Function at 0x40ab60
Capabilities:
Accept command line arguments
Check if file exists
Check mutex on windows
Check os version
Create process on windows
Get token membership
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x241c
call fcn.0043f530
mov eax, dword [0x461008]
xor eax, esp
mov dword [esp + 0x2418], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [0x4636f8], esi
call fcn.00416e10
push 0x463760
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x46375c], 0
call fcn.0041a420
call fcn.0041c310
xor eax, eax
mov dword [0x463708], 0
mov word [0x4636fc], ax
xor bl, bl
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
mov dword [esp + 0x90], eax
mov word [esp + 0x80], ax
lea eax, [esp + 0x7c]
push eax
push edi
mov dword [0x463704], esi
mov dword [0x463700], 0x12c
mov dword [esp + 0x9c], 7
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
je 0x40aeba
mov ecx, dword [esp + 0x7c]
xor edi, edi
test ecx, ecx
jle 0x40ad33
nop
push 2
push 0x45582c
push dword [esi + edi*4]
call fcn.00432bbb
add esp, 0xc
test eax, eax
jne 0x40ac3d
mov bl, 1
jmp 0x40ad26
mov esi, dword [esi + edi*4]
mov ecx, str._elevated
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ac6d
test dx, dx
je 0x40ac69
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ac6d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ac47
xor eax, eax
jmp 0x40ac72
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ac80
mov byte [esp + 0x12], 1
jmp 0x40ad22
mov ecx, 0x455834
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40acad
test dx, dx
je 0x40aca9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40acad
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ac87
xor eax, eax
jmp 0x40acb2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40acbd
mov byte [esp + 0x13], 1
jmp 0x40ad22
mov ecx, str._flyout:
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40acea
test dx, dx
je 0x40ace6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40acea
add eax, 4
add ecx, 4
test dx, dx
jne 0x40acc4
xor eax, eax
jmp 0x40acef
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40ad22
cmp word [esi + 0x10], ax
lea edx, [esi + 0x10]
jne 0x40ad00
xor ecx, ecx
jmp 0x40ad14
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad05
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x88]
call fcn.00404220
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x7c]
inc edi
cmp edi, ecx
jl 0x40ac20
xor edi, edi
test ecx, ecx
jle 0x40aeba
lea ecx, [ecx]
push 7
push str._alert:
push dword [esi + edi*4]
call fcn.00432bbb
add esp, 0xc
test eax, eax
je 0x40b1d1
mov esi, dword [esi + edi*4]
mov ecx, str._service
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ad8a
test dx, dx
je 0x40ad86
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ad8a
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ad64
xor eax, eax
jmp 0x40ad8f
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b185
mov ecx, 0x455878
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40adc6
test dx, dx
je 0x40adc2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40adc6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ada0
xor eax, eax
jmp 0x40adcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x40b135
push 0xa
push str._uninstall
push esi
call fcn.00432bbb
add esp, 0xc
test eax, eax
je 0x40b007
mov edx, dword [esp + 0x14]
mov ecx, str._update
mov edx, dword [edx + edi*4]
mov eax, edx
lea esp, [esp]
mov si, word [eax]
cmp si, word [ecx]
jne 0x40ae26
test si, si
je 0x40ae22
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x40ae26
add eax, 4
add ecx, 4
test si, si
jne 0x40ae00
xor eax, eax
jmp 0x40ae2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40afd4
mov ecx, str._upgrade
mov eax, edx
lea ebx, [ebx]
mov si, word [eax]
cmp si, word [ecx]
jne 0x40ae66
test si, si
je 0x40ae62
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x40ae66
add eax, 4
add ecx, 4
test si, si
jne 0x40ae40
xor eax, eax
jmp 0x40ae6b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40af9c
mov eax, str._run
mov cx, word [edx]
cmp cx, word [eax]
jne 0x40ae9e
test cx, cx
je 0x40ae9a
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x40ae9e
add edx, 4
add eax, 4
test cx, cx
jne 0x40ae78
xor eax, eax
jmp 0x40aea3
sbb eax, eax
or eax, 1
test eax, eax
je 0x40af92
mov esi, dword [esp + 0x14]
inc edi
cmp edi, dword [esp + 0x7c]
jl 0x40ad40
lea eax, [esp + 0x30]
mov dword [esp + 0x70], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [esp + 0x98]
mov word [esp + 0x9c], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esp + 0x78], eax
test eax, eax
je 0x40af40
lea eax, [esp + 0x78]
push eax
push dword [esp + 0x34]
push 0
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40af32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x455628
push 0x4566ac
call fcn.00416f00
add esp, 0xc
mov dword [esp + 0x78], 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [esp + 0x78]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, 1
push 0
push 1
push 0x463708
sete bl
mov byte [esp + 0x1d], 0
call edi
test eax, eax
jne 0x40af65
call fcn.004164c0
mov edx, dword [0x4637c0]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x40b44f
lea ebx, [ebx]
cmp dword [eax + 0x10], 0x65
jge 0x40b42d
mov eax, dword [eax + 8]
jmp 0x40b431
call fcn.0040e970
jmp 0x40b8f7
call fcn.00409200
push 0x9c4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push str.Installer::Upgrade___returned__d_r_n
call fcn.00416f00
add esp, 8
cmp esi, 1
je 0x40b8f7
cmp esi, 2
jne 0x40afff
mov esi, 0xbc2
jmp 0x40b8f9
call fcn.00408ef0
cmp eax, 3
jne 0x40afe8
mov esi, 0xbc2
jmp 0x40b8f9
cmp eax, 2
jne 0x40aff7
mov esi, 0xbc2
jmp 0x40b8f9
test eax, eax
je 0x40b8f7
or esi, 0xffffffff
jmp 0x40b8f9
call fcn.00409b80
test al, al
jne 0x40b07c
test bl, bl
jne 0x40b072
mov ecx, 0x65
call fcn.00416830
mov ecx, 0xd6
mov ebx, eax
call fcn.00416830
push 5
push 0x3e7
mov edi, eax
call fcn.004168a0
mov esi, eax
mov edx, 0x44bba8
push esi
mov ecx, edi
call fcn.00414dc0
add esp, 0xc
mov edi, eax
push esi
call fcn.004323fa
movzx ecx, word [0x4636fc]
add esp, 4
push ecx
push 0x10
push ebx
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push edi
call fcn.004323fa
add esp, 4
mov esi, 5
jmp 0x40b8f9
mov edi, dword [sym.imp.USER32.dll_MessageBoxExW]
test bl, bl
jne 0x40b0b9
mov ecx, 0x65
call fcn.00416830
mov ecx, 0xd3
mov esi, eax
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x34
push esi
push eax
push 0
call edi
cmp eax, 6
je 0x40b0b9
or esi, 0xffffffff
jmp 0x40b8f9
call fcn.00408970
cmp eax, 1
jne 0x40b0f6
test bl, bl
jne 0x40b8f7
mov ecx, 0xd7
call fcn.00416830
mov ecx, 0x65
mov esi, eax
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x40
push eax
push esi
push 0
call edi
jmp 0x40b8f7
cmp eax, 0xffffffff
jne 0x40b8f7
test bl, bl
jne 0x40afff
mov ecx, 0xd6
call fcn.00416830
mov ecx, 0x65
mov esi, eax
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x30
push eax
push esi
push 0
call edi
or esi, 0xffffffff
jmp 0x40b8f9
call fcn.00409b80
test al, al
jne 0x40b148
mov esi, 5
jmp 0x40b8f9
cmp dword [esp + 0x90], 0
jbe 0x40b171
cmp dword [esp + 0x94], 8
mov edx, dword [esp + 0x80]
jae 0x40b16a
lea edx, [esp + 0x80]
xor ecx, ecx
call fcn.00415570
call fcn.00407f00
movzx esi, al
neg esi
sbb esi, esi
neg esi
dec esi
jmp 0x40b8f9
push str.Service::StartDispatcher_r_n
call fcn.00416f00
add esp, 4
mov dword [esp + 0x2414], 0x455cd0
lea eax, [esp + 0x2414]
mov dword [esp + 0x2418], 0x40ee60
mov dword [esp + 0x241c], 0
mov dword [esp + 0x2420], 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
jmp 0x40b8f7
xor eax, eax
mov dword [esp + 0xdc], 7
lea ecx, [esp + 0xb0]
mov word [esp + 0xc8], ax
push ecx
mov dword [esp + 0xac], eax
lea ecx, [esp + 0x9c]
push ecx
mov word [esp + 0xa0], ax
lea ecx, [esp + 0xd0]
mov dword [esp + 0xc8], eax
mov word [esp + 0xb8], ax
mov eax, dword [esi + edi*4]
push ecx
add eax, 0xe
mov dword [esp + 0xe4], 0
mov dword [esp + 0xb8], 7
lea ecx, [esp + 0x20c]
mov dword [esp + 0xd0], 7
mov dword [esp + method.PipeClient.virtual_0], vtable.PipeClient.0
push eax
mov dword [esp + 0x214], 0
call fcn.00417310
test al, al
je 0x40b364
call fcn.00418230
mov ebx, eax
push dword [ebx + 0x88]
call fcn.004323fa
add esp, 4
push 0x44bba4
call fcn.004319e0
mov dword [ebx + 0x88], eax
add esp, 4
cmp dword [esp + 0xdc], 8
mov esi, dword [esp + 0xc8]
jae 0x40b2ae
lea esi, [esp + 0xc8]
push dword [ebx + 0x8c]
call fcn.004323fa
add esp, 4
push esi
call fcn.004319e0
mov esi, dword [0x464638]
add esp, 4
mov dword [ebx + 0x8c], eax
test esi, esi
jne 0x40b337
call fcn.00415830
mov edi, edx
mov ecx, eax
or eax, edi
jne 0x40b2ec
mov ecx, 0x8f3583da
mov edi, 0x87aeacb6
xor ecx, 0xeaf10254
xor edi, 0x95662ba3
call fcn.00415710
mov ecx, edi
mov esi, eax
call fcn.00415710
mov edi, eax
mov edx, esi
push edi
mov ecx, 0x456484
call fcn.00414dc0
add esp, 4
mov dword [esp + 0x30], eax
mov dword [0x464638], eax
push esi
call fcn.004323fa
add esp, 4
push edi
call fcn.004323fa
mov esi, dword [esp + 0x34]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b406
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or esi, 0xffffffff
cmp dword [esp + 0xc4], 8
mov dword [esp + method.PipeClient.virtual_0], vtable.PipeClient.0
jb 0x40b38b
push dword [esp + 0xb0]
call fcn.0043198a
add esp, 4
xor eax, eax
mov dword [esp + 0xc4], 7
cmp dword [esp + 0xac], 8
mov dword [esp + 0xc0], 0
mov word [esp + 0xb0], ax
jb 0x40b3c4
push dword [esp + 0x98]
call fcn.0043198a
add esp, 4
xor eax, eax
mov dword [esp + 0xac], 7
cmp dword [esp + 0xdc], 8
mov dword [esp + 0xa8], 0
mov word [esp + 0x98], ax
jb 0x40b8f9
push dword [esp + 0xc8]
call fcn.0043198a
add esp, 4
jmp 0x40b8f9
push 0
push 0xffffffffffffffff
push dword [ebx + 0x28]
mov dword [ebx + 0x44], esi
push dword [ebx + 0x30]
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
sete al
test al, al
je 0x40b364
xor esi, esi
jmp 0x40b367
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40af80
cmp ecx, edx
je 0x40b44f
cmp dword [ecx + 0x10], 0x65
jg 0x40b44f
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x20]
jmp 0x40b457
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x1c]
mov eax, dword [eax]
cmp eax, edx
jne 0x40b467
mov dword [esp + 0x14], 0x44bba4
jmp 0x40b46e
mov eax, dword [eax + 0x14]
mov dword [esp + 0x14], eax
test bl, bl
jne 0x40b47f
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setae byte [esp + 0x11]
cmp word [0x4637d0], 0
mov ebx, dword [sym.imp.USER32.dll_MessageBoxExW]
je 0x40b496
mov esi, 0x4637d0
jmp 0x40b4d4
call fcn.004153c0
mov esi, eax
test esi, esi
je 0x40b4bd
push esi
push 0x104
push 0x4637d0
call fcn.0043256a
add esp, 0xc
push esi
call fcn.004323fa
add esp, 4
movzx esi, word [0x4637d0]
neg esi
sbb esi, esi
and esi, 0x4637d0
je 0x40b5d9
cmp byte [esp + 0x13], 0
jne 0x40b8dd
cmp word [0x4639d8], 0
jne 0x40b4fb
push 0x104
push 0x4639d8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, esi
mov ecx, 0x4639d8
call fcn.0040a510
test eax, eax
je 0x40b8dd
cmp eax, 0xfffffffe
je 0x40b8dd
test eax, eax
jns 0x40b560
push 0x38
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.0043cf50
add esp, 0xc
mov dword [esp + 0x34], 0x3c
lea eax, [esp + 0x34]
mov dword [esp + 0x40], str.open
mov dword [esp + 0x44], esi
mov dword [esp + 0x50], 0xa
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea esi, [eax - 1]
neg esi
sbb esi, esi
jmp 0x40b8f9
cmp byte [esp + 0x12], 0
jne 0x40b5c2
mov ecx, 0xcd
call fcn.00416830
mov ecx, 0x6f
mov esi, eax
call fcn.00416830
mov edx, eax
mov ecx, esi
call fcn.00409cf0
test al, al
je 0x40b8f7
call fcn.00409a10
test al, al
je 0x40b5c2
mov ecx, 0xd8
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x30
push dword [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov esi, 0xbc2
jmp 0x40b8f9
cmp byte [esp + 0x11], 0
je 0x40b7ce
call fcn.00409c20
mov esi, eax
jmp 0x40b8f9
cmp byte [esp + 0x12], 0
jne 0x40b78d
push 0
push 1
push 0x463708
call edi
test eax, eax
jne 0x40b5f8
call fcn.004164c0
mov edx, dword [0x4637c0]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x40b63f
lea esp, [esp]
cmp dword [eax + 0x10], 0xc9
jge 0x40b61e
mov eax, dword [eax + 8]
jmp 0x40b622
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40b610
cmp ecx, edx
je 0x40b63f
cmp dword [ecx + 0x10], 0xc9
jg 0x40b63f
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x2c]
jmp 0x40b647
mov dword [esp + 0x18], edx
lea eax, [esp + 0x18]
mov eax, dword [eax]
mov esi, 0x44bba4
cmp eax, edx
je 0x40b655
mov esi, dword [eax + 0x14]
push 0
push 1
push 0x463708
call edi
test eax, eax
jne 0x40b669
call fcn.004164c0
mov edx, dword [0x4637c0]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x40b6a9
lea ebx, [ebx]
cmp dword [eax + 0x10], 0x6f
jge 0x40b68b
mov eax, dword [eax + 8]
jmp 0x40b68f
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x40b680
cmp ecx, edx
je 0x40b6a9
cmp dword [ecx + 0x10], 0x6f
jg 0x40b6a9
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x28]
jmp 0x40b6b1
mov dword [esp + 0x24], edx
lea eax, [esp + 0x24]
mov eax, dword [eax]
cmp eax, edx
mov edx, 0x44bba4
je 0x40b6bf
mov edx, dword [eax + 0x14]
mov ecx, esi
call fcn.00409cf0
test al, al
je 0x40b8f7
call fcn.00409a10
test al, al
je 0x40b702
mov ecx, 0xd8
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x30
push dword [esp + 0x1c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov esi, 0xbc2
jmp 0x40b8f9
push 0x118
lea eax, [esp + 0xe8]
push 0
push eax
call fcn.0043cf50
add esp, 0xc
mov dword [esp + 0xe0], 0x11c
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40b78d
cmp byte [esp + 0x1fa], 1
je 0x40b78d
mov eax, dword [esp + 0xe4]
cmp eax, 6
jb 0x40b758
jne 0x40b78d
cmp dword [esp + 0xe8], 1
jae 0x40b78d
mov ecx, 0x1b3
call fcn.00416830
mov ecx, 0x1b7
mov esi, eax
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x34
push esi
push eax
push 0
call ebx
cmp eax, 6
je 0x40b78d
mov esi, 1
jmp 0x40b8f9
cmp byte [esp + 0x11], 0
je 0x40b7a0
call fcn.00409c20
mov esi, eax
jmp 0x40b8f9
call fcn.00409e70
test al, al
je 0x40b8f7
lea ecx, [esp + 0x11]
mov byte [esp + 0x11], 0
call fcn.00404620
test al, al
je 0x40b87b
cmp byte [esp + 0x11], 0
je 0x40b87b
call fcn.00409200
mov esi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push 0x9c4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 2
jne 0x40b809
mov ecx, 0xe1
call fcn.00416830
mov ecx, eax
call fcn.004192b0
mov esi, 0xbc2
jmp 0x40b8f9
cmp esi, 1
je 0x40b8dd
cmp esi, 0xffffffff
jne 0x40b8f7
mov ecx, 0xcc
call fcn.00416830
push ebx
push 0x3e7
mov edi, eax
call fcn.004168a0
mov esi, eax
mov edx, 0x44bba8
push esi
mov ecx, edi
call fcn.00414dc0
add esp, 0xc
mov edi, eax
push esi
call fcn.004323fa
add esp, 4
mov ecx, 0x65
call fcn.00416830
movzx ecx, word [0x4636fc]
push ecx
push 0x30
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push edi
call fcn.004323fa
add esp, 4
or esi, 0xffffffff
jmp 0x40b8f9
call fcn.00407f00
test al, al
jne 0x40b8dd
mov ecx, 0xcc
call fcn.00416830
mov edi, eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
push eax
push 0x3e7
call fcn.004168a0
mov esi, eax
mov edx, 0x44bba8
push esi
mov ecx, edi
call fcn.00414dc0
add esp, 0xc
mov edi, eax
push esi
call fcn.004323fa
movzx ecx, word [0x4636fc]
add esp, 4
push ecx
push 0x30
push dword [esp + 0x1c]
push edi
push 0
call ebx
push edi
call fcn.004323fa
add esp, 4
jmp 0x40b8f7
call fcn.00412660
mov esi, eax
test esi, esi
je 0x40b8f7
mov ecx, esi
call fcn.00413c10
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx]
xor esi, esi
cmp dword [esp + 0x94], 8
jb 0x40b912
push dword [esp + 0x80]
call fcn.0043198a
add esp, 4
mov ecx, dword [esp + 0x2424]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043183b
mov esp, ebp
pop ebp
ret 0x10