Function at 0x40eac0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov edx, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x28]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x20]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
test eax, eax
mov esi, 6
cmovns esi, eax
mov dword [esp + 4], edx
mov eax, edx
mov dword [esp + 0x3c], ecx
or eax, ecx
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
je 0x40eb26
mov ecx, esi
and ecx, 0x400
jmp 0x40eb39
mov eax, esi
and eax, 0x400
xor ecx, ecx
cmp dword [ebp + 0x14], 0
je 0x40eb3f
test eax, eax
jne 0x40eb3f
mov eax, ecx
mov cx, 8
movzx edx, cx
lea ecx, [edx + 0x800]
test esi, 0x10000
cmove edx, ecx
mov dword [esp + 0x6c], edx
mov ecx, esi
and ecx, 0xf
mov dword [esp + 0x24], ecx
sete cl
test eax, eax
setne byte [esp + 0x1c]
mov edx, dword [edi + 0x48]
mov dword [esp + 0xc], edx
test edx, edx
je 0x40ebc6
cmp dword [edi + 0x14], 2
jne 0x40ebc6
cmp dword [ebp + 0x14], 0
setne ch
cmp dword [ebp + 0x10], 0
sete dh
cmp dword [ebp + 0xc], 0
je 0x40ebc6
and dh, ch
jne 0x40ebc6
cmp word [ebp + 0x1c], 0
setne ch
cmp dword [ebp + 0x18], 0
sete dh
test dh, ch
jne 0x40ebc6
cmp dword [esp + 0x24], 0xb
jae 0x40ebc6
mov edx, dword [esp + 0xc]
cmp dword [edx + 0x34], 0
mov edx, dword [edi + 0x10]
je 0x40ebd7
cmp edx, 0xffffffff
jne 0x40ebf1
mov dword [edi + 0x1c], 2
jmp 0x40ebcd
mov dword [edi + 0x1c], 0x18
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0x3c], 0
jne 0x40ebe6
cmp edx, 0xffff
jne 0x40ebf1
mov edx, dword [esp + 0xc]
mov dword [edx + 0x34], 1
mov dword [esp], ebx
mov ebx, dword [esp + 4]
or ebx, dword [esp + 0x3c]
je 0x40ec1e
mov ebx, esi
xor ebx, 0xfffffbff
mov edi, esi
or edi, 0x400
and edi, ebx
jne 0x40ec1e
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x18
jmp 0x40ebcd
mov edi, dword [ebp + 0xc]
cmp byte [edi], 0x2f
jne 0x40ec32
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x19
jmp 0x40ebcd
or cl, byte [esp + 0x1c]
movzx ecx, cl
test eax, eax
mov ebx, dword [ebp + 8]
je 0x40ec4d
mov dword [esp + 0x20], ecx
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x68], eax
jmp 0x40ec9b
mov edi, dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push 0
mov ebx, ecx
call fcn.00402fa0
add esp, 0xc
mov dword [esp + 0x68], eax
xor ecx, ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0
cmp edi, 4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x3c], 0
cmovb eax, ecx
mov dword [esp + 0x24], eax
mov eax, 1
cmovb ebx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 4], edi
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00417520
add esp, 4
cmp eax, 0x10000
jb 0x40ecb9
mov dword [ebx + 0x1c], 0x19
jmp 0x40ebcd
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0
mov ecx, 0xfffffffe
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x24]
or edx, eax
mov edx, 0
je 0x40ecf6
mov edx, eax
xor edx, ecx
mov edi, eax
and edi, 0xfffffffe
lea edx, [edx + edi*2]
inc edx
and edx, dword [ebx]
mov edi, 0xfffffffe
add edi, eax
inc edi
sub eax, edx
and eax, edi
mov edx, eax
mov dword [esp + 0x38], edx
mov edi, dword [esp + 0xc]
mov ebx, dword [edi + 4]
movzx eax, word [ebp + 0x1c]
xor edx, edx
mov dword [esp + 0x64], eax
add eax, dword [esp + 0x1c]
setb dl
mov dword [esp + 0x18], ebx
add eax, ebx
adc edx, 0
add eax, 0x4a
adc edx, 0
cmp ecx, eax
sbb dword [esp + 0x14], edx
jae 0x40ed38
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0xf
jmp 0x40ebcd
mov ebx, dword [edi + 0x34]
test ebx, ebx
mov edi, dword [ebp + 8]
jne 0x40ed9c
mov eax, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 0x1f
mov dword [esp + 0x14], ecx
xor ebx, ebx
mov ecx, dword [esp + 0x64]
add ecx, dword [ebp + 0x38]
mov edx, 0
adc edx, 0xffffffff
add ecx, dword [ebp + 0x40]
adc edx, 0
add eax, eax
add ecx, eax
adc edx, dword [esp + 0x14]
add ecx, dword [esp + 0x38]
adc edx, 0
add ecx, dword [esp + 0x18]
adc edx, 0
add ecx, dword [edi]
adc edx, dword [edi + 4]
add ecx, 0x72
adc edx, 0
cmp edx, 0xffffffff
je 0x40ed9c
mov eax, dword [esp + 0xc]
mov dword [eax + 0x34], 1
mov ebx, 1
mov dword [esp + 0x14], ebx
mov edi, dword [esp + 0x64]
xor ebx, ebx
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x40ede1
mov eax, edx
or eax, 0xfffffffe
mov ecx, edx
and ecx, 0xfffffffe
add ecx, eax
mov eax, dword [ebp + 0xc]
cmp byte [eax + ecx + 1], 0x2f
jne 0x40ede1
cmp dword [ebp + 0x14], 0
jne 0x40ec12
mov ebx, 0x10
mov eax, dword [esp + 4]
or eax, dword [esp + 0x3c]
jne 0x40ec12
mov dword [esp + 0x3c], ebx
mov eax, edx
and eax, 0x2e
mov ecx, edx
xor ecx, 0x2e
lea eax, [ecx + eax*2]
mov ecx, eax
and ecx, edi
xor eax, edi
mov ebx, dword [esp + 0x14]
test ebx, ebx
mov edx, 0x1c
cmove edx, ebx
lea eax, [eax + ecx*2]
add edx, eax
mov eax, edx
mov ecx, dword [esp + 0x18]
and eax, ecx
xor edx, ecx
lea eax, [edx + eax*2]
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 8]
cmp ecx, eax
jae 0x40ee70
test ecx, ecx
mov edi, 1
cmovne edi, ecx
cmp edi, eax
jae 0x40ee4d
mov ecx, edi
and ecx, 2
mov edx, edi
or edi, 2
imul edi, ecx
xor ecx, 2
and edx, 0xfffffffd
imul edx, ecx
add edi, edx
cmp edi, eax
jb 0x40ee31
push edi
mov ebx, dword [esp + 0x10]
push dword [ebx + 0xc]
push dword [ebx]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [eax + 0x30]
add esp, 0x10
test eax, eax
je 0x40ef6d
mov dword [ebx], eax
mov dword [ebx + 8], edi
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov edx, eax
and edx, 1
xor eax, 1
lea eax, [eax + edx*2]
cmp ecx, eax
jae 0x40eed4
test ecx, ecx
mov edi, 1
cmovne edi, ecx
cmp edi, eax
jae 0x40eeaf
mov ecx, edi
and ecx, 2
mov edx, edi
or edi, 2
imul edi, ecx
xor ecx, 2
and edx, 0xfffffffd
imul edx, ecx
add edi, edx
cmp edi, eax
jb 0x40ee93
push edi
mov ebx, dword [esp + 0x10]
push dword [ebx + 0x1c]
push dword [ebx + 0x10]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [eax + 0x30]
add esp, 0x10
test eax, eax
je 0x40ef6d
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], edi
xor eax, eax
cmp dword [ebp + 0x14], 0
je 0x40eefa
cmp dword [esp + 0x20], 0
jne 0x40eefa
push 0x4df40
push 1
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [eax + 0x28]
add esp, 0xc
test eax, eax
je 0x40ef6d
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov ebx, dword [esp + 8]
mov edx, ebx
push dword [esp + 0x38]
mov edi, dword [esp + 4]
push edi
call fcn.0040f640
add esp, 8
test eax, eax
je 0x40efc9
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x38]
add eax, edx
adc ecx, 0
add ebx, edx
mov dword [esp + 8], ebx
adc edi, 0
mov dword [esp], edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
movups xmmword [esp + 0x7e], xmm0
cmp dword [esp + 0x20], 0
je 0x40ef7c
test esi, 0x400
jne 0x40ef7c
xor ebx, ebx
mov dword [esp + 0x14], 0
jmp 0x40ef86
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x10
jmp 0x40ebcd
mov dx, 8
mov dword [esp + 0x14], edx
mov bl, 0x14
mov edx, dword [esp + 0xc]
cmp dword [edx + 0x34], 0
je 0x40efde
xor edi, edi
mov esi, 0xfffffffe
cmp esi, dword [esp + 0x30]
mov edx, 0
sbb edx, dword [esp + 0x34]
jae 0x40f0bc
xor edx, edx
cmp esi, eax
mov eax, 0
sbb eax, ecx
lea eax, [esp + 0x28]
cmovae eax, edx
lea edx, [esp + 0x30]
lea edi, [esp + 0x40]
jmp 0x40f0cd
push dword [esp + 4]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [eax + 0x2c]
add esp, 8
jmp 0x40ebcd
cmp dword [esp + 0x44], 0
jne 0x40f445
cmp dword [esp], 0
jne 0x40f445
mov dword [esp + 0x70], 0x4034b50
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], 0
mov ebx, dword [esp + 0x6c]
movzx edx, bx
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], dh
mov edx, dword [esp + 0x14]
mov byte [esp + 0x78], dl
movups xmmword [esp + 0x79], xmm0
mov byte [esp + 0x89], 0
mov edx, dword [esp + 0x1c]
mov byte [esp + 0x8a], dl
mov byte [esp + 0x8b], dh
mov ebx, dword [ebp + 0x38]
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], bh
lea edx, [esp + 0x70]
push 0x1e
push edx
push ecx
push eax
mov esi, dword [ebp + 8]
push dword [esi + 0x44]
call dword [esi + 0x3c]
add esp, 0x14
cmp eax, 0x1e
jne 0x40f27c
mov edi, dword [esp + 8]
lea eax, [edi + edi]
and eax, 0x3c
xor edi, 0x1e
add edi, eax
mov eax, dword [esp]
adc eax, 0
mov ebx, dword [esp + 0x1c]
push ebx
push dword [ebp + 0xc]
mov dword [esp + 8], eax
push eax
push edi
push dword [esi + 0x44]
call dword [esi + 0x3c]
add esp, 0x14
cmp eax, ebx
jne 0x40f294
add edi, ebx
mov ecx, dword [esp]
adc ecx, 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov edx, edi
jmp 0x40f1f8
cmp esi, eax
mov edx, 0
sbb edx, ecx
jae 0x40f0ef
lea eax, [esp + 0x28]
xor edx, edx
lea ecx, [esp + 0xb0]
push eax
push edi
call fcn.0040f6e0
add esp, 8
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
lea edi, [esp + 0xb0]
jmp 0x40f0f3
mov esi, eax
xor eax, eax
mov dword [esp + 0x70], 0x4034b50
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], 0
movzx edx, word [esp + 0x6c]
mov byte [esp + 0x76], dl
mov byte [esp + 0x77], dh
mov edx, dword [ebp + 0x38]
mov dword [esp + 0xc], eax
add edx, eax
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x78], bl
xorps xmm0, xmm0
movups xmmword [esp + 0x79], xmm0
mov byte [esp + 0x89], 0
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x8a], bl
mov byte [esp + 0x8b], bh
mov byte [esp + 0x8c], dl
mov byte [esp + 0x8d], dh
lea edx, [esp + 0x70]
push 0x1e
push edx
push ecx
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x44]
call dword [esi + 0x3c]
add esp, 0x14
cmp eax, 0x1e
jne 0x40f27c
mov dword [esp + 0x18], edi
mov eax, esi
mov esi, dword [esp + 8]
add esi, 0x1e
mov edi, dword [esp]
adc edi, 0
push ebx
push dword [ebp + 0xc]
push edi
push esi
push dword [eax + 0x44]
call dword [eax + 0x3c]
add esp, 0x14
cmp eax, ebx
jne 0x40f26c
add esi, ebx
adc edi, 0
cmp dword [esp + 0x18], 0
mov ecx, edi
mov edx, esi
je 0x40f1f0
lea eax, [esp + 0xb0]
mov ebx, dword [esp + 0xc]
push ebx
push eax
push ecx
push edx
mov esi, dword [ebp + 8]
push dword [esi + 0x44]
mov dword [esp + 0x14], ecx
mov edi, edx
call dword [esi + 0x3c]
add esp, 0x14
cmp eax, ebx
jne 0x40f27c
mov eax, edi
and eax, ebx
mov ecx, eax
shr ecx, 0x1f
add eax, eax
xor edi, ebx
add edi, eax
mov eax, dword [esp]
adc eax, ecx
mov ebx, dword [ebp + 0x38]
mov ecx, eax
mov edx, edi
jmp 0x40f1fb
mov dword [esp + 0x18], 0
mov ebx, dword [ebp + 0x38]
test ebx, ebx
mov dword [esp], ecx
je 0x40f226
push ebx
push dword [ebp + 0x34]
push ecx
push edx
mov edi, dword [ebp + 8]
push dword [edi + 0x44]
mov esi, edx
call dword [edi + 0x3c]
add esp, 0x14
cmp eax, ebx
jne 0x40f288
add esi, ebx
mov dword [esp + 8], esi
adc dword [esp], 0
jmp 0x40f22a
mov dword [esp + 8], edx
cmp dword [esp + 0x20], 0
je 0x40f29a
mov esi, dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [esp + 8]
push dword [esp + 0x14]
mov eax, dword [ebp + 8]
push dword [eax + 0x44]
call dword [eax + 0x3c]
add esp, 0x14
cmp eax, esi
jne 0x40f26c
mov eax, dword [ebp + 0x14]
add dword [esp + 8], eax
adc dword [esp], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
jmp 0x40f33e
push dword [esp + 4]
mov esi, dword [ebp + 8]
push dword [esi + 0x34]
call dword [esi + 0x2c]
add esp, 8
mov dword [esi + 0x1c], 0x13
jmp 0x40ebcd
mov dword [edi + 0x1c], 0x13
jmp 0x40ebcd
push dword [esp + 4]
jmp 0x40f273
cmp dword [ebp + 0x14], 0
je 0x40f33e
mov eax, dword [ebp + 8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x50], eax
mov eax, dword [esp]
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
push 0
push 0xfffffffffffffff1
push dword [esp + 0x2c]
call fcn.0040ddf0
add esp, 0xc
lea ecx, [esp + 0x48]
push eax
push ecx
push 0x40f740
mov esi, dword [esp + 0x10]
push esi
call fcn.0040dc50
add esp, 0x10
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xac], eax
lea eax, [esp + 0xac]
push 4
push 0
push 0
push eax
push dword [ebp + 0x10]
push esi
call fcn.00403c50
add esp, 0x18
cmp eax, 1
jne 0x40f454
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x54]
mov dword [esp], eax
push dword [esp + 4]
mov eax, dword [ebp + 8]
push dword [eax + 0x34]
call dword [eax + 0x2c]
add esp, 8
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov edi, eax
mov dword [esp + 0x24], ecx
or eax, ecx
je 0x40f567
mov dword [esp + 0x48], 0x8074b50
mov ecx, dword [esp + 0x68]
mov byte [esp + 0x4c], cl
mov byte [esp + 0x4d], ch
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x4e], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x4f], al
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
cmp dword [esp + 0x18], 0
je 0x40f441
mov byte [esp + 0x50], cl
mov byte [esp + 0x51], ch
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x52], al
mov eax, edx
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x53], cl
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x54], dl
mov byte [esp + 0x55], dh
mov byte [esp + 0x56], al
mov byte [esp + 0x57], cl
mov ecx, edi
mov byte [esp + 0x58], cl
mov byte [esp + 0x59], ch
mov eax, edi
shr eax, 0x10
mov byte [esp + 0x5a], al
mov eax, edi
shr eax, 0x18
mov byte [esp + 0x5b], al
mov dword [esp + 0x20], 0x38
mov dword [esp + 0xa4], 0x30
mov ecx, 0x28
mov dword [esp + 4], 0x18
mov dword [esp + 0x38], 0x17
mov eax, dword [esp + 0x24]
mov byte [esp + 0x13], al
mov dword [esp + 0xa0], 0x16
mov dword [esp + 0x9c], 0x15
mov dword [esp + 0x98], 0x14
jmp 0x40f4c3
test edx, edx
je 0x40f470
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c], 0x1d
jmp 0x40ebcd
push dword [esp + 4]
mov esi, dword [ebp + 8]
push dword [esi + 0x34]
call dword [esi + 0x2c]
add esp, 8
mov dword [esi + 0x1c], 0xc
jmp 0x40ebcd
mov dword [esp + 0x50], ecx
mov dword [esp + 0x20], 0x18
mov dword [esp + 0xa4], 0x10
mov ecx, 8
mov dword [esp + 0x38], 0xf
mov dword [esp + 0xa0], 0xe
mov eax, edi
mov byte [esp + 0x13], al
mov dword [esp + 0x9c], 0xd
mov dword [esp + 0x98], 0xc
mov dword [esp + 4], 0x10
mov ebx, edi
mov edx, dword [esp + 0x24]
shrd ebx, edx, cl
mov eax, edx
shr eax, cl
test cl, 0x20
cmove eax, ebx
mov esi, edi
mov ecx, dword [esp + 0xa4]
shrd esi, edx, cl
mov dword [esp + 0xa8], esi
movzx ebx, byte [esp + 0x13]
mov esi, dword [esp + 0x98]
mov byte [esp + esi + 0x48], bl
mov ebx, dword [esp + 0x9c]
mov byte [esp + ebx + 0x48], al
mov eax, edx
shr eax, cl
test cl, 0x20
cmove eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa0]
mov byte [esp + ecx + 0x48], al
mov ecx, dword [esp + 0x20]
shrd edi, edx, cl
shr edx, cl
test cl, 0x20
cmove edx, edi
mov eax, dword [esp + 0x38]
mov byte [esp + eax + 0x48], dl
lea eax, [esp + 0x48]
mov esi, dword [esp + 4]
push esi
push eax
push dword [esp + 8]
push dword [esp + 0x14]
mov eax, dword [ebp + 8]
push dword [eax + 0x44]
call dword [eax + 0x3c]
add esp, 0x14
cmp eax, esi
jne 0x40ebcd
mov eax, dword [esp + 4]
add dword [esp + 8], eax
adc dword [esp], 0
cmp dword [esp + 0x18], 0
je 0x40f5b9
xor ecx, ecx
mov edx, 0xfffffffe
cmp edx, dword [esp + 0x28]
mov eax, 0
sbb eax, dword [esp + 0x2c]
lea eax, [esp + 0x28]
cmovae eax, ecx
cmp edx, dword [esp + 0x30]
mov edx, 0
sbb edx, dword [esp + 0x34]
lea esi, [esp + 0x40]
cmovae esi, ecx
lea edx, [esp + 0x30]
cmovae edx, ecx
lea ecx, [esp + 0xb0]
push eax
push esi
call fcn.0040f6e0
add esp, 8
mov dword [esp + 0xc], eax
movzx ebx, word [esp + 0x6c]
movzx esi, word [esp + 0x14]
movzx eax, word [esp + 0xc]
movzx edi, word [esp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
push dword [esp + 0x44]
push dword [esp + 0x38]
push dword [esp + 0x38]
push 0
push 0
push ebx
push esi
push dword [esp + 0x8c]
push dword [esp + 0x6c]
push dword [esp + 0x6c]
push dword [esp + 0x64]
push dword [esp + 0x64]
push dword [esp + 0x9c]
push dword [ebp + 0x18]
push eax
push dword [esp + 0x5c]
push edi
call fcn.0040f7a0
add esp, 0x4c
test eax, eax
je 0x40ebcd
mov eax, dword [ebp + 8]
inc dword [eax + 0x10]
mov ecx, dword [esp + 8]
mov dword [eax], ecx
mov ecx, dword [esp]
mov dword [eax + 4], ecx
mov eax, 1
jmp 0x40ebcf