Function at 0x6707ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x751937
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x124
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xa4]
mov dword [esp + 0x10], esi
call fcn.004049b0
xor ebx, ebx
push str.map_map_realms_religion.ini
lea ecx, [esp + 0xa8]
mov dword [esp + 0x140], ebx
call fcn.00403a50
lea ecx, [esp + 0xec]
call fcn.004049b0
push str.map_map_realms_climate.ini
lea ecx, [esp + 0xf0]
mov byte [esp + 0x140], 1
call fcn.00403a50
mov eax, dword [esi + 0x1f8]
xor ebp, ebp
cmp eax, ebx
je 0x67086c
push str.1000
push eax
call fcn.0071f59b
add esp, 8
neg eax
sbb eax, eax
add eax, 1
test al, al
je 0x67086c
mov ebp, 1
jmp 0x670894
mov eax, dword [esi + 0x1f8]
cmp eax, ebx
je 0x670894
push str.1200
push eax
call fcn.0071f59b
add esp, 8
neg eax
sbb eax, eax
add eax, 1
test al, al
je 0x670894
mov ebp, 2
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], vtable.CBSList_struct_TTownTemplate_.0
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x7c], ebx
push ebx
push str.defs_economy_town_templates.ini
mov byte [esp + 0x144], 2
call fcn.00404ed0
mov edi, eax
add esp, 8
mov ecx, edi
call fcn.004043a0
mov esi, eax
cmp esi, ebx
je 0x6708f7
push ebp
lea eax, [esp + 0x70]
push eax
push esi
mov ecx, edi
call fcn.00402f50
push eax
push edi
call fcn.00666f80
add esp, 0x10
push esi
mov ecx, edi
call fcn.00403050
mov esi, eax
cmp esi, ebx
jne 0x6708d1
mov eax, vtable.CBSList_class_CWorldCastleDef__.0
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], vtable.CBSList_class_CGameObjDef__.0
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x90], ebx
lea ecx, [esp + 0x80]
push ebx
push ecx
mov byte [esp + 0x144], 6
call fcn.0057fac0
mov ecx, dword [0x914298]
push eax
call fcn.005cc350
mov eax, dword [esp + 0x88]
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x670a78
mov edi, 1
lea esp, [esp]
mov edx, dword [eax + 4]
push ebx
push 0x861c50
push 0x85e1c8
mov dword [esp + 0x20], edx
mov eax, dword [eax]
push ebx
push eax
call fcn.0071f44c
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x670a6c
mov eax, dword [esi + 0xb80]
cmp eax, 2
jne 0x670a08
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x40]
call dword [edx + 0x60]
mov dword [eax], esi
mov dword [eax + 4], ebx
cmp dword [esp + 0x48], ebx
jne 0x6709f7
add dword [esp + 0x44], edi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
jmp 0x670a6c
mov ecx, dword [esp + 0x4c]
mov dword [ecx + 4], eax
add dword [esp + 0x44], edi
mov dword [esp + 0x4c], eax
jmp 0x670a6c
cmp eax, edi
jne 0x670a41
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x54]
call dword [edx + 0x60]
mov dword [eax], esi
mov dword [eax + 4], ebx
cmp dword [esp + 0x5c], ebx
jne 0x670a30
add dword [esp + 0x58], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
jmp 0x670a6c
mov ecx, dword [esp + 0x60]
mov dword [ecx + 4], eax
add dword [esp + 0x58], edi
mov dword [esp + 0x60], eax
jmp 0x670a6c
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x2c]
call dword [edx + 0x60]
mov dword [eax], esi
mov dword [eax + 4], ebx
cmp dword [esp + 0x34], ebx
jne 0x670a5d
mov dword [esp + 0x34], eax
jmp 0x670a64
mov ecx, dword [esp + 0x38]
mov dword [ecx + 4], eax
add dword [esp + 0x30], edi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x6709a0
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp + 0x24]
add ebp, 0x24
xor esi, esi
mov ecx, ebp
mov dword [esp + 0x98], esi
call dword [edx + 0xc]
test eax, eax
jbe 0x671033
mov eax, dword [ebp]
push esi
mov ecx, ebp
call dword [eax + 0x14]
mov ebp, dword [eax]
cmp ebp, ebx
mov dword [esp + 0x94], ebp
je 0x671010
mov edx, dword [ebp + 0x64]
cmp edx, ebx
je 0x671010
mov eax, edx
shr eax, 0x18
sub eax, ebx
je 0x670af0
sub eax, 1
je 0x670ae2
sub eax, 1
jne 0x671010
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e4]
jmp 0x670afc
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e0]
jmp 0x670afc
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2dc]
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp eax, ebx
je 0x671010
lea ecx, [eax - 0x18]
cmp ecx, ebx
je 0x671010
mov edx, dword [ecx]
call dword [edx + 0x50]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x68], ebx
je 0x671010
mov eax, dword [ebp + 0x10]
push 4
push eax
push 0x7b1fb4
lea ecx, [esp + 0xb0]
call fcn.00402f10
push eax
lea ecx, [esp + 0xb0]
call fcn.00403300
cmp eax, 4
jne 0x670bb7
mov ax, word [ebp + 0x22]
test ax, ax
je 0x670b73
mov ecx, dword [0x923cb8]
movzx eax, ax
mov edx, dword [ecx + eax*4 + 0x44]
movzx eax, byte [edx + 0x429]
cmp eax, 4
jne 0x670bb7
mov eax, dword [ebp + 0x194]
cmp eax, 4
jne 0x670bb7
mov ax, word [ebp + 0x2a]
test ax, ax
jne 0x670b8b
xor eax, eax
jmp 0x670bb1
mov esi, dword [esp + 0x10]
add esi, 0x1a8
movzx edi, ax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
cmp edi, eax
jb 0x670ba7
xor eax, eax
jmp 0x670bb1
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + 0x294]
cmp eax, 2
mov dword [ebp + 0x24], eax
mov ecx, dword [0x912e94]
jne 0x670bfd
mov edx, dword [esp + 0x44]
mov eax, dword [ecx]
push 0x2221
push str.BSSKoHGame_realm.cpp
add edx, 0xffffffff
push edx
push 0
call dword [eax + 0x40]
test eax, eax
mov ecx, dword [esp + 0x48]
jbe 0x670bee
sub eax, 1
mov ecx, dword [ecx + 4]
jne 0x670be6
mov ecx, dword [ecx]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0xa4]
jmp 0x670c65
test eax, eax
mov edx, dword [ecx]
jne 0x670c2c
mov eax, dword [esp + 0x30]
push 0x2223
push str.BSSKoHGame_realm.cpp
add eax, 0xffffffff
push eax
push 0
call dword [edx + 0x40]
test eax, eax
mov ecx, dword [esp + 0x34]
jbe 0x670c58
sub eax, 1
mov ecx, dword [ecx + 4]
jne 0x670c22
jmp 0x670c58
mov eax, dword [esp + 0x58]
push 0x2225
push str.BSSKoHGame_realm.cpp
add eax, 0xffffffff
push eax
push 0
call dword [edx + 0x40]
test eax, eax
mov ecx, dword [esp + 0x5c]
jbe 0x670c58
jmp 0x670c50
sub eax, 1
mov ecx, dword [ecx + 4]
jne 0x670c50
mov eax, dword [ecx]
mov edx, dword [ebx]
mov ecx, ebx
push eax
call dword [edx + 0xa4]
mov eax, dword [ebp + 0x10]
push eax
push str.climate
lea ecx, [esp + 0xf4]
call fcn.00403270
mov esi, eax
test esi, esi
je 0x670ccf
push str.desert
push esi
call fcn.00734cec
add esp, 8
test eax, eax
jne 0x670c9b
mov byte [ebp + 0x204], 2
jmp 0x670ccf
push str.palms
push esi
call fcn.00734cec
add esp, 8
test eax, eax
jne 0x670cb6
mov byte [ebp + 0x204], 1
jmp 0x670ccf
push str.snow
push esi
call fcn.00734cec
add esp, 8
test eax, eax
jne 0x670ccf
mov byte [ebp + 0x204], 3
lea ecx, [esp + 0x6c]
push ecx
push ebp
call fcn.00658730
add esp, 8
test eax, eax
je 0x670ceb
push eax
push ebp
call fcn.0066e6b0
add esp, 8
mov ecx, dword [0x914298]
push 0
call fcn.005cbfb0
test eax, eax
je 0x670d0b
mov edx, dword [eax + 4]
push edx
mov ecx, ebp
call fcn.0065be80
test eax, eax
jne 0x670d2b
mov ecx, dword [0x914298]
push 0
call fcn.005cbfb0
test eax, eax
je 0x670d2b
mov eax, dword [eax + 4]
push 0
push 1
push eax
mov ecx, ebp
call fcn.0066d610
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], vtable.CBDList_unsigned_long_int_.0
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov ebx, dword [esp + 0x94]
mov edx, dword [ebx + 0x70]
add ebx, 0x70
mov ecx, ebx
mov byte [esp + 0x13c], 7
call dword [edx + 0x2c]
cmp eax, edi
mov dword [esp + 0x9c], eax
je 0x670dbd
lea ebx, [ebx]
mov eax, dword [ebx]
lea ecx, [esp + 0x9c]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [esp + 0x18]
mov esi, dword [eax]
lea ecx, [esp + 0x18]
call dword [edx + 0x60]
mov dword [eax], esi
mov dword [eax + 4], edi
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
cmp dword [esp + 0x20], edi
jne 0x670da4
mov dword [esp + 0x20], eax
jmp 0x670dab
mov edx, dword [esp + 0x24]
mov dword [edx + 4], eax
add dword [esp + 0x1c], 1
cmp dword [esp + 0x9c], edi
mov dword [esp + 0x24], eax
jne 0x670d70
mov ebp, dword [esp + 0x20]
cmp ebp, edi
je 0x670ead
lea esp, [esp]
mov eax, ebp
mov edx, dword [eax]
mov ebp, dword [ebp + 4]
mov eax, edx
shr eax, 0x18
sub eax, edi
je 0x670e09
sub eax, 1
je 0x670dfb
sub eax, 1
jne 0x670ea3
mov eax, dword [0x912e94]
mov ecx, dword [eax + 0x2e4]
jmp 0x670e15
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e0]
jmp 0x670e15
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2dc]
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp eax, edi
je 0x670ea3
lea ecx, [eax - 0x18]
cmp ecx, edi
je 0x670ea3
mov edx, dword [ecx]
call dword [edx + 0x38]
mov edi, eax
test edi, edi
je 0x670ea3
mov eax, dword [edi]
push 1
push 1
mov ecx, edi
call dword [eax + 0x278]
mov ecx, dword [0x912e94]
mov edx, dword [ecx]
push 0x22a9
push str.BSSKoHGame_realm.cpp
push 7
push 0
call dword [edx + 0x40]
mov ecx, eax
mov eax, dword [edi]
mov esi, 1
shl esi, cl
mov ecx, edi
call dword [eax + 0x27c]
mov ecx, eax
and ecx, esi
test cx, cx
je 0x670e43
test al, 0x20
je 0x670e81
mov esi, 0x20
mov edx, dword [edi]
push 1
push esi
mov ecx, edi
call dword [edx + 0x278]
test eax, eax
je 0x670ea3
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x220]
mov ecx, edi
call fcn.006d77c0
xor edi, edi
cmp ebp, edi
jne 0x670dd0
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x2c]
cmp eax, edi
mov dword [esp + 0xa0], eax
je 0x670f9e
mov ebp, dword [esp + 0x68]
jmp 0x670ed0
mov eax, dword [ebx]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, ebx
call dword [eax + 0x34]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x18
sub eax, edi
je 0x670f13
sub eax, 1
je 0x670f05
sub eax, 1
jne 0x670f91
mov eax, dword [0x912e94]
mov ecx, dword [eax + 0x2e4]
jmp 0x670f1f
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e0]
jmp 0x670f1f
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2dc]
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp eax, edi
je 0x670f91
lea ecx, [eax - 0x18]
cmp ecx, edi
je 0x670f91
mov edx, dword [ecx]
call dword [edx + 0x38]
mov esi, eax
cmp esi, edi
je 0x670f91
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x28c]
test al, al
je 0x670f84
mov ecx, dword [0x912e94]
mov eax, dword [ecx]
mov edx, dword [ebp]
push 0x22c5
push str.BSSKoHGame_realm.cpp
mov ecx, ebp
mov dword [esp + 0x70], eax
call dword [edx + 0x28c]
mov ecx, dword [0x912e94]
movzx eax, al
sub eax, 1
push eax
mov eax, dword [esp + 0x74]
xor edi, edi
push edi
call dword [eax + 0x40]
jmp 0x670f86
xor eax, eax
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x1b4]
cmp dword [esp + 0xa0], edi
jne 0x670ed0
mov eax, dword [esp + 0x94]
push eax
call fcn.0065a900
add esp, 4
mov dword [esp + 0x18], vtable.CBDList_unsigned_long_int_.0
mov eax, dword [esp + 0x20]
cmp eax, edi
mov byte [esp + 0x13c], 8
je 0x670feb
jmp 0x670fd0
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x1c]
call dword [edx + 0x64]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x670fd0
mov esi, dword [esp + 0x98]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13c], 6
mov dword [esp + 0x18], vtable.CBList_unsigned_long_int_.0
mov ebp, dword [esp + 0x10]
mov eax, dword [ebp + 0x24]
add ebp, 0x24
add esi, 1
mov ecx, ebp
mov dword [esp + 0x98], esi
call dword [eax + 0xc]
xor ebx, ebx
cmp esi, eax
jb 0x670a98
mov eax, dword [0x912e94]
cmp dword [eax + 0xc], ebx
je 0x67117e
mov ax, word [eax + 0x1ac]
cmp ax, bx
jne 0x671051
xor eax, eax
jmp 0x67107b
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0x1a8]
add esi, 0x1a8
mov ecx, esi
movzx edi, ax
call dword [edx + 0xc]
cmp edi, eax
jb 0x671071
xor eax, eax
jmp 0x67107b
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x14]
mov eax, dword [eax]
mov edx, dword [eax + 0x24]
lea esi, [eax + 0x24]
mov ecx, esi
call dword [edx + 0x48]
cmp eax, 1
jne 0x67117e
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x40]
mov cx, word [eax]
mov edx, dword [esp + 0x10]
movzx eax, cx
cmp eax, dword [edx + 0x60]
jae 0x6710b2
mov edx, dword [ebp]
push eax
mov ecx, ebp
call dword [edx + 0x14]
mov eax, dword [eax]
jmp 0x6710c0
cmp cx, 0xffff
jne 0x6710be
mov eax, dword [edx + 0x6c]
jmp 0x6710c0
xor eax, eax
lea edi, [eax + 0x70]
mov eax, dword [edi]
mov ecx, edi
xor ebp, ebp
call dword [eax + 0x2c]
cmp dword [esp + 0x14], ebx
je 0x67117e
mov edx, dword [edi]
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call dword [edx + 0x34]
mov edx, dword [eax]
mov eax, edx
shr eax, 0x18
sub eax, ebx
je 0x671113
sub eax, 1
je 0x671105
sub eax, 1
jne 0x671139
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e4]
jmp 0x67111f
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2e0]
jmp 0x67111f
mov ecx, dword [0x912e94]
mov ecx, dword [ecx + 0x2dc]
mov eax, dword [ecx]
push edx
call dword [eax + 0x18]
cmp eax, ebx
je 0x671139
lea ecx, [eax - 0x18]
cmp ecx, ebx
je 0x671139
mov edx, dword [ecx]
call dword [edx + 0x38]
mov esi, eax
jmp 0x67113b
xor esi, esi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x280]
cmp ax, 1
je 0x67117e
cmp ebp, ebx
jne 0x671161
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x280]
cmp ax, 0x20
je 0x671161
mov ebp, esi
cmp dword [esp + 0x14], ebx
jne 0x6710d6
cmp ebp, ebx
je 0x67117e
mov eax, dword [ebp]
push 1
push 1
mov ecx, ebp
call dword [eax + 0x278]
mov ecx, dword [esp + 0x10]
call fcn.0066b200
mov dword [esp + 0x80], vtable.CBSList_class_CGameObjDef__.0
mov eax, dword [esp + 0x88]
cmp eax, ebx
mov byte [esp + 0x13c], 9
je 0x6711cc
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x88], ecx
push eax
lea ecx, [esp + 0x84]
call dword [edx + 0x64]
mov eax, dword [esp + 0x88]
test eax, eax
jne 0x6711a5
xor ecx, ecx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x84], ecx
mov dword [esp + 0x80], vtable.CBList_class_CGameObjDef__.0
mov dword [esp + 0x2c], vtable.CBSList_class_CWorldCastleDef__.0
mov eax, dword [esp + 0x34]
cmp eax, ecx
mov byte [esp + 0x13c], 0xa
je 0x67122b
jmp 0x671210
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esp + 0x30]
call dword [edx + 0x64]
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x671210
xor ecx, ecx
mov esi, vtable.CBList_class_CWorldCastleDef__.0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], vtable.CBSList_class_CWorldCastleDef__.0
mov eax, dword [esp + 0x48]
cmp eax, ecx
mov byte [esp + 0x13c], 0xb
je 0x67127b
lea ebx, [ebx]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
push eax
lea ecx, [esp + 0x44]
call dword [edx + 0x64]
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x671260
xor ecx, ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0x54], vtable.CBSList_class_CWorldCastleDef__.0
mov eax, dword [esp + 0x5c]
cmp eax, ecx
mov byte [esp + 0x13c], 0xc
je 0x6712c0
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x54]
mov dword [esp + 0x5c], ecx
push eax
lea ecx, [esp + 0x58]
call dword [edx + 0x64]
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x6712a5
xor ecx, ecx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], esi
mov dword [esp + 0x6c], vtable.CBSList_struct_TTownTemplate_.0
mov eax, dword [esp + 0x74]
cmp eax, ecx
pop edi
pop esi
pop ebp
mov byte [esp + 0x130], 0xd
pop ebx
je 0x67130e
mov edi, edi
mov ecx, dword [eax + 0x138]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x64], ecx
push eax
lea ecx, [esp + 0x60]
call dword [edx + 0x64]
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x6712f0
xor eax, eax
lea ecx, [esp + 0xdc]
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], vtable.CBList_struct_TTownTemplate_.0
mov byte [esp + 0x12c], al
call fcn.004049f0
lea ecx, [esp + 0x94]
mov dword [esp + 0x12c], 0xffffffff
call fcn.004049f0
mov ecx, dword [esp + 0x124]
mov dword fs:[0], ecx
add esp, 0x130
ret