Function at 0x4106e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48f9c1
mov eax, dword fs:[0]
push eax
sub esp, 0x934
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x930], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x948]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x3de8]
mov edx, dword [edx + 4]
xor edi, edi
lea ecx, [esi + 0x3de8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x10000000
mov dword [esp + 0x2c], 0x1f5
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x19b
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
lea ecx, [esp + 0x40]
mov dword [esp + 0x2c], edx
push ecx
lea edx, [esp + 0x18]
mov ebp, 0x1d
mov ebx, 0x50000000
push edx
lea ecx, [esi + 0x4b3c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1f7
mov dword [esp + 0x20], 0x1dc
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 0x495bb8
mov dword [esp + 0x4c], 0x495b88
mov dword [esp + 0x50], 0x495b58
mov dword [esp + 0x54], 0x495b28
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x4f64]
mov edx, eax
sub ecx, edx
lea ecx, [ecx]
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x410820
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x19a
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
lea ecx, [esp + 0x40]
mov dword [esp + 0x2c], edx
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esi + 0x51e4]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1f8
mov dword [esp + 0x20], 0x1fc
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 0x495b00
mov dword [esp + 0x4c], 0x495ad8
mov dword [esp + 0x50], 0x495ab0
mov dword [esp + 0x54], 0x495a88
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x560c]
mov edx, eax
sub ecx, edx
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x4108d6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x678]
mov edx, dword [esi + 0x807c]
mov edx, dword [edx + 4]
lea ebp, [esi + 0x807c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ecx
push eax
mov ecx, ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0x201
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x20], 0x33
mov dword [esp + 0x24], 0x1f8
mov dword [esp + 0x28], 0x1e
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
push 0x20
mov ecx, ebp
call fcn.0040a980
mov ecx, dword [esi + 4]
push 0x400
push 0x104
lea eax, [esp + 0x334]
push eax
push 0xc8
push ecx
mov dword [esi + 0x86e8], 0xec9505
mov word [esp + 0x340], di
call fcn.0040e380
add esp, 0x14
lea edx, [esp + 0x32c]
push edx
mov ecx, ebp
call fcn.0040a900
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x678]
mov edx, dword [esi + 0x8928]
mov edx, dword [edx + 4]
lea ebp, [esi + 0x8928]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ecx
push eax
mov ecx, ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0x202
mov dword [esp + 0x1c], 0x14
mov dword [esp + 0x20], 0x51
mov dword [esp + 0x24], 0x1f8
mov dword [esp + 0x28], 0x32
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
push 0x10
mov ecx, ebp
call fcn.0040a980
mov ecx, dword [esi + 4]
push 0x400
push 0x104
lea eax, [esp + 0x53c]
push eax
push 0xc9
push ecx
mov dword [esi + 0x8f94], 0xffffff
mov word [esp + 0x548], di
call fcn.0040e380
add esp, 0x14
lea edx, [esp + 0x534]
push edx
mov ecx, ebp
call fcn.0040a900
mov ecx, dword [esi + 4]
lea eax, [esp + 0x73c]
push eax
mov word [esp + 0x128], di
push ecx
call fcn.0040c490
add esp, 8
test eax, eax
jl 0x410a81
lea edx, [esp + 0x73c]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xfffffffffffffff2
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [esp + 0x50], eax
mov ecx, dword [esi + 4]
push 0x400
push 0x104
lea eax, [esp + 0x12c]
push eax
push 0xca
push ecx
call fcn.0040e380
mov edx, dword [esp + 0x64]
push edx
lea eax, [esp + 0x13c]
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], 0x204
mov dword [esp + 0x34], 0x19
mov dword [esp + 0x38], 0xec
call fcn.0040d310
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x678]
mov dword [esp + 0x48], ecx
lea ebp, [esi + 0x91d4]
add esp, 0x1c
mov dword [esp + 0x20], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 4]
push ecx
mov ecx, ebp
mov dword [esp + 0x28], 0x14
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
push 0x20
mov ecx, ebp
call fcn.0040a980
lea eax, [esp + 0x124]
push eax
mov ecx, ebp
mov dword [esi + 0x9840], 0xffffff
call fcn.0040a900
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x128]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x203
call fcn.0040d310
mov edx, dword [esi + 0xc]
add eax, 0x19
mov dword [esp + 0x20], eax
mov ecx, 0x20e
sub ecx, eax
mov eax, dword [esi + 0x678]
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0x9a80]
mov edx, dword [edx + 4]
lea ebp, [esi + 0x9a80]
mov dword [esp + 0x38], eax
add esp, 8
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ecx
push eax
mov ecx, ebp
mov dword [esp + 0x20], 0xec
mov dword [esp + 0x28], 0x14
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
push 0x20
mov ecx, ebp
call fcn.0040a980
mov ebp, 0xffffff
mov dword [esi + 0xa0ec], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0x1f9
mov dword [esp + 0x18], 0x1b
mov dword [esp + 0x1c], 0x105
mov dword [esp + 0x20], 0x1f2
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 0x4488]
mov edx, dword [edx + 4]
lea ecx, [esi + 0x4488]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x28], 0xac
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call edx
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x194
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc0]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x40], ecx
lea ecx, [esi + 0x588c]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1fb
mov dword [esp + 0x20], 0x119
mov dword [esp + 0x24], 0x1c1
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], 0x22
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x494968
mov dword [esp + 0x4c], 0x49493c
mov dword [esp + 0x50], 0x494910
mov dword [esp + 0x54], 0x4948e4
call fcn.00405bd0
lea eax, [esi + 0x5cb4]
lea ecx, [esp + 0xc0]
mov dword [esi + 0x5ef8], ebp
sub ecx, eax
movzx edx, word [eax + ecx]
mov word [eax], dx
add eax, 2
cmp dx, di
jne 0x410cd1
mov edx, dword [esi + 4]
push 0x400
push 0x32
lea ecx, [esp + 0xc8]
push ecx
push 0x195
push edx
call fcn.0040e380
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x678]
add esp, 0x14
mov dword [esp + 0x2c], eax
lea edx, [esp + 0xc0]
lea eax, [esp + 0x40]
mov dword [esp + 0x3c], edx
push eax
lea edx, [esp + 0x18]
mov dword [esp + 0x34], ecx
lea ecx, [esi + 0x5f34]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1fc
mov dword [esp + 0x20], 0x119
mov dword [esp + 0x24], 0x1c1
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], 0x22
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x494968
mov dword [esp + 0x4c], 0x49493c
mov dword [esp + 0x50], 0x494910
mov dword [esp + 0x54], 0x4948e4
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x635c]
mov edx, eax
mov dword [esi + 0x65a0], ebp
sub ecx, edx
lea esp, [esp]
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x410da0
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x199
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc0]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x40], ecx
lea ecx, [esi + 0x65dc]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1fd
mov dword [esp + 0x20], 0x119
mov dword [esp + 0x24], 0x1c1
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], 0x22
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x494968
mov dword [esp + 0x4c], 0x49493c
mov dword [esp + 0x50], 0x494910
mov dword [esp + 0x54], 0x4948e4
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x6a04]
mov edx, eax
mov dword [esi + 0x6c48], ebp
sub ecx, edx
jmp 0x410e70
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x410e70
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x191
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc0]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x40], ecx
push eax
lea ecx, [esi + 0x6c84]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1fe
mov dword [esp + 0x20], 0x19a
mov dword [esp + 0x24], 0x1c1
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], 0x22
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x494968
mov dword [esp + 0x4c], 0x49493c
mov dword [esp + 0x50], 0x494910
mov dword [esp + 0x54], 0x4948e4
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x70ac]
mov edx, eax
mov dword [esi + 0x72f0], ebp
sub ecx, edx
jmp 0x410f40
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x410f40
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x19a
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
add esp, 0x14
mov dword [esp + 0x2c], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0xc0]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x40], ecx
lea ecx, [esi + 0x732c]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0x1f8
mov dword [esp + 0x20], 0x19a
mov dword [esp + 0x24], 0x1c1
mov dword [esp + 0x28], 0x78
mov dword [esp + 0x2c], 0x22
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x48], 0x494968
mov dword [esp + 0x4c], 0x49493c
mov dword [esp + 0x50], 0x494910
mov dword [esp + 0x54], 0x4948e4
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x7754]
mov edx, eax
mov dword [esi + 0x7998], ebp
sub ecx, edx
jmp 0x411010
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x411010
mov ecx, dword [esi + 4]
push 0x400
push 0x32
lea eax, [esp + 0xc8]
push eax
push 0x19d
push ecx
call fcn.0040e380
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 0x678]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x64]
lea ecx, [esp + 0xd4]
mov dword [esp + 0x44], eax
push edx
mov eax, ecx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], 0x205
mov dword [esp + 0x34], 0x14
mov dword [esp + 0x38], 0x1c1
mov dword [esp + 0x3c], 0x78
mov dword [esp + 0x40], 0x22
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], 0x494968
mov dword [esp + 0x60], 0x49493c
mov dword [esp + 0x64], 0x494910
mov dword [esp + 0x68], 0x4948e4
call fcn.0040d310
add esp, 0x1c
cmp eax, 0x64
jb 0x4110c8
add eax, 0x14
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x50]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, 0xa
mov dword [esi + 0x8028], eax
mov ecx, 8
mov edx, ecx
mov dword [esi + 0x802c], ecx
mov dword [esi + 0x8030], eax
mov dword [esi + 0x8034], edx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x79d4]
call fcn.00405bd0
lea eax, [esp + 0xc0]
lea ecx, [esi + 0x7dfc]
mov edx, eax
mov dword [esi + 0x8040], ebp
sub ecx, edx
movzx edx, word [eax]
mov word [eax + ecx], dx
add eax, 2
cmp dx, di
jne 0x411123
push edi
lea ecx, [esi + 0x3de8]
call fcn.00406760
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
push edi
lea ecx, [esi + 0x4488]
call fcn.00406760
push eax
call ebp
push edi
lea ecx, [esi + 0x588c]
call fcn.00406760
push eax
call ebp
push edi
lea ecx, [esi + 0x65dc]
call fcn.00406760
push eax
call ebp
push edi
lea ecx, [esi + 0x732c]
call fcn.00406760
push eax
call ebp
push edi
lea ecx, [esi + 0x5f34]
call fcn.00406720
push 0x32b0
call fcn.00478bdb
add esp, 4
mov dword [esp + 0x50], eax
cmp eax, edi
mov dword [esp + 0x950], edi
je 0x4111c3
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push ecx
push edx
lea ecx, [esi + 0x6a0]
push ecx
mov ecx, eax
call fcn.00408b40
jmp 0x4111c5
xor eax, eax
mov ecx, dword [esi + 0x678]
mov edx, dword [esi + 0xc]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
mov dword [esi + 0x698], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0x258
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0x83
mov dword [esp + 0x20], 0x1f6
mov dword [esp + 0x24], 0x5e
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov edx, dword [eax]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x14]
push ecx
or ebp, 0xffffffff
mov ecx, eax
mov dword [esp + 0x954], ebp
call edx
mov ecx, dword [esi + 0x698]
call fcn.004080f0
test eax, eax
jl 0x41125a
mov eax, dword [esi + 0x694]
mov ecx, dword [eax + 0x1f8]
mov eax, dword [eax + 0x1fc]
push eax
push ecx
mov ecx, dword [esi + 0x698]
call fcn.00408d40
mov eax, vtable.CGdiPlusBitmapResource.0
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], eax
mov dword [esp + 0x98], edi
mov ebx, 1
mov dword [esp + 0x950], ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xb4], eax
mov dword [esp + 0xbc], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], eax
mov dword [esp + 0x8c], edi
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa4], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], edi
mov dword [esp + 0x7c], edi
mov dword [esp + 0x78], eax
mov dword [esp + 0x80], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x60], eax
mov dword [esp + 0x68], edi
mov dword [esp + 0xac], edi
mov dword [esp + 0xa8], eax
mov dword [esp + 0xb0], edi
push edi
push 0x494138
push 0x494354
lea ecx, [esp + 0x9c]
mov byte [esp + 0x95c], 9
call fcn.00405a80
push edi
push 0x494138
push 0x494adc
lea ecx, [esp + 0x60]
call fcn.00405a80
push edi
push 0x494138
push 0x494ab4
lea ecx, [esp + 0xc0]
call fcn.00405a80
push edi
push 0x494138
push 0x494a8c
lea ecx, [esp + 0x90]
call fcn.00405a80
push edi
push 0x494138
push 0x494a64
lea ecx, [esp + 0xa8]
call fcn.00405a80
push edi
push 0x494138
push 0x494a38
lea ecx, [esp + 0x78]
call fcn.00405a80
push edi
push 0x494138
push 0x494a0c
lea ecx, [esp + 0x84]
call fcn.00405a80
push edi
push 0x494138
push 0x4949e0
lea ecx, [esp + 0x6c]
call fcn.00405a80
push edi
push 0x494138
push 0x4949b4
lea ecx, [esp + 0xb4]
call fcn.00405a80
lea ecx, [esp + 0xa8]
mov byte [esp + 0x950], 8
call fcn.004059c0
lea ecx, [esp + 0x60]
mov byte [esp + 0x950], 7
call fcn.004059c0
lea ecx, [esp + 0x78]
mov byte [esp + 0x950], 6
call fcn.004059c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x950], 5
call fcn.004059c0
lea ecx, [esp + 0x9c]
mov byte [esp + 0x950], 4
call fcn.004059c0
lea ecx, [esp + 0x84]
mov byte [esp + 0x950], 3
call fcn.004059c0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x950], 2
call fcn.004059c0
lea ecx, [esp + 0x54]
mov byte [esp + 0x950], bl
call fcn.004059c0
lea ecx, [esp + 0x90]
mov dword [esp + 0x950], ebp
call fcn.004059c0
xor eax, eax
mov ecx, dword [esp + 0x948]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x930]
xor ecx, esp
call fcn.00477bf8
add esp, 0x940
ret