Function at 0x1002a1a5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10052f66
call fcn.10052218
sub esp, 0x130
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x80], edi
test cl, cl
je 0x1002ab0e
cmp byte [ebp + 8], 0
je 0x1002aaf6
mov dword [ebp - 0x14], 0xe48d327c
or esi, 0xffffffff
mov dword [ebp - 0x20], 0xdb505206
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], edi
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1002a201
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a1f3
mov dword [ebp - 0x18], ebx
jmp 0x1002a21c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], 0x2e6e7f73
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002a20b
mov dword [ebp - 0x18], ebx
jmp 0x1002a238
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x118], 0xdade
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a227
inc dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0xfffffffd
jmp 0x1002a36c
mov dword [ebp - 0x18], 0xfd07
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x15
jl 0x1002a30e
mov dword [ebp - 0x20], 3
jmp 0x1002a2f4
mov dword [ebp - 0x2c], 0xfffffff8
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x28], ebx
push 0x76b8
call fcn.1002bfdb
pop ecx
mov dword [ebp - 0x2c], ebx
jmp 0x1002a2eb
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x98]
cmp dword [ebp - 0x18], ebx
jne 0x1002a2b3
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x2c]
sub ecx, dword [ebp + eax*4 - 0x98]
jne 0x1002a2b3
mov eax, ebx
jmp 0x1002a2b6
xor eax, eax
inc eax
mov dword [ebp - 0x5c], eax
add eax, 9
je 0x1002a2cf
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x98], ebx
je 0x1002a2cf
xor edx, edx
inc edx
jmp 0x1002a2d1
mov edx, ebx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x1002a28a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
jne 0x1002a26d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x15
jge 0x1002a261
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
jmp 0x1002a363
mov dword [ebp - 0x20], 0x3988
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1002a333
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], 0x63832542
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002a325
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x20]
jg 0x1002a35b
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
add eax, ecx
cmp eax, 0xe5ff1fc5
mov eax, ebx
jae 0x1002a35d
mov eax, edx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1e
jg 0x1002a313
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jge 0x1002a24d
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x14], ebx
jmp 0x1002a393
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x124], 0xdc7555b7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1002a382
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1002a3bf
push edx
push 0x2f9
push 0x8f5
push edx
mov edx, 0x2e66
xor cl, cl
call fcn.1002a1a5
xor edx, edx
add esp, 0x10
inc edx
push 0xfffffffffffffffb
mov dword [ebp - 0x20], 0xfffffff3
pop edi
jmp 0x1002a418
mov dword [ebp - 0x3c], 0x72fd
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x14], ebx
jmp 0x1002a3ee
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x104], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1002a3e1
push ecx
push edx
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x2d], bl
push eax
push ecx
push ecx
mov ecx, 0x6ebd
call fcn.1002a053
add esp, 0x14
inc dword [ebp - 0xfc]
inc dword [ebp - 0x20]
push 1
pop edx
cmp dword [ebp - 0x20], edi
jg 0x1002a3cb
mov word [ebp - 0x64], 0x8a00
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x28], 0x63b4
cmp dword [ebp - 0x28], 0x6527
jle 0x1002a4c8
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, esi
mov dword [ebp - 0x14], ebx
cdq
idiv edi
mov edi, edx
mov esi, ebx
mov ebx, dword [ebp - 0x14]
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1006a318
xor eax, edi
cdq
push edx
push eax
call fcn.10001c75
inc esi
cmp esi, 0x22f7
jl 0x1002a469
inc ebx
push 0
mov dword [ebp - 0x14], ebx
cmp ebx, 0x592a
pop ebx
jl 0x1002a464
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5a74
jl 0x1002a45a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x75e9
jl 0x1002a455
push 0x21a0
push ebx
push 0x96
call dword [sym.imp.KERNEL32.dll_OpenProcess]
or esi, 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1002a595
mov dword [ebp - 0x18], 0x60b0ceaf
mov dword [ebp - 0x14], ebx
jmp 0x1002a4e9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x110], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a4dc
mov dword [ebp - 0x18], ebx
jmp 0x1002a501
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002a4f3
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x78]
mov ecx, dword [ebp - 0x78]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x1c]
setge dl
add ecx, edx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x78]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle bl
xor edx, edx
imul ebx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 0x1c]
sub ebx, dword [ebp + eax*4 - 0x78]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, ebx
jle 0x1002a587
mov eax, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x78], ebx
je 0x1002a589
mov eax, ebx
jmp 0x1002a58c
xor ebx, ebx
xor eax, eax
inc eax
mov dword [ebp - 0x10c], eax
inc dword [ebp - 0x1c]
push 3
pop ecx
cmp dword [ebp - 0x1c], ecx
jle 0x1002a4d0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x62f3
jge 0x1002a5e3
mov edx, str.hlwum_azv_xhfmkae_tzhrea_xutib_jtj
mov ecx, 0x1006a318
call fcn.10003644
jmp 0x1002a5e3
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xf0]
push 0x7c
pop eax
mov word [ebp - 0x68], ax
xor eax, eax
mov word [ebp - 0x66], ax
mov word [ebp - 0xf0], ax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0xdc], 7
mov dword [ebp - 0xe0], ebx
call fcn.100055e3
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 4], 2
call fcn.10029ed6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 4
call fcn.10005a02
xor eax, eax
mov dword [ebp - 0x20], 0xd5e48d32
inc eax
mov ecx, 0x1022
push eax
push ebx
push 0x126c
mov dl, al
call fcn.1002be06
add esp, 0xc
mov dword [ebp - 0x20], 6
jmp 0x1002a6a9
mov dword [ebp - 0x14], 0x665683c8
mov dword [ebp - 0x14], ebx
jmp 0x1002a6a0
xor eax, eax
mov byte [ebp - 0x2e], bl
inc eax
lea ecx, [ebp - 0x2e]
push eax
push ecx
push 0x3c11
push ebx
mov edx, 0x2806
mov cl, al
call fcn.1002a1a5
add esp, 0x10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jge 0x1002a67d
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jne 0x1002a671
push ecx
push ebx
push 0x1fc3
push ecx
push ecx
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
call fcn.1002a053
add esp, 0x14
mov dword [ebp - 0x44], ebx
jmp 0x1002a75c
xor ecx, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x1002a6ed
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0x250e6da5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a6dc
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x2f], bl
push eax
push 0x1bbd
mov edx, 0x5e56
xor cl, cl
call fcn.1002c006
mov dword [ebp - 0x14], ebx
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
jl 0x1002a759
mov dword [ebp - 0x1c], 0xc9e53e58
mov dword [ebp - 0x1c], ebx
jmp 0x1002a74f
mov dword [ebp - 0x34], 0xfffffffa
mov ecx, esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xac]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1002a74c
push ecx
push ecx
xor cl, cl
call fcn.1002ac68
pop ecx
pop ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1002a720
dec dword [ebp - 0x14]
jns 0x1002a714
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xfffffff3
je 0x1002a6d1
push 9
pop eax
push 2
mov byte [ebp - 0x58], bl
mov ecx, ebx
mov dword [ebp - 0x57], 0x6e190419
mov dword [ebp - 0x53], 0x3025e19
mov dword [ebp - 0x4f], 0x2d030701
mov word [ebp - 0x8c], ax
pop esi
cmp esi, 2
jne 0x1002a799
push 5
pop ecx
push ecx
pop esi
jmp 0x1002a7c8
movzx edx, byte [ebp + esi - 0x57]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x5a]
movzx ecx, word [ebp + eax*2 - 0x8c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x58]
add ecx, edx
mov word [ebp + eax*2 - 0x8c], cx
mov ecx, ebx
add esi, 2
cmp esi, 0xd
jb 0x1002a78d
xor eax, eax
mov dword [ebp - 0xb4], 7
mov word [ebp - 0x84], ax
lea ecx, [ebp - 0xc8]
mov word [ebp - 0xc8], ax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 0xb8], ebx
call fcn.100055e3
mov byte [ebp - 4], 5
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0xb064bae0
mov dword [ebp - 0x3c], 0x2657
mov dword [ebp - 0x14], ebx
jmp 0x1002a82d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0x2ba75a59
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a81f
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ecx
jg 0x1002a9ec
mov dword [ebp - 0x18], 0xdc7555b7
mov dword [ebp - 0x14], ebx
jmp 0x1002a858
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0x57e8b72f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002a84a
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x1002a933
mov dword [ebp - 0x28], 0xf8b8ae50
mov dword [ebp - 0x34], 0xb641b44a
mov dword [ebp - 0x14], 0x3131
cmp dword [ebp - 0x14], 0x34d0
jle 0x1002a8ce
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x13c]
xor eax, esi
cdq
push edx
push eax
call fcn.10003c04
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a8a7
mov eax, dword [eax]
push eax
call fcn.1003a280
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.10002056
inc edi
cmp edi, 0x67a6
jl 0x1002a88b
inc esi
cmp esi, 0x82a
jl 0x1002a889
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], ecx
xor ecx, ecx
mov dword [ebp - 0x28], 0x34b6
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x34], ecx
jle 0x1002a908
mov eax, ebx
cmp dword [ebp - 0x48], ebx
je 0x1002a90a
mov eax, ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x14], 0x2fac
jge 0x1002a924
push str.igy_oeuy_dbnz
call fcn.1003a280
pop ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 4], 5
inc dword [ebp - 0x18]
jmp 0x1002a860
mov dword [ebp - 0x18], ebx
jmp 0x1002a9db
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x14], 0xeb4983ca
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x38], ebx
je 0x1002a9c8
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
sbb eax, eax
neg eax
sub eax, 7
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x18]
je 0x1002a970
mov esi, ecx
cmp dword [ebp - 0x48], ebx
jne 0x1002a972
mov esi, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x38]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, esi
setne dl
sub edx, 0xe630971c
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp + eax*4 - 0x38]
jl 0x1002a9ae
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x38], ebx
jne 0x1002a9ae
xor ecx, ecx
mov edx, ebx
inc ecx
jmp 0x1002a9b3
xor ecx, ecx
inc ecx
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], edx
mov edx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x38]
cmp eax, dword [ebp - 0x14]
jl 0x1002a9ca
mov edx, ebx
xor eax, eax
cmp edx, 0x4a6e8f59
setne al
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002a93b
inc dword [ebp - 0x20]
jmp 0x1002a835
xor eax, eax
lea edi, [ebp - 0x8c]
stosd dword es:[edi], eax
mov edx, 0x1e57
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x40]
push eax
push 0x6cd1
push ecx
mov dword [ebp - 0xa8], 0x164c
lea eax, [ebp - 0xb0]
push ecx
mov dword [ebp - 0x40], 0x9f196e6c
mov dword [ebp - 0xb0], 8
push ecx
mov dword [ebp - 0xd8], ebx
push ecx
mov dword [ebp - 0xd4], ebx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
push eax
call fcn.10029fa0
add esp, 0x1c
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], 3
jg 0x1002aa71
push ecx
push ecx
mov cl, 1
call fcn.1002ac68
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 3
pop ecx
pop ecx
jle 0x1002aa5b
xor ebx, ebx
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xa4]
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x60], ebx
mov esi, eax
test esi, esi
je 0x1002aac9
push 0x4833
push ecx
lea eax, [ebp - 0xc8]
mov dl, 1
push eax
push 0x6d9b
push 0x35db
lea eax, [ebp - 0xa4]
push eax
push 0x6013
lea ecx, [ebp - 0x60]
call fcn.1002a0d7
mov eax, dword [ebp - 0x60]
add esp, 0x1c
inc eax
mov dword [ebp - 0x60], eax
cmp eax, esi
jb 0x1002aa8c
xor ebx, ebx
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0xa4]
push eax
call fcn.1002da61
push ebx
push 1
lea ecx, [ebp - 0xc8]
call fcn.10005a02
lea ecx, [ebp - 0xa4]
call fcn.1002def1
jmp 0x1002abd5
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002abd5
push ecx
call fcn.1002c103
pop ecx
jmp 0x1002abd5
mov dword [ebp - 0x34], 0x1cca
cmp dword [ebp - 0x34], 0xb0a
jge 0x1002abb5
call fcn.1003a839
push eax
push 0x1005bbe8
push str.in.txt
call fcn.1003a9e8
call fcn.1003a839
add eax, 0x20
push eax
push 0x1005bbf4
push str.out.txt
call fcn.1003a9e8
add esp, 0x18
lea eax, [ebp - 0xf4]
mov esi, 0x1006a438
mov ecx, esi
push eax
call fcn.10020c78
jmp 0x1002ab9e
mov ecx, dword [ebp - 0x7c]
lea eax, [ecx + 1]
imul eax, ecx
dec eax
push eax
lea eax, [ecx - 1]
imul eax, ecx
mov ecx, 0x1006a318
inc eax
push eax
call fcn.1002d722
mov edx, 0x1005d760
mov ecx, eax
call fcn.10003644
mov ecx, eax
call fcn.1002d722
push eax
call fcn.1002318a
pop ecx
lea eax, [ebp - 0x7c]
mov ecx, esi
push eax
call fcn.10020c78
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1002ab67
xor eax, eax
push eax
push eax
cmp byte [ebp + 0x14], al
je 0x1002abc6
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1002abd5
push 0x25f5
push eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret