Function at 0x10035950
Capabilities:
Contain obfuscated stackstrings
Execute command
Inspect section memory permissions
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047452
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x56c
mov dword [ebp - 0x3bc], 0
mov dword [ebp - 0x3c0], 0
jmp 0x10035994
cmp dword [ebp + 0x18], 0
jne 0x1003599f
jmp 0x1003766b
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [0x10086198]
call fcn.1000fa30
mov dword [ebp - 4], 0
push 0
push 0x1bff9364
lea ecx, [ebp - 0x66]
call fcn.10039f00
mov dword [ebp - 0x3c4], eax
mov edx, dword [ebp - 0x3c4]
mov dword [ebp - 0x3c8], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x3bc]
or eax, 1
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x3c8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x4589a95b
lea ecx, [ebp - 0x78]
call fcn.10039f80
mov dword [ebp - 0x3cc], eax
mov edx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3d0], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x3bc]
or eax, 2
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x3d0]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xfbfd4dfb
push edx
lea ecx, [ebp - 0x84]
call fcn.1003a000
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x3bc]
or ecx, 4
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3d8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x3aa43e33
lea ecx, [ebp - 0xa0]
call fcn.1003a080
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x3bc]
or ecx, 8
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x3e0]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xaf8c0e62
push eax
lea ecx, [ebp - 0xaf]
call fcn.1003a100
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x3bc]
or edx, 0x10
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x329bdfc0
lea ecx, [ebp - 0xba]
call fcn.1003a180
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], ecx
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0x3bc]
or edx, 0x20
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3f0]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x200b9f5f
lea ecx, [ebp - 0xc5]
call fcn.1003a200
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x3f8], ecx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x3bc]
or edx, 0x40
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x161c3ad7
lea ecx, [ebp - 0xd0]
call fcn.1003a280
mov dword [ebp - 0x3fc], eax
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x400], ecx
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x3bc]
or edx, 0x80
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x400]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x20df1022
lea ecx, [ebp - 0xdd]
call fcn.1003a300
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x408], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x3bc]
or edx, 0x100
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x408]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xf42c7788
push ecx
lea ecx, [ebp - 0xe9]
call fcn.1003a380
mov dword [ebp - 0x40c], eax
mov edx, dword [ebp - 0x40c]
mov dword [ebp - 0x410], edx
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x3bc]
or eax, 0x200
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x127f7788
lea ecx, [ebp - 0xf9]
call fcn.1003a400
mov dword [ebp - 0x414], eax
mov edx, dword [ebp - 0x414]
mov dword [ebp - 0x418], edx
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x3bc]
or eax, 0x400
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x24864b9c
lea ecx, [ebp - 0x103]
call fcn.1003a480
mov dword [ebp - 0x41c], eax
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], edx
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x3bc]
or eax, 0x800
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x3491c743
lea ecx, [ebp - 0x114]
call fcn.1003a500
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x428], edx
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x3bc]
or eax, 0x1000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x428]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xfa81a8f4
push edx
lea ecx, [ebp - 0x120]
call fcn.1003a580
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x430], eax
mov dword [ebp - 4], 0xe
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x2000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x430]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xf07cef2f
push eax
lea ecx, [ebp - 0x12d]
call fcn.1003a600
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x438], ecx
mov dword [ebp - 4], 0xf
mov edx, dword [ebp - 0x3bc]
or edx, 0x4000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x438]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xb2ef9a70
push ecx
lea ecx, [ebp - 0x136]
call fcn.1003a680
mov dword [ebp - 0x43c], eax
mov edx, dword [ebp - 0x43c]
mov dword [ebp - 0x440], edx
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x3bc]
or eax, 0x8000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x3cc52098
lea ecx, [ebp - 0x142]
call fcn.1003a700
mov dword [ebp - 0x444], eax
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x448], edx
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x3bc]
or eax, 0x10000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x448]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xad93a8d1
push edx
lea ecx, [ebp - 0x158]
call fcn.1003a780
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x450], eax
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x20000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x450]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xc0b65cb1
push eax
lea ecx, [ebp - 0x17a]
call fcn.1003a800
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
mov dword [ebp - 0x458], ecx
mov dword [ebp - 4], 0x13
mov edx, dword [ebp - 0x3bc]
or edx, 0x40000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x162c047c
lea ecx, [ebp - 0x186]
call fcn.1003a880
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x460], ecx
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0x3bc]
or edx, 0x80000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x460]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0x6f66d7f
push ecx
lea ecx, [ebp - 0x1a4]
call fcn.1003a900
mov dword [ebp - 0x464], eax
mov edx, dword [ebp - 0x464]
mov dword [ebp - 0x468], edx
mov dword [ebp - 4], 0x15
mov eax, dword [ebp - 0x3bc]
or eax, 0x100000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x468]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x8d32cc58
lea ecx, [ebp - 0x1b4]
call fcn.1003a980
mov dword [ebp - 0x46c], eax
mov edx, dword [ebp - 0x46c]
mov dword [ebp - 0x470], edx
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0x3bc]
or eax, 0x200000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x470]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x47ca7f35
lea ecx, [ebp - 0x1c5]
call fcn.1003aa00
mov dword [ebp - 0x474], eax
mov edx, dword [ebp - 0x474]
mov dword [ebp - 0x478], edx
mov dword [ebp - 4], 0x17
mov eax, dword [ebp - 0x3bc]
or eax, 0x400000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x478]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xa7534b40
push edx
lea ecx, [ebp - 0x1d6]
call fcn.1003aa80
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x480], eax
mov dword [ebp - 4], 0x18
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x800000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x480]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x69f468af
lea ecx, [ebp - 0x1e5]
call fcn.1003ab00
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x488], eax
mov dword [ebp - 4], 0x19
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x1000000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x488]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x59f5ec54
lea ecx, [ebp - 0x1f7]
call fcn.1000f7f0
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x490], eax
mov dword [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x2000000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x490]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x7cf22894
lea ecx, [ebp - 0x206]
call fcn.1003ab80
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x498], eax
mov dword [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x4000000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x498]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x365e6e3e
lea ecx, [ebp - 0x211]
call fcn.1003ac00
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x3bc]
or ecx, 0x8000000
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0x4a0]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xd34a3a92
push eax
lea ecx, [ebp - 0x21d]
call fcn.1003ac80
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x4a4]
mov dword [ebp - 0x4a8], ecx
mov dword [ebp - 4], 0x1d
mov edx, dword [ebp - 0x3bc]
or edx, 0x10000000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x330f4c1e
lea ecx, [ebp - 0x22c]
call fcn.1003ad00
mov dword [ebp - 0x4ac], eax
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b0], ecx
mov dword [ebp - 4], 0x1e
mov edx, dword [ebp - 0x3bc]
or edx, 0x20000000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x1f81c1a7
lea ecx, [ebp - 0x234]
call fcn.1003ad80
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b8], ecx
mov dword [ebp - 4], 0x1f
mov edx, dword [ebp - 0x3bc]
or edx, 0x40000000
mov dword [ebp - 0x3bc], edx
mov eax, dword [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xaa870a8d
push ecx
lea ecx, [ebp - 0x23d]
call fcn.1003ae00
mov dword [ebp - 0x4bc], eax
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 4], 0x20
mov eax, dword [ebp - 0x3bc]
or eax, 0x80000000
mov dword [ebp - 0x3bc], eax
mov ecx, dword [ebp - 0x4c0]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xd2386e61
push edx
lea ecx, [ebp - 0x251]
call fcn.1003ae80
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 4], 0x21
mov ecx, dword [ebp - 0x3c0]
or ecx, 1
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x4c8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x813514bf
lea ecx, [ebp - 0x258]
call fcn.1003af00
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 4], 0x22
mov ecx, dword [ebp - 0x3c0]
or ecx, 2
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x4d0]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x79b4a351
lea ecx, [ebp - 0x265]
call fcn.1003af80
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 4], 0x23
mov ecx, dword [ebp - 0x3c0]
or ecx, 4
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x4d8]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xaf6f1cd9
push eax
lea ecx, [ebp - 0x272]
call fcn.1003b000
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 4], 0x24
mov edx, dword [ebp - 0x3c0]
or edx, 8
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xe959bf29
push ecx
lea ecx, [ebp - 0x286]
call fcn.1003b080
mov dword [ebp - 0x4e4], eax
mov edx, dword [ebp - 0x4e4]
mov dword [ebp - 0x4e8], edx
mov dword [ebp - 4], 0x25
mov eax, dword [ebp - 0x3c0]
or eax, 0x10
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x4e8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xd21866c3
push edx
lea ecx, [ebp - 0x293]
call fcn.1003b100
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 4], 0x26
mov ecx, dword [ebp - 0x3c0]
or ecx, 0x20
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x4f0]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0x97a71dac
push eax
lea ecx, [ebp - 0x29f]
call fcn.1003b180
mov dword [ebp - 0x4f4], eax
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp - 0x4f8], ecx
mov dword [ebp - 4], 0x27
mov edx, dword [ebp - 0x3c0]
or edx, 0x40
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x4f8]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x8fc722ea
lea ecx, [ebp - 0x2b7]
call fcn.1003b200
mov dword [ebp - 0x4fc], eax
mov ecx, dword [ebp - 0x4fc]
mov dword [ebp - 0x500], ecx
mov dword [ebp - 4], 0x28
mov edx, dword [ebp - 0x3c0]
or edx, 0x80
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x500]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xa55cb49e
push ecx
lea ecx, [ebp - 0x2c9]
call fcn.1003b280
mov dword [ebp - 0x504], eax
mov edx, dword [ebp - 0x504]
mov dword [ebp - 0x508], edx
mov dword [ebp - 4], 0x29
mov eax, dword [ebp - 0x3c0]
or eax, 0x100
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x508]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x825569ae
lea ecx, [ebp - 0x2d3]
call fcn.1003b300
mov dword [ebp - 0x50c], eax
mov edx, dword [ebp - 0x50c]
mov dword [ebp - 0x510], edx
mov dword [ebp - 4], 0x2a
mov eax, dword [ebp - 0x3c0]
or eax, 0x200
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x510]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x6920d16d
lea ecx, [ebp - 0x2e7]
call fcn.1003b380
mov dword [ebp - 0x514], eax
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x518], edx
mov dword [ebp - 4], 0x2b
mov eax, dword [ebp - 0x3c0]
or eax, 0x400
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x518]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xe8ad22fe
push edx
lea ecx, [ebp - 0x2fe]
call fcn.1003b400
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x520], eax
mov dword [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x3c0]
or ecx, 0x800
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x520]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x426d61de
lea ecx, [ebp - 0x309]
call fcn.1003b480
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x528], eax
mov dword [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x3c0]
or ecx, 0x1000
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x528]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0x97a2f22b
push eax
lea ecx, [ebp - 0x31f]
call fcn.1003b500
mov dword [ebp - 0x52c], eax
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0x530], ecx
mov dword [ebp - 4], 0x2e
mov edx, dword [ebp - 0x3c0]
or edx, 0x2000
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x530]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x80de4537
lea ecx, [ebp - 0x329]
call fcn.1003b580
mov dword [ebp - 0x534], eax
mov ecx, dword [ebp - 0x534]
mov dword [ebp - 0x538], ecx
mov dword [ebp - 4], 0x2f
mov edx, dword [ebp - 0x3c0]
or edx, 0x4000
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x538]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov ecx, 0xaedd82b2
push ecx
lea ecx, [ebp - 0x335]
call fcn.1003b600
mov dword [ebp - 0x53c], eax
mov edx, dword [ebp - 0x53c]
mov dword [ebp - 0x540], edx
mov dword [ebp - 4], 0x30
mov eax, dword [ebp - 0x3c0]
or eax, 0x8000
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x540]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
push 0x7f90bc4e
lea ecx, [ebp - 0x33d]
call fcn.1003b680
mov dword [ebp - 0x544], eax
mov edx, dword [ebp - 0x544]
mov dword [ebp - 0x548], edx
mov dword [ebp - 4], 0x31
mov eax, dword [ebp - 0x3c0]
or eax, 0x10000
mov dword [ebp - 0x3c0], eax
mov ecx, dword [ebp - 0x548]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov edx, 0xaedd82b2
push edx
lea ecx, [ebp - 0x349]
call fcn.1003b600
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x550], eax
mov dword [ebp - 4], 0x32
mov ecx, dword [ebp - 0x3c0]
or ecx, 0x20000
mov dword [ebp - 0x3c0], ecx
mov edx, dword [ebp - 0x550]
push edx
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
push 0
mov eax, 0xc5925ddf
push eax
lea ecx, [ebp - 0x362]
call fcn.1003b700
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x554]
mov dword [ebp - 0x558], ecx
mov dword [ebp - 4], 0x33
mov edx, dword [ebp - 0x3c0]
or edx, 0x40000
mov dword [ebp - 0x3c0], edx
mov eax, dword [ebp - 0x558]
push eax
lea ecx, [ebp - 0x28]
call fcn.10009210
cmp eax, dword [0x1004b6a0]
jne 0x10036b1a
mov dword [ebp - 0x55c], 0
jmp 0x10036b24
mov dword [ebp - 0x55c], 1
mov cl, byte [ebp - 0x55c]
mov byte [ebp - 0x59], cl
mov dword [ebp - 4], 0x32
mov edx, dword [ebp - 0x3c0]
and edx, 0x40000
je 0x10036b57
and dword [ebp - 0x3c0], 0xfffbffff
lea ecx, [ebp - 0x362]
call fcn.1001e580
mov dword [ebp - 4], 0x31
mov eax, dword [ebp - 0x3c0]
and eax, 0x20000
je 0x10036b80
and dword [ebp - 0x3c0], 0xfffdffff
lea ecx, [ebp - 0x349]
call fcn.10039bc0
mov dword [ebp - 4], 0x30
mov ecx, dword [ebp - 0x3c0]
and ecx, 0x10000
je 0x10036baa
and dword [ebp - 0x3c0], 0xfffeffff
lea ecx, [ebp - 0x33d]
call fcn.10039c80
mov dword [ebp - 4], 0x2f
mov edx, dword [ebp - 0x3c0]
and edx, 0x8000
je 0x10036bd4
and dword [ebp - 0x3c0], 0xffff7fff
lea ecx, [ebp - 0x335]
call fcn.10039bc0
mov dword [ebp - 4], 0x2e
mov eax, dword [ebp - 0x3c0]
and eax, 0x4000
je 0x10036bfd
and dword [ebp - 0x3c0], 0xffffbfff
lea ecx, [ebp - 0x329]
call fcn.10039c20
mov dword [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x3c0]
and ecx, 0x2000
je 0x10036c27
and dword [ebp - 0x3c0], 0xffffdfff
lea ecx, [ebp - 0x31f]
call fcn.1001e5e0
mov dword [ebp - 4], 0x2c
mov edx, dword [ebp - 0x3c0]
and edx, 0x1000
je 0x10036c51
and dword [ebp - 0x3c0], 0xffffefff
lea ecx, [ebp - 0x309]
call fcn.10039bf0
mov dword [ebp - 4], 0x2b
mov eax, dword [ebp - 0x3c0]
and eax, 0x800
je 0x10036c7a
and dword [ebp - 0x3c0], 0xfffff7ff
lea ecx, [ebp - 0x2fe]
call fcn.10039de0
mov dword [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x3c0]
and ecx, 0x400
je 0x10036ca4
and dword [ebp - 0x3c0], 0xfffffbff
lea ecx, [ebp - 0x2e7]
call fcn.1001e790
mov dword [ebp - 4], 0x29
mov edx, dword [ebp - 0x3c0]
and edx, 0x200
je 0x10036cce
and dword [ebp - 0x3c0], 0xfffffdff
lea ecx, [ebp - 0x2d3]
call fcn.10039c20
mov dword [ebp - 4], 0x28
mov eax, dword [ebp - 0x3c0]
and eax, 0x100
je 0x10036cf7
and dword [ebp - 0x3c0], 0xfffffeff
lea ecx, [ebp - 0x2c9]
call fcn.10039db0
mov dword [ebp - 4], 0x27
mov ecx, dword [ebp - 0x3c0]
and ecx, 0x80
je 0x10036d21
and dword [ebp - 0x3c0], 0xffffff7f
lea ecx, [ebp - 0x2b7]
call fcn.1001e2b0
mov dword [ebp - 4], 0x26
mov edx, dword [ebp - 0x3c0]
and edx, 0x40
je 0x10036d45
and dword [ebp - 0x3c0], 0xffffffbf
lea ecx, [ebp - 0x29f]
call fcn.10039bc0
mov dword [ebp - 4], 0x25
mov eax, dword [ebp - 0x3c0]
and eax, 0x20
je 0x10036d69
and dword [ebp - 0x3c0], 0xffffffdf
lea ecx, [ebp - 0x293]
call fcn.10039b90
mov dword [ebp - 4], 0x24
mov ecx, dword [ebp - 0x3c0]
and ecx, 0x10
je 0x10036d8d
and dword [ebp - 0x3c0], 0xffffffef
lea ecx, [ebp - 0x286]
call fcn.1001e790
mov dword [ebp - 4], 0x23
mov edx, dword [ebp - 0x3c0]
and edx, 8
je 0x10036db1
and dword [ebp - 0x3c0], 0xfffffff7
lea ecx, [ebp - 0x272]
call fcn.10039b90
mov dword [ebp - 4], 0x22
mov eax, dword [ebp - 0x3c0]
and eax, 4
je 0x10036dd5
and dword [ebp - 0x3c0], 0xfffffffb
lea ecx, [ebp - 0x265]
call fcn.10039b90
mov dword [ebp - 4], 0x21
mov ecx, dword [ebp - 0x3c0]
and ecx, 2
je 0x10036df9
and dword [ebp - 0x3c0], 0xfffffffd
lea ecx, [ebp - 0x258]
call fcn.10039e10
mov dword [ebp - 4], 0x20
mov edx, dword [ebp - 0x3c0]
and edx, 1
je 0x10036e1d
and dword [ebp - 0x3c0], 0xfffffffe
lea ecx, [ebp - 0x251]
call fcn.1001e790
mov dword [ebp - 4], 0x1f
mov eax, dword [ebp - 0x3bc]
and eax, 0x80000000
je 0x10036e46
and dword [ebp - 0x3bc], 0x7fffffff
lea ecx, [ebp - 0x23d]
call fcn.10039d20
mov dword [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x40000000
je 0x10036e70
and dword [ebp - 0x3bc], 0xbfffffff
lea ecx, [ebp - 0x234]
call fcn.10039c80
mov dword [ebp - 4], 0x1d
mov edx, dword [ebp - 0x3bc]
and edx, 0x20000000
je 0x10036e9a
and dword [ebp - 0x3bc], 0xdfffffff
lea ecx, [ebp - 0x22c]
call fcn.1001e250
mov dword [ebp - 4], 0x1c
mov eax, dword [ebp - 0x3bc]
and eax, 0x10000000
je 0x10036ec3
and dword [ebp - 0x3bc], 0xefffffff
lea ecx, [ebp - 0x21d]
call fcn.10039bc0
mov dword [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x8000000
je 0x10036eed
and dword [ebp - 0x3bc], 0xf7ffffff
lea ecx, [ebp - 0x211]
call fcn.10039bf0
mov dword [ebp - 4], 0x1a
mov edx, dword [ebp - 0x3bc]
and edx, 0x4000000
je 0x10036f17
and dword [ebp - 0x3bc], 0xfbffffff
lea ecx, [ebp - 0x206]
call fcn.1001e250
mov dword [ebp - 4], 0x19
mov eax, dword [ebp - 0x3bc]
and eax, 0x2000000
je 0x10036f40
and dword [ebp - 0x3bc], 0xfdffffff
lea ecx, [ebp - 0x1f7]
call fcn.10039db0
mov dword [ebp - 4], 0x18
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x1000000
je 0x10036f6a
and dword [ebp - 0x3bc], 0xfeffffff
lea ecx, [ebp - 0x1e5]
call fcn.1001e250
mov dword [ebp - 4], 0x17
mov edx, dword [ebp - 0x3bc]
and edx, 0x800000
je 0x10036f94
and dword [ebp - 0x3bc], 0xff7fffff
lea ecx, [ebp - 0x1d6]
call fcn.1001e280
mov dword [ebp - 4], 0x16
mov eax, dword [ebp - 0x3bc]
and eax, 0x400000
je 0x10036fbd
and dword [ebp - 0x3bc], 0xffbfffff
lea ecx, [ebp - 0x1c5]
call fcn.1001e280
mov dword [ebp - 4], 0x15
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x200000
je 0x10036fe7
and dword [ebp - 0x3bc], 0xffdfffff
lea ecx, [ebp - 0x1b4]
call fcn.1001e460
mov dword [ebp - 4], 0x14
mov edx, dword [ebp - 0x3bc]
and edx, 0x100000
je 0x10037011
and dword [ebp - 0x3bc], 0xffefffff
lea ecx, [ebp - 0x1a4]
call fcn.1001e5b0
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0x3bc]
and eax, 0x80000
je 0x1003703a
and dword [ebp - 0x3bc], 0xfff7ffff
lea ecx, [ebp - 0x186]
call fcn.10039bc0
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x40000
je 0x10037064
and dword [ebp - 0x3bc], 0xfffbffff
lea ecx, [ebp - 0x17a]
call fcn.10039c50
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x3bc]
and edx, 0x20000
je 0x1003708e
and dword [ebp - 0x3bc], 0xfffdffff
lea ecx, [ebp - 0x158]
call fcn.1001e5e0
mov dword [ebp - 4], 0x10
mov eax, dword [ebp - 0x3bc]
and eax, 0x10000
je 0x100370b7
and dword [ebp - 0x3bc], 0xfffeffff
lea ecx, [ebp - 0x142]
call fcn.10039bc0
mov dword [ebp - 4], 0xf
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x8000
je 0x100370e1
and dword [ebp - 0x3bc], 0xffff7fff
lea ecx, [ebp - 0x136]
call fcn.10039d20
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0x3bc]
and edx, 0x4000
je 0x1003710b
and dword [ebp - 0x3bc], 0xffffbfff
lea ecx, [ebp - 0x12d]
call fcn.10039b90
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x3bc]
and eax, 0x2000
je 0x10037134
and dword [ebp - 0x3bc], 0xffffdfff
lea ecx, [ebp - 0x120]
call fcn.10039bc0
mov dword [ebp - 4], 0xc
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x1000
je 0x1003715e
and dword [ebp - 0x3bc], 0xffffefff
lea ecx, [ebp - 0x114]
call fcn.1001e280
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0x3bc]
and edx, 0x800
je 0x10037188
and dword [ebp - 0x3bc], 0xfffff7ff
lea ecx, [ebp - 0x103]
call fcn.10039c20
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x3bc]
and eax, 0x400
je 0x100371b1
and dword [ebp - 0x3bc], 0xfffffbff
lea ecx, [ebp - 0xf9]
call fcn.1001e460
mov dword [ebp - 4], 9
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x200
je 0x100371db
and dword [ebp - 0x3bc], 0xfffffdff
lea ecx, [ebp - 0xe9]
call fcn.10039bc0
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x3bc]
and edx, 0x100
je 0x10037205
and dword [ebp - 0x3bc], 0xfffffeff
lea ecx, [ebp - 0xdd]
call fcn.10039b90
mov dword [ebp - 4], 7
mov eax, dword [ebp - 0x3bc]
and eax, 0x80
je 0x1003722e
and dword [ebp - 0x3bc], 0xffffff7f
lea ecx, [ebp - 0xd0]
call fcn.10039bf0
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x3bc]
and ecx, 0x40
je 0x10037252
and dword [ebp - 0x3bc], 0xffffffbf
lea ecx, [ebp - 0xc5]
call fcn.10039bf0
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x3bc]
and edx, 0x20
je 0x10037276
and dword [ebp - 0x3bc], 0xffffffdf
lea ecx, [ebp - 0xba]
call fcn.10039bf0
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x3bc]
and eax, 0x10
je 0x1003729a
and dword [ebp - 0x3bc], 0xffffffef
lea ecx, [ebp - 0xaf]
call fcn.1001e250
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x3bc]
and ecx, 8
je 0x100372be
and dword [ebp - 0x3bc], 0xfffffff7
lea ecx, [ebp - 0xa0]
call fcn.1001e520
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x3bc]
and edx, 4
je 0x100372e2
and dword [ebp - 0x3bc], 0xfffffffb
lea ecx, [ebp - 0x84]
call fcn.10039bc0
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3bc]
and eax, 2
je 0x10037303
and dword [ebp - 0x3bc], 0xfffffffd
lea ecx, [ebp - 0x78]
call fcn.10039db0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3bc]
and ecx, 1
je 0x10037324
and dword [ebp - 0x3bc], 0xfffffffe
lea ecx, [ebp - 0x66]
call fcn.10039b90
movzx edx, byte [ebp - 0x59]
test edx, edx
je 0x10037340
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10001180
jmp 0x1003766b
mov byte [ebp - 0x58], 0x42
mov byte [ebp - 0x57], 0x61
mov byte [ebp - 0x56], 0x64
mov byte [ebp - 0x55], 0x20
mov byte [ebp - 0x54], 0x50
mov byte [ebp - 0x53], 0x72
mov byte [ebp - 0x52], 0x6f
mov byte [ebp - 0x51], 0x63
mov byte [ebp - 0x50], 0x65
mov byte [ebp - 0x4f], 0x73
mov byte [ebp - 0x4e], 0x73
mov byte [ebp - 0x4d], 0x3a
mov byte [ebp - 0x4c], 0x20
mov byte [ebp - 0x4b], 0x25
mov byte [ebp - 0x4a], 0x73
mov byte [ebp - 0x49], 0x28
mov byte [ebp - 0x48], 0x25
mov byte [ebp - 0x47], 0x73
mov byte [ebp - 0x46], 0x7c
mov byte [ebp - 0x45], 0x25
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], 0x29
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x41], 0x69
mov byte [ebp - 0x40], 0x73
mov byte [ebp - 0x3f], 0x20
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x72
mov byte [ebp - 0x3b], 0x6d
mov byte [ebp - 0x3a], 0x69
mov byte [ebp - 0x39], 0x6e
mov byte [ebp - 0x38], 0x61
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x64
mov byte [ebp - 0x34], 0x21
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x54
mov byte [ebp - 0x31], 0x79
mov byte [ebp - 0x30], 0x70
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x3a
mov byte [ebp - 0x2d], 0x20
mov byte [ebp - 0x2c], 0x25
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0
lea ecx, [ebp - 0x28]
call fcn.100011a0
push eax
push 0x2000
lea eax, [ebp - 0x58]
push eax
call fcn.10040da0
add esp, 0xc
call fcn.10010680
call fcn.1002bd50
mov ecx, 0x95207ea9
push ecx
lea ecx, [ebp - 0x38b]
call fcn.1001e9c0
mov dword [ebp - 0x560], eax
mov edx, dword [ebp - 0x560]
push edx
call sub.MSVCR90.dll_system
add esp, 4
lea ecx, [ebp - 0x38b]
call fcn.1001e400
push 0x7d0
mov eax, dword [0x100860c4]
mov ecx, dword [eax + 0x18]
call ecx
call fcn.10003b70
movzx edx, al
test edx, edx
je 0x100374b7
push 0x10
mov eax, 0xb56c43c2
push eax
lea ecx, [ebp - 0x399]
call fcn.1003b780
mov dword [ebp - 0x564], eax
mov ecx, dword [ebp - 0x564]
mov dword [ebp - 0x568], ecx
mov byte [ebp - 4], 0x34
mov edx, dword [ebp - 0x568]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.100105f0
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x399]
call fcn.1001e3a0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x28]
call fcn.100011a0
push eax
lea ecx, [ebp - 0x58]
push ecx
push 0
mov edx, dword [0x10085d2c]
push edx
call fcn.10004da0
add esp, 0x1c
push 0
push 0xffffffffffffffff
mov eax, dword [0x100860c4]
mov ecx, dword [eax + 0xd0]
call ecx
push 0x40010004
push 0
push 0
mov edx, dword [0x100860c4]
mov eax, dword [edx + 0x154]
call eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret