Function at 0x403d2c
Capabilities:
Enumerate files on windows
Get common file path
Set current directory
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x406028]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
xor ebx, ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push ebx
push ebx
push 1
push ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x22], bl
mov byte [esp + 0x23], bl
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
push ebx
push ebx
push 0x100
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_SetThreadPreferredUILanguages]
call fcn.004057a6
mov ebx, dword [ebp + 8]
mov dword [esp + 0x18], ebx
test al, al
je 0x403db1
xor esi, esi
test ebx, ebx
je 0x403dab
push dword [edi + esi*4]
push dword [edi + esi*4]
call dword [sym.imp.ext_ms_win_ntuser_chartranslation_l1_1_0.dll_CharToOemA]
inc esi
cmp esi, ebx
jb 0x403d9a
call dword [sym.imp.api_ms_win_core_file_l1_2_2.dll_SetFileApisToOEM]
call dword [sym.imp.msvcrt.dll_clock]
push 0x40ed20
push 0xfffffffffffffff5
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
push eax
call dword [sym.imp.api_ms_win_core_console_l2_1_0.dll_GetConsoleScreenBufferInfo]
mov eax, dword [0x40ed28]
or eax, 8
push 0x190
mov word [0x40ee60], ax
lea eax, [esp + 0x17c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401230
push esi
push 1
call dword [sym.imp.msvcrt.dll__wsetlocale]
push esi
push 3
call dword [sym.imp.msvcrt.dll__wsetlocale]
push esi
push 4
call dword [sym.imp.msvcrt.dll__wsetlocale]
push esi
push 5
call dword [sym.imp.msvcrt.dll__wsetlocale]
add esp, 0x20
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
push eax
push 0x40123c
lea eax, [esp + 0x330]
push 8
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
lea eax, [esp + 0x338]
push eax
push 2
call dword [sym.imp.msvcrt.dll__wsetlocale]
push 0x100
push 1
push 0x40ed50
mov byte [0x4067cc], 1
mov dword [0x40abe4], 0x401244
call sub.msvcrt.dll_memset
and dword [0x4067c0], 0
add esp, 0x24
mov esi, 0x8000
push esi
push 1
call fcn.00405777
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__fileno]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__setmode]
pop ecx
pop ecx
push esi
push 2
call fcn.00405777
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__fileno]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__setmode]
and dword [esp + 0x34], 0
xor edi, edi
inc edi
mov dword [esp + 0x2c], edi
pop ecx
pop ecx
cmp ebx, edi
jle 0x4041e6
mov eax, dword [esp + 0x30]
mov esi, dword [eax + edi*4]
mov al, byte [esi]
cmp al, 0x2f
je 0x40407a
cmp al, 0x2d
je 0x40407a
cmp byte [esp + 0x12], 0
je 0x40419c
cmp byte [esp + 0x13], 0
je 0x404190
push 0x13
jmp 0x4048e3
movsx eax, bl
add eax, 0xffffffc1
cmp eax, 0x39
ja case.0x403f0d.64
movzx eax, byte [eax + 0x404928]
jmp dword [eax*4 + 0x4048f0]
or dword [0x4067c0], 8
jmp 0x40407a
or dword [0x4067c0], 0x10
jmp 0x40407a
and dword [0x40604c], 0
jmp 0x40407a
mov dword [0x40ed38], 0x402d80
mov byte [esp + 0x12], 1
jmp 0x40407a
or dword [0x4067c0], 2
jmp 0x40407a
or dword [0x4067c0], 4
jmp 0x40407a
push 0x40124c
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x403f7d
push 0x40124c
jmp 0x403f91
mov ebx, 0x401254
push ebx
push esi
call dword [sym.imp.msvcrt.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x403fa9
push ebx
or dword [0x4067c0], 0x200
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
dec esi
add esi, eax
jmp 0x40407a
or dword [0x4067c0], 0x80
jmp 0x40407a
or dword [0x4067c0], 0x100
jmp 0x40407a
mov dword [0x40ed38], fcn.00401f90
mov byte [esp + 0x13], 1
jmp 0x40407a
mov dword [esp + 0x2c], 1
jmp 0x40407a
mov dword [section..data], 0x4037e0
jmp 0x40407a
or dword [0x4067c0], 0x18
jmp 0x40407a
cmp byte [esi + 1], 0x3a
jne 0x40404e
add esi, 2
cmp byte [esi], 0
je 0x404165
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
mov ecx, eax
cmp bl, 0x61
jg 0x4040eb
je 0x40409b
cmp bl, 0x41
je 0x40409b
cmp bl, 0x43
je 0x404123
cmp bl, 0x44
je 0x404117
cmp bl, 0x45
jle 0x40404b
cmp bl, 0x47
jle 0x404101
dec esi
add esi, ecx
lea eax, [esp + 0x14]
mov byte [esp + 0x14], 0x2f
push eax
push dword [0x40abe4]
mov byte [esp + 0x1d], bl
push 6
push 2
mov byte [esp + 0x26], 0
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0x10
inc esi
mov bl, byte [esi]
test bl, bl
jne 0x403ef7
mov ebx, dword [esp + 0x18]
inc edi
mov dword [esp + 0x24], edi
cmp edi, ebx
jl 0x403ec1
jmp 0x403eda
xor eax, eax
mov word [0x40ee60], ax
jmp 0x4040e2
movsx eax, al
push eax
call dword [sym.imp.msvcrt.dll_isxdigit]
pop ecx
test eax, eax
je 0x4040e8
cmp byte [esi], 0x39
movsx ecx, byte [esi]
jg 0x4040c1
lea eax, [ecx - 0x30]
jmp 0x4040cc
push ecx
call dword [sym.imp.msvcrt.dll_tolower]
pop ecx
sub eax, 0x57
mov cx, word [0x40ee60]
shl cx, 4
add cx, ax
inc esi
mov word [0x40ee60], cx
mov al, byte [esi]
test al, al
jne 0x4040a5
dec esi
jmp 0x40407a
cmp bl, 0x63
je 0x404123
cmp bl, 0x64
je 0x404117
mov al, bl
sub al, 0x66
cmp al, 1
ja 0x40404b
cmp bl, 0x66
je 0x404111
cmp bl, 0x46
je 0x404111
mov dword [esp + 0x1c], esi
jmp 0x40411b
mov dword [esp + 0x20], esi
jmp 0x40411b
mov dword [esp + 0x28], esi
dec esi
add esi, ecx
jmp 0x40407a
mov eax, dword [esp + 0x34]
mov dword [0x40ed38], 0x402d80
cmp eax, 0x64
jge 0x4048e1
mov dword [esp + eax*4 + 0x178], esi
inc eax
mov dword [esp + 0x34], eax
jmp 0x40411b
push 0
push 3
push 1
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0xc
push 0
call dword [sym.imp.msvcrt.dll_exit]
lea eax, [esp + 0x14]
mov byte [esp + 0x14], bl
push eax
push dword [0x40abe4]
mov byte [esp + 0x1d], 0
push 0xb
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0x10
push 2
jmp 0x40415f
mov dword [0x40ed38], 0x402d80
jmp 0x4041ad
cmp byte [esp + 0x13], 0
je 0x4041ad
mov dword [0x40ed38], fcn.00401f90
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4041e6
xor edi, edi
test eax, eax
jle 0x4041e2
mov esi, dword [esp + edi*4 + 0x178]
test esi, esi
je 0x4041e2
push 0x401258
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
add eax, esi
push eax
push esi
call fcn.00402e20
inc edi
cmp edi, dword [esp + 0x34]
jl 0x4041bb
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
cmp edi, ebx
jne 0x404203
cmp dword [0x40ec1c], 0
jne 0x404203
test esi, esi
jne 0x404203
xor ecx, ecx
inc ecx
jmp 0x4048e4
mov eax, dword [0x406018]
push 1
mov byte [eax - 1], 0xa
mov eax, dword [0x406014]
mov byte [eax - 1], 0xa
call fcn.00405777
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__fileno]
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__isatty]
pop ecx
test eax, eax
je 0x404245
mov dword [0x406004], 0x4030c0
mov dword [0x406008], 0x403310
test esi, esi
je 0x4042bf
cmp byte [esi], 0x2f
jne 0x404256
movzx eax, byte [esi + 1]
test al, al
je 0x404263
cmp byte [esi], 0x2d
jne 0x404292
movzx eax, byte [esi + 1]
test al, al
jne 0x404292
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov esi, eax
push esi
mov edx, 0x40122c
mov ecx, fcn.00402e20
call fcn.004038c8
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
cmp esi, eax
je 0x4042f1
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
jmp 0x4042f1
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0x80000000
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40426d
mov eax, dword [esp + 0x1c]
push eax
push dword [0x40abe4]
push 7
jmp 0x40417b
cmp dword [0x40ec1c], 0
jne 0x404301
mov eax, dword [esp + 0x30]
mov edx, dword [eax + edi*4]
mov ecx, edx
inc edi
mov dword [esp + 0x24], edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4042d9
sub ecx, esi
push 0x40125c
lea eax, [ecx + edx]
push eax
push edx
call fcn.00402e20
cmp dword [0x40ec1c], 0
jne 0x404301
push 0xc
jmp 0x4048e3
cmp dword [0x40ed38], fcn.00401f90
je 0x40441e
mov ecx, dword [0x40606c]
mov eax, 0xff
cmp ecx, eax
jae 0x404323
lea eax, [ecx + 1]
push 0x100
push eax
push 0x40ed50
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [0x40ec18], 0x404a90
xor esi, esi
xor ebx, ebx
cmp dword [0x40604c], 0
jne 0x404365
push ebx
call dword [sym.imp.msvcrt.dll_isalpha]
pop ecx
test eax, eax
je 0x404365
push ebx
call dword [sym.imp.msvcrt.dll_islower]
pop ecx
test eax, eax
jne 0x404398
cmp byte [ebx + 0x40ec20], 0
je 0x404398
xor edx, edx
mov byte [esp + 0x12], bl
push 0
inc edx
lea ecx, [esp + 0x16]
call fcn.004029fc
movsx ecx, byte [ebx + 0x40ec20]
xor edx, edx
inc edx
mov ecx, dword [ecx*4 + 0x4069d0]
call fcn.00402f79
add esi, eax
inc ebx
cmp ebx, 0x100
jb 0x404344
mov eax, dword [0x40ec1c]
cmp esi, eax
je 0x404400
push 0xa
push 0xf
lea eax, [esp + 0x320]
push eax
push esi
call dword [sym.imp.msvcrt.dll__itoa_s]
push 0xa
push 0xf
lea eax, [esp + 0x320]
push eax
push dword [0x40ec1c]
call dword [sym.imp.msvcrt.dll__itoa_s]
add esp, 0x20
lea eax, [esp + 0x308]
push eax
lea eax, [esp + 0x31c]
push eax
push 8
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
mov eax, dword [0x40ec1c]
add esp, 0x10
cmp eax, 1
jne 0x404418
cmp dword [0x40604c], 0
je 0x404418
mov dword [0x40ec18], 0x4049c0
mov ebx, dword [esp + 0x18]
jmp 0x404431
cmp dword [0x40ec18], 0
jne 0x404431
mov dword [0x40ec18], 0x4021d0
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x40453f
or dword [0x4067c0], 1
cmp byte [ecx], 0x2f
jne 0x404451
movzx eax, byte [ecx + 1]
test al, al
je 0x404466
cmp byte [ecx], 0x2d
jne 0x404515
movzx eax, byte [ecx + 1]
test al, al
jne 0x404515
push 0
call fcn.00405777
pop ecx
mov esi, eax
push esi
lea eax, [esp + 0x33c]
push 0x105
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
test eax, eax
je 0x4044ff
lea eax, [esp + 0x338]
push 0x40122c
push eax
call dword [sym.imp.msvcrt.dll_strcspn]
pop ecx
pop ecx
cmp eax, 0x105
jae 0x4048e9
lea ecx, [esp + 0x338]
mov byte [esp + eax + 0x338], 0
call fcn.00402fc0
mov edi, eax
cmp edi, 0xffffffff
je 0x4044e0
mov ecx, dword [section..data]
lea edx, [esp + 0x338]
push edi
call fcn.004038c8
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push esi
lea eax, [esp + 0x33c]
push 0x105
push eax
call dword [sym.imp.msvcrt.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x40448b
mov edi, dword [esp + 0x24]
push 0
call fcn.00405777
pop ecx
cmp esi, eax
je 0x404560
push esi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
jmp 0x404560
push 0x401260
push ecx
call dword [sym.imp.msvcrt.dll_fopen]
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x404470
mov eax, dword [esp + 0x20]
push eax
push dword [0x40abe4]
push 9
jmp 0x40417b
cmp edi, ebx
jne 0x404560
and dword [0x4067c0], 0xfffffffc
push 0xfffffffffffffff6
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetStdHandle]
mov ecx, dword [section..data]
xor edx, edx
push eax
call fcn.004038c8
mov edx, dword [esp + 0x2c]
lea eax, [edi + 1]
cmp ebx, eax
jg 0x404594
test edx, edx
jne 0x404594
cmp edi, ebx
jge 0x40459b
mov eax, dword [esp + 0x30]
lfence
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x40459b
jmp 0x40458c
cmp al, 0x3f
je 0x404594
cmp al, 0x2a
je 0x404594
inc ecx
mov al, byte [ecx]
test al, al
jne 0x404583
jmp 0x40459b
or dword [0x4067c0], 1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x404790
cmp byte [eax], 0
je 0x404790
xor edi, edi
push edi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryA]
mov esi, eax
test esi, esi
je 0x40477b
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
mov dword [esp + 0x38], edi
pop ecx
test edi, edi
jne 0x4045f4
push dword [0x40abe4]
push 2
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0xc
jmp 0x40418c
push edi
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40477b
mov esi, dword [esp + 0x28]
push 0x3b
push esi
call dword [sym.imp.msvcrt.dll_strchr]
mov ebx, eax
mov dword [esp + 0x24], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x404620
mov byte [ebx], 0
cmp byte [esi], 0
je 0x404749
movzx eax, word [0x40ee60]
mov esi, dword [0x406004]
mov ecx, esi
push eax
push 2
push 0x401264
call dword [0x40f1e4]
call esi
movzx eax, word [0x40ee60]
mov esi, dword [esp + 0x28]
push eax
push esi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrlenA]
push eax
push esi
mov esi, dword [0x406004]
mov ecx, esi
call dword [0x40f1e4]
call esi
movzx eax, word [0x40ee60]
mov esi, dword [0x406004]
mov ecx, esi
push eax
push 3
push 0x401268
call dword [0x40f1e4]
call esi
push edi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryA]
test eax, eax
je 0x404765
mov esi, dword [esp + 0x28]
push esi
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4046c9
push esi
push dword [0x40abe4]
push 4
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0x10
jmp 0x404749
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
push dword [esp + 0x2c]
mov esi, dword [esp + 0x1c]
sub esi, eax
lea eax, [ecx + eax*4]
push esi
push eax
lea ecx, [esp + 0x344]
mov dword [esp + 0x2c], eax
call fcn.0040238b
test eax, eax
js 0x404749
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x338]
call fcn.00402fc0
mov dword [esp + 0x20], eax
cmp eax, 0xffffffff
je 0x40472e
mov ecx, dword [section..data]
lea edx, [esp + 0x338]
push eax
call fcn.004038c8
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push edi
push esi
push ebx
lea ecx, [esp + 0x344]
call fcn.0040238b
test eax, eax
jns 0x4046fc
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x1c]
lea esi, [ebx + 1]
mov dword [esp + 0x28], esi
test ebx, ebx
jne 0x404608
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x404895
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push edi
push dword [0x40abe4]
push 4
jmp 0x40417b
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [0x40abe4]
push 0x11
jmp 0x4045de
test edx, edx
je 0x4047f0
cmp ebx, edi
jle 0x404895
mov eax, dword [esp + 0x30]
sub ebx, edi
push edx
lea edi, [eax + edi*4]
jmp 0x4047d9
lea ecx, [esp + 0x338]
call fcn.00402fc0
mov esi, eax
cmp esi, 0xffffffff
je 0x4047d5
mov ecx, dword [section..data]
lea edx, [esp + 0x338]
push esi
call fcn.004038c8
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
push dword [esp + 0x2c]
push ebx
push edi
lea ecx, [esp + 0x344]
call fcn.0040238b
test eax, eax
jns 0x4047a8
jmp 0x404895
cmp edi, ebx
jge 0x404895
mov eax, dword [esp + 0x30]
sub ebx, edi
mov dword [esp + 0x18], ebx
lea esi, [eax + edi*4]
lea eax, [esp + 0x38]
push eax
push dword [esi]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x404836
push dword [esi]
push dword [0x40abe4]
push 4
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0x10
jmp 0x404887
mov ecx, dword [esi]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40483b
sub ecx, edx
push ecx
push dword [esi]
lea ecx, [esp + 0x6c]
call fcn.00403c8f
lea ecx, [esp + 0x64]
call fcn.00402fc0
mov edi, eax
cmp edi, 0xffffffff
je 0x404877
mov ecx, dword [section..data]
lea edx, [esp + 0x64]
push edi
call fcn.004038c8
push edi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileA]
test eax, eax
jne 0x404836
add esi, 4
sub dword [esp + 0x18], 1
jne 0x404805
mov esi, dword [0x406008]
mov ecx, esi
call dword [0x40f1e4]
call esi
cmp byte [0x40ed36], 0
je 0x4048c7
push dword [0x40abe4]
push 0x16
push 2
call fcn.00405777
pop ecx
push eax
call fcn.00404d63
add esp, 0xc
mov ecx, dword [esp + 0x444]
mov eax, dword [0x406054]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004051e0
mov esp, ebp
pop ebp
ret
push 0x15
pop ecx
call fcn.004028c1
call fcn.00405328
mov edi, edi
dec eax
inc ecx
inc eax
add byte [edi + edi], dl
inc eax
add byte [eax], ah
aas
inc eax
add byte [edi + edi], ch
inc eax
add byte [eax], bh
aas
inc eax
add byte [edi + edi + 0x40], cl
add byte [eax + 0x3f], bl
inc eax
add byte [edi + edi + 0x40], ah
add byte [eax - 0x38ffbfc1], bh
aas
inc eax
add bl, bl
aas
inc eax
add al, ch
aas
inc eax
add bh, dh
aas
inc eax
add byte [eax], al
inc eax
inc eax
add byte [eax], al
or eax, 0xd0d010d
add cl, byte [218303757]
or eax, 117835012
or byte [218958345], cl
or ecx, dword [218959116]
or eax, 218959117
or eax, 34409729
or eax, 218303757
or eax, 117835012
or byte [218958345], cl
or ecx, dword [1442810636]
mov edi, edi
push ebp