Function at 0x407ba0
Capabilities:
Create thread
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42884a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3e8
mov eax, dword [0x439018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 1
call fcn.004163ad
add esp, 4
push eax
call fcn.00416267
add esp, 4
push 0
push 0
push 0
push 0x405220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push str.SUB
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.00402470
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x20]
call fcn.00406040
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x407c86
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407c7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ce7
push edx
push ecx
call fcn.0040e203
add esp, 8
push 1
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x2c]
push 0x435a38
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.00402470
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 3
lea ecx, [ebx + 8]
call fcn.00406040
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x407cf6
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407cec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407cec
call fcn.004127d7
push edx
push ecx
call fcn.0040e203
add esp, 8
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
jb 0x407d0b
mov edi, dword [ebx + 8]
mov ecx, edi
mov esi, dword [ebx + 0x18]
add esi, edi
jmp 0x407d14
lea esi, [ebx + 8]
add esi, dword [ebx + 0x18]
lea edi, [ebx + 8]
cmp edi, esi
je 0x407d3a
sub ecx, edi
mov dword [ebp - 0x324], ecx
movzx eax, byte [edi]
push eax
call fcn.0041637d
mov ecx, dword [ebp - 0x324]
add esp, 4
mov byte [edi + ecx], al
inc edi
cmp edi, esi
jne 0x407d20
call fcn.00404d10
mov edi, eax
mov dword [ebp - 0x328], edi
call fcn.00404640
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
mov edx, dword [ebx + 0x18]
cmovae ecx, dword [ebx + 8]
push 3
push 0x435a3c
push ecx
mov dword [ebp - 0x324], eax
call fcn.0040c5e0
add esp, 0xc
test eax, eax
jne 0x4080a7
push 0x148
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.0040fdb0
add esp, 0xc
mov dword [ebp - 0x1cc], 0x435a20
mov dword [ebp - 0x1d4], 0x7a120
push 0x7a120
call fcn.0040e211
add esp, 4
mov dword [ebp - 0x1d8], eax
push dword [ebp - 0x1d4]
push 0
push eax
call fcn.0040fdb0
add esp, 0xc
mov dword [ebp - 0x1b4], 0xfde9
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x198], 0
mov byte [ebp - 4], 4
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x3c], 0x4f5e4d01
mov dword [ebp - 0x38], 0x434f4001
mov dword [ebp - 0x34], 0x465e004b
mov ecx, dword [eax]
mov eax, dword [0x43ae6c]
mov word [ebp - 0x30], 0x2e5e
cmp eax, dword [ecx + 4]
jle 0x407e70
push 0x43ae6c
call fcn.0040e34c
add esp, 4
cmp dword [0x43ae6c], 0xffffffff
jne 0x407e70
mov eax, dword [ebp - 0x34]
movq xmm0, qword [ebp - 0x3c]
mov dword [0x43ad88], eax
mov ax, word [ebp - 0x30]
push 0x4292e0
movq qword [0x43ad80], xmm0
mov word [0x43ad8c], ax
call fcn.0040e773
add esp, 4
push 0x43ae6c
call fcn.0040e302
add esp, 4
cmp byte [0x43ad8d], 0
je 0x407e8d
xor eax, eax
nop dword [eax + eax]
xor byte [eax + 0x43ad80], 0x2e
inc eax
cmp eax, 0xe
jb 0x407e80
mov ecx, 0x43ad80
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407eb0
sub ecx, edx
push ecx
push 0x43ad80
lea ecx, [ebp - 0x5c]
call fcn.00402470
mov byte [ebp - 4], 5
mov eax, 0x43ad20
cmp dword [0x43ad34], 0x10
push dword [0x43ad30]
cmovae eax, dword [0x43ad20]
push eax
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0040cb30
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x48]
cmp edx, 0x10
jb 0x407f5e
mov ecx, dword [ebp - 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x407f54
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x407f54
call fcn.004127d7
push edx
push ecx
call fcn.0040e203
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0xf
mov byte [ebp - 0x5c], 0
nop word [eax + eax]
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov eax, dword [ebp - 0x1ac]
cmovae esi, dword [ebp - 0x2c]
mov dword [ebp - 0x1a4], 0
test eax, eax
je 0x407fb2
push eax
call fcn.0040dfd1
add esp, 4
mov dword [ebp - 0x1ac], 0
push esi
lea ecx, [ebp - 0x1d8]
call fcn.00401d30
test eax, eax
je 0x408055
mov edx, dword [ebp - 0x1b0]
xor eax, eax
cmp dword [ebp - 0x1a4], eax
mov dword [ebp - 0x44], eax
cmove edx, eax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x44], al
mov eax, edx
mov dword [ebp - 0x30], 0xf
lea esi, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ff0
sub eax, esi
lea ecx, [ebp - 0x44]
push eax
push edx
call fcn.00402470
mov byte [ebp - 4], 8
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
mov ecx, dword [ebp - 0x44]
mov esi, dword [ebp - 0x34]
cmovae eax, ecx
cmp esi, 1
je 0x408061
cmp esi, 0x14
jb 0x40807a
mov byte [ebp - 4], 7
cmp edx, 0x10
jb 0x408055
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40804b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407ce7
push edx
push ecx
call fcn.0040e203
add esp, 8
push 0xbb8
call edi
jmp 0x407f80
movzx eax, byte [eax]
cmp al, 0x30
jne 0x40806c
xor eax, eax
jmp 0x408071
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40807a
call fcn.00405040
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebx + 8]
call fcn.0040b810
lea ecx, [ebp - 0x44]
call fcn.00402200
lea ecx, [ebp - 0x2c]
call fcn.00402200
lea ecx, [ebp - 0x1d8]
call fcn.004016e0
mov edi, dword [ebp - 0x328]
lea ecx, [ebp - 0x44]
call fcn.0040b840
lea ecx, [ebp - 0x74]
call fcn.0040b840
lea ecx, [ebp - 0x5c]
call fcn.0040b840
mov byte [ebp - 4], 0xb
call fcn.004088a0
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408191
push ecx
push str.mixone
lea ecx, [ebx + 8]
call fcn.00402180
cmp eax, 0xffffffff
je 0x408134
call fcn.00408920
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.004089b0
jmp 0x40815f
call fcn.00408a30
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00408ac0
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040b810
jmp 0x408636
call fcn.00408b40
mov ecx, eax
call fcn.0040b420
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408290
call fcn.00408bc0
mov ecx, eax
call fcn.0040b420
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00408c40
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00408cc0
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408258
call fcn.00408d50
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
lea ecx, [ebp - 0x74]
jmp 0x408628
call fcn.00408dd0
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408636
call fcn.00408e60
jmp 0x408240
call fcn.00408ee0
mov ecx, eax
call fcn.0040b420
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x40837f
call fcn.00408f60
mov ecx, eax
call fcn.0040b420
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00408ff0
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409070
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408344
call fcn.00409100
jmp 0x408240
call fcn.00409180
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408636
call fcn.00409210
jmp 0x408240
call fcn.00409290
mov ecx, eax
call fcn.0040b400
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408494
call fcn.00409310
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409390
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409410
mov ecx, eax
call fcn.0040b400
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x74]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409490
mov ecx, eax
call fcn.0040b4e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408459
call fcn.00409520
jmp 0x408240
call fcn.004095a0
mov ecx, eax
call fcn.0040b4e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408636
call fcn.00409630
jmp 0x408240
call fcn.004096b0
mov ecx, eax
call fcn.0040b3d0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408517
call fcn.00409740
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.004097c0
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x74]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409850
jmp 0x408615
call fcn.004098d0
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408597
call fcn.00409960
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.004099e0
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x74]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409a60
jmp 0x408615
call fcn.00409ae0
mov ecx, eax
call fcn.0040b400
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push ecx
push eax
lea ecx, [ebx + 8]
call fcn.0040b630
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.00402200
test esi, esi
jne 0x408636
call fcn.00409b60
mov ecx, eax
call fcn.0040b440
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x44]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409be0
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
push eax
lea ecx, [ebp - 0x74]
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
call fcn.00409c60
mov ecx, eax
call fcn.0040b400
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
lea ecx, [ebp - 0x5c]
push eax
call fcn.00402250
lea ecx, [ebp - 0x2c]
call fcn.00402200
cmp dword [ebp - 0x324], 0
je 0x40864c
push 0x435a4c
lea ecx, [ebp - 0x74]
call fcn.004021d0
test edi, edi
je 0x40865d
push 0x435a50
lea ecx, [ebp - 0x74]
call fcn.004021d0
sub esp, 0x10
lea ecx, [ebp - 0x320]
push 0x435a20
call fcn.00401680
mov byte [ebp - 4], 0xc
call fcn.00409e00
mov ecx, eax
call fcn.0040b4b0
push eax
lea ecx, [ebp - 0x3f4]
call fcn.004022d0
mov edi, eax
mov byte [ebp - 4], 0xd
call fcn.00409d80
mov ecx, eax
call fcn.0040b490
push eax
lea ecx, [ebp - 0x3dc]
call fcn.004022d0
mov esi, eax
mov byte [ebp - 4], 0xe
call fcn.00409ce0
mov ecx, eax
call fcn.0040b460
push eax
lea ecx, [ebp - 0x3c4]
call fcn.004022d0
push eax
mov edx, 0x43ad20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3ac]
call fcn.0040be30
add esp, 4
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x10
push ecx
mov edx, eax
lea ecx, [ebp - 0x394]
call fcn.0040be90
add esp, 4
push esi
mov edx, eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x37c]
call fcn.0040bf40
add esp, 4
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
push ecx
mov edx, eax
lea ecx, [ebp - 0x364]
call fcn.0040be90
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x34c]
call fcn.0040bf40
add esp, 4
lea ecx, [ebx + 0x20]
mov byte [ebp - 4], 0x14
push ecx
mov edx, eax
lea ecx, [ebp - 0x8c]
call fcn.0040be90
add esp, 4
lea ecx, [ebp - 0x34c]
call fcn.00402200
lea ecx, [ebp - 0x364]
call fcn.00402200
lea ecx, [ebp - 0x37c]
call fcn.00402200
lea ecx, [ebp - 0x394]
call fcn.00402200
lea ecx, [ebp - 0x3ac]
call fcn.00402200
lea ecx, [ebp - 0x3c4]
call fcn.00402200
lea ecx, [ebp - 0x3dc]
call fcn.00402200
lea ecx, [ebp - 0x3f4]
mov byte [ebp - 4], 0x1d
call fcn.00402200
nop
lea ecx, [ebp - 0x8c]
call fcn.004021c0
push eax
lea ecx, [ebp - 0x320]
call fcn.00402040
test eax, eax
je 0x408809
lea ecx, [ebp - 0x320]
call fcn.00402080
push eax
lea ecx, [ebp - 0x2c]
call fcn.004022d0
mov edx, 0x435a40
lea ecx, [ebp - 0x2c]
call fcn.004025c0
test al, al
jne 0x408816
mov edx, 0x435a20
lea ecx, [ebp - 0x2c]
call fcn.004025c0
test al, al
jne 0x408816
lea ecx, [ebp - 0x2c]
call fcn.00402200
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4087b0
lea ecx, [ebp - 0x2c]
call fcn.00402200
sub esp, 0x18
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x330], esp
push eax
call fcn.0040b860
sub esp, 0x18
mov byte [ebp - 4], 0x1e
mov ecx, esp
mov dword [ebp - 0x334], esp
push 0x43ad38
call fcn.0040b860
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
push 0x43ad50
call fcn.0040b860
cmp dword [ebp - 0x328], 0
mov byte [ebp - 4], 0x1d
setne dl
cmp dword [ebp - 0x324], 0
setne cl
call fcn.00407220
add esp, 0x30
mov ecx, esp
push 0x43ad08
call fcn.0040b860
call fcn.004060c0
add esp, 0x18
call fcn.00405040
int3