Function at 0x642a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x74ffbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x80
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov ebx, ecx
xor ecx, ecx
push edi
xor edi, edi
cmp eax, edi
setl cl
cmp eax, edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], ecx
jge 0x642ac3
xor eax, eax
mov dword [ebp + 0x20], eax
mov dx, word [ebp + 0x10]
cmp dx, word [ebp + 0x1c]
mov dword [ebx + 0x20], eax
jne 0x6435af
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x50]
mov esi, dword [ebx + 0xc]
cdq
idiv esi
mov esi, eax
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0xc]
cdq
idiv esi
mov dword [esp + 0x54], eax
mov eax, dword [ecx + 0x50]
cdq
idiv dword [ebx + 0xc]
mov esi, eax
mov eax, dword [ebp + 0x14]
cdq
idiv esi
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x18]
cdq
idiv esi
mov esi, dword [ebp + 0x10]
push esi
mov dword [esp + 0x50], eax
mov ecx, dword [ecx + 0xb0]
lea eax, [esp + 0x54]
push eax
call fcn.0063a640
test eax, eax
je 0x6435af
cmp dword [ebp + 0x20], edi
jne 0x642b51
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebx]
push ecx
mov ecx, dword [eax + 0xb0]
lea edx, [esp + 0x4c]
push edx
call fcn.0063a640
test eax, eax
je 0x6435af
cmp dword [ebx + 0x30], edi
push esi
je 0x642c4a
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x58]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.00640a20
test al, al
je 0x642d45
push 0x3c
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov dword [esp + 0x94], edi
je 0x642ba4
push 1
mov ecx, eax
call fcn.0063db70
mov esi, eax
jmp 0x642ba6
xor esi, esi
cmp dword [esp + 0x24], edi
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x94], 0xffffffff
je 0x642bdd
mov ecx, dword [esp + 0x4c]
lea edx, [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
push edx
push eax
push ebx
call fcn.0063f350
add esp, 0x18
mov ecx, dword [esp + 0x54]
sub esp, 0x10
mov eax, esp
mov dword [eax + 4], ecx
movzx ecx, word [ebp + 0x10]
mov dword [eax + 8], ecx
mov dword [eax], ebx
mov word [eax + 0xc], di
mov word [eax + 0xe], di
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x54], esp
call dword [edx + 4]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
mov dword [eax + 4], ecx
movzx ecx, word [ebp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax], edx
mov word [eax + 0xc], di
mov word [eax + 0xe], di
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x54], esp
call dword [edx + 8]
mov eax, esi
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [esp + 0x28], edi
je 0x642c77
mov edx, dword [esp + 0x50]
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x60]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00642420
jmp 0x642c92
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.0063f080
movzx eax, al
cmp eax, edi
je 0x642d45
push 0x3c
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov dword [esp + 0x94], 1
je 0x642cc7
push 1
mov ecx, eax
call fcn.0063db70
mov esi, eax
jmp 0x642cc9
xor esi, esi
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
sub esp, 0x10
mov eax, esp
mov dword [eax + 4], ecx
movzx ecx, word [ebp + 0x10]
mov dword [eax + 8], ecx
mov dword [eax], edx
mov word [eax + 0xc], di
mov word [eax + 0xe], di
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0xa4], 0xffffffff
mov dword [esp + 0x54], esp
call dword [edx + 4]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
sub esp, 0x10
mov eax, esp
mov dword [eax + 4], ecx
movzx ecx, word [ebp + 0x1c]
mov dword [eax + 8], ecx
mov dword [eax], edx
mov word [eax + 0xc], di
mov word [eax + 0xe], di
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x54], esp
call dword [edx + 8]
mov eax, esi
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
sub eax, edx
jns 0x642d53
neg eax
cmp eax, 0x40
jg 0x6435af
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x4c]
sub eax, ecx
jns 0x642d6a
neg eax
cmp eax, 0x40
jg 0x6435af
mov eax, dword [ebp + 0x1c]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00641c80
mov dword [esp + 0x38], eax
mov eax, 1
test byte [0x97b3f0], al
mov dword [esp + 0x14], eax
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
jne 0x642dcf
or dword [0x97b3f0], eax
push 0x641190
push 0x1324
push 0x1c
push 0x959c00
mov dword [esp + 0xa4], 2
call fcn.0041fa60
mov dword [esp + 0x94], 0xffffffff
mov ecx, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
lea eax, [ecx + edi]
mov ecx, dword [esp + 0x50]
lea esi, [ecx + edx]
cdq
sub eax, edx
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar ecx, 1
add ecx, 0xffffffdd
sar eax, 1
add eax, 0xffffffdd
mov dword [esp + 0x7c], ecx
add ecx, 0x45
mov dword [esp + 0x78], eax
add eax, 0x45
mov dword [esp + 0x84], ecx
xor ecx, ecx
mov dword [esp + 0x80], eax
mov eax, dword [ebx + 0xc]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], ecx
push edx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
call fcn.0042b700
mov esi, dword [esp + 0x84]
mov ecx, dword [esp + 0x78]
sub esi, dword [esp + 0x7c]
mov eax, dword [esp + 0x80]
sub eax, ecx
add eax, 1
add esi, 1
cmp dword [ebx + 0x30], 0
mov dword [esp + 0x68], eax
mov dword [esp + 0x60], ecx
je 0x642f10
test eax, eax
jle 0x642f8f
mov dword [esp + 0x20], 0x959c0c
mov dword [esp + 0x2c], eax
test esi, esi
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x64], ecx
jle 0x642ef6
mov edi, dword [esp + 0x20]
mov dword [esp + 0x30], esi
lea ebx, [ebx]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0xb0]
push edx
lea eax, [esp + 0x64]
push eax
call fcn.0063a640
test eax, eax
je 0x642ed9
mov edx, dword [ebx + 0x38]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x58]
push ecx
call dword [ebx + 0x30]
add esp, 0xc
test al, al
je 0x642ed9
mov eax, 1
jmp 0x642edb
xor eax, eax
mov dword [edi], eax
mov eax, 1
add dword [esp + 0x64], eax
add edi, 0x7a8
sub dword [esp + 0x30], eax
jne 0x642ea0
mov edi, dword [esp + 0x4c]
add dword [esp + 0x20], 0x1c
mov eax, 1
add dword [esp + 0x60], eax
sub dword [esp + 0x2c], eax
jne 0x642e86
jmp 0x642f8f
cmp dword [esp + 0x68], 0
jle 0x642f8f
mov edx, dword [esp + 0x68]
mov dword [esp + 0x20], 0x959c0c
mov dword [esp + 0x2c], edx
jmp 0x642f30
test esi, esi
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x64], eax
jle 0x642f7b
mov edi, dword [esp + 0x20]
mov dword [esp + 0x30], esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx]
push ecx
mov ecx, dword [eax + 0xb0]
lea edx, [esp + 0x64]
push edx
call fcn.0063a640
neg eax
sbb eax, eax
neg eax
mov dword [edi], eax
mov eax, 1
add dword [esp + 0x64], eax
add edi, 0x7a8
sub dword [esp + 0x30], eax
jne 0x642f44
mov edi, dword [esp + 0x4c]
add dword [esp + 0x20], 0x1c
mov eax, 1
add dword [esp + 0x60], eax
sub dword [esp + 0x2c], eax
jne 0x642f30
mov ebx, dword [esp + 0x68]
test ebx, ebx
jle 0x642fd7
mov edx, esi
shl edx, 4
sub edx, esi
lea eax, [esi + edx*4]
lea eax, [esi + eax*4]
mov ecx, 0x959c0c
lea eax, [eax*8 + 0x959464]
mov edx, ebx
jmp 0x642fc0
mov dword [eax], 0
mov dword [ecx], 0
add eax, 0x1c
add ecx, 0x1c
sub edx, 1
jne 0x642fc0
test esi, esi
jle 0x64300c
lea eax, [ebx*8]
sub eax, ebx
mov ecx, 0x959c0c
lea eax, [eax*4 + 0x959bf0]
mov dword [eax], 0
mov dword [ecx], 0
add eax, 0x7a8
add ecx, 0x7a8
sub esi, 1
jne 0x642ff0
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x54]
mov esi, dword [esp + 0x78]
mov edx, dword [esp + 0x50]
sub dword [esp + 0x48], esi
sub ecx, eax
sub edi, eax
sub edx, esi
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
lea esi, [eax*8]
sub esi, eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x6c], ecx
sub ecx, edi
lea eax, [esi*4 + 0x959c00]
mov dword [esp + 0x50], edx
mov dword [esp + 0x4c], edi
mov ebx, edx
mov dword [eax + 4], 0
jns 0x643064
neg ecx
sub edx, dword [esp + 0x48]
mov esi, ecx
jns 0x64306e
neg edx
lea ecx, [esi*8]
sub ecx, esi
lea ecx, [ecx + ecx*4]
or esi, 0xffffffff
lea edx, [edx + ecx*2]
mov ecx, dword [edx*4 + 0x914448]
mov dword [eax + 8], ecx
mov dword [eax], ecx
mov word [eax + 0x14], si
mov word [eax + 0x16], si
mov word [eax + 0x18], si
mov word [eax + 0x1a], si
mov word [eax + 0x10], si
mov word [eax + 0x12], si
or dword [eax + 0xc], 2
jmp 0x6430b0
cmp ebx, esi
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x30], esi
mov edx, ebx
jle 0x643100
mov edi, edi
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
lea esi, [eax*8]
sub esi, eax
lea eax, [esi*4 + 0x959c00]
mov esi, dword [eax]
cmp esi, dword [esp + 0x30]
jae 0x6430f3
mov dword [esp + 0x30], esi
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], ecx
movsx edx, word [eax + 0x18]
cmp edx, 0xffffffff
movsx ecx, word [eax + 0x1a]
jg 0x6430c0
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
lea eax, [ecx*8]
sub eax, ecx
lea edx, [eax + eax*4]
lea eax, [esi + edx*2]
lea edx, [eax*8]
sub edx, eax
cmp esi, dword [esp + 0x48]
lea eax, [edx*4 + 0x959c00]
mov dword [esp + 0x30], eax
jne 0x643139
cmp ecx, edi
je 0x6434ec
cmp dword [esp + 0x24], 0
je 0x64316d
mov edx, dword [ebp + 0x1c]
mov eax, dword [esp + 0x7c]
push edx
add ecx, eax
push ecx
mov ecx, dword [esp + 0x80]
lea edx, [esi + ecx]
mov ecx, dword [esp + 0x3c]
push edx
call fcn.00641c80
cmp eax, dword [esp + 0x38]
je 0x6434ec
mov edi, dword [esp + 0x4c]
lea edx, [esi - 1]
lea eax, [esi + 1]
cmp edx, eax
mov dword [esp + 0x10], edx
jg 0x64343d
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x5c]
mov eax, esi
sub eax, edx
mov dword [esp + 0x1c], eax
mov eax, edx
sub eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x58]
sub esi, eax
add ecx, 1
sub eax, dword [esp + 0x48]
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], eax
lea esp, [esp]
mov esi, dword [esp + 0x5c]
add esi, 0xffffffff
cmp esi, ecx
jg 0x64341b
mov eax, edi
sub eax, esi
lea ecx, [eax*8]
sub ecx, eax
mov dword [esp + 0x18], eax
lea ecx, [ecx + ecx*4]
add ecx, ecx
mov dword [esp + 0x28], ecx
mov eax, esi
sub eax, edi
lea ecx, [eax*8]
sub ecx, eax
lea eax, [esi*8]
sub eax, esi
lea ecx, [ecx + ecx*4]
add ecx, ecx
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x2c], ecx
lea ecx, [eax*8]
sub ecx, eax
sub edx, edi
lea eax, [ecx*4 + 0x959c12]
mov dword [esp + 0x3c], edx
jmp 0x643220
mov edx, dword [esp + 0x3c]
mov edi, edi
lea ecx, [eax - 0x12]
cmp ecx, dword [esp + 0x30]
je 0x6433ea
test byte [eax - 6], 1
je 0x6433ea
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
add ecx, edi
mov edi, dword [esp + 0x18]
add edx, edi
test ecx, ecx
jge 0x643255
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x20]
add ecx, edi
test edx, edx
jge 0x64325b
neg edx
cmp ecx, edx
mov edi, ecx
jl 0x643267
mov edi, edx
jle 0x643267
mov edx, ecx
mov ecx, edi
shl ecx, 4
sub ecx, edi
sub edx, edi
lea ecx, [ecx + ecx*2]
shl edx, 8
lea ecx, [edi + ecx*4]
lea ecx, [edx + ecx*2]
mov edx, dword [esp + 0x30]
add ecx, dword [edx + 4]
mov edx, dword [eax - 6]
test dl, 4
je 0x643318
cmp dword [eax - 0xe], ecx
jbe 0x6433ea
movzx edx, word [esp + 0x58]
mov word [eax - 2], dx
movzx edx, word [esp + 0x5c]
mov word [eax], dx
mov edx, dword [eax - 0xa]
add edx, ecx
mov dword [eax - 0xe], ecx
mov ecx, dword [eax - 6]
and ecx, 0xfffffffb
mov dword [eax - 0x12], edx
mov edx, dword [esp + 0x6c]
or ecx, 2
or edi, 0xffffffff
cmp ebx, edi
mov dword [eax - 6], ecx
mov word [eax + 6], bx
mov word [eax + 8], dx
jle 0x6432fe
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*4]
lea ecx, [ebx + edx*2]
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx*4 + 0x959c14]
mov dx, word [esp + 0x10]
mov word [ecx], dx
mov word [ecx + 2], si
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], 1
mov word [eax + 2], di
mov word [eax + 4], di
mov dword [esp + 0x6c], esi
jmp 0x6433ea
test dl, 2
je 0x643348
cmp dword [eax - 0xe], ecx
jbe 0x6433ea
mov dx, word [esp + 0x5c]
mov dword [eax - 0xe], ecx
mov cx, word [esp + 0x58]
mov word [eax - 2], cx
mov word [eax], dx
mov ecx, dword [eax - 0xa]
add ecx, dword [eax - 0xe]
mov dword [eax - 0x12], ecx
jmp 0x6433ea
mov dx, word [esp + 0x58]
mov dword [eax - 0xe], ecx
mov cx, word [esp + 0x5c]
mov word [eax - 2], dx
mov word [eax], cx
mov edx, dword [eax - 6]
and edx, 0xfffffffb
or edx, 2
mov dword [eax - 6], edx
mov edx, dword [esp + 0x6c]
or edi, 0xffffffff
cmp ebx, edi
mov word [eax + 6], bx
mov word [eax + 8], dx
jle 0x6433a6
lea ecx, [edx*8]
sub ecx, edx
lea ecx, [ecx + ecx*4]
lea ecx, [ebx + ecx*2]
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx*4 + 0x959c14]
mov dx, word [esp + 0x10]
mov word [ecx], dx
mov word [ecx + 2], si
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x6c], esi
mov word [eax + 2], di
mov word [eax + 4], di
jl 0x6433c5
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jge 0x6433d1
mov ecx, dword [esp + 0x20]
add dword [esp + 0x14], 1
add ecx, edx
mov ecx, dword [ecx*4 + 0x914448]
mov edx, dword [eax - 0xe]
add edx, ecx
mov dword [eax - 0xa], ecx
mov dword [eax - 0x12], edx
sub dword [esp + 0x18], 1
mov ecx, 0x46
sub dword [esp + 0x28], ecx
add dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x5c]
add esi, 1
add ecx, 1
add eax, 0x7a8
cmp esi, ecx
jle 0x64321a
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x10]
mov eax, 1
sub dword [esp + 0x1c], eax
add dword [esp + 0x20], eax
add edx, eax
mov eax, dword [esp + 0x58]
add eax, 1
cmp edx, eax
mov dword [esp + 0x10], edx
jle 0x6431b0
mov eax, dword [esp + 0x30]
mov ecx, dword [eax + 0xc]
mov si, word [eax + 0x14]
and ecx, 0xfffffffd
or ecx, 4
cmp si, 0xffff
mov dword [eax + 0xc], ecx
jle 0x64348e
movsx edx, word [eax + 0x16]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*4]
movsx ecx, si
lea ecx, [ecx + edx*2]
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx*4 + 0x959c18]
movzx edx, word [eax + 0x18]
mov word [ecx], dx
movzx edx, word [eax + 0x1a]
mov word [ecx + 2], dx
jmp 0x64349a
movsx ecx, word [eax + 0x1a]
movsx ebx, word [eax + 0x18]
mov dword [esp + 0x6c], ecx
mov si, word [eax + 0x18]
cmp si, 0xffff
jle 0x6434d9
movsx edx, word [eax + 0x1a]
lea ecx, [edx*8]
sub ecx, edx
lea edx, [ecx + ecx*4]
movsx ecx, si
lea ecx, [ecx + edx*2]
lea edx, [ecx*8]
sub edx, ecx
lea ecx, [edx*4 + 0x959c14]
mov dx, word [eax + 0x14]
mov word [ecx], dx
mov ax, word [eax + 0x16]
mov word [ecx + 2], ax
sub dword [esp + 0x14], 1
je 0x6435af
or esi, 0xffffffff
jmp 0x6430b0
push 0x3c
call fcn.0040fa60
add esp, 4
mov dword [esp + 0x44], eax
test eax, eax
mov dword [esp + 0x94], 3
je 0x643516
push 1
mov ecx, eax
call fcn.0063db70
mov edi, eax
jmp 0x643518
xor edi, edi
mov esi, dword [esp + 0x58]
cmp esi, 0xffffffff
mov ebx, dword [esp + 0x5c]
mov dword [esp + 0x94], 0xffffffff
jle 0x643596
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
add ecx, esi
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
movzx ecx, word [ebp + 0x10]
mov dword [eax + 8], ecx
xor ecx, ecx
add edx, ebx
mov word [eax + 0xc], cx
mov word [eax + 0xe], cx
mov dword [eax + 4], edx
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x54], esp
call dword [eax + 4]
lea eax, [ebx*8]
sub eax, ebx
lea ecx, [eax + eax*4]
lea eax, [esi + ecx*2]
lea edx, [eax*8]
sub edx, eax
movsx esi, word [edx*4 + 0x959c10]
cmp esi, 0xffffffff
movsx ebx, word [edx*4 + 0x959c12]
lea eax, [edx*4 + 0x959c00]
jg 0x643530
mov eax, edi
mov ecx, dword [esp + 0x8c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, dword [esp + 0x8c]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c