Function at 0x402400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407b8e
mov eax, dword fs:[0]
push eax
sub esp, 0x5f8
mov eax, dword [0x40c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5fc], edi
mov dword [ebp - 0x5ec], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x600], edi
mov dword [ebp - 0x5f8], 0
movq qword [edi], xmm0
push 0x2c
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00406b1d
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
mov dword [ebp - 4], 0
lea edi, [esi + 0x10]
cmp dword [esi + 0x14], 0xf
mov edi, dword [edi]
mov dword [ebp - 0x5f8], 1
jbe 0x4024a6
mov eax, dword [esi]
mov esi, eax
add edi, eax
jmp 0x4024a8
add edi, esi
mov dword [ebp - 0x428], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x438], xmm0
cmp esi, edi
jne 0x4024d9
mov ecx, 7
xor eax, eax
mov dword [ebp - 0x424], ecx
mov word [ebp - 0x438], ax
jmp 0x4025fd
sub edi, esi
mov dword [ebp - 0x424], 7
cmp edi, 0x7ffffffe
ja 0x402edd
mov eax, 7
cmp edi, eax
jbe 0x4025b2
mov eax, edi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x40251d
mov ecx, 0x7fffffff
mov dword [ebp - 0x5f0], 0x7ffffffe
add ecx, ecx
jmp 0x402546
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x5f0], eax
lea ecx, [eax + 1]
cmp ecx, 0x7fffffff
ja 0x402ee2
add ecx, ecx
cmp ecx, 0x1000
jb 0x40257f
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x402ee2
push eax
call fcn.00406b1d
add esp, 4
test eax, eax
je 0x402eac
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x424], eax
jmp 0x4025b8
test ecx, ecx
je 0x4025a2
push ecx
call fcn.00406b1d
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x438], ecx
mov dword [ebp - 0x424], eax
jmp 0x4025b8
xor ecx, ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x438], ecx
jmp 0x4025b8
mov ecx, dword [ebp - 0x438]
cmp eax, 7
lea edx, [ebp - 0x438]
cmova edx, ecx
mov dword [ebp - 0x5f0], edx
mov ecx, edx
mov edx, edi
test edi, edi
je 0x4025e5
movsx ax, byte [esi]
lea ecx, [ecx + 2]
lea esi, [esi + 1]
mov word [ecx - 2], ax
sub edx, 1
jne 0x4025d2
mov eax, dword [ebp - 0x5f0]
xor ecx, ecx
mov dword [ebp - 0x428], edi
mov word [eax + edi*2], cx
mov ecx, dword [ebp - 0x424]
cmp ecx, 7
mov dword [ebp - 4], 1
lea eax, [ebp - 0x438]
cmova eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x8010
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x402e7a
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x218]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x420]
push eax
call esi
inc eax
add eax, eax
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
lea eax, [eax + edi*2]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov byte [ebp - 0x5f0], 0
lea edx, [ebp - 0x218]
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0x450]
call fcn.00406320
add esp, 0x10
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 2
call fcn.00402280
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x43c]
mov byte [ebp - 0x5f1], al
cmp ecx, 7
jbe 0x402700
mov edx, dword [ebp - 0x450]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4026f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4026f0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00406b52
mov al, byte [ebp - 0x5f1]
add esp, 8
test al, al
jne 0x40289d
push 0xb0
lea eax, [ebp - 0x530]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x530], 0x40860c
lea ecx, [ebp - 0x4c8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [ebp - 0x52c]
mov byte [ebp - 4], 3
mov esi, 0x21
lea ecx, [ebp - 0x530]
push eax
mov dword [ebp - 0x5f8], esi
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x530]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ofstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x530]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0x534], eax
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [ebp - 0x52c]
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebp - 0x4e4], 0
mov byte [ebp - 0x4ef], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov eax, dword [0x40c854]
mov ecx, dword [0x40c858]
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4f4], 0
push ecx
push 2
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x52c]
call fcn.00404fd0
test eax, eax
jne 0x402819
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x530]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x4e0], 0
jne 0x402854
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.file_error
call fcn.00405420
push 0x405640
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 1
call fcn.00402f10
jmp 0x4028a2
mov edx, str.attackspeed2.0_nmovespeed2.0_nsekmeme1_n
lea ecx, [ebp - 0x530]
call fcn.00405420
lea ecx, [ebp - 0x52c]
call fcn.00404f40
test eax, eax
jne 0x40288c
mov eax, dword [ebp - 0x530]
lea ecx, [ebp - 0x530]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 1
call fcn.00402f10
jmp 0x4028a2
mov esi, 1
push 0xb8
lea eax, [ebp - 0x5e8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5e8], 0x40867c
lea ecx, [ebp - 0x578]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [ebp - 0x5d8]
mov byte [ebp - 4], 7
or esi, 0x10
lea ecx, [ebp - 0x5e8]
push eax
mov dword [ebp - 0x5f8], esi
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x5e8]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x5ec], eax
lea ecx, [ebp - 0x5d8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
lea ecx, [ebp - 0x5d8]
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebp - 0x590], 0
mov byte [ebp - 0x59b], 0
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void_]
mov eax, dword [0x40c854]
mov ecx, dword [0x40c858]
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x5a0], 0
push ecx
push 1
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00404fd0
test eax, eax
jne 0x4029b1
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 0
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x58c], 0
je 0x402e6f
xorps xmm0, xmm0
mov dword [ebp - 0x458], 0
movups xmmword [ebp - 0x468], xmm0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5e8]
mov eax, dword [ebp - 0x5e8]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00406170
mov edx, eax
add esp, 4
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x402e0c
lea eax, [ebp - 0x518]
mov dword [ebp - 0x604], eax
nop dword [eax]
push 0xa8
lea eax, [ebp - 0x528]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x528], 0x408684
lea ecx, [ebp - 0x4c8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::constructor_void_]
push 0
push 0
lea eax, [ebp - 0x518]
mov byte [ebp - 4], 0xc
or esi, 2
lea ecx, [ebp - 0x528]
push eax
mov dword [ebp - 0x5f8], esi
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char_____bool_]
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x528]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x52c], eax
lea ecx, [ebp - 0x518]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void_]
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x468]
cmp dword [ebp - 0x454], 0xf
mov edi, dword [ebp - 0x458]
cmova eax, dword [ebp - 0x468]
mov dword [ebp - 0x5f0], eax
mov eax, 2
mov dword [ebp - method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
cmp edi, 0x7fffffff
ja 0x402e06
test edi, edi
je 0x402b81
cmp edi, 0x1000
jb 0x402b3c
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x402ee2
push eax
call fcn.00406b1d
add esp, 4
test eax, eax
je 0x4026ea
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x402b47
push edi
call fcn.00406b1d
add esp, 4
mov esi, eax
push edi
push dword [ebp - 0x5f0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x50c]
lea ecx, [edi + esi]
mov dword [ebp - 0x4e0], ecx
add esp, 0xc
sub ecx, esi
mov dword [eax], esi
mov eax, dword [ebp - 0x4fc]
mov dword [eax], esi
mov eax, dword [ebp - 0x4ec]
mov dword [eax], ecx
mov eax, 3
jmp 0x402b8b
mov dword [ebp - 0x4e0], 0
mov dword [ebp - 0x4dc], eax
xorps xmm0, xmm0
mov dword [ebp - 0x440], 0
movups xmmword [ebp - 0x450], xmm0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
push 0x3d
lea edx, [ebp - 0x450]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x528]
call fcn.00406170
mov edx, eax
add esp, 4
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x402cfc
xorps xmm0, xmm0
mov dword [ebp - 0x470], 0
movups xmmword [ebp - 0x480], xmm0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x528]
mov eax, dword [ebp - 0x528]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x528]
call fcn.00406170
mov edx, eax
add esp, 4
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x402cbe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [ebp - 0x46c], 0xf
lea esi, [ebp - 0x480]
mov edi, eax
lea eax, [ebp - 0x5ec]
cmova esi, dword [ebp - 0x480]
push eax
push esi
mov dword [edi], 0
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtof]
add esp, 8
fstp dword [ebp - 0x5f0]
cmp esi, dword [ebp - 0x5ec]
je 0x402dfb
cmp dword [edi], 0x22
je 0x402df0
mov ecx, dword [ebp - 0x5fc]
lea eax, [ebp - 0x450]
push eax
call fcn.00404260
movss xmm0, dword [ebp - 0x5f0]
movss dword [eax], xmm0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x46c]
cmp ecx, 0xf
jbe 0x402cfc
mov edx, dword [ebp - 0x480]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402cf2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4026ea
push ecx
push edx
call fcn.00406b52
add esp, 8
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x43c]
cmp ecx, 0xf
jbe 0x402d3a
mov edx, dword [ebp - 0x450]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402d30
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4026ea
push ecx
push edx
call fcn.00406b52
add esp, 8
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_0], vtable.std::basic_istringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x52c], eax
lea ecx, [ebp - 0x518]
call fcn.00404aa0
lea ecx, [ebp - 0x510]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x4c8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00406170
mov edx, eax
add esp, 4
mov eax, dword [edx]
mov ecx, dword [eax + 4]
add ecx, edx
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x402e0c
mov esi, dword [ebp - 0x5f8]
jmp 0x402a40
push str.stof_argument_out_of_range
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
push str.invalid_stof_argument
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const__]
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
lea ecx, [ebp - 0x5d8]
call fcn.00404f40
test eax, eax
jne 0x402e33
push eax
mov eax, dword [ebp - 0x5e8]
lea ecx, [ebp - 0x5e8]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov ecx, dword [ebp - 0x454]
cmp ecx, 0xf
jbe 0x402e6f
mov edx, dword [ebp - 0x468]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402e65
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402e65
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00406b52
add esp, 8
lea ecx, [ebp - 0x5e8]
call fcn.00402fd0
mov ecx, dword [ebp - 0x424]
cmp ecx, 7
jbe 0x402ebc
mov edx, dword [ebp - 0x438]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402eb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402eb2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00406b52
add esp, 8
mov eax, dword [ebp - 0x5fc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406b0f
mov esp, ebp
pop ebp
ret
call fcn.00401170
call fcn.004010d0
int3