Function at 0x409c00
Capabilities:
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d4a0
mov eax, dword fs:[0]
push eax
sub esp, 0xad0
mov eax, dword [0x41b1d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 0
push 0
push 1
push 0
mov dword [ebp - 0xa98], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
call fcn.0040cd99
test al, al
je 0x409c58
push 0xffffffffffffffff
call dword [sym.imp.ext_ms_win_imm_l1_1_0.dll_ImmDisableIME]
sub esp, 8
call fcn.0040bc63
test byte [0x41b741], 0x20
jne 0x40e84c
lea eax, [ebp - 0xf0]
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xd4]
push 0x50
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x94]
push 0
push eax
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xd4], 0
mov byte [ebp - 0xd0], 0
mov byte [ebp - 0xa0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0x403ab0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x44], 0
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xf0], 0x4010a0
add esp, 0xc
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call fcn.0040a640
mov esi, 1
push 2
mov dword [ebp - 0xac0], esi
call dword [sym.imp.api_ms_win_core_windowserrorreporting_l1_1_0.dll_WerSetFlags]
test eax, eax
js 0x40e862
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetErrorMode]
call fcn.0040bc30
call fcn.0040baa0
push 0
push 0
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
test ebx, ebx
js 0x40ecaa
cmp dword [ebp + 8], 7
mov dword [ebp - 0xac8], 0
mov dword [ebp - 0xac4], 0
mov dword [ebp - 0xab8], 0
mov dword [ebp - 0xabc], 0
mov dword [ebp - 0xaa8], 0
jne 0x40e883
xor esi, esi
test ebx, ebx
js 0x409f45
mov esi, dword [0x40186c]
mov ecx, esi
push 0x60
call dword [0x41c398]
call esi
test eax, eax
je 0x40e88d
mov ecx, eax
call fcn.0040b646
mov esi, eax
test esi, esi
je 0x40e894
lock inc dword [esi + 0x58]
test esi, esi
je 0x40e894
sub esp, 8
mov dword [ebp - 0xadc], 0
lea ecx, [ebp - 0xadc]
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0xacc], 0
call fcn.0040b1f0
lea edx, [ebp - 0xaac]
mov dword [ebp - 0xaac], 0
call fcn.0040af60
mov edi, dword [ebp - 0xaac]
mov ebx, eax
test ebx, ebx
js 0x409ec3
lea edx, [ebp - 0xa9c]
mov ecx, edi
call fcn.0040a510
test eax, eax
js 0x40e8a8
mov edx, dword [ebp - 0xa9c]
push ecx
lea ecx, [ebp - 0xad0]
call fcn.0040a3e0
mov ebx, dword [ebp - 0xadc]
test eax, eax
js 0x409e9b
push 0
push dword [ebp - 0xad0]
push 1
push ebx
call dword [sym.imp.api_ms_win_security_base_l1_1_0.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x40e89e
push dword [ebp - 0xa9c]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push 0
push 0
push 0
push 2
push 5
push 0
push 0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeSecurity]
mov ebx, eax
test edi, edi
je 0x409edf
mov dword [ebp - 4], 0
push edi
mov edi, dword [0x401870]
mov ecx, edi
call dword [0x41c398]
call edi
mov dword [ebp - 4], 1
push dword [ebp - 0xadc]
mov edi, dword [0x401870]
mov ecx, edi
call dword [0x41c398]
call edi
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0xad8]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push dword [ebp - 0xad4]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push dword [ebp - 0xad0]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push dword [ebp - 0xacc]
call dword [sym.imp.msvcrt.dll_free]
mov edi, dword [ebp - 0xa98]
add esp, 4
mov dword [ebp - 0xab0], 0
test ebx, ebx
js 0x409fd7
push dword [edi + 8]
call dword [sym.imp.msvcrt.dll__wtoi64]
add esp, 4
mov dword [ebp - 0xac8], eax
lea ecx, [ebp - 0xab0]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
test eax, eax
je 0x40e8b3
test ebx, ebx
js 0x409fd7
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll__wtoi64]
add esp, 4
mov dword [ebp - 0xab8], eax
lea ecx, [ebp - 0xab0]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
test eax, eax
je 0x40e8d7
test ebx, ebx
js 0x409fd7
push dword [edi + 0x10]
call dword [sym.imp.msvcrt.dll__wtoi64]
add esp, 4
mov dword [ebp - 0xabc], eax
lea ecx, [ebp - 0xab0]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
test eax, eax
je 0x40e8fb
mov dword [ebp - 0xa9c], 0
test ebx, ebx
js 0x40a095
push dword [edi + 0x14]
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
mov dword [ebp - 0xa9c], eax
cmp eax, 0x2000
ja 0x40e91f
push dword [edi + 0x18]
call dword [sym.imp.msvcrt.dll__wtoi64]
add esp, 4
mov dword [ebp - 0xac4], eax
lea ecx, [ebp - 0xab0]
push ecx
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_GetHandleInformation]
test eax, eax
je 0x40e929
test ebx, ebx
js 0x40a095
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0
push eax
push 0x403aa0
push 1
push 0
push 0x404554
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
test eax, eax
mov eax, dword [ebp - 0xa94]
js 0x40a07f
test eax, eax
je 0x40a07f
mov ecx, dword [eax]
push 2
push 1
push eax
mov edi, dword [ecx + 0xc]
mov ecx, edi
call dword [0x41c398]
call edi
mov eax, dword [ebp - 0xa94]
xor ebx, ebx
test eax, eax
je 0x40a095
mov ecx, dword [eax]
push eax
mov edi, dword [ecx + 8]
mov ecx, edi
call dword [0x41c398]
call edi
xor edi, edi
mov dword [ebp - 0xaa0], edi
test ebx, ebx
js 0x40a161
lea ecx, [ebp - 0xab4]
call fcn.0040aca0
mov ebx, eax
test ebx, ebx
js 0x40a161
mov ebx, dword [ebp - 0xab4]
push ebx
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebp - 0xa98], eax
cmp eax, fcn.0040ac80
jne 0x40e94d
call fcn.0040ac80
test esi, esi
je 0x40a0e4
lock inc dword [esi + 0x58]
mov ecx, dword [ebx + 0x34]
test ecx, ecx
jne 0x40e960
lea eax, [ebx + 0x30]
mov dword [ebx + 0x34], esi
mov ecx, dword [eax]
mov dword [ebp - 0xa98], eax
test ecx, ecx
jne 0x40e96a
push eax
push 0x403a90
push 1
push 0
push 0x403a80
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ebx, eax
mov eax, dword [ebp - 0xab4]
test ebx, ebx
js 0x40a13f
push eax
lea ecx, [ebp - 0xaa0]
mov dword [eax + 0x2c], 1
call fcn.0040aaa8
mov edi, dword [ebp - 0xaa0]
mov ecx, dword [ebp - 0xab4]
push ecx
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov dword [ebp - 0xa98], eax
cmp eax, fcn.0040aa80
jne 0x40e987
call fcn.0040aa80
xor eax, eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0x40a19c
push 1
push eax
push eax
push edi
push 0x403a70
lea eax, [ebp - 0xaa4]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoGetMarshalSizeMax]
mov ebx, eax
mov eax, dword [ebp - 0xaa4]
test ebx, ebx
js 0x40a19c
cmp eax, dword [ebp - 0xa9c]
ja 0x40e99a
mov dword [ebp - 0xa94], 0
test ebx, ebx
js 0x40a1e5
push eax
push 0x42
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_GlobalAlloc]
mov ecx, eax
mov dword [ebp - 0xa94], ecx
test ecx, ecx
je 0x40e9a4
test ebx, ebx
js 0x40e9ce
lea eax, [ebp - 0xaa8]
push eax
push 1
push ecx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CreateStreamOnHGlobal]
mov ebx, eax
test ebx, ebx
js 0x40e9c8
mov dword [ebp - 0xaac], 0
test ebx, ebx
js 0x40ebd9
push 1
push 0
push 0
push edi
push 0x403a70
push dword [ebp - 0xaa8]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoMarshalInterface]
mov ebx, eax
test ebx, ebx
js 0x40ebd9
mov eax, dword [ebp - 0xaa4]
add eax, 4
mov dword [ebp - 0xaac], 1
push eax
push 0
push 0
push 2
push dword [ebp - 0xabc]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0x40e9e2
test ebx, ebx
js 0x40ebd9
push dword [ebp - 0xa94]
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_GlobalLock]
mov edx, eax
mov dword [ebp - 0xaa0], edx
test edx, edx
je 0x40ea00
test ebx, ebx
js 0x40a2b4
mov ecx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xaa4]
mov dword [ecx], eax
lea eax, [ecx + 4]
push dword [ebp - 0xaa4]
push edx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0xa94]
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_GlobalUnlock]
test eax, eax
jne 0x40a2b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jne 0x40ea24
push dword [ebp - 0xa9c]
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_UnmapViewOfFile]
test ebx, ebx
js 0x40ebd9
cmp dword [0x41b1e8], 0
je 0x40a342
call fcn.0040a360
mov dword [0x41b1e4], eax
mov dword [0x41b1e8], 0
test eax, eax
je 0x40a349
push 0x100000
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
mov dword [ebp - 0xac0], 1
push dword [ebp - 0xab8]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
test eax, eax
je 0x40ea42
test ebx, ebx
push 0xffffffffffffffff
js 0x40ea7e
push 0
lea eax, [ebp - 0xac8]
push eax
push 2
call dword [sym.imp.api_ms_win_core_synch_l1_2_1.dll_WaitForMultipleObjects]
cmp eax, 0xffffffff
je 0x40ea60
jmp 0x40ebbe
mov eax, dword [0x41b1e4]
jmp 0x40a2e5
mov dword [ebp - 0xac0], 0
jmp 0x40a305
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
mov edx, 0x405b88
call fcn.00415e35
jmp 0x409c6d
cmp eax, 0x80004001
je 0x40e87c
mov ecx, dword [ebp + 4]
mov edx, 0x297
push eax
push 0x405a28
call fcn.00411e93
push 3
jmp 0x409d4f
mov ebx, 0x80070667
jmp 0x409daf
xor esi, esi
jmp 0x409de8
mov ebx, 0x8007000e
jmp 0x409f45
call fcn.0040b54a
jmp 0x409e9b
mov ebx, dword [ebp - 0xadc]
jmp 0x409eaa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40e8c8
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac8], 0
jmp 0x409f7f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40e8ec
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xab8], 0
jmp 0x409fab
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40e910
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xabc], 0
jmp 0x409fd7
mov ebx, 0x80070057
jmp 0x40a095
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40e93e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xac4], 0
jmp 0x40a02e
mov ecx, eax
call dword [0x41c398]
call dword [ebp - 0xa98]
jmp 0x40a0dc
call fcn.0040844e
jmp 0x40a0ef
mov dword [eax], edi
mov eax, dword [ecx]
push ecx
mov ebx, dword [eax + 8]
mov ecx, ebx
call dword [0x41c398]
call ebx
mov eax, dword [ebp - 0xa98]
jmp 0x40a105
mov ecx, eax
call dword [0x41c398]
call dword [ebp - 0xa98]
jmp 0x40a161
mov ebx, 0x80028016
jmp 0x40a19c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, dword [ebp - 0xa94]
mov ebx, eax
test ebx, ebx
jle 0x40a1c5
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a1c3
mov ecx, dword [ebp - 0xa94]
test ecx, ecx
je 0x40a1e5
push ecx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_GlobalFree]
jmp 0x40a1e5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40a24f
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a24d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, dword [ebp - 0xaa0]
mov ebx, eax
test ebx, ebx
jle 0x40a273
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a271
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40a2b4
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a2b4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40a31b
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a319
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x40ebbe
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40ebbe
lea eax, [ebp - 0x140]
mov dword [ebp - 0x150], 0x401124
push 0x4047ac
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], 0x21
call fcn.004175cd
mov eax, 3
mov dword [ebp - 0x150], 0x401754
mov word [ebp - 0xf8], ax
lea ecx, [ebp - 0xa8c]
lea eax, [ebp - 0x150]
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xa90], eax
call fcn.0040f753
lea ecx, [ebp - 0x9f8]
call fcn.0040f753
lea ecx, [ebp - 0x964]
call fcn.0040f772
push ebx
lea ecx, [ebp - 0xa90]
call fcn.00417b15
push 0
lea eax, [ebp - 0xa90]
push 0xc0000c1c
push eax
call fcn.004133a9
mov eax, dword [ebp - 0x960]
add esp, 0xc
mov dword [ebp - 0x964], 0x401738
test eax, eax
je 0x40eb45
lea ecx, [ebp - 0x954]
cmp eax, ecx
je 0x40eb45
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x964], 0x401124
mov dword [ebp - 0x9f8], 0x401140
test eax, eax
je 0x40eb77
lea ecx, [ebp - 0x9e8]
cmp eax, ecx
je 0x40eb77
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x9f8], 0x401124
mov dword [ebp - 0xa8c], 0x401140
test eax, eax
je 0x40eba9
lea ecx, [ebp - 0xa7c]
cmp eax, ecx
je 0x40eba9
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
lea ecx, [ebp - 0x150]
mov dword [ebp - 0xa8c], 0x401124
call fcn.004163da
cmp dword [ebp - 0xac0], 0
je 0x40ebd9
push 0x200000
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
xor eax, eax
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp + eax*4 - 0xac8]
test ecx, ecx
je 0x40ebf9
push ecx
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0xaa0]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, 2
jb 0x40ebe1
mov eax, dword [ebp - 0xaa8]
test eax, eax
je 0x40ec4b
cmp dword [ebp - 0xaac], 0
je 0x40ec4b
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
mov dword [ebp - 0xa98], ecx
mov ecx, dword [ecx + 0x14]
push eax
call dword [0x41c398]
mov eax, dword [ebp - 0xa98]
call dword [eax + 0x14]
test eax, eax
js 0x40ec4b
push dword [ebp - 0xaa8]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoReleaseMarshalData]
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0x40ec5c
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0x40ec6d
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov dword [ebp - 4], 2
test edi, edi
je 0x40ec88
mov eax, dword [edi]
push edi
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x41c398]
call edi
test esi, esi
je 0x40ec93
mov ecx, esi
call fcn.0040844e
lea ecx, [ebp - 0xaa8]
call fcn.0040f9c5
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
mov esi, dword [ebp - 0xac0]
test byte [0x41b741], 0x20
je 0x40ecc4
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push eax
mov edx, 0x405b28
call fcn.00415e35
call fcn.00415dbc
test esi, esi
lea ecx, [ebp - 0xf0]
setne al
movzx eax, al
push eax
push ebx
call fcn.00414264
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf0], 0x4010a0
call fcn.0041120b
lea ecx, [ebp - 0x38]
call fcn.00415b27
lea ecx, [ebp - 0x44]
call fcn.00415bb9
cmp byte [ebp - 0xa0], 0
je 0x40ed28
push dword [ebp - 0xa4]
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov byte [ebp - 0xa0], 0
cmp dword [ebp - 0xd4], 1
mov dword [ebp - 0xa4], 0
jne 0x40ed80
push 0x40f540
mov dword [ebp - 0xd4], 2
call fcn.0040a830
mov ecx, dword [eax + 4]
cmp dword [ecx], 5
jbe 0x40ed80
push 0x4000
push 0
call fcn.0040a7ea
test al, al
je 0x40ed80
lea eax, [ebp - 0x30]
mov edx, 0x404d26
push eax
push 2
push 0
lea eax, [ebp - 0xcc]
push eax
call fcn.00415fab
cmp dword [ebp - 0xe0], 0
mov dword [ebp - 0xd4], 3
je 0x40ed9e
lea ecx, [ebp - 0xec]
call fcn.0041489e
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c440
mov esp, ebp
pop ebp
ret