Function at 0x64430c
Capabilities:
Accept command line arguments
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x644314
push ecx
push ebx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6451a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040b458
movzx eax, bl
cmp eax, 0x54
ja case.0x644344.0
jmp dword [eax*4 + 0x64434b]
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x6451bc
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00643fe0
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x6451f0
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00643fe0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
call fcn.00645518
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a250]
call fcn.0040b848
jmp case.0x644344.0
lea edx, [ebp - 0x28]
mov eax, 0x28
call fcn.00644248
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 8]
call fcn.00429368
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x645214
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00643fe0
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, 0x645214
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
call fcn.00643fe0
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.005516f4
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a25c]
call fcn.0040b848
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a25c]
call fcn.0040b848
jmp case.0x644344.0
cmp byte [0x68a221], 0
jne 0x6445db
mov edx, dword [ebp - 8]
mov eax, 0x26
call fcn.00644248
jmp case.0x644344.0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov ebx, eax
cmp byte [0x68a220], 0
je 0x6445fb
mov dword [ebx + 0x18], 0x20119
jmp 0x644602
mov dword [ebx + 0x18], 0x20019
mov edx, 0x80000002
mov eax, ebx
call fcn.00516664
xor ecx, ecx
mov edx, 0x645234
mov eax, ebx
call fcn.005167c0
test al, al
je 0x644646
mov edx, 0x645294
mov eax, ebx
call fcn.00517720
test al, al
je 0x64463f
mov ecx, dword [ebp - 8]
mov edx, 0x645294
mov eax, ebx
call fcn.00517188
mov eax, ebx
call fcn.00516634
mov eax, ebx
call fcn.00409668
jmp case.0x644344.0
mov eax, dword [ebp - 8]
call fcn.00644284
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a254]
call fcn.0040b848
jmp case.0x644344.0
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 8]
call fcn.00429244
jmp case.0x644344.0
mov eax, dword [ebp - 8]
call fcn.004295c4
jmp case.0x644344.0
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.00407540
jmp case.0x644344.0
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.00407540
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 8]
call fcn.00429368
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x24
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x25
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x14
call fcn.00644248
jmp case.0x644344.0
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x3c]
mov eax, 0x24
call fcn.00644248
mov eax, dword [ebp - 0x3c]
mov ecx, 2
mov edx, 1
call fcn.0040c3c4
jmp case.0x644344.0
push 1
mov ecx, 0x6452c0
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x68a226]
je 0x644762
mov eax, 0x6452e8
call fcn.00641db8
test al, al
je 0x644762
mov edx, dword [ebp - 8]
mov eax, 0x23
call fcn.00644248
jmp case.0x644344.0
cmp dword [0x68a290], 0
je 0x644779
mov eax, 0x645304
call fcn.00641db8
test al, al
je 0x64478b
mov edx, dword [ebp - 8]
mov eax, 0x1a
call fcn.00644248
jmp case.0x644344.0
movzx eax, byte [0x645314]
push eax
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x40]
mov al, 4
call fcn.0064430c
mov eax, dword [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, 0x1a
call fcn.00644248
mov eax, dword [ebp - 0x44]
mov ecx, dword [0x68a290]
pop edx
call fcn.004316b8
jmp case.0x644344.0
push 1
mov ecx, 0x6452c0
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x68a226]
je 0x644808
mov eax, 0x6452e8
call fcn.00641db8
test al, al
je 0x644808
mov edx, dword [ebp - 8]
mov eax, 0x2e
call fcn.00644248
jmp case.0x644344.0
cmp dword [0x68a290], 0
je 0x64481f
mov eax, 0x645304
call fcn.00641db8
test al, al
je 0x644831
mov edx, dword [ebp - 8]
mov eax, 5
call fcn.00644248
jmp case.0x644344.0
movzx eax, byte [0x645314]
push eax
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x48]
mov al, 4
call fcn.0064430c
mov eax, dword [ebp - 0x48]
push eax
lea edx, [ebp - 0x4c]
mov eax, 5
call fcn.00644248
mov eax, dword [ebp - 0x4c]
mov ecx, dword [0x68a290]
pop edx
call fcn.004316b8
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x645324
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 8]
call fcn.00643fe0
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x645340
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 8]
call fcn.00643fe0
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a264]
call fcn.0040b848
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x28
call fcn.00644248
jmp case.0x644344.0
cmp byte [0x68a221], 0
jne 0x644900
mov edx, dword [ebp - 8]
mov eax, 0x2b
call fcn.00644248
jmp case.0x644344.0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov ebx, eax
cmp byte [0x68a220], 0
je 0x644920
mov dword [ebx + 0x18], 0x20119
jmp 0x644927
mov dword [ebx + 0x18], 0x20019
mov edx, 0x80000002
mov eax, ebx
call fcn.00516664
xor ecx, ecx
mov edx, 0x645234
mov eax, ebx
call fcn.005167c0
test al, al
je 0x64496b
mov edx, 0x645364
mov eax, ebx
call fcn.00517720
test al, al
je 0x644964
mov ecx, dword [ebp - 8]
mov edx, 0x645364
mov eax, ebx
call fcn.00517188
mov eax, ebx
call fcn.00516634
mov eax, ebx
call fcn.00409668
jmp case.0x644344.0
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0xb
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 2
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 7
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x19
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x16
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x17
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x18
call fcn.00644248
jmp case.0x644344.0
call fcn.0042b728
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [0x682358]
call fcn.0042c6dc
jmp case.0x644344.0
cmp byte [0x68a221], 0
jne 0x644a40
mov edx, dword [ebp - 8]
mov eax, 0x1c
call fcn.00644248
jmp case.0x644344.0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov ebx, eax
cmp byte [0x68a220], 0
je 0x644a60
mov dword [ebx + 0x18], 0x20119
jmp 0x644a67
mov dword [ebx + 0x18], 0x20019
mov edx, 0x80000002
mov eax, ebx
call fcn.00516664
xor ecx, ecx
mov edx, 0x645234
mov eax, ebx
call fcn.005167c0
test al, al
je 0x644aab
mov edx, 0x645390
mov eax, ebx
call fcn.00517720
test al, al
je 0x644aa4
mov ecx, dword [ebp - 8]
mov edx, 0x645390
mov eax, ebx
call fcn.00517188
mov eax, ebx
call fcn.00516634
mov eax, ebx
call fcn.00409668
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x23
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 9
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x2d
call fcn.00644248
jmp case.0x644344.0
lea edx, [ebp - 0x58]
mov al, 0x20
call fcn.0064430c
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 8]
call fcn.00429244
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x494]
call fcn.005516f4
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x49c]
call fcn.005516f4
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x484]
call fcn.005516f4
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x478]
call fcn.005516f4
jmp case.0x644344.0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x6453b8
mov edx, 0x6453cc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644344.0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x6453e4
mov edx, 0x6453cc
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644344.0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x6453f8
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 6
call fcn.00644248
jmp case.0x644344.0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov ebx, eax
cmp byte [0x68a220], 0
je 0x644bf6
mov dword [ebx + 0x18], 0x20119
jmp 0x644bfd
mov dword [ebx + 0x18], 0x20219
mov edx, 0x80000002
mov eax, ebx
call fcn.00516664
xor ecx, ecx
mov edx, 0x645234
mov eax, ebx
call fcn.005167c0
test al, al
je 0x644c62
mov edx, 0x645410
mov eax, ebx
call fcn.00517720
test al, al
je 0x644c3c
mov ecx, dword [ebp - 8]
mov edx, 0x645410
mov eax, ebx
call fcn.00517188
jmp 0x644c5b
mov edx, 0x645294
mov eax, ebx
call fcn.00517720
test al, al
je 0x644c5b
mov ecx, dword [ebp - 8]
mov edx, 0x645294
mov eax, ebx
call fcn.00517188
mov eax, ebx
call fcn.00516634
mov eax, ebx
call fcn.00409668
jmp case.0x644344.0
lea edx, [ebp - 0x5c]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.005516f4
mov eax, dword [ebp - 0x5c]
mov ecx, 1
mov edx, eax
mov eax, 0x64543c
call fcn.0040c520
test eax, eax
jle 0x644d1f
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x644d18
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.005516f4
lea edx, [ebp - 0x60]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.005516f4
mov eax, dword [ebp - 0x60]
mov ecx, 1
mov edx, eax
mov eax, 0x64543c
call fcn.0040c520
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040c3c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644344.0
lea eax, [ebp - 4]
call fcn.0040b458
pop eax
jmp eax
mov eax, dword [ebp - 8]
mov edx, 0x64544c
call fcn.0040b848
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x25
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x2a
call fcn.00644248
jmp case.0x644344.0
push 0
mov ecx, 0x645460
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
sub eax, 1
jb 0x644d7d
je 0x644d92
dec eax
je 0x644da7
dec eax
je 0x644dbc
jmp case.0x644344.0
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
mov edx, dword [ebp - 8]
call fcn.00427d7c
jmp case.0x644344.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov edx, dword [ebp - 8]
call fcn.00427d7c
jmp case.0x644344.0
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx eax, ax
mov edx, dword [ebp - 8]
call fcn.00427d7c
jmp case.0x644344.0
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
mov edx, dword [ebp - 8]
call fcn.00427d7c
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x1f
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x27
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0xd
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x36
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x35
call fcn.00644248
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, 0x2e
call fcn.00644248
jmp case.0x644344.0
call fcn.0042b728
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [0x682358]
mov eax, 0x645488
call fcn.0042c744
jmp case.0x644344.0
cmp byte [0x68a221], 0
jne 0x644e7f
mov edx, dword [ebp - 8]
mov eax, 0x1c
call fcn.00644248
jmp case.0x644344.0
mov dl, 1
mov eax, dword [0x515430]
call fcn.0051657c
mov ebx, eax
cmp byte [0x68a220], 0
je 0x644e9f
mov dword [ebx + 0x18], 0x20119
jmp 0x644ea6
mov dword [ebx + 0x18], 0x20019
mov edx, 0x80000002
mov eax, ebx
call fcn.00516664
xor ecx, ecx
mov edx, 0x645234
mov eax, ebx
call fcn.005167c0
test al, al
je 0x644eea
mov edx, 0x645390
mov eax, ebx
call fcn.00517720
test al, al
je 0x644ee3
mov ecx, dword [ebp - 8]
mov edx, 0x645390
mov eax, ebx
call fcn.00517188
mov eax, ebx
call fcn.00516634
mov eax, ebx
call fcn.00409668
jmp case.0x644344.0
call sub.kernel32.dll_GetCommandLineW
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040c050
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x6822cc]
mov edx, dword [edx]
call fcn.0040b848
jmp case.0x644344.0
lea edx, [ebp - 0x64]
mov eax, dword [0x681e3c]
mov eax, dword [eax]
call fcn.00427d7c
push dword [ebp - 0x64]
push 0x6454a8
lea edx, [ebp - 0x68]
mov eax, dword [0x6821cc]
mov eax, dword [eax]
call fcn.00427d7c
push dword [ebp - 0x68]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040c2dc
jmp case.0x644344.0
mov eax, dword [ebp - 8]
call fcn.00641c54
jmp case.0x644344.0
mov eax, dword [ebp - 8]
call fcn.00650200
jmp case.0x644344.0
mov eax, dword [ebp - 8]
call fcn.00641b9c
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x68a26c]
call fcn.0040b848
jmp case.0x644344.0
mov edx, dword [ebp - 8]
movzx eax, byte [0x68a231]
call fcn.006441e8
jmp case.0x644344.0
mov edx, dword [ebp - 8]
movzx eax, byte [0x68a22e]
call fcn.006441e8
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4e0]
call fcn.005516f4
jmp case.0x644344.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4e0]
mov edx, dword [eax]
call dword [edx + 0x150]
mov edx, dword [ebp - 8]
call fcn.00427d7c
jmp case.0x644344.0
mov edx, dword [ebp - 8]
movzx eax, byte [0x68a224]
call fcn.006441e8
jmp case.0x644344.0
mov edx, dword [ebp - 8]
movzx eax, byte [0x68a226]
call fcn.006441e8
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x681e3c]
mov eax, dword [eax]
call fcn.00427d7c
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x6821cc]
mov eax, dword [eax]
call fcn.00427d7c
jmp case.0x644344.0
mov edx, dword [ebp - 8]
mov eax, dword [0x681ff0]
mov eax, dword [eax]
call fcn.00427d7c
jmp case.0x644344.0
lea eax, [ebp - 0x70]
call fcn.00438c38
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.0042705c
mov eax, dword [ebp - 0x6c]
mov ecx, 1
mov edx, eax
mov eax, 0x6454b8
call fcn.0040c520
mov ebx, eax
test ebx, ebx
setg al
mov edx, dword [ebp - 8]
call fcn.006441e8
jmp case.0x644344.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4b4]
mov edx, dword [eax]
call dword [edx + 0x150]
mov edx, dword [ebp - 8]
call fcn.006441e8
jmp case.0x644344.0
mov edx, dword [ebp - 8]
movzx eax, byte [0x68a231]
call fcn.006441e8
jmp case.0x644344.0
cmp byte [0x68a22e], 0
je 0x6450df
mov eax, dword [ebp - 8]
mov edx, 0x6454d4
call fcn.0040b848
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, 0x6454e8
call fcn.0040b848
jmp case.0x644344.0
mov eax, dword [ebp - 8]
mov edx, dword [0x6822cc]
mov edx, dword [edx]
call fcn.0040b848
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, 1
mov eax, 0x6454fc
call fcn.0040c520
mov edx, dword [ebp - 8]
mov ecx, eax
mov eax, 1
xchg edx, eax
call fcn.0040c40c
jmp case.0x644344.0
push 0
lea eax, [ebp - 0x78]
push eax
mov ecx, 0x64550c
mov edx, 0x6451d8
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.00643fe0
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 8]
call fcn.00645518
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004312b4
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
call fcn.0040b848
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6451aa
lea eax, [ebp - 0x7c]
mov edx, 7
call fcn.0040b4b8
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.0040b4b8
lea eax, [ebp - 0x58]
mov edx, 0x10
call fcn.0040b4b8
pop eax
jmp eax