Function at 0x412620
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4fb822
mov eax, dword fs:[0]
push eax
sub esp, 0x290
mov eax, dword [0x52f4a8]
xor eax, esp
mov dword [esp + 0x288], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x52f4a8]
xor eax, esp
push eax
lea eax, [esp + 0x2a4]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov edi, ecx
lea ebp, [edi + 0x30]
push str.mainswitch
mov ecx, ebp
mov dword [esp + 0x18], edi
call ebx
mov esi, eax
mov ecx, esi
mov dword [esp + 0x18], esi
call dword [sym.imp.LibDui.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const]
cmp eax, dword [esp + 0x2b4]
je 0x4126a7
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.LibDui.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [edx + 0xf0]
mov ecx, esi
call eax
cmp dword [edi + 0x1bf8], 0
jg 0x4126c0
push 1
mov ecx, edi
call fcn.00412350
xor eax, eax
jmp 0x41315a
mov eax, dword [esp + 0x2b4]
cmp eax, 1
jne 0x4126f4
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0xffffffffffffffff
push str.homeOptBuyVip
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_]
call fcn.00414da0
push 0
jmp 0x413149
cmp eax, 2
jne 0x412721
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0xffffffffffffffff
push str.homeOptMyUc
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_]
call fcn.00414da0
push 0
jmp 0x413149
cmp eax, 0x14
jne 0x41274e
sub esp, 0x84
mov ecx, esp
mov dword [esp + 0xa0], esp
push 0xffffffffffffffff
push str.homeOptTg
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_]
call fcn.00414da0
push 0
jmp 0x413149
cmp eax, 8
jne 0x412b33
lea ecx, [esp + 0x214]
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
mov dword [esp + 0x2ac], 0
cmp dword [edi + 0x1d2c], 0x10
jb 0x412780
mov eax, dword [edi + 0x1d18]
jmp 0x412786
lea eax, [edi + 0x1d18]
push eax
lea ebx, [esp + 0x28]
call fcn.0046b440
add esp, 4
mov esi, eax
mov byte [esp + 0x2ac], 1
cmp dword [edi + 0x1e0c], 0x10
jb 0x4127ae
mov edi, dword [edi + 0x1df8]
jmp 0x4127b4
add edi, 0x1df8
push edi
lea ebx, [esp + 0x4c]
call fcn.0046b440
add esp, 4
mov edx, 8
mov byte [esp + 0x2ac], 2
cmp dword [esi + 0x1c], edx
jb 0x4127d8
mov ecx, dword [esi + 8]
jmp 0x4127db
lea ecx, [esi + 8]
cmp dword [eax + 0x1c], edx
jb 0x4127e5
mov eax, dword [eax + 8]
jmp 0x4127e8
add eax, 8
push ecx
push eax
lea ecx, [esp + 0x21c]
push str._s_s
push ecx
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0x10
lea esi, [esp + 0x48]
mov byte [esp + 0x2ac], 1
call fcn.00401810
lea esi, [esp + 0x24]
mov byte [esp + 0x2ac], 0
call fcn.00401810
push str.myQrcodeUrl
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov ebx, eax
mov esi, dword [ebx]
lea ecx, [esp + 0x214]
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
mov edx, dword [esi + 0x2c]
push eax
mov ecx, ebx
call edx
lea esi, [esp + 0x170]
call fcn.0040a1c0
mov ecx, eax
mov byte [esp + 0x2ac], 3
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
lea ecx, [esp + 0x1f4]
push ecx
mov edi, eax
call fcn.00406500
mov byte [esp + 0x2ac], 5
mov edi, dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, esi
call edi
lea edx, [esp + 0x1f4]
push edx
mov esi, str.myQrcodePic.bmp
call fcn.00421420
cmp dword [esp + 0x210], 8
mov eax, dword [esp + 0x1fc]
jae 0x4128af
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x4c]
call fcn.0046b7b0
add esp, 4
mov esi, eax
lea ecx, [esp + 0x214]
mov byte [esp + 0x2ac], 6
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
lea ecx, [esp + 0x28]
call fcn.0046b7b0
add esp, 4
mov edx, 0x10
mov byte [esp + 0x2ac], 7
cmp dword [esi + 0x1c], edx
jb 0x4128f7
mov ecx, dword [esi + 8]
jmp 0x4128fa
lea ecx, [esi + 8]
cmp dword [eax + 0x1c], edx
jb 0x412904
mov eax, dword [eax + 8]
jmp 0x412907
add eax, 8
push ecx
call fcn.0046bcc0
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ac], 6
call fcn.00401740
lea ecx, [esp + 0x48]
mov byte [esp + 0x2ac], 5
call fcn.00401740
push str.myQrcodePic
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea esi, [esp + 0x68]
mov dword [esp + 0x1c], eax
call fcn.0040a1c0
push str.myQrcodePic.bmp
lea ecx, [esp + 0xf0]
push ecx
mov ecx, eax
mov byte [esp + 0x2b4], 8
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CDuiString___thiscall_DuiLib::CDuiString::operator_wchar_t_const__]
mov ecx, eax
mov byte [esp + 0x2ac], 9
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
mov ecx, dword [esp + 0x1c]
push eax
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_wchar_t_const__]
lea ecx, [esp + 0xec]
mov byte [esp + 0x2ac], 8
call edi
mov ecx, esi
mov byte [esp + 0x2ac], 5
call edi
lea esi, [esp + 0xec]
call fcn.0040a1c0
push str.myQrcodePic.bmp
lea edx, [esp + 0x6c]
push edx
mov ecx, eax
mov byte [esp + 0x2b4], 0xa
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CDuiString___thiscall_DuiLib::CDuiString::operator_wchar_t_const__]
mov byte [esp + 0x2ac], 0xb
mov esi, dword [ebx]
mov ecx, eax
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
mov eax, dword [esi + 0xe8]
mov ecx, ebx
call eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x2ac], 0xa
call edi
lea ecx, [esp + 0xec]
mov byte [esp + 0x2ac], 5
call edi
push str.share_groupName
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov esi, eax
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x1c60], 0x10
jb 0x412a27
mov eax, dword [eax + 0x1c4c]
jmp 0x412a2c
add eax, 0x1c4c
push eax
lea ebx, [esp + 0x28]
call fcn.0046b440
add esp, 4
mov byte [esp + 0x2ac], 0xc
cmp dword [eax + 0x1c], 8
jb 0x412a4c
mov eax, dword [eax + 8]
jmp 0x412a4f
add eax, 8
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x2c]
mov ecx, esi
call eax
lea esi, [esp + 0x24]
mov byte [esp + 0x2ac], 5
call fcn.00401810
push str.share_endTime
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov ebp, eax
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x1c38], 0x10
jb 0x412a8e
mov eax, dword [eax + 0x1c24]
jmp 0x412a93
add eax, 0x1c24
push eax
lea ebx, [esp + 0x28]
call fcn.0046b440
add esp, 4
mov byte [esp + 0x2ac], 0xd
cmp dword [eax + 0x1c], 8
jb 0x412ab3
mov eax, dword [eax + 8]
jmp 0x412ab6
add eax, 8
push eax
lea ecx, [esp + 0x218]
push 0x50fc54
push ecx
call dword [sym.imp.LibDui.dll_public:_int___cdecl_DuiLib::CDuiString::Format_wchar_t_const__]
add esp, 0xc
lea esi, [esp + 0x24]
mov byte [esp + 0x2ac], 5
call fcn.00401810
lea edx, [esp + 0x214]
push edx
call fcn.00434470
mov esi, dword [ebp]
add esp, 4
lea ecx, [esp + 0x214]
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
mov eax, dword [esi + 0x2c]
mov ecx, ebp
call eax
lea esi, [esp + 0x1f4]
mov byte [esp + 0x2ac], 0
call fcn.00401810
lea ecx, [esp + 0x214]
mov dword [esp + 0x2ac], 0xffffffff
call edi
jmp 0x413131
cmp eax, 0xe
jne 0x412b44
mov esi, edi
call fcn.004465f0
jmp 0x413131
cmp eax, 0xf
je 0x41312a
cmp eax, 0x10
je 0x41312a
cmp eax, 0x11
jne 0x412b67
mov esi, edi
call fcn.004466b0
jmp 0x413131
cmp eax, 0x12
jne 0x412b78
mov esi, edi
call fcn.00446710
jmp 0x413131
cmp eax, 9
jne 0x412b89
mov esi, edi
call fcn.00446210
jmp 0x413131
cmp eax, 0xa
jne 0x412c5c
push str.yuyanlist
mov ecx, ebp
call ebx
lea ecx, [esp + 0x214]
mov ebp, eax
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
push str.lan_id
mov ebx, 0x50e8cc
lea edi, [esp + 0x6c]
mov dword [esp + 0x2b0], 0xe
call fcn.00434760
add esp, 4
push eax
lea ecx, [esp + 0x218]
mov byte [esp + 0x2b0], 0xf
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_class_DuiLib::CDuiString_const__]
mov byte [esp + 0x2ac], 0xe
mov ecx, edi
mov edi, dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
call edi
lea ecx, [esp + 0x214]
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
push eax
lea ecx, [esp + 0x28]
call fcn.0046b7b0
add esp, 4
cmp dword [eax + 0x1c], 0x10
jb 0x412c18
mov eax, dword [eax + 8]
jmp 0x412c1b
add eax, 8
push eax
call fcn.0047e660
add esp, 4
lea ecx, [esp + 0x24]
mov ebx, eax
call fcn.00401740
mov edx, dword [ebp + 0x6c0]
mov eax, dword [edx + 0xc]
lea ecx, [ebp + 0x6c0]
push 0
push ebx
call eax
lea ecx, [esp + 0x214]
mov dword [esp + 0x2ac], 0xffffffff
call edi
jmp 0x413135
cmp eax, 0xb
jne 0x412e1b
push str.desk_webBtn
mov ecx, ebp
call ebx
cmp dword [edi + 0x1dcc], 0x10
mov esi, eax
jb 0x412c81
mov edi, dword [edi + 0x1db8]
jmp 0x412c87
add edi, 0x1db8
lea ecx, [esp + 0x24]
push ecx
mov ebx, edi
call fcn.0046b950
add esp, 4
mov ebx, 8
mov dword [esp + 0x2ac], 0x10
cmp dword [eax + 0x1c], ebx
jb 0x412cb0
mov eax, dword [eax + 8]
jmp 0x412cb3
add eax, 8
mov edx, dword [esi]
push eax
mov eax, dword [edx + 0x2c]
mov ecx, esi
call eax
lea esi, [esp + 0x24]
mov dword [esp + 0x2ac], 0xffffffff
call fcn.00401810
lea esi, [esp + 0x68]
call fcn.0040a1c0
mov ecx, eax
mov dword [esp + 0x2ac], 0x11
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
lea ecx, [esp + 0x1f4]
push ecx
mov edi, eax
call fcn.00406500
mov byte [esp + 0x2ac], 0x13
mov edi, dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, esi
call edi
lea edx, [esp + 0x1f4]
push edx
mov esi, str.desk_qrcode.bmp
call fcn.00421420
mov eax, dword [esp + 0x1fc]
cmp dword [esp + 0x210], ebx
jae 0x412d37
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x28]
call fcn.0046b7b0
add esp, 4
mov edx, 0x10
mov byte [esp + 0x2ac], 0x14
cmp dword [eax + 0x1c], edx
jb 0x412d5b
mov ecx, dword [eax + 8]
jmp 0x412d5e
lea ecx, [eax + 8]
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x1dcc], edx
jb 0x412d72
mov eax, dword [eax + 0x1db8]
jmp 0x412d77
add eax, 0x1db8
push ecx
call fcn.0046bcc0
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x2ac], 0x13
call fcn.00401740
push str.desk_qrcode
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
lea esi, [esp + 0x170]
mov ebp, eax
call fcn.0040a1c0
push str.desk_qrcode.bmp
lea ecx, [esp + 0xf0]
push ecx
mov bl, 0x15
mov ecx, eax
mov byte [esp + 0x2b4], bl
call dword [sym.imp.LibDui.dll_public:_class_DuiLib::CDuiString___thiscall_DuiLib::CDuiString::operator_wchar_t_const__]
mov ecx, eax
mov byte [esp + 0x2ac], 0x16
call dword [sym.imp.LibDui.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
mov ecx, ebp
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CControlUI::SetBkImage_wchar_t_const__]
lea ecx, [esp + 0xec]
mov byte [esp + 0x2ac], bl
call edi
mov ecx, esi
mov byte [esp + 0x2ac], 0x13
call edi
lea esi, [esp + 0x1f4]
mov dword [esp + 0x2ac], 0xffffffff
call fcn.00401810
jmp 0x413131
cmp eax, 0xc
jne 0x412e3f
push str.gonggaolist
mov ecx, ebp
call ebx
mov edx, dword [eax + 0x550]
lea ecx, [eax + 0x550]
mov eax, dword [edx + 0x20]
call eax
jmp 0x413135
cmp eax, 0x1d
jne 0x412ece
mov ecx, dword [edi + 0x1c64]
cmp ecx, 2
jg 0x412e83
mov eax, edi
call fcn.00413190
test eax, eax
jne 0x412e7a
mov ecx, dword [edi + 0x1f8c]
mov dword [edi + 0x20b8], ecx
push 0x1e
mov ecx, edi
call fcn.00412620
xor eax, eax
jmp 0x41315a
cmp ecx, 2
jle 0x413135
mov eax, edi
call fcn.00413190
test eax, eax
jne 0x413135
push str._vN_kT
push 0x50fcd0
push eax
push 0x50fcdc
mov eax, edi
call fcn.0040c6b0
cmp eax, 1
jne 0x413135
mov edx, dword [edi + 0x1f8c]
push 0x1e
mov ecx, edi
mov dword [edi + 0x20b8], edx
call fcn.00412620
xor eax, eax
jmp 0x41315a
cmp eax, 0x15
jne 0x412ef6
lea eax, [esp + 0x44]
push eax
push 0
push edi
push 0x435be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x413135
cmp eax, 0x16
jne 0x412f47
push str.Exchange_submitpage
mov ecx, ebp
call ebx
push str.Exchange_querypage
mov ecx, ebp
mov edi, eax
call ebx
mov edx, dword [edi]
mov esi, eax
mov eax, dword [edx + 0xf8]
push 0
mov ecx, edi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xf8]
push 1
mov ecx, esi
call eax
push str.BtnExchange
mov ecx, ebp
call ebx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x11c]
call eax
jmp 0x413131
cmp eax, 0x17
jne 0x412f53
push str.Btnchangepwd
jmp 0x412f69
cmp eax, 0x18
jne 0x412f5f
push str.Btnsetemailpwd
jmp 0x412f69
cmp eax, 0x19
jne 0x412f7e
push str.BtnReward
mov ecx, ebp
call ebx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x11c]
call eax
jmp 0x413135
cmp eax, 0x1b
jne 0x412fc8
push str.OptOrderStatus0
mov ecx, ebp
call ebx
push str.OptOrderStatus1
mov ecx, ebp
mov esi, eax
call ebx
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x1b0]
push 0
mov ecx, esi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x1b0]
push 0
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0x1b0]
push 1
mov ecx, edi
call eax
jmp 0x413131
cmp eax, 0x1c
je 0x413135
cmp eax, 0x1e
jne 0x41310b
push str.backTitleUc
mov ecx, ebp
call ebx
push str.bd_pwd
mov ecx, ebp
mov dword [esp + 0x24], eax
call ebx
push str.bd_repwd
mov ecx, ebp
mov esi, eax
call ebx
push str.bd_UserNames
mov ecx, ebp
mov dword [esp + 0x20], eax
call ebx
push str.bd_tips
mov ecx, ebp
mov dword [esp + 0x18], eax
call ebx
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x2c]
push 0x50d5f8
mov ecx, esi
call eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x50d5f8
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x50d5f8
call eax
cmp dword [edi + 0x20b8], 0
jne 0x413072
mov ebp, dword [esp + 0x20]
mov edx, dword [ebp]
mov eax, dword [edx + 0x2c]
push 0x50fdb4
mov ecx, ebp
call eax
mov ecx, dword [esp + 0x14]
push 0x50f9c8
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CEditUI::SetTipValue_wchar_t_const__]
jmp 0x413095
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x50fdc0
call eax
mov ecx, dword [esp + 0x14]
push str.Kb:g
call dword [sym.imp.LibDui.dll_public:_void___thiscall_DuiLib::CEditUI::SetTipValue_wchar_t_const__]
mov ebp, dword [esp + 0x20]
mov eax, edi
call fcn.00413190
test eax, eax
jne 0x4130dd
mov edx, dword [ebp]
mov eax, dword [edx + 0x2c]
push str._u7b
mov ecx, ebp
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xf8]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xf8]
push 1
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0xf8]
push 1
mov ecx, ebx
call eax
jmp 0x413131
mov edx, dword [esi]
mov eax, dword [edx + 0xf8]
push 0
mov ecx, esi
call eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [edx + 0xf8]
push 0
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0xf8]
push 0
mov ecx, ebx
call eax
jmp 0x413131
cmp eax, 3
jne 0x413117
call fcn.00446770
jmp 0x413135
cmp eax, 0x1f
je 0x413135
cmp eax, 5
jne 0x413135
mov ecx, edi
call fcn.00411c90
jmp 0x413135
mov esi, edi
call fcn.00446650
mov esi, dword [esp + 0x18]
mov ecx, esi
call dword [sym.imp.LibDui.dll_public:_int___thiscall_DuiLib::CTabLayoutUI::GetCurSel_void_const]
mov ecx, dword [esp + 0x2b4]
cmp eax, ecx
je 0x413155
push ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x200]
mov ecx, esi
call eax
mov eax, 1
mov ecx, dword [esp + 0x2a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x288]
xor ecx, esp
call fcn.00476050
add esp, 0x29c
ret 4