Function at 0x401f90
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x453f8f
push eax
mov dword fs:[0], esp
sub esp, 0xe50
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.00401f40
cmp eax, edi
je 0x4020cb
mov eax, dword [str.lF_F]
mov dword [esp + 0x18], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x4602b0
test ecx, ecx
mov dword [esp + 0xe68], edi
jne 0x401ff2
xor eax, eax
jmp 0x401ff9
push 0x4602b0
call esi
push 0x4602b0
push eax
lea ecx, [esp + 0x20]
call fcn.00404190
mov edx, dword [str.lF_F]
mov dword [esp + 0x1c], edx
mov eax, 0x460298
mov byte [esp + 0xe68], 1
test eax, eax
je 0x40202a
push 0x460298
call esi
push 0x460298
push eax
lea ecx, [esp + 0x24]
call fcn.00404190
push 0x41
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x402065
push eax
push edi
push edi
push str.http:__down.360safe.com_safesetup_2000.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x1c]
mov edx, dword [0x46005c]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402096
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x402096
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4020c1
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4020c1
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
mov eax, 1
jmp 0x402d04
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 8
push eax
mov dword [esp + 0x3c], 0x404
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x460208
push 0x4601f8
mov esi, dword [esp + 0xe78]
push esi
call fcn.00401c40
push 0x4601f4
push edi
call fcn.00440c24
add esp, 0x14
mov ecx, 0x468350
push edi
push esi
push edi
call fcn.00402d20
cmp eax, edi
jl 0x402156
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0xc
mov dword [0x4683d4], eax
mov dword [0x4683d8], edi
call fcn.00440c16
add esp, 4
cmp eax, edi
je 0x402145
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
jmp 0x402147
xor eax, eax
cmp eax, edi
mov dword [0x4683d8], eax
je 0x402156
mov dword [0x4683dc], edi
call fcn.00401920
mov al, byte [0x469ba8]
test al, 1
jne 0x402186
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
mov ecx, 0x469bc0
call int.00436230
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edi
push ecx
push str.360Installer.exe
push 0x4601f8
mov ecx, 0x468320
call fcn.0042f420
test eax, eax
je 0x402214
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402bb3
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4021dc
mov ecx, dword [esp + 0x20]
push 9
push ecx
jmp 0x4021e3
mov edx, dword [esp + 0x20]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
mov eax, dword [esp + 0x24]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
call esi
push 3
push edi
mov ecx, dword [esp + 0x28]
push edi
push edi
push edi
push 0xfffffffffffffffe
push ecx
call esi
xor eax, eax
jmp 0x402d04
mov al, byte [0x469bf8]
test al, 1
jne 0x40223f
mov dl, al
mov ecx, 0x469c00
or dl, 1
mov byte [0x469bf8], dl
call fcn.00436830
push 0x402df0
call fcn.0044055c
add esp, 4
mov ecx, 0x469c00
call fcn.004368d0
call fcn.00437650
mov ecx, eax
call fcn.00437680
lea ecx, [esp + 0x2c]
call fcn.0042e430
mov dword [esp + 0xe68], 2
call fcn.0042cd30
test eax, eax
jne 0x4022a2
push 0x40
push 0x96
push 0xa2
push edi
call fcn.004128c0
add esp, 0x10
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe68], 0xffffffff
call fcn.0042e4b0
xor eax, eax
jmp 0x402d04
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x45a]
mov word [esp + 0x458], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x458]
push edx
push 0x104
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [esp + 0x458]
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x402484
push 0x40
push 0x96
push 0xbf
push 0
call fcn.004128c0
add esp, 0x10
cmp eax, 1
jne 0x402471
mov ecx, dword [str.lF_F]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0x660]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x660]
push edx
push 0x400
rep stosd dword es:[edi], eax
mov byte [esp + 0xe70], 3
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x660]
push eax
call ebp
mov esi, eax
cmp esi, 1
je 0x4023a9
call fcn.00404450
mov esi, eax
test esi, esi
je 0x402411
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x660]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x660]
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x660]
push edx
call ebp
test eax, eax
jne 0x4023a9
push eax
lea eax, [esp + 0x664]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
jne 0x402411
test esi, esi
je 0x402411
lea ecx, [esp + 0x660]
test ecx, ecx
jne 0x4023bc
xor eax, eax
jmp 0x4023c6
lea edx, [esp + 0x660]
push edx
call ebx
lea ecx, [esp + 0x660]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00404190
mov edx, dword [0x46005c]
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402484
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402484
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
jmp 0x402484
push 0x40
push 0x96
push 0xc0
push 0
call fcn.004128c0
mov eax, dword [esp + 0x24]
mov ecx, dword [0x46005c]
add esp, 0x10
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x402456
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402456
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00439890
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe68], 0xffffffff
call fcn.0042e4b0
xor eax, eax
jmp 0x402d04
push 0x40
push 0x96
push 0xc1
push 0
jmp 0x40227f
mov eax, dword [str.lF_F]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x4c]
push 0x100
push ecx
push 0x8f
mov byte [esp + 0xe74], 4
call fcn.004042c0
mov edx, 0x100
or ebp, 0xffffffff
sub edx, eax
cmp edx, 1
jle 0x4024d8
lea eax, [esp + 0x4c]
test eax, eax
je 0x4024c7
lea ecx, [esp + 0x4c]
push ecx
call ebx
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.00404190
jmp 0x402525
push 0x1ff
lea ecx, [esp + 0x14]
mov esi, 0x200
call fcn.00403f70
test eax, eax
je 0x40251b
push esi
push eax
push 0x8f
call fcn.004042c0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x40251b
add esi, 0x100
lea ecx, [esp + 0x10]
lea edx, [esi - 1]
push edx
call fcn.00403f70
test eax, eax
jne 0x4024ef
push ebp
lea ecx, [esp + 0x14]
call fcn.00404030
lea eax, [esp + 0x10]
push eax
call fcn.00401120
add esp, 4
lea ecx, [esp + 0x4c]
mov edi, eax
push 0x100
push ecx
push 0x94
call fcn.004042c0
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x402564
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
call fcn.004032e0
jmp 0x4025b1
push 0x1ff
lea ecx, [esp + 0x14]
mov esi, 0x200
call fcn.00403f70
test eax, eax
je 0x4025a7
push esi
push eax
push 0x94
call fcn.004042c0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x4025a7
add esi, 0x100
lea ecx, [esp + 0x10]
lea edx, [esi - 1]
push edx
call fcn.00403f70
test eax, eax
jne 0x40257b
push ebp
lea ecx, [esp + 0x14]
call fcn.00404030
test edi, edi
je 0x4025c4
lea eax, [esp + 0x10]
push eax
call fcn.00401120
add esp, 4
mov edi, eax
lea ecx, [esp + 0x4c]
push 0x100
push ecx
push 0x9b
call fcn.004042c0
mov edx, 0x100
sub edx, eax
cmp edx, 1
jle 0x4025f4
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x10]
push eax
call fcn.004032e0
jmp 0x402641
push 0x1ff
lea ecx, [esp + 0x14]
mov esi, 0x200
call fcn.00403f70
test eax, eax
je 0x402637
push esi
push eax
push 0x9b
call fcn.004042c0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x402637
add esi, 0x100
lea ecx, [esp + 0x10]
lea edx, [esi - 1]
push edx
call fcn.00403f70
test eax, eax
jne 0x40260b
push ebp
lea ecx, [esp + 0x14]
call fcn.00404030
test edi, edi
je 0x40265a
lea eax, [esp + 0x10]
push eax
call fcn.00401120
add esp, 4
test eax, eax
jne 0x4026ec
mov al, byte [0x469ba8]
test al, 1
jne 0x402685
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
push 0x18
mov ecx, 0x469bc0
call fcn.00435ae0
push 0x40
push 0x4601c8
push 0x4601b8
push 0x460170
push 0
call fcn.00412dd0
add esp, 0x14
cmp eax, 1
jne 0x4026c8
push eax
push 0
push 0
push str.http:__360.cn
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x10]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402ba3
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x402906
call fcn.00431470
mov ecx, eax
call fcn.00431620
test eax, eax
je 0x402c76
call fcn.00431470
mov ecx, eax
call fcn.00431a10
test eax, eax
je 0x402c76
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x24e]
mov word [esp + 0x24c], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
lea ecx, [esp + 0x250]
push 0xc800000
push ecx
call 0x42bee0
add esp, 0xc
test eax, eax
jne 0x402923
mov al, byte [0x469ba8]
test al, 1
jne 0x40278b
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
push 0x1a
mov ecx, 0x469bc0
call fcn.00435ae0
lea edx, [esp + 0x24c]
lea eax, [esp + 0x14]
push edx
push eax
call 0x42bf40
add esp, 8
lea ecx, [esp + 0x24]
push 1
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe70], 5
call fcn.00403530
mov esi, eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
cmp ecx, eax
mov byte [esp + 0xe68], 6
je 0x40281c
mov edx, dword [ecx - 0xc]
test edx, edx
jge 0x4027ec
mov edx, dword [0x46005c]
add ecx, 0xfffffff4
cmp ecx, edx
jne 0x4027f3
mov ecx, dword [eax - 0xc]
test ecx, ecx
jge 0x402803
mov edx, dword [eax - 8]
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.00404190
jmp 0x40281c
lea ecx, [esp + 0x14]
call fcn.00404250
mov esi, dword [esi]
mov dword [esp + 0x14], esi
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x24]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x40284f
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x402855
mov edx, dword [esp + 0x24]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
jmp 0x402855
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, dword [str.lF_F]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x14]
push 0xc8
push ecx
lea edx, [esp + 0x3c]
push 0x95
push edx
mov byte [esp + 0xe78], 7
call fcn.004036a0
mov eax, dword [esp + 0x44]
push 0x40
push 0x96
push eax
push 0
call fcn.00412b50
mov eax, dword [esp + 0x54]
mov edx, dword [0x46005c]
add esp, 0x20
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4028c0
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4028c0
mov edx, dword [esp + 0x34]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
mov eax, dword [esp + 0x14]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4028eb
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x4028eb
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402ba3
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x402ba3
mov edx, dword [esp + 0x10]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
jmp 0x402ba3
lea ecx, [esp + 0x3c]
call fcn.0042b5f0
mov eax, dword [esp + 0x44]
mov byte [esp + 0xe68], 8
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x402979
mov al, byte [0x469ba8]
test al, 1
jne 0x40296a
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
lea ecx, [esp + 0x44]
push ecx
mov ecx, 0x469bc0
call fcn.00435f30
mov ecx, 0x468910
call fcn.004331e0
mov ecx, 0x468910
call fcn.00432d20
call fcn.0042ceb0
test eax, eax
jne 0x402bed
mov eax, dword [0x46898c]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x4029b6
mov dword [esp + 0x1c], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4029ca
mov edx, dword [str.lF_F]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], edx
call fcn.004032e0
mov eax, dword [str.lF_F]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4c]
push 0x100
push eax
push 0x9c
mov byte [esp + 0xe74], 0xb
call fcn.004042c0
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x402a0f
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x18]
push edx
call fcn.004032e0
jmp 0x402a5c
push 0x1ff
lea ecx, [esp + 0x1c]
mov esi, 0x200
call fcn.00403f70
test eax, eax
je 0x402a52
push esi
push eax
push 0x9c
call fcn.004042c0
mov ecx, esi
sub ecx, eax
cmp ecx, 1
jg 0x402a52
add esi, 0x100
lea ecx, [esp + 0x18]
lea edx, [esi - 1]
push edx
call fcn.00403f70
test eax, eax
jne 0x402a26
push ebp
lea ecx, [esp + 0x1c]
call fcn.00404030
mov eax, dword [esp + 0x18]
push eax
call fcn.00440bc4
add esp, 4
lea ecx, [esp + 0x24]
mov dword [0x4689bc], eax
push 0x9d
call fcn.00403d60
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00440bc4
mov dword [0x4689c0], eax
mov eax, dword [0x4689bc]
shl eax, 0x14
cdq
push edx
mov edx, dword [esp + 0x24]
push eax
push edx
call 0x42bee0
add esp, 0x10
test eax, eax
jne 0x402bba
mov al, byte [0x469ba8]
test al, 1
jne 0x402ad6
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
push 0x1b
mov ecx, 0x469bc0
call fcn.00435ae0
mov eax, dword [str.lF_F]
mov dword [esp + 0x28], eax
mov ecx, dword [0x4689bc]
lea edx, [esp + 0x28]
push ecx
push 0x99
push edx
mov byte [esp + 0xe74], 0xc
call fcn.004036a0
mov eax, dword [esp + 0x34]
push 0x40
push 0x96
push eax
push 0
call fcn.00412b50
mov eax, dword [esp + 0x44]
mov edx, dword [0x46005c]
add esp, 0x1c
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x402b4e
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402b4e
mov edx, dword [esp + 0x28]
lea eax, [edx - 0xc]
push eax
call fcn.00439890
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0xe68], 0xa
call fcn.00404100
lea ecx, [esp + 0x18]
mov byte [esp + 0xe68], 9
call fcn.00404100
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe68], 8
call fcn.00404100
lea ecx, [esp + 0x3c]
mov byte [esp + 0xe68], 4
call fcn.0042b740
lea ecx, [esp + 0x10]
mov byte [esp + 0xe68], 2
call fcn.00404100
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe68], ebp
call fcn.0042e4b0
xor eax, eax
jmp 0x402d04
lea ecx, [esp + 0x24]
mov byte [esp + 0xe68], 0xa
call fcn.00404100
lea ecx, [esp + 0x18]
mov byte [esp + 0xe68], 9
call fcn.00404100
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe68], 8
call fcn.00404100
mov eax, dword [esp + 0xe7c]
mov ecx, dword [esp + 0xe78]
push eax
push ecx
call fcn.00401ca0
add esp, 8
mov ecx, 0x468320
mov esi, eax
call int.0042f640
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x468350
call fcn.00403060
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.00401ab0
call fcn.004042f0
mov ecx, eax
call fcn.00436210
lea ecx, [esp + 0x3c]
mov byte [esp + 0xe68], 4
call fcn.0042b740
lea ecx, [esp + 0x10]
mov byte [esp + 0xe68], 2
call fcn.00404100
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe68], ebp
call fcn.0042e4b0
mov eax, esi
jmp 0x402d04
mov al, byte [0x469ba8]
test al, 1
jne 0x402ca1
mov dl, al
mov ecx, 0x469bc0
or dl, 1
mov byte [0x469ba8], dl
call fcn.00435810
push 0x404330
call fcn.0044055c
add esp, 4
push 0x19
mov ecx, 0x469bc0
call fcn.00435ae0
push 0x40
push 0x80
push 0x8d
push 0
call fcn.004128c0
mov eax, dword [esp + 0x20]
mov ecx, dword [0x46005c]
add esp, 0x10
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x402cf2
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402cf2
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.00439890
add esp, 4
lea ecx, [esp + 0x2c]
mov dword [esp + 0xe68], ebp
call fcn.0042e4b0
mov eax, ebp
mov ecx, dword [esp + 0xe60]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xe5c
ret 0x10