Function at 0x489920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
call fcn.0047ac48
mov esi, eax
lea eax, [esi + 0x325aa0]
mov dword [ebp - 0x14], eax
cmp esi, dword [0x49f4dc]
jae 0x48995c
mov eax, dword [ebp - 0x14]
cmp eax, dword [0x49f4dc]
jbe 0x48995c
mov eax, dword [0x49f4dc]
sub eax, 4
mov dword [ebp - 0x14], eax
push 0x48a468
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jg 0x489975
test ebx, ebx
jge 0x48a45c
push 0x48a474
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x48a45c
mov dword [0x4a11b4], edi
push 0x48a47c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 8], eax
push 0x48a48c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0xc], eax
push 0x48a49c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a121c], eax
push 0x48a4a8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1218], eax
push 0x48a4b4
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1214], eax
push 0x48a4c8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1210], eax
push 0x48a4dc
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a120c], eax
push 0x48a4e8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1208], eax
push 0x48a4f8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1200], eax
push 0x48a504
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11f8], eax
push 0x48a518
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11fc], eax
push 0x48a52c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1204], eax
push 0x48a538
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1220], eax
push 0x48a54c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1224], eax
push 0x48a55c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a1228], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
push 0x48a56c
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jg 0x489a9e
test ebx, ebx
jge 0x48a45c
push 0x48a578
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11b8], eax
push 0x48a588
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11bc], eax
push 0x48a598
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11c0], eax
push 0x48a5a8
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11c4], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [0x4a11b8], 0
je 0x48a45c
cmp dword [0x4a11bc], 0
je 0x48a45c
push 0x48a5b8
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jg 0x489b17
test ebx, ebx
jge 0x48a45c
push 0x48a5c4
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11cc], eax
push 0x48a5d0
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11c8], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
push 0x48a5e0
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jg 0x489b56
test ebx, ebx
jge 0x48a45c
push 0x48a5ec
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11e4], eax
push 0x48a600
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11e8], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
mov eax, 0x447f38
test eax, eax
je 0x48a45c
cmp dword [0x4a11e4], 0
je 0x48a45c
push 0x48a620
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
cmp ebx, 0x20
jg 0x489baf
test ebx, ebx
jge 0x48a45c
push 0x48a62c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a122c], eax
push 0x48a638
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11d4], eax
push 0x48a644
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11d8], eax
push 0x48a654
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11dc], eax
push 0x48a66c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11d0], eax
push 0x48a67c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11f4], eax
push 0x48a68c
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11f0], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [0x4a122c], 0
je 0x48a45c
cmp dword [0x4a11f0], 0
je 0x48a45c
cmp dword [0x4a11d4], 0
je 0x48a45c
cmp dword [0x4a11d8], 0
je 0x48a45c
cmp dword [0x4a11dc], 0
je 0x48a45c
cmp dword [0x4a11d0], 0
je 0x48a45c
push 0x48a698
call sub.KERNEL32.DLL_LoadLibraryA
mov ebx, eax
push 0x48a6a4
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4a11e0], eax
push ebx
call sub.KERNEL32.DLL_FreeLibrary
cmp dword [0x4a11e0], 0
je 0x48a45c
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jae 0x48a45c
mov byte [ebp - 0x21], 0
xor edx, edx
push ebp
push 0x48a430
push dword fs:[edx]
mov dword fs:[edx], esp
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
je 0x489cdb
mov byte [ebp - 0x21], 1
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [ebp - 0xc]
jne 0x489d54
xor edx, edx
push ebp
push 0x489d45
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x488864
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a11c8]
jne 0x489dd0
xor edx, edx
push ebp
push 0x489dc1
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x487e10
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489db4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a11e8]
jne 0x489e4c
xor edx, edx
push ebp
push 0x489e3d
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x488a64
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a11f4]
jne 0x489ec8
xor edx, edx
push ebp
push 0x489eb9
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x488e10
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a11f0]
jne 0x489f44
xor edx, edx
push ebp
push 0x489f35
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x488df0
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489f28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a121c]
jne 0x489fc0
xor edx, edx
push ebp
push 0x489fb1
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x489614
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x489fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
cmp edx, dword [0x4a1218]
jne 0x48a03c
xor edx, edx
push ebp
push 0x48a02d
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x1c]
push edx
push 0x40
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x489544
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a120c]
jne 0x48a0bb
xor edx, edx
push ebp
push 0x48a0ac
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4892d4
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a09f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a1204]
jne 0x48a13a
xor edx, edx
push ebp
push 0x48a12b
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x489220
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a11e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a1200]
jne 0x48a1b9
xor edx, edx
push ebp
push 0x48a1aa
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4891cc
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a19d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a11f8]
jne 0x48a238
xor edx, edx
push ebp
push 0x48a229
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x489124
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a1220]
jne 0x48a2b7
xor edx, edx
push ebp
push 0x48a2a8
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4896d0
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a29b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a1224]
jne 0x48a336
xor edx, edx
push ebp
push 0x48a327
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4896f8
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a31a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a11e4]
jne 0x48a3b2
xor edx, edx
push ebp
push 0x48a3a6
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x488878
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a399
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, dword [0x4a122c]
jne 0x48a426
xor edx, edx
push ebp
push 0x48a41c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_VirtualProtect
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x4898ac
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp - 0x1c]
push edx
push 4
push eax
call sub.KERNEL32.DLL_VirtualProtect
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jne 0x48a412
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a45c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a426
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48a43e
cmp byte [ebp - 0x21], 0
je 0x48a44d
push ebp
call fcn.004898e8
pop ecx
jmp 0x48a450
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jb 0x489cb1
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret