebp + 0x68]
cmp dword [ebp + 0x64], 0x10
cmovae ecx, dword [ebp + 0x50]
sub esp, 0x18
mov eax, esp
push edx
push ecx
push 0x49f000
push eax
call fcn.004465a0
add esp, 0x10
call fcn.004477f0
add esp, 0x18
push esi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x48c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403bbe
mov eax, dword [ecx]
jmp 0x403bc0
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x68]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x12
mov ecx, esp
mov dword [ebp - 0x490], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403c05
mov eax, dword [ecx]
jmp 0x403c07
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x50]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x13
mov ecx, esp
mov dword [ebp - 0x4a0], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403c4c
mov eax, dword [ecx]
jmp 0x403c4e
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x38]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x14
mov ecx, esp
mov dword [ebp - 0x498], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403c93
mov eax, dword [ecx]
jmp 0x403c95
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x20]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x15
mov ecx, esp
mov dword [ebp - 0x49c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403cda
mov eax, dword [ecx]
jmp 0x403cdc
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x9c]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x16
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403d1e
mov eax, dword [ecx]
jmp 0x403d20
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 8]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 0x10
call fcn.004049a0
jmp 0x403e66
cmp dword [ebp - 0x42c], 0x10
lea eax, [ebp - 0x440]
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmovae eax, dword [ebp - 0x440]
push eax
call ebx
cmp dword [ebp + 0x7c], 0x10
lea edx, [ebp + 0x68]
lea ecx, [ebp + 0x50]
cmovae edx, dword [ebp + 0x68]
cmp dword [ebp + 0x64], 0x10
cmovae ecx, dword [ebp + 0x50]
sub esp, 0x18
mov eax, esp
push edx
push ecx
push 0x49f000
push eax
call fcn.004465a0
add esp, 0x10
call fcn.004477f0
add esp, 0x18
push esi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x494], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403dc0
mov eax, dword [ecx]
jmp 0x403dc2
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x68]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, esp
mov dword [ebp - 0x49c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403e07
mov eax, dword [ecx]
jmp 0x403e09
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp + 0x50]
push 0
push eax
call fcn.00401d80
sub esp, 0x18
mov byte [ebp - 4], 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403e48
mov eax, dword [ecx]
jmp 0x403e4a
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.00401d80
mov byte [ebp - 4], 0x10
call fcn.004044c0
cmp dword [esi + 0x14], 0x10
mov edi, eax
jb 0x403e70
mov esi, dword [esi]
sub esp, 0x18
mov eax, esp
push esi
push 0x49f018
push eax
call fcn.004465a0
add esp, 0xc
call fcn.004477f0
add esp, 0x18
lea eax, [ebp - 0x458]
cmp dword [ebp - 0x444], 0x10
cmovae eax, dword [ebp - 0x458]
push eax
call ebx
test edi, edi
je 0x403eac
or esi, 0xffffffff
jmp 0x403eae
xor esi, esi
mov eax, dword [ebp - 0x45c]
cmp eax, 0x10
jb 0x403ecc
inc eax
lea ecx, [ebp - 0x470]
push eax
push dword [ebp - 0x470]
call fcn.00402390
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x45c], 0xf
mov dword [ebp - 0x460], 0
mov byte [ebp - 0x470], 0
cmp eax, 0x10
jb 0x403f05
inc eax
lea ecx, [ebp - 0x458]
push eax
push dword [ebp - 0x458]
call fcn.00402390
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x444], 0xf
mov dword [ebp - 0x448], 0
mov byte [ebp - 0x458], 0
cmp eax, 0x10
jb 0x403f3e
inc eax
lea ecx, [ebp - 0x440]
push eax
push dword [ebp - 0x440]
call fcn.00402390
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x42c], 0xf
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x440], 0
cmp eax, 0x10
jb 0x403f77
inc eax
lea ecx, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
call fcn.00402390
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x414], 0xf
mov dword [ebp - 0x418], 0
mov byte [ebp - 0x428], 0
cmp eax, 0x10
jb 0x403fa7
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00402390
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
cmp eax, 0x10
jb 0x403fce
inc eax
lea ecx, [ebp + 0x20]
push eax
push dword [ebp + 0x20]
call fcn.00402390
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x34], 0xf
mov dword [ebp + 0x30], 0
mov byte [ebp + 0x20], 0
cmp eax, 0x10
jb 0x403ff5
inc eax
lea ecx, [ebp + 0x38]
push eax
push dword [ebp + 0x38]
call fcn.00402390
mov eax, dword [ebp + 0x64]
mov dword [ebp + 0x4c], 0xf
mov dword [ebp + 0x48], 0
mov byte [ebp + 0x38], 0
cmp eax, 0x10
jb 0x40401c
inc eax
lea ecx, [ebp + 0x50]
push eax
push dword [ebp + 0x50]
call fcn.00402390
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x64], 0xf
mov dword [ebp + 0x60], 0
mov byte [ebp + 0x50], 0
cmp eax, 0x10
jb 0x404043
inc eax
lea ecx, [ebp + 0x68]
push eax
push dword [ebp + 0x68]
call fcn.00402390
mov eax, dword [ebp + 0x94]
mov dword [ebp + 0x7c], 0xf
mov dword [ebp + 0x78], 0
mov byte [ebp + 0x68], 0
cmp eax, 0x10
jb 0x404073
inc eax
lea ecx, [ebp + 0x80]
push eax
push dword [ebp + 0x80]
call fcn.00402390
mov ecx, dword [ebp + 0xb0]
mov dword [ebp + 0x94], 0xf
mov dword [ebp + 0x90], 0
mov byte [ebp + 0x80], 0
cmp ecx, 0x10
jb 0x4040ac
inc ecx
push ecx
push dword [ebp + 0x9c]
lea ecx, [ebp + 0x9c]
call fcn.00402390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00451a48
mov esp, ebp
pop ebp
ret 0xac