Function at 0x40e800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5d8a32
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x638190]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x248]
mov ebx, dword [esp + 0x24c]
mov esi, ecx
mov dword [esp + 0x58], eax
mov dword [esp + 0x18], ebx
xor edi, edi
push ebx
lea ecx, [esp + 0x15c]
mov dword [esp + 0x244], 1
mov dword [esp + 0x18], edi
call fcn.0053b5d0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x240], 2
call fcn.005bfee0
push edi
lea ecx, [esp + 0xa0]
mov byte [esp + 0x244], 3
call fcn.005bec90
lea ecx, [esp + 0x28]
mov dword [esp + 0x9c], edi
xor ebp, ebp
call fcn.004f8520
lea ecx, [esp + 0x44]
mov byte [esp + 0x240], 4
call fcn.004f8520
lea ecx, [esp + 0x88]
mov byte [esp + 0x240], 5
call fcn.004f8520
lea ecx, [esp + 0x74]
mov byte [esp + 0x240], 6
call fcn.004f8520
lea ecx, [esp + 0xa8]
mov byte [esp + 0x240], 7
call fcn.004f1250
lea ecx, [esp + 0xec]
mov byte [esp + 0x240], 8
call fcn.004f1250
lea ecx, [esp + 0x134]
mov byte [esp + 0x240], 9
call fcn.004f1250
lea ecx, [esp + 0x110]
mov byte [esp + 0x240], 0xa
call fcn.004f1250
lea ecx, [esp + 0x158]
mov byte [esp + 0x240], 0xb
call fcn.0053b220
mov ecx, dword [esp + 0x164]
cmp ecx, dword [esp + 0x168]
ja 0x40f52b
lea ebx, [ebx]
lea ecx, [esp + 0x158]
call fcn.0053b460
sub eax, 1
je 0x40ea06
sub eax, 5
jne 0x40ea75
mov ecx, dword [esp + 0x178]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
call eax
cmp eax, 0xa
jl 0x40ea87
inc ebp
cmp ebp, 1
jne 0x40e9b1
mov ecx, dword [esp + 0x178]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004f8960
jmp 0x40ea7e
cmp ebp, 2
jne 0x40e9cc
mov edx, dword [esp + 0x178]
push edx
lea ecx, [esp + 0x48]
call fcn.004f8960
jmp 0x40ea7e
cmp ebp, 3
jne 0x40e9ea
mov eax, dword [esp + 0x178]
push eax
lea ecx, [esp + 0x8c]
call fcn.004f8960
jmp 0x40ea7e
cmp ebp, 4
jne 0x40ea78
mov ecx, dword [esp + 0x178]
push ecx
lea ecx, [esp + 0x78]
call fcn.004f8960
jmp 0x40ea7e
mov ecx, dword [esp + 0x178]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
call eax
cmp eax, 0xa
jl 0x40ea87
inc edi
cmp edi, 1
jne 0x40ea30
mov ecx, dword [esp + 0x178]
push ecx
lea ecx, [esp + 0xac]
jmp 0x40ea70
cmp edi, 2
jne 0x40ea46
mov edx, dword [esp + 0x178]
push edx
lea ecx, [esp + 0xf0]
jmp 0x40ea70
cmp edi, 3
jne 0x40ea5c
mov eax, dword [esp + 0x178]
push eax
lea ecx, [esp + 0x138]
jmp 0x40ea70
cmp edi, 4
jne 0x40ea75
mov ecx, dword [esp + 0x178]
push ecx
lea ecx, [esp + 0x114]
call fcn.004f2e40
cmp ebp, 4
jg 0x40ecc3
cmp edi, 4
jg 0x40ecc3
lea ecx, [esp + 0x158]
call fcn.0053b450
mov edx, dword [esp + 0x164]
cmp edx, dword [esp + 0x168]
jbe 0x40e960
cmp ebp, 2
jne 0x40ee6b
cmp edi, ebp
jne 0x40f2e4
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00406870
cmp eax, 1
jne 0x40f52b
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0xec]
call fcn.004f41c0
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xac]
push edx
mov ecx, esi
call fcn.00404dd0
cmp eax, 1
jne 0x40f52b
fld qword [0x5f3dd0]
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
lea eax, [esp + 0x28]
jne 0x40ec3f
call fcn.00403a80
fstp qword [esp + 0x3c]
lea eax, [esp + 0x44]
call fcn.00403a80
fcomp qword [esp + 0x3c]
fnstsw ax
test ah, 0x41
lea eax, [esp + 0x28]
je 0x40eb97
lea eax, [esp + 0x44]
call fcn.00403a80
fstp qword [esp + 0x18]
mov edi, dword [esp + 0xc4]
lea ecx, [esp + 0x28]
add edi, edi
call fcn.004f85c0
mov ebp, eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x6c]
push ecx
mov ecx, ebx
add ebp, edi
call edx
fld qword [esp + 0x18]
sub esp, 8
fstp qword [esp]
push ebp
push edi
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0xe0]
call fcn.004f7a20
cmp edi, dword [esp + 0x250]
mov byte [esp + 0x240], 0xc
jl 0x40ec2b
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, dword [esi + 0x20]
push edx
call fcn.00493c70
sub esp, 0xc
mov edi, eax
lea eax, [esp + 0x26c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.005be070
push edi
mov ecx, esi
call fcn.00405d30
test edi, edi
je 0x40ec33
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xcc]
jmp 0x40f51e
call fcn.00403a80
fstp qword [esp + 0x3c]
lea eax, [esp + 0x44]
call fcn.00403a80
fcomp qword [esp + 0x3c]
fnstsw ax
test ah, 0x41
lea eax, [esp + 0x28]
je 0x40ec64
lea eax, [esp + 0x44]
call fcn.00403a80
fstp qword [esp + 0x3c]
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0xac]
call fcn.004f55d0
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0xf0]
call fcn.004f55d0
push eax
lea ecx, [esp + 0x68]
call fcn.005befc0
fstp qword [esp + 0x5c]
lea ecx, [esp + 0x28]
call fcn.004f85c0
mov dword [esp + 0x6c], eax
fild dword [esp + 0x6c]
fld qword [esp + 0x5c]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x40edb4
fstp st(0)
lea ecx, [esp + 0x110]
mov byte [esp + 0x240], 0xa
call fcn.004f1b60
lea ecx, [esp + 0x134]
mov byte [esp + 0x240], 9
call fcn.004f1b60
lea ecx, [esp + 0xec]
mov byte [esp + 0x240], 8
call fcn.004f1b60
lea ecx, [esp + 0xa8]
mov byte [esp + 0x240], 7
call fcn.004f1b60
lea ecx, [esp + 0x74]
mov byte [esp + 0x240], 6
call fcn.004f85b0
lea ecx, [esp + 0x88]
mov byte [esp + 0x240], 5
call fcn.004f85b0
lea ecx, [esp + 0x44]
mov byte [esp + 0x240], 4
call fcn.004f85b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x240], 3
call fcn.004f85b0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x240], 2
call fcn.005c2ee0
lea ecx, [esp + 0x158]
mov byte [esp + 0x240], 1
call fcn.0053b190
lea ecx, [esp + 0x254]
mov byte [esp + 0x240], 0
call fcn.005bd9f0
lea ecx, [esp + 0x260]
mov dword [esp + 0x240], 0xffffffff
call fcn.005bd9f0
xor eax, eax
jmp 0x40f619
call fcn.005c3ce0
mov ebp, eax
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
call fcn.004f9850
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
mov ebx, dword [esp + 0xc4]
mov edi, eax
lea eax, [esp + 0x20]
push eax
call edx
fld qword [esp + 0x3c]
push ebx
push edi
push ebp
sub esp, 8
lea eax, [esp + 0x34]
fstp qword [esp]
push eax
lea ecx, [esp + 0xe4]
call fcn.0053a600
cmp edi, dword [esp + 0x250]
mov byte [esp + 0x240], 0xd
jl 0x40ee4a
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, dword [esi + 0x20]
push edx
call fcn.00493bd0
sub esp, 0xc
mov edi, eax
lea eax, [esp + 0x26c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.005be070
push edi
mov ecx, esi
call fcn.00405d30
test edi, edi
je 0x40ee52
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x240], 0xb
call fcn.0053a710
jmp 0x40f52b
cmp ebp, 4
jne 0x40f52b
test edi, edi
jne 0x40f00e
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.004068f0
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0x44]
call fcn.004f85c0
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.004f85c0
cmp eax, edi
jl 0x40ef2e
lea ecx, [esp + 0x28]
call fcn.004f85c0
lea ecx, [esp + 0x44]
mov ebp, eax
call fcn.004f85c0
mov edi, eax
lea eax, [esp + 0x28]
call fcn.00403a80
fstp qword [esp + 0x20]
lea eax, [esp + 0x88]
call fcn.00403a80
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
jne 0x40ef25
lea eax, [esp + 0x28]
jmp 0x40ef6d
lea eax, [esp + 0x88]
jmp 0x40ef6d
lea ecx, [esp + 0x44]
call fcn.004f85c0
lea ecx, [esp + 0x28]
mov ebp, eax
call fcn.004f85c0
mov edi, eax
lea eax, [esp + 0x44]
call fcn.00403a80
fstp qword [esp + 0x20]
lea eax, [esp + 0x74]
call fcn.00403a80
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
lea eax, [esp + 0x44]
je 0x40ef6d
lea eax, [esp + 0x74]
call fcn.00403a80
fstp qword [esp + 0x18]
mov edx, dword [ebx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x5c]
push eax
mov ecx, ebx
call edx
fld qword [esp + 0x18]
push 0
push edi
push ebp
sub esp, 8
lea eax, [esp + 0x70]
fstp qword [esp]
push eax
lea ecx, [esp + 0xe4]
call fcn.0053a600
cmp edi, dword [esp + 0x250]
mov byte [esp + 0x240], 0xe
jl 0x40efed
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, dword [esi + 0x20]
push edx
call fcn.00493bd0
sub esp, 0xc
mov edi, eax
lea eax, [esp + 0x26c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.005be070
push edi
mov ecx, esi
call fcn.00405d30
test edi, edi
je 0x40eff5
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x240], 0xb
call fcn.0053a710
jmp 0x40f52b
cmp edi, 4
jne 0x40f52b
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.004068f0
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0x44]
call fcn.004f85c0
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.004f85c0
cmp eax, edi
mov edi, dword [esp + 0xc4]
jl 0x40f0d9
lea ecx, [esp + 0x28]
call fcn.004f85c0
lea ebp, [eax + edi*2]
mov edi, dword [esp + 0xc4]
lea ecx, [esp + 0x44]
call fcn.004f85c0
lea edi, [eax + edi*2]
lea eax, [esp + 0x28]
call fcn.00403a80
fstp qword [esp + 0x20]
lea eax, [esp + 0x88]
call fcn.00403a80
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
jne 0x40f0d0
lea eax, [esp + 0x28]
jmp 0x40f121
lea eax, [esp + 0x88]
jmp 0x40f121
lea ecx, [esp + 0x44]
call fcn.004f85c0
lea ebp, [eax + edi*2]
mov edi, dword [esp + 0xc4]
lea ecx, [esp + 0x28]
call fcn.004f85c0
lea edi, [eax + edi*2]
lea eax, [esp + 0x44]
call fcn.00403a80
fstp qword [esp + 0x20]
lea eax, [esp + 0x74]
call fcn.00403a80
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
lea eax, [esp + 0x44]
je 0x40f121
lea eax, [esp + 0x74]
call fcn.00403a80
fstp qword [esp + 0x18]
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0xf0]
call fcn.004f1bd0
fld qword [eax]
lea edx, [esp + 0x3c]
fstp qword [esp + 0x20]
push edx
lea ecx, [esp + 0xac]
call fcn.004f4130
fld qword [eax]
fld qword [esp + 0x20]
sub esp, 0x10
fstp qword [esp + 8]
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
test eax, eax
je 0x40ecc3
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x138]
call fcn.004f1bd0
fld qword [eax]
lea ecx, [esp + 0x3c]
fstp qword [esp + 0x20]
push ecx
lea ecx, [esp + 0xf0]
call fcn.004f4130
fld qword [eax]
fld qword [esp + 0x20]
sub esp, 0x10
fstp qword [esp + 8]
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
test eax, eax
je 0x40ecc3
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x114]
call fcn.004f1bd0
fld qword [eax]
lea eax, [esp + 0x3c]
fstp qword [esp + 0x20]
push eax
lea ecx, [esp + 0x138]
call fcn.004f4130
fld qword [eax]
fld qword [esp + 0x20]
sub esp, 0x10
fstp qword [esp + 8]
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
test eax, eax
je 0x40ecc3
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0xac]
call fcn.004f1bd0
fld qword [eax]
lea edx, [esp + 0x3c]
fstp qword [esp + 0x20]
push edx
lea ecx, [esp + 0x114]
call fcn.004f4130
fld qword [eax]
fld qword [esp + 0x20]
sub esp, 0x10
fstp qword [esp + 8]
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
test eax, eax
je 0x40ecc3
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, ebx
call edx
fld qword [esp + 0x18]
mov eax, dword [esp + 0xc4]
push eax
push edi
push ebp
sub esp, 8
lea ecx, [esp + 0x70]
fstp qword [esp]
push ecx
lea ecx, [esp + 0xe4]
call fcn.0053a600
cmp edi, dword [esp + 0x250]
mov byte [esp + 0x240], 0xf
jl 0x40f2c3
mov eax, dword [esp + 0x58]
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0xcc]
push edx
push eax
call fcn.00493bd0
sub esp, 0xc
lea edx, [esp + 0x26c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov edi, eax
call fcn.005be070
push edi
mov ecx, esi
call fcn.00405d30
test edi, edi
je 0x40f2cb
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xcc]
mov byte [esp + 0x240], 0xb
call fcn.0053a710
jmp 0x40f52b
cmp edi, 4
jne 0x40f52b
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00406870
cmp eax, 1
jne 0x40f52b
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.00404d70
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0xec]
call fcn.004f41c0
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0xac]
push edx
mov ecx, esi
call fcn.00404dd0
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0x134]
call fcn.004f41c0
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
jne 0x40f52b
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0xac]
push ecx
mov ecx, esi
call fcn.00404dd0
cmp eax, 1
jne 0x40f52b
lea ecx, [esp + 0x110]
call fcn.004f41c0
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
jne 0x40f52b
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0xac]
push eax
mov ecx, esi
call fcn.00404dd0
cmp eax, 1
jne 0x40f52b
fld qword [0x5f3de8]
sub esp, 8
lea ecx, [esp + 0xb0]
fstp qword [esp]
call fcn.004f41c0
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00404e80
cmp eax, 1
jne 0x40f52b
lea eax, [esp + 0x28]
call fcn.00403a80
fstp qword [esp + 0x20]
lea eax, [esp + 0x44]
call fcn.00403a80
fcomp qword [esp + 0x20]
fnstsw ax
test ah, 0x41
lea eax, [esp + 0x28]
je 0x40f474
lea eax, [esp + 0x44]
call fcn.00403a80
fstp qword [esp + 0x3c]
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004f9850
lea ecx, [esp + 0x28]
mov edi, eax
call fcn.004f85c0
mov edx, dword [ebx]
mov edx, dword [edx + 0x28]
mov ebp, eax
lea eax, [esp + 0x6c]
push eax
mov ecx, ebx
add ebp, edi
call edx
fld qword [esp + 0x3c]
sub esp, 8
fstp qword [esp]
push ebp
push edi
lea eax, [esp + 0x7c]
push eax
lea ecx, [esp + 0x228]
call fcn.004f7a20
cmp edi, dword [esp + 0x250]
mov byte [esp + 0x240], 0x10
jl 0x40f50f
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x214]
push ecx
mov ecx, dword [esi + 0x20]
push edx
call fcn.00493c70
sub esp, 0xc
mov edi, eax
lea eax, [esp + 0x26c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.005be070
push edi
mov ecx, esi
call fcn.00405d30
test edi, edi
je 0x40f517
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x214]
mov byte [esp + 0x240], 0xb
call fcn.004f7a50
lea ecx, [esp + 0x110]
mov byte [esp + 0x240], 0xa
call fcn.004f1b60
lea ecx, [esp + 0x134]
mov byte [esp + 0x240], 9
call fcn.004f1b60
lea ecx, [esp + 0xec]
mov byte [esp + 0x240], 8
call fcn.004f1b60
lea ecx, [esp + 0xa8]
mov byte [esp + 0x240], 7
call fcn.004f1b60
lea ecx, [esp + 0x74]
mov byte [esp + 0x240], 6
call fcn.004f85b0
lea ecx, [esp + 0x88]
mov byte [esp + 0x240], 5
call fcn.004f85b0
lea ecx, [esp + 0x44]
mov byte [esp + 0x240], 4
call fcn.004f85b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x240], 3
call fcn.004f85b0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x240], 2
call fcn.005c2ee0
lea ecx, [esp + 0x158]
mov byte [esp + 0x240], 1
call fcn.0053b190
lea ecx, [esp + 0x254]
mov byte [esp + 0x240], 0
call fcn.005bd9f0
lea ecx, [esp + 0x260]
mov dword [esp + 0x240], 0xffffffff
call fcn.005bd9f0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.005c3bb6
add esp, 0x230
ret 0x24