Function at 0x408db0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x558
mov eax, dword [0x4360c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x4e8], esi
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov byte [ebp - 0x4e4], 0
push dword [ebp - 0x4e4]
lea edx, [ecx + eax*4]
mov eax, edx
sub eax, ecx
sar eax, 2
push eax
mov byte [esi + 0x20], 0
call fcn.00409e50
mov eax, dword [0x4385d0]
add esp, 8
cmp eax, dword [section.Shared]
je 0x408e27
mov eax, 1
jmp 0x409a7d
movss xmm0, dword [0x433ab0]
xor eax, eax
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4ec], eax
mov eax, dword [esi + 0x14]
xor edi, edi
xor ecx, ecx
xor edx, edx
xor ebx, ebx
movss dword [ebp - 0x54c], xmm0
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d8], edx
mov dword [ebp - 0x4e4], eax
test eax, eax
je 0x408f1b
ja 0x408e88
push 0x80070057
call fcn.00401e80
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x550], ebx
mov eax, dword [eax]
mov dword [ebp - 0x4f4], 1
movzx edx, byte [eax + 5]
movzx ecx, byte [eax + 4]
lea eax, [eax + edx*2]
add eax, 8
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], eax
movq xmm0, qword [ebp - 0x530]
movq qword [ebp - 0x558], xmm0
mov dword [ebp - 0x4fc], 1
mov dword [ebp - 0x4f8], 1
cmp ecx, 3
jbe 0x408ee9
lea edi, [ecx + 1]
mov dword [ebp - 0x4cc], edi
mov eax, dword [ebp - 0x554]
mov ebx, dword [ebp - 0x558]
lea ecx, [ecx*2 + 1]
lea edx, [edx*2 + 5]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d8], edx
mov esi, 1
mov dword [ebp - 0x4c8], esi
cmp eax, esi
jbe 0x409124
mov eax, dword [ebp - 0x4e8]
cmp esi, dword [eax + 0x14]
jae 0x408e7e
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x4e0], 0
mov edi, dword [eax + esi*4]
mov dword [ebp - 0x4e4], edi
movzx edx, byte [edi + 5]
movzx ecx, byte [edi + 4]
lea esi, [edx + 4]
mov dword [ebp - 0x500], edx
lea esi, [edi + esi*2]
xor edx, edx
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], esi
cmp ecx, ebx
je 0x408f8a
mov esi, dword [ebp - 0x4c8]
jmp 0x409079
test ecx, ecx
je 0x408fbf
mov ecx, dword [ebp - 0x4ec]
mov edi, esi
sub edi, ecx
jmp 0x408fa0
mov al, byte [edi + ecx + 1]
cmp al, byte [ecx + 1]
jne 0x40903d
inc edx
add ecx, 2
cmp edx, dword [ebp - 0x4dc]
jb 0x408fa0
mov edi, dword [ebp - 0x4e4]
xor edx, edx
mov dword [ebp - 0x4f0], 1
test ebx, ebx
je 0x408fe8
mov ecx, dword [ebp - 0x4ec]
sub esi, ecx
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x409047
inc edx
add ecx, 2
cmp edx, ebx
jb 0x408fd7
mov esi, dword [ebp - 0x4c8]
mov ecx, dword [ebp - 0x4e8]
lea eax, [esi - 1]
mov dword [ebp - 0x4e0], 1
cmp eax, dword [ecx + 0x14]
jae 0x408e7e
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4 - 4]
add ecx, 8
lea eax, [edi + 8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x409059
test dx, dx
je 0x409039
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x409059
add eax, 4
add ecx, 4
test dx, dx
jne 0x409017
xor ecx, ecx
jmp 0x40905e
mov esi, dword [ebp - 0x4c8]
xor edx, edx
jmp 0x409073
mov esi, dword [ebp - 0x4c8]
mov dword [ebp - 0x4e0], 0
jmp 0x40906d
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
sete al
test eax, eax
jne 0x4090fc
mov edx, dword [ebp - 0x4f0]
mov ecx, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x500]
inc dword [ebp - 0x4f8]
lea eax, [eax*2 + 5]
add dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4e0], 0
jne 0x4090da
movq xmm0, qword [ebp - 0x530]
inc dword [ebp - 0x4fc]
lea eax, [ecx*2 + 1]
add dword [ebp - 0x4d4], eax
movq qword [ebp - 0x558], xmm0
mov eax, dword [ebp - 0x554]
mov ebx, dword [ebp - 0x558]
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x4ec], eax
test edx, edx
jne 0x4090fc
inc dword [ebp - 0x4f4]
mov edi, dword [ebp - 0x4cc]
cmp ebx, 3
jbe 0x409102
lea eax, [ebx + 1]
add edi, eax
mov dword [ebp - 0x4cc], edi
jmp 0x409102
mov edi, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x4e8]
inc esi
mov dword [ebp - 0x4c8], esi
cmp esi, dword [eax + 0x14]
jb 0x408f3d
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ebp - 0x4d8]
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x50c], 0x4000
lea ebx, [eax*8]
sub ebx, eax
mov eax, dword [ebp - 0x4fc]
add ebx, 0xf
lea esi, [eax*8]
sub esi, eax
mov eax, dword [ebp - 0x4f8]
add esi, 0xf
lea eax, [eax*4 + 0xf]
and ebx, 0xfffffff0
add ebx, 0xb0
and esi, 0xfffffff0
and eax, 0xfffffff0
add esi, ebx
add eax, esi
mov dword [ebp - 0x4d8], eax
add eax, edi
add ecx, eax
mov dword [ebp - 0x4d4], eax
xor eax, eax
mov dword [ebp - 0x500], ebx
mov dword [ebp - 0x4e4], esi
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x510], eax
lea esi, [ecx + edx]
mov dword [ebp - 4], eax
mov dword [ebp - 0x540], eax
test esi, esi
je 0x4091ea
add esi, 0x3fff
and esi, 0xffffc000
push esi
push eax
call fcn.00413d22
add esp, 8
test eax, eax
je 0x4091ea
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], esi
mov ecx, dword [ebp - 0x4e8]
xor edi, edi
xor edx, edx
xor esi, esi
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x514], edi
mov dword [ebp - 0x4e0], edx
mov dword [ebp - 0x538], esi
cmp dword [ecx + 0x14], edx
jbe 0x4098d8
mov eax, dword [ebp - 0x4e4]
add eax, 4
mov dword [ebp - 0x524], eax
lea eax, [ebx + 7]
mov dword [ebp - 0x548], eax
mov eax, 0xfffffff9
sub eax, ebx
mov bl, byte [ebp - 0x414]
mov dword [ebp - 0x55c], 0xb7
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 0x560], eax
cmp esi, dword [ecx + 0x14]
jae 0x408e7e
mov eax, dword [ecx + 0x10]
mov esi, dword [eax + esi*4]
mov dword [ebp - 0x534], esi
movzx eax, byte [esi + 5]
movzx ecx, byte [esi + 4]
lea esi, [esi + eax*2]
add esi, 8
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x52c], esi
cmp ecx, edx
jne 0x40936b
xor edx, edx
test ecx, ecx
je 0x4092bf
mov eax, dword [ebp - 0x4ec]
mov ecx, eax
sub esi, eax
lea esp, [esp]
mov al, byte [esi + ecx + 1]
cmp al, byte [ecx + 1]
jne 0x40935f
inc edx
add ecx, 2
cmp edx, dword [ebp - 0x530]
jb 0x4092a0
mov esi, dword [ebp - 0x52c]
xor edx, edx
cmp dword [ebp - 0x4e0], edx
jbe 0x4092ec
mov eax, dword [ebp - 0x4ec]
mov ecx, eax
sub esi, eax
mov ax, word [ecx + esi]
cmp ax, word [ecx]
jne 0x409522
inc edx
add ecx, 2
cmp edx, dword [ebp - 0x4e0]
jb 0x4092d3
mov esi, dword [ebp - 0x538]
test esi, esi
je 0x4096e2
mov ecx, dword [ebp - 0x4e8]
lea eax, [esi - 1]
cmp eax, dword [ecx + 0x14]
jae 0x408e7e
mov eax, dword [ecx + 0x10]
mov ecx, dword [ebp - 0x534]
mov eax, dword [eax + esi*4 - 4]
add eax, 8
add ecx, 8
nop
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x409346
test dx, dx
je 0x409342
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x409346
add ecx, 4
add eax, 4
test dx, dx
jne 0x409320
xor ecx, ecx
jmp 0x40934b
sbb ecx, ecx
or ecx, 1
xor eax, eax
test ecx, ecx
sete al
test eax, eax
jne 0x4098b5
jmp 0x4096e2
mov esi, dword [ebp - 0x52c]
mov ecx, dword [ebp - 0x530]
xor dl, dl
mov al, cl
cmp ecx, 3
ja 0x4093b5
shl al, 2
or al, 1
mov dword [ebp - 0x508], 0
mov byte [ebp - 0x508], al
test al, 0xfc
jbe 0x409471
movzx ecx, dl
inc dl
movzx eax, byte [esi + ecx*2 + 1]
mov byte [ebp + ecx - 0x507], al
movzx eax, byte [ebp - 0x508]
shr al, 2
cmp dl, al
jb 0x409391
jmp 0x409471
mov byte [ebp - 0x414], al
test cl, cl
je 0x4093db
nop
movzx ecx, dl
inc dl
movzx eax, byte [esi + ecx*2 + 1]
mov byte [ebp + ecx - 0x413], al
mov al, byte [ebp - 0x414]
cmp dl, al
jb 0x4093c0
mov edi, dword [ebp - 0x4d8]
movzx ebx, al
inc ebx
add edi, ebx
cmp edi, dword [ebp - 0x518]
jbe 0x409422
lea esi, [edi + 0x3fff]
and esi, 0xffffc000
push esi
push dword [ebp - 0x4c8]
call fcn.00413d22
add esp, 8
test eax, eax
je 0x409456
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], esi
jmp 0x409428
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x4d8]
push ebx
lea ecx, [ebp - 0x414]
push ecx
push eax
call fcn.00414f60
mov eax, dword [ebp - 0x4cc]
add esp, 0xc
cmp edi, eax
cmova eax, edi
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x4d8]
shl eax, 2
mov dword [ebp - 0x4d8], edi
mov edi, dword [ebp - 0x4cc]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x560]
add ecx, dword [ebp - 0x548]
mov ebx, dword [ebp - 0x55c]
mov eax, 0x24924925
mul ecx
movzx eax, byte [ebp - 0x505]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 2
shl ecx, 8
or ecx, eax
mov dword [ebp - 0x505], ecx
cmp ebx, dword [ebp - 0x518]
jbe 0x4094e2
lea esi, [ebx + 0x3fff]
and esi, 0xffffc000
push esi
push dword [ebp - 0x4c8]
call fcn.00413d22
add esp, 8
test eax, eax
je 0x409519
mov ecx, eax
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x518], esi
jmp 0x4094e8
mov ecx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x508]
mov dword [ebx + ecx - 7], eax
mov ax, word [ebp - 0x504]
mov word [ebx + ecx - 3], ax
mov al, byte [ebp - 0x502]
cmp ebx, edi
cmova edi, ebx
mov byte [ebx + ecx - 1], al
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x514], edi
add ebx, 7
mov dword [ebp - 0x55c], ebx
mov ecx, dword [ebp - 0x530]
movq xmm0, qword [ebp - 0x530]
mov al, cl
xor dl, dl
movq qword [ebp - 0x558], xmm0
mov dword [ebp - 0x550], 0
mov byte [ebp - 0x4cd], al
mov byte [ebp - 0x414], al
test cl, cl
je 0x409581
mov esi, dword [ebp - 0x52c]
lea esp, [esp]
movzx ecx, dl
inc dl
mov ax, word [esi + ecx*2]
mov word [ebp + ecx*2 - 0x413], ax
mov al, byte [ebp - 0x414]
mov byte [ebp - 0x4cd], al
cmp dl, al
jb 0x409560
movzx eax, al
lea ebx, [eax*2 + 1]
mov eax, dword [ebp - 0x4d4]
lea edi, [ebx + eax]
cmp edi, dword [ebp - 0x518]
jbe 0x4095d3
lea esi, [edi + 0x3fff]
and esi, 0xffffc000
push esi
push dword [ebp - 0x4c8]
call fcn.00413d22
add esp, 8
test eax, eax
je 0x409605
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x518], esi
push ebx
mov ebx, dword [ebp - 0x4c8]
lea ecx, [ebp - 0x414]
push ecx
add eax, ebx
push eax
call fcn.00414f60
mov eax, dword [ebp - 0x4cc]
add esp, 0xc
cmp edi, eax
cmova eax, edi
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x514], eax
jmp 0x40960b
mov ebx, dword [ebp - 0x4c8]
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x4f0]
xor eax, dword [ebp - 0x541]
mov dword [ebp - 0x4d4], edi
mov edi, dword [ebp - 0x548]
and eax, 0xff
xor eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x541], eax
cmp edi, dword [ebp - 0x518]
jbe 0x409684
mov esi, dword [ebp - 0x500]
add esi, 0x4006
add esi, dword [ebp - 0x560]
add esi, edi
and esi, 0xffffc000
push esi
push ebx
call fcn.00413d22
add esp, 8
test eax, eax
je 0x4096bb
mov ebx, eax
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x518], esi
mov eax, dword [ebp - 0x544]
mov dword [edi + ebx - 7], eax
mov ax, word [ebp - 0x540]
mov word [edi + ebx - 3], ax
mov al, byte [ebp - 0x53e]
mov byte [edi + ebx - 1], al
mov eax, dword [ebp - 0x4cc]
cmp edi, eax
cmova eax, edi
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x554]
mov bl, byte [ebp - 0x4cd]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x558]
add edi, 7
mov dword [ebp - 0x548], edi
mov dword [ebp - 0x4e0], eax
mov edi, dword [ebp - 0x534]
and bl, 3
mov al, byte [edi + 5]
shl al, 2
or bl, al
and bl, 0xfc
xor dl, dl
mov byte [ebp - 0x414], bl
test bl, 0xfc
jbe 0x409724
movzx ecx, dl
inc dl
mov ax, word [edi + ecx*2 + 8]
mov word [ebp + ecx*2 - 0x40f], ax
mov bl, byte [ebp - 0x414]
mov al, bl
shr al, 2
cmp dl, al
jb 0x409703
mov eax, dword [edi]
mov ecx, dword [ebp - 0x4dc]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mov dword [ebp - 0x413], eax
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x433ac0]
movzx eax, bl
shr eax, 2
cvtpd2ps xmm0, xmm0
lea eax, [eax*2 + 5]
addss xmm0, dword [ebp - 0x54c]
lea edi, [eax + ecx]
mov dword [ebp - 0x534], eax
movss dword [ebp - 0x54c], xmm0
cmp edi, dword [ebp - 0x518]
jbe 0x4097b1
lea esi, [edi + 0x3fff]
and esi, 0xffffc000
push esi
push dword [ebp - 0x4c8]
call fcn.00413d22
add esp, 8
test eax, eax
je 0x4097e6
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], esi
jmp 0x4097b7
mov eax, dword [ebp - 0x4c8]
push dword [ebp - 0x534]
lea edx, [ebp - 0x414]
push edx
add eax, ecx
push eax
call fcn.00414f60
mov eax, dword [ebp - 0x4cc]
add esp, 0xc
cmp edi, eax
cmova eax, edi
mov dword [ebp - 0x4cc], eax
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x524]
mov esi, dword [ebp - 0x4dc]
lea eax, [ecx - 4]
mov dword [ebp - 0x4dc], edi
mov dword [ebp - 0x510], eax
cmp ecx, dword [ebp - 0x518]
jbe 0x409842
lea edi, [ecx + 0x3fff]
and edi, 0xffffc000
push edi
push dword [ebp - 0x4c8]
call fcn.00413d22
mov ecx, dword [ebp - 0x524]
add esp, 8
test eax, eax
je 0x40986b
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], edi
jmp 0x409848
mov eax, dword [ebp - 0x4c8]
mov edi, dword [ebp - 0x4cc]
cmp ecx, edi
cmova edi, ecx
mov dword [ecx + eax - 4], esi
mov dword [ebp - 0x510], ecx
mov dword [ebp - 0x4cc], edi
mov dword [ebp - 0x514], edi
jmp 0x409871
mov edi, dword [ebp - 0x4cc]
add ecx, 4
add dword [ebp - 0x4f0], 0x100
mov dword [ebp - 0x524], ecx
mov ecx, dword [0x43a530]
inc ecx
mov eax, 0xd1b71759
mul ecx
shr edx, 0xd
imul edx, edx, 0x2710
mov eax, ecx
mov dword [0x43a530], ecx
sub eax, edx
jne 0x4098af
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x538]
mov ecx, dword [ebp - 0x4e8]
inc esi
mov dword [ebp - 0x538], esi
cmp esi, dword [ecx + 0x14]
jae 0x4098d2
mov edx, dword [ebp - 0x4e0]
jmp 0x409252
mov ebx, dword [ebp - 0x500]
push 0xa8
lea eax, [ebp - 0x4c0]
push 0
push eax
call fcn.00414e20
mov eax, dword [ebp - 0x4f4]
movss xmm1, dword [ebp - 0x54c]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x4e4]
add esp, 0xc
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x44c]
push eax
mov dword [ebp - 0x4c4], 0x51505943
mov dword [ebp - 0x4c0], 2
movss dword [ebp - 0x444], xmm1
mov dword [ebp - 0x43c], 0xb0
mov dword [ebp - 0x434], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov esi, dword [ebp - 0x4e8]
mov ecx, 1
mov eax, dword [esi + 0x24]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x82
or ecx, eax
jge 0x409996
push 0x82
lea ecx, [esi + 0x24]
call fcn.00402440
push 0x80
push dword [esi + 0x24]
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x4099b6
xor ecx, ecx
jmp 0x4099cc
push dword [eax - 8]
push eax
call fcn.00413af9
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x408e7e
mov eax, dword [esi + 0x24]
cmp ecx, dword [eax - 8]
jg 0x408e7e
mov ebx, dword [ebp - 0x4c8]
mov dword [eax - 0xc], ecx
mov eax, dword [esi + 0x24]
xor edx, edx
cmp dword [ebp - 0x518], 0xac
mov word [eax + ecx*2], dx
jae 0x409a0a
push 0x4000
push ebx
call fcn.00413d22
add esp, 8
test eax, eax
je 0x409a29
mov ebx, eax
push 0xac
lea eax, [ebp - 0x4c4]
push eax
push ebx
call fcn.00414f60
mov eax, 0xac
add esp, 0xc
cmp edi, eax
cmovb edi, eax
mov esi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x540]
push eax
push 0
xorps xmm0, xmm0
push esi
movlpd qword [ebp - 0x544], xmm0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x409a53
call fcn.00401ec0
push 0
lea eax, [ebp - 0x500]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x409a6e
call fcn.00401ec0
test ebx, ebx
je 0x409a7b
push ebx
call fcn.00413ac1
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413156
mov esp, ebp
pop ebp
ret 4