Function at 0x4b1ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
xor eax, eax
mov dword [esp + 0x38], 0
push ebx
mov dword [esp + 0x40], eax
mov ebx, edx
mov eax, dword [ebp + 8]
xor dl, dl
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], ebx
mov ecx, dword [ebp + 0x10]
xor dh, dh
add eax, ecx
mov dword [esp + 0x1c], edi
mov esi, eax
mov dword [esp + 0x114], eax
xor eax, eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x40], eax
mov dword [esp + 0x4c], 0
mov byte [esp + 0x1a], dl
lea eax, [esi - 1]
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
mov byte [esp + 0x13], dh
mov byte [esp + 0x1b], dl
mov byte [esp + 0x12], dl
mov dword [esp + 0x14], esi
test edi, edi
jne 0x4b1f45
test ebx, ebx
mov ebx, dword [ebp + 0xc]
jne 0x4b1f48
test eax, eax
jne 0x4b1f48
cmp ebx, 0xfffffc19
jne 0x4b1f48
cmp ecx, ebx
jne 0x4b1f48
push eax
push eax
push eax
push eax
push eax
xor edx, edx
xor ecx, ecx
call fcn.004ad900
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
test edx, 0xe20f5a6f
je 0x4b1f5f
mov eax, 0xfffffffd
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x4b2a52
test eax, eax
je 0x4b2a52
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp + 0x1c]
jne 0x4b1f80
test eax, eax
jg 0x4b2a52
test eax, eax
jns 0x4b1f90
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ecx, ecx
js 0x4b2a46
cmp ecx, ebx
jg 0x4b2a46
mov ecx, dword [edi]
cmp ecx, 0x50435245
je 0x4b1fc4
cmp ecx, 0x45524350
mov eax, 0xfffffffc
mov edx, 0xffffffe3
cmove eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + 0xc]
test al, 1
jne 0x4b1fd8
mov eax, 0xffffffe4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0xa0], 0
test edx, 0x8000000
je 0x4b1ff2
mov eax, 2
jmp 0x4b1ffa
mov eax, edx
shr eax, 0xf
and eax, 1
movzx ebx, word [edi + 0x18]
movzx ecx, word [edi + 0x1c]
movzx edx, word [edi + 0x1a]
mov dword [esp + 0xe0], eax
lea eax, [ebx + edi]
mov dword [esp + 0x78], ecx
mov edi, dword [edi + 0x20]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x30], 0
mov dword [esp + 0x5c], 0x989680
mov dword [esp + 0x60], 0x1770
mov dword [esp + 0x100], 0
test eax, eax
je 0x4b2096
mov ecx, dword [eax]
test cl, 1
je 0x4b205b
mov esi, dword [eax + 4]
mov dword [esp + 0x30], esi
test cl, 2
je 0x4b206b
mov eax, dword [eax + 8]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x24]
test cl, 0x10
je 0x4b2077
mov eax, dword [eax + 0x14]
mov dword [esp + 0x60], eax
test cl, 4
je 0x4b208a
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x100], eax
test cl, 8
je 0x4b2096
mov eax, dword [esp + 0x24]
mov edi, dword [eax + 0x10]
mov eax, dword [esp + 0x1c]
test edi, edi
mov ecx, 0x4d9268
mov dword [esp + 0xc4], 0
cmovne ecx, edi
mov dword [esp + 0xb8], 0
mov dword [esp + 0x108], 0
mov esi, dword [eax + 8]
movzx edi, word [eax + 0xc]
mov dword [esp + 0x3c], esi
or esi, dword [ebp + 0x14]
mov dword [esp + 0x50], esi
mov esi, eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x104], 0
mov dword [esp + 0xfc], 0
movzx eax, word [esi + 0x1c]
imul edx, eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xec], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x88], ecx
add edx, ebx
mov ebx, dword [ebp + 0x14]
add edx, esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc8], edx
mov edx, dword [ebp + 8]
add eax, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xcc], edx
mov edx, dword [esp + 0x3c]
mov eax, edx
shr eax, 5
and eax, 1
mov dword [esp + 0xac], eax
mov eax, edx
shr eax, 0x1d
and eax, 1
mov dword [esp + 0xa8], eax
mov eax, edx
shr eax, 0x19
and eax, 1
mov dword [esp + 0xa4], eax
mov eax, ebx
shr eax, 7
and eax, 1
mov dword [esp + 0x98], eax
mov eax, ebx
shr eax, 8
and eax, 1
mov dword [esp + 0x9c], eax
mov eax, ebx
shr eax, 0xa
and eax, 1
mov dword [esp + 0xb0], eax
mov eax, ebx
shr eax, 0x1c
and eax, 1
mov dword [esp + 0xb4], eax
mov eax, edi
shr eax, 0xc
and eax, 1
mov dword [esp + 0xc0], eax
lea eax, [ecx + 0x100]
mov dword [esp + 0x8c], eax
lea eax, [ecx + 0x340]
mov dword [esp + 0x90], eax
mov eax, ebx
and eax, 0x1800000
je 0x4b2250
cmp eax, 0x800000
je 0x4b2243
cmp eax, 0x1000000
jne 0x4b22ae
mov dword [esp + 0xbc], 0
test ebx, 0x700000
mov eax, ebx
cmove eax, edx
and eax, 0x700000
cmp eax, 0x300000
ja 0x4b22a0
je 0x4b2283
test eax, eax
je 0x4b2283
cmp eax, 0x100000
je 0x4b2269
cmp eax, 0x200000
jne 0x4b22ae
xor eax, eax
mov ebx, 1
mov dword [esp + 0x70], eax
mov al, 0xa
mov dword [esp + 0x74], ebx
mov byte [esp + 0x84], al
jmp 0x4b22ce
mov dword [esp + 0xbc], 1
jmp 0x4b21f3
test edx, 0x1800000
je 0x4b21e8
mov eax, edx
shr eax, 0x17
and eax, 1
mov dword [esp + 0xbc], eax
jmp 0x4b21f3
xor eax, eax
mov ebx, 1
mov dword [esp + 0x70], eax
mov al, 0xd
mov dword [esp + 0x74], ebx
mov byte [esp + 0x84], al
jmp 0x4b22ce
mov ebx, 2
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], ebx
mov word [esp + 0x84], 0xa0d
jmp 0x4b22ce
cmp eax, 0x400000
je 0x4b22c1
cmp eax, 0x500000
je 0x4b22ba
mov eax, 0xffffffe9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 2
jmp 0x4b22c6
mov eax, 1
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x70], eax
cmp dword [esp + 0xe0], 0
je 0x4b22ec
test edi, 0x200
je 0x4b22ec
mov eax, 0xfffffff3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xaaaaaaab
mul dword [ebp + 0x1c]
mov eax, 0x55555556
shr edx, 1
lea edi, [edx + edx*2]
lea ecx, [edi + edi]
mov dword [esp + 0x28], edi
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + 0x12]
test ax, ax
je 0x4b236d
mov ecx, eax
mov eax, 0x55555556
imul edi
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jl 0x4b236d
inc ecx
lea eax, [ecx + ecx*2]
mov dword [esp + 0x28], eax
shl eax, 2
push eax
call fcn.004b6720
mov edi, eax
add esp, 4
mov dword [esp + 0x64], edi
test edi, edi
jne 0x4b235b
lea eax, [edi - 6]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x44], 1
mov dword [esp + 0x14], edi
jmp 0x4b237a
mov eax, dword [ebp + 0x18]
mov edi, eax
mov dword [esp + 0x64], edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x68], eax
mov dword [esp + 0x94], 0
mov dword [esp + 0xe8], 0xffffffff
lea ecx, [eax + eax]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4b2406
mov ecx, dword [esp + 0x28]
lea ecx, [eax + ecx*4]
mov eax, dword [esp + 0x1c]
mov edx, ecx
movzx eax, word [eax + 0x10]
shl eax, 2
sub edx, eax
mov eax, dword [esp + 0x14]
add eax, 8
cmp edx, eax
cmovb edx, eax
sub ecx, 4
cmp ecx, edx
jb 0x4b23f1
nop
mov dword [ecx], 0xffffffff
sub ecx, 4
cmp ecx, edx
jae 0x4b23e0
mov edi, dword [esp + 0x64]
mov dword [edi + 4], 0xffffffff
mov eax, dword [esp + 0x64]
mov dword [eax], 0xffffffff
mov ebx, dword [esp + 0x74]
test byte [esp + 0x50], 0x10
mov edi, dword [esp + 0x1c]
jne 0x4b246d
movzx eax, word [edi + 0xc]
test al, 0x10
je 0x4b2445
mov dh, byte [edi + 0x14]
mov ecx, dword [esp + 0x8c]
mov dl, dh
mov dword [esp + 0x34], 1
mov byte [esp + 0x13], dh
mov byte [esp + 0x1a], dl
test al, 0x20
je 0x4b2474
movzx eax, dh
mov dh, byte [eax + ecx]
mov byte [esp + 0x13], dh
jmp 0x4b2474
test dword [esp + 0x2c], 0x100
jne 0x4b246d
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b246d
test byte [eax + 4], 1
mov ecx, dword [esp + 0x8c]
je 0x4b2474
add eax, 8
mov dword [esp + 0x48], eax
jmp 0x4b2474
mov ecx, dword [esp + 0x8c]
movzx eax, word [edi + 0xc]
test al, 0x40
je 0x4b249f
mov dh, byte [edi + 0x16]
mov dword [esp + 0x4c], 1
mov dl, dh
mov byte [esp + 0x12], dh
mov byte [esp + 0x1b], dl
test al, al
jns 0x4b249f
movzx eax, dh
mov al, byte [eax + ecx]
mov byte [esp + 0x12], al
mov edx, dword [esp + 0x20]
test dword [esp + 0x3c], 0x40000
mov edi, edx
je 0x4b251c
mov ecx, dword [esp + 0xd0]
mov edi, esi
cmp esi, ecx
jae 0x4b251c
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4b24ef
cmp edi, ecx
jae 0x4b2517
push ecx
lea edx, [esp + 0x78]
push edx
push ecx
mov edx, eax
mov ecx, edi
call fcn.004b2d60
mov ebx, dword [esp + 0x80]
add esp, 0xc
test eax, eax
jne 0x4b251c
mov ecx, dword [esp + 0xd0]
jmp 0x4b2513
mov eax, ecx
sub eax, ebx
cmp edi, eax
ja 0x4b2513
mov al, byte [edi]
cmp al, byte [esp + 0x84]
jne 0x4b2513
cmp ebx, 1
je 0x4b251c
mov al, byte [edi + 1]
cmp al, byte [esp + 0x85]
je 0x4b251c
mov eax, dword [esp + 0x70]
inc edi
cmp edi, ecx
jb 0x4b24c0
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
or eax, dword [ebp + 0x14]
and eax, 0x4000000
mov dword [esp + 0x14], eax
jne 0x4b2660
cmp dword [esp + 0x34], 0
je 0x4b2582
cmp esi, edi
jae 0x4b2668
mov cl, byte [esp + 0x1a]
mov dl, byte [esp + 0x13]
cmp cl, dl
je 0x4b2570
mov al, byte [esi]
cmp al, cl
je 0x4b2668
cmp al, dl
je 0x4b2668
inc esi
cmp esi, edi
jb 0x4b2550
jmp 0x4b2668
cmp byte [esi], cl
je 0x4b2668
inc esi
cmp esi, edi
jb 0x4b2570
jmp 0x4b2668
test dword [esp + 0x2c], 0x100
je 0x4b262c
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0xcc]
add eax, ecx
cmp esi, eax
jbe 0x4b2668
cmp esi, edi
jae 0x4b260c
mov eax, dword [esp + 0x70]
nop dword [eax]
test eax, eax
je 0x4b25d5
cmp esi, ecx
jbe 0x4b2607
push ecx
lea edx, [esp + 0x78]
push edx
push ecx
mov edx, eax
mov ecx, esi
call fcn.004b2df0
add esp, 0xc
test eax, eax
jne 0x4b260c
mov ebx, dword [esp + 0x74]
jmp 0x4b25fc
lea eax, [ecx + ebx]
cmp esi, eax
jb 0x4b2603
mov ecx, esi
sub ecx, ebx
mov al, byte [ecx]
cmp al, byte [esp + 0x84]
jne 0x4b25fc
cmp ebx, 1
je 0x4b260c
mov al, byte [ecx + 1]
cmp al, byte [esp + 0x85]
je 0x4b260c
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x70]
inc esi
cmp esi, edi
jb 0x4b25b0
cmp byte [esi - 1], 0xd
jne 0x4b2668
mov eax, dword [esp + 0x70]
cmp eax, 1
je 0x4b2620
cmp eax, 2
jne 0x4b2668
cmp esi, edi
jae 0x4b2668
cmp byte [esi], 0xa
jne 0x4b2668
inc esi
jmp 0x4b2668
mov ebx, dword [esp + 0x48]
test ebx, ebx
je 0x4b2668
cmp esi, edi
jae 0x4b2668
nop dword [eax + eax]
movzx edx, byte [esi]
mov eax, 1
mov ecx, edx
shr edx, 3
and ecx, 7
shl eax, cl
test byte [edx + ebx], al
jne 0x4b2668
inc esi
cmp esi, edi
jb 0x4b2640
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4b2700
cmp dword [esp + 0xe0], 0
jne 0x4b2700
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
test ecx, ecx
je 0x4b2695
test byte [ecx + 4], 2
je 0x4b2695
mov eax, edx
sub eax, esi
cmp eax, dword [ecx + 0x28]
jb 0x4b277d
cmp dword [esp + 0x4c], 0
je 0x4b2700
mov eax, edx
sub eax, esi
cmp eax, 0x3e8
jge 0x4b2700
mov eax, dword [esp + 0x34]
lea ecx, [esi + eax]
cmp ecx, dword [esp + 0x38]
jbe 0x4b2700
cmp ecx, edx
jae 0x4b277d
mov ah, byte [esp + 0x1b]
cmp ah, byte [esp + 0x12]
je 0x4b26e4
mov al, byte [ecx]
mov ebx, ecx
inc ecx
mov dword [esp + 0x38], ebx
cmp al, ah
je 0x4b26fc
cmp al, byte [esp + 0x12]
je 0x4b26fc
cmp ecx, edx
jb 0x4b26c6
xor edi, edi
jmp 0x4b28c6
mov al, byte [ecx]
mov ebx, ecx
mov dword [esp + 0x38], ecx
inc ecx
cmp al, ah
je 0x4b26fc
cmp ecx, edx
jb 0x4b26e4
xor edi, edi
jmp 0x4b28c6
cmp ebx, edx
jae 0x4b277d
mov edx, dword [esp + 0xc8]
lea eax, [esp + 0x58]
push 0
push 0
push eax
push 2
push esi
mov ecx, esi
mov dword [esp + 0xe8], esi
mov dword [esp + 0xf0], esi
mov dword [esp + 0x6c], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0xf8], 0
call fcn.004ad900
add esp, 0x14
mov edi, eax
cmp dword [esp + 0xb8], 0
je 0x4b2767
mov eax, dword [esp + 0x40]
test eax, eax
cmove eax, dword [esp + 0xdc]
mov dword [esp + 0x40], eax
cmp edi, 0xfffffc1d
jg 0x4b2784
je 0x4b27cc
cmp edi, 0xfffffc1a
jne 0x4b28be
xor edi, edi
jmp 0x4b28c6
cmp edi, 0xfffffc20
jg 0x4b27c4
je 0x4b27cc
cmp edi, 0xfffffc1e
je 0x4b27b3
cmp edi, 0xfffffc1f
jne 0x4b28c6
mov dword [esp + 0x14], esi
mov dword [esp + 0xc4], 1
jmp 0x4b27de
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x4b27cc
jmp 0x4b27de
test edi, edi
jne 0x4b28b9
lea eax, [esi + 1]
mov dword [esp + 0xc4], 0
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x70]
xor edi, edi
test dword [esp + 0x3c], 0x40000
je 0x4b2820
mov eax, dword [esp + 0xd0]
test ecx, ecx
je 0x4b288e
cmp esi, eax
jae 0x4b2820
push ecx
lea edx, [esp + 0x78]
push edx
mov edx, ecx
mov ecx, esi
push eax
call fcn.004b2d60
add esp, 0xc
test eax, eax
jne 0x4b28c6
mov ecx, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
test byte [esp + 0x50], 0x10
mov eax, dword [esp + 0x14]
mov esi, eax
jne 0x4b28c6
mov edx, dword [esp + 0x20]
cmp eax, edx
ja 0x4b28c6
cmp eax, dword [esp + 0x114]
jbe 0x4b287e
cmp byte [eax - 1], 0xd
jne 0x4b287e
cmp eax, edx
jae 0x4b287e
cmp byte [eax], 0xa
jne 0x4b287e
mov edi, dword [esp + 0x1c]
mov edx, 0x800
test word [edi + 0xc], dx
mov edx, dword [esp + 0x20]
jne 0x4b287e
cmp ecx, 1
je 0x4b287b
cmp ecx, 2
je 0x4b287b
cmp ebx, 2
jne 0x4b287e
lea esi, [eax + 1]
mov dword [esp + 0x104], 0
jmp 0x4b24a3
mov ebx, dword [esp + 0x74]
sub eax, ebx
cmp esi, eax
ja 0x4b2824
mov al, byte [esi]
cmp al, byte [esp + 0x84]
jne 0x4b2824
cmp ebx, 1
je 0x4b28c6
mov al, byte [esi + 1]
cmp al, byte [esp + 0x85]
je 0x4b28c6
jmp 0x4b2824
cmp edi, 1
je 0x4b2939
cmp edi, 0xfffffc19
je 0x4b2939
cmp dword [esp + 0x44], 0
je 0x4b28d9
push dword [esp + 0x64]
call fcn.004b6427
add esp, 4
test edi, edi
je 0x4b28eb
cmp edi, 0xfffffff4
je 0x4b28eb
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4b290e
cmp dword [ebp + 0x1c], 1
jle 0x4b2907
mov ecx, dword [ebp + 0x18]
sub eax, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, 0xfffffff4
jmp 0x4b2911
or eax, 0xffffffff
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4b2a57
test byte [ecx], 0x20
je 0x4b2a57
mov edx, dword [ecx + 0x18]
mov ecx, dword [esp + 0x108]
mov dword [edx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x44], 0
mov edi, dword [esp + 0x54]
je 0x4b298e
mov esi, dword [esp + 0x64]
cmp edi, 4
jl 0x4b2968
lea eax, [edi*4 - 8]
push eax
lea eax, [esi + 8]
push eax
mov eax, dword [ebp + 0x18]
add eax, 8
push eax
call fcn.004b4620
add esp, 0xc
mov eax, dword [esp + 0x94]
mov ecx, 1
cmp dword [esp + 0xe4], edi
push esi
cmovg eax, ecx
mov dword [esp + 0x98], eax
call fcn.004b6427
add esp, 4
cmp dword [esp + 0x94], 0
mov ecx, dword [esp + 0xe4]
je 0x4b29a7
cmp ecx, edi
jl 0x4b29a7
xor esi, esi
jmp 0x4b29b0
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
mov eax, dword [esp + 0x1c]
movzx edi, word [eax + 0x10]
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [ebp + 0x18]
sar eax, 1
cmp eax, edi
jg 0x4b29f9
test edx, edx
je 0x4b29f9
lea eax, [edi*2 + 2]
cmp eax, dword [ebp + 0x1c]
lea edi, [edx + ecx*4]
cmovg eax, dword [esp + 0x28]
xor ebx, ebx
lea eax, [edx + eax*4]
mov ecx, eax
sub ecx, edi
add ecx, 3
shr ecx, 2
cmp edi, eax
cmova ecx, ebx
test ecx, ecx
je 0x4b29f9
or eax, 0xffffffff
rep stosd dword es:[edi], eax
cmp dword [ebp + 0x1c], 2
jge 0x4b2a03
xor esi, esi
jmp 0x4b2a24
mov eax, dword [esp + 0xd4]
sub eax, dword [esp + 0xcc]
mov dword [edx], eax
mov eax, dword [esp + 0xd8]
sub eax, dword [esp + 0xcc]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4b2a3d
test byte [eax], 0x20
je 0x4b2a3d
mov edx, dword [eax + 0x18]
mov ecx, dword [esp + 0x104]
mov dword [edx], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffffffe8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret