Function at 0x475576
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x94
and dword [esp + 0x24], 0
and dword [esp + 0x30], 0
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], eax
test ecx, ecx
jne 0x4755ba
xor eax, eax
jmp 0x4760e6
test ebx, ebx
jne 0x4755c3
push 0x62
pop edi
jmp 0x4755c6
movzx edi, byte [ebx]
cmp edi, 0x5e
jg 0x475a31
je 0x475a18
cmp edi, 0x46
jg 0x4757bb
je 0x475b30
cmp edi, 0x25
jg 0x475690
je 0x47561f
mov eax, edi
sub eax, 0x13
je 0x4759ee
dec eax
je 0x475b11
sub eax, 4
jne 0x475ba5
push edx
mov edx, dword [ebx + 8]
mov ecx, esi
call fcn.00475576
pop ecx
mov dword [esp + 0xc], eax
jmp 0x4760ca
push edx
mov edx, dword [ebx + 8]
mov ecx, esi
call fcn.00475576
pop ecx
mov ecx, dword [ebx + 4]
mov edi, eax
mov dword [esp + 0xc], edi
call fcn.00479ccb
movsx ebx, al
cmp edi, dword [ebp + 8]
je 0x475661
push 0
push dword [ebp + 8]
push edi
mov edi, dword [esp + 0x1c]
push 0xf
pop edx
mov ecx, edi
call fcn.00467132
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [esp + 0xc], eax
jmp 0x475669
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push 0
push 0
push eax
lea edx, [ebx + 0x2c]
mov ecx, edi
call fcn.00467132
mov ebx, dword [esp + 0x18]
add esp, 0xc
mov edx, ebx
push 1
mov ecx, esi
call fcn.004753a7
pop ecx
jmp 0x4760ce
cmp edi, 0x38
je 0x475743
cmp edi, 0x3c
je 0x4756e1
cmp edi, 0x43
jle 0x475ba5
cmp edi, 0x45
jg 0x475ba5
mov edx, dword [ebx + 8]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004760ed
mov edx, dword [ebx + 0xc]
mov esi, eax
pop ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
call fcn.004760ed
pop ecx
push dword [ebp + 8]
mov ecx, dword [esp + 0x14]
push esi
push eax
mov edx, edi
jmp 0x475736
mov edi, dword [ebx + 0x28]
movsx eax, word [ebx + 0x1c]
movsx ecx, word [edi + 0x26]
mov esi, dword [esp + 0x10]
inc ecx
imul ecx, dword [ebx + 0x18]
push 0
push edx
inc eax
add eax, ecx
push eax
push 0x74
pop edx
mov ecx, esi
call fcn.00467132
movzx eax, word [ebx + 0x1c]
add esp, 0xc
test ax, ax
js 0x4760ca
movsx ecx, ax
mov eax, dword [edi + 4]
imul ecx, ecx, 0x18
cmp byte [ecx + eax + 0x15], 0x65
jne 0x4760ca
push 0
push 0
push dword [ebp + 8]
mov ecx, esi
push 0x16
pop edx
call fcn.00467132
add esp, 0xc
jmp 0x4760ca
xor edi, edi
cmp dword [esi + 0x1b4], edi
jne 0x47575f
push str.RAISE___may_only_be_used_within_a_trigger_program
push esi
call fcn.004554e6
pop ecx
pop ecx
jmp 0x4755b3
cmp byte [ebx + 1], 2
jne 0x47577a
mov eax, dword [esi + 0x1b0]
mov ecx, esi
test eax, eax
cmovne ecx, eax
mov byte [ecx + 0x18], 1
mov ecx, dword [esp + 0x10]
mov al, byte [ebx + 1]
push edi
cmp al, 4
jne 0x4757a6
mov esi, dword [ebx + 4]
push 4
push edi
push 6
pop edx
call fcn.00467132
add esp, 0xc
push edi
push esi
mov edx, eax
mov ecx, dword [esp + 0x18]
call fcn.004675b9
pop ecx
jmp 0x4760c9
push dword [ebx + 4]
movsx eax, al
push eax
mov edx, 0x713
mov ecx, esi
call fcn.0047c48d
jmp 0x47573b
cmp edi, 0x50
jg 0x4759ca
cmp edi, 0x4b
jge 0x475987
cmp edi, 0x47
je 0x4758c1
cmp edi, 0x48
je 0x47584b
lea eax, [edi - 0x49]
cmp eax, 1
ja 0x475ba5
push 0
push edx
push 1
push 7
pop edx
call fcn.00467132
mov edx, dword [ebx + 8]
add esp, 0xc
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004760ed
mov ebx, dword [esp + 0x14]
pop ecx
push 0
push 0
push eax
mov edx, edi
mov ecx, ebx
call fcn.00467132
add esp, 0xc
mov ecx, ebx
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
mov esi, eax
push 0x14
pop edx
call fcn.00467132
add esp, 0xc
test esi, esi
js 0x4760ca
push dword [ebx + 0x1c]
mov edx, esi
mov ecx, ebx
call fcn.00467421
jmp 0x4760c9
call fcn.00467230
mov ecx, dword [esp + 0x10]
mov esi, eax
call fcn.00467230
mov ecx, dword [esp + 0x10]
push 0
push dword [ebp + 8]
mov edi, eax
push 0
push 0xa
pop edx
call fcn.00467132
mov ecx, dword [esp + 0x20]
add esp, 0xc
mov edx, ebx
push edi
push esi
call fcn.00474f87
mov ebx, dword [esp + 0x18]
push 0
push dword [ebp + 8]
mov ecx, ebx
push 1
push 7
pop edx
call fcn.00467132
add esp, 0x14
mov edx, esi
mov ecx, ebx
call fcn.0046726c
push 0
push 0
push dword [ebp + 8]
push 0x14
pop edx
call fcn.00467132
add esp, 0xc
mov edx, edi
mov ecx, ebx
call fcn.0046726c
jmp 0x4760ca
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 8]
mov edi, dword [eax + 8]
lea eax, [esp + 0x30]
mov esi, dword [edi]
mov dword [esp + 0x20], ecx
mov edx, ecx
mov ecx, dword [esp + 0x14]
push eax
call fcn.004760ed
mov ebx, eax
pop ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
mov edx, esi
call fcn.004760ed
pop ecx
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.00476c98
mov dword [esp + 0x18], eax
call fcn.00476c98
push 0x10
push dword [esp + 0x1c]
mov dword [esp + 0x40], eax
push edx
mov edx, dword [esp + 0x2c]
push ebx
push 0x50
push esi
call fcn.00473839
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x2c]
mov esi, dword [edi + 0x18]
call fcn.00476cb4
lea eax, [esp + 0x54]
push eax
mov edx, esi
call fcn.004760ed
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x3c]
add esp, 0x1c
push 0x10
push edi
push eax
push ebx
push 0x4e
push esi
mov esi, dword [esp + 0x2c]
mov ecx, esi
call fcn.00473839
push dword [ebp + 8]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x2c]
push edi
push ebx
push 0x45
pop edx
call fcn.00467132
add esp, 0x24
mov edx, ebx
mov ecx, esi
call fcn.00476cb4
mov edx, edi
call fcn.00476cb4
jmp 0x4760ca
mov edx, dword [ebx + 8]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004760ed
mov edx, dword [ebx + 0xc]
mov esi, eax
pop ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
call fcn.004760ed
pop ecx
push 0x10
push dword [ebp + 8]
push eax
push esi
push edi
push dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x2c]
call fcn.00473839
add esp, 0x18
jmp 0x4760ca
cmp edi, 0x52
jl 0x475ba5
cmp edi, 0x5b
jle 0x4756b0
cmp edi, 0x5c
je 0x47560a
cmp edi, 0x5d
jne 0x475ba5
mov edx, dword [ebx + 8]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004760ed
mov ebx, dword [ebp + 8]
pop ecx
mov ecx, dword [esp + 0x10]
push 0
push ebx
push eax
mov edx, edi
call fcn.00467132
add esp, 0xc
jmp 0x4760ce
mov esi, dword [ebx + 4]
xor ebx, ebx
push ebx
push edx
push ebx
push 0x5e
pop edx
call fcn.00467132
add esp, 0xc
push ebx
jmp 0x475794
cmp edi, 0x92
jg 0x475b6f
je 0x475b30
sub edi, 0x62
je 0x475b24
sub edi, 0x12
je 0x475b11
sub edi, 0xd
je 0x475b00
dec edi
je 0x475af0
dec edi
je 0x475ab1
dec edi
je 0x475aa9
dec edi
jne 0x475ba5
movsx eax, word [ebx + 0x1c]
push edi
push edx
push eax
push 0xc
pop edx
call fcn.00467132
mov eax, dword [ebx + 4]
add esp, 0xc
cmp byte [eax + 1], 0
je 0x4760ca
movsx ecx, word [ebx + 0x1c]
mov eax, dword [esi + 0x1ec]
push 0xfffffffffffffffe
push dword [eax + ecx*4 - 4]
or edx, 0xffffffff
jmp 0x475797
mov eax, dword [ebx + 0x18]
jmp 0x475d97
mov ecx, dword [ebx + 4]
add ecx, 2
call fcn.0045545d
mov ebx, dword [esp + 0x10]
lea esi, [eax - 1]
mov edx, ecx
mov ecx, dword [ebx]
push esi
call fcn.004560da
pop ecx
push 0xffffffffffffffff
push eax
mov eax, esi
cdq
push 0
push dword [ebp + 8]
sub eax, edx
sar eax, 1
push eax
push 0xb
pop edx
mov ecx, ebx
call fcn.00467183
add esp, 0x14
jmp 0x4760ca
push edx
mov edx, dword [ebx + 4]
push 0
call fcn.0047519e
jmp 0x4757a0
push edx
push 0
mov edx, ebx
mov ecx, esi
call fcn.0047521c
jmp 0x4757a0
push 0
push 0
mov edx, ebx
mov ecx, esi
call fcn.00474b80
pop ecx
jmp 0x475615
push 0
push edx
push 0
push 0xa
jmp 0x475735
mov edx, dword [ebx + 8]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004760ed
mov edx, dword [ebx + 0xc]
mov esi, eax
pop ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
call fcn.004760ed
pop ecx
push 0x90
push dword [ebp + 8]
push eax
xor eax, eax
cmp edi, 0x46
sete al
push esi
add eax, 0x4b
push eax
jmp 0x4759b3
sub edi, 0x97
je 0x475e0a
dec edi
je 0x475ddb
dec edi
je 0x475db2
dec edi
je 0x475d82
dec edi
je 0x475e0a
dec edi
je 0x475cfd
dec edi
je 0x47560a
mov eax, dword [ebx + 0x10]
and dword [esp + 0x18], 0
mov esi, dword [eax + 8]
mov edi, dword [eax]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x38], edi
call fcn.00467230
mov edx, dword [ebx + 8]
mov dword [esp + 0x34], eax
mov dword [esp + 0x24], edx
test edx, edx
je 0x475c1a
push 0xb
pop ecx
mov esi, edx
lea edi, [esp + 0x48]
lea eax, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call fcn.004760ed
and dword [esp + 0x34], 0
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x78]
pop ecx
mov byte [esp + 0x48], 0x84
mov byte [esp + 0x74], 0x4c
mov dword [esp + 0x18], eax
test edi, edi
jle 0x475cb5
mov ebx, dword [esp + 0x14]
lea eax, [edi - 1]
mov edi, dword [esp + 0x10]
shr eax, 1
inc eax
mov dword [esp + 0x20], eax
inc dword [ebx + 0x5c]
mov eax, dword [esi]
test edx, edx
je 0x475c46
mov dword [esp + 0x80], eax
jmp 0x475c4a
mov dword [esp + 0x18], eax
mov ecx, edi
call fcn.00467230
mov edx, dword [esp + 0x18]
mov esi, eax
push 8
push esi
mov ecx, ebx
call fcn.0047657f
mov edx, dword [esp + 0x24]
push dword [ebp + 8]
mov edx, dword [edx + 0x18]
mov ecx, ebx
call fcn.00476126
add esp, 0xc
xor edx, edx
push 0
push dword [esp + 0x38]
inc edx
push 0
mov ecx, edi
call fcn.00467132
add esp, 0xc
mov ecx, ebx
call fcn.004753e3
mov edx, esi
mov ecx, edi
call fcn.0046726c
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
add esi, 0x30
dec dword [esp + 0x20]
mov dword [esp + 0x1c], esi
jne 0x475c34
mov ebx, dword [esp + 0x2c]
jmp 0x475cb9
mov edi, dword [esp + 0x10]
xor eax, eax
cmp dword [ebx + 0xc], eax
je 0x475ce0
mov eax, dword [esp + 0x14]
push dword [ebp + 8]
inc dword [eax + 0x5c]
mov edx, dword [ebx + 0xc]
mov ecx, eax
call fcn.00476126
pop ecx
mov ecx, dword [esp + 0x14]
call fcn.004753e3
jmp 0x475cf2
push eax
push dword [ebp + 8]
mov ecx, edi
push eax
push 0xa
pop edx
call fcn.00467132
add esp, 0xc
mov edx, dword [esp + 0x34]
mov ecx, edi
jmp 0x4758b7
mov eax, dword [ebx + 8]
mov cl, byte [eax]
mov byte [esp + 0x43], cl
cmp cl, 0x81
mov ecx, dword [esp + 0x10]
jne 0x475d1d
push edx
push 1
mov edx, eax
mov ecx, esi
call fcn.0047521c
jmp 0x475d2f
cmp byte [esp + 0x43], 0x82
jne 0x475d33
push edx
mov edx, dword [eax + 4]
push 1
call fcn.0047519e
pop ecx
pop ecx
jmp 0x475d7a
mov ecx, esi
call fcn.00476c98
mov ecx, dword [esp + 0x10]
push 0
mov esi, eax
push esi
push 0
push 7
pop edx
mov dword [esp + 0x3c], esi
call fcn.00467132
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
call fcn.004760ed
pop ecx
push dword [ebp + 8]
mov ecx, dword [esp + 0x14]
push esi
push eax
push 0x57
pop edx
call fcn.00467132
add esp, 0xc
mov ebx, dword [ebp + 8]
jmp 0x4760ce
movsx eax, word [ebx + 0x1e]
mov edi, dword [ebx + 0x24]
imul eax, eax, 0x18
add eax, dword [edi + 0x14]
cmp byte [edi], 0
jne 0x475d9e
mov eax, dword [eax + 0x10]
mov ebx, eax
jmp 0x4760ce
cmp byte [edi + 1], 0
je 0x475ddb
push edx
push dword [eax + 0xc]
push dword [edi + 8]
push 0x1d
jmp 0x475735
mov eax, dword [ebx + 0x24]
test eax, eax
jne 0x475dcc
push dword [ebx + 4]
push str.misuse_of_aggregate:__s__
push esi
call fcn.004554e6
jmp 0x47573b
movsx ecx, word [ebx + 0x1e]
mov eax, dword [eax + 0x20]
add ecx, ecx
mov eax, dword [eax + ecx*8 + 8]
jmp 0x475d97
cmp dword [ebx + 0x18], 0
jge 0x475dea
movsx eax, word [ebx + 0x1c]
add eax, dword [esi + 0x58]
jmp 0x475d97
movzx eax, byte [ebx + 0x23]
push eax
movsx eax, word [ebx + 0x1c]
push edx
push dword [ebx + 0x18]
mov edx, dword [ebx + 0x28]
push eax
mov ecx, esi
call fcn.00475470
add esp, 0x10
jmp 0x475616
mov eax, dword [eax + 0x10]
and dword [esp + 0x20], 0
mov eax, dword [eax + 0xc]
and dword [esp + 0x1c], 0
mov al, byte [eax + 0x4d]
mov byte [esp + 0x38], al
mov eax, 0x4000
test word [ebx + 2], ax
je 0x475e83
xor edi, edi
mov dword [esp + 0x24], edi
xor edx, edx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
call fcn.0045545d
push 0
push dword [esp + 0x3c]
mov dword [esp + 0x4c], eax
push edx
mov edx, ecx
mov ecx, dword [esp + 0x24]
push eax
call fcn.0047ca94
mov edx, eax
add esp, 0x10
mov dword [esp + 0x34], edx
test edx, edx
jne 0x475e92
push dword [esp + 0x2c]
push dword [esp + 0x48]
push str.unknown_function:__.s__
push esi
call fcn.004554e6
add esp, 0x10
jmp 0x4760ca
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x24], edi
test edi, edi
je 0x475e32
mov edx, dword [edi]
jmp 0x475e34
test byte [edx + 3], 0x20
je 0x475f34
mov ebx, dword [esp + 0x10]
mov ecx, ebx
call fcn.00467230
mov edx, dword [esp + 0x24]
mov edi, dword [ebp + 8]
mov edx, dword [edx + 8]
push edi
mov edx, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.00476126
pop ecx
mov ecx, dword [esp + 0x28]
cmp ecx, 1
jle 0x475f22
dec ecx
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x20], ecx
push 0
push dword [esp + 0x20]
mov ecx, ebx
push edi
push 0x4a
pop edx
call fcn.00467132
add esp, 0xc
mov edx, edi
push 1
mov ecx, esi
call fcn.004753a7
mov eax, dword [esp + 0x28]
inc dword [esi + 0x5c]
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x1c]
pop ecx
mov edx, dword [eax + edx]
push edi
mov ecx, esi
call fcn.00476126
pop ecx
mov ecx, esi
call fcn.004753e3
add dword [esp + 0x18], 0x18
dec dword [esp + 0x20]
jne 0x475ed6
mov edx, dword [esp + 0x1c]
mov ecx, ebx
call fcn.0046726c
mov ebx, edi
jmp 0x4760ce
test edi, edi
je 0x475f85
mov edx, dword [esp + 0x28]
mov ecx, esi
call fcn.00476ce8
mov edx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], edx
mov ah, byte [eax + 3]
test ah, 0xc0
je 0x475f67
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
mov al, byte [ecx]
cmp al, 0x98
je 0x475f64
cmp al, 0x9a
jne 0x475f67
mov byte [ecx + 0x23], ah
inc dword [esi + 0x5c]
push 1
push edx
mov edx, edi
mov ecx, esi
call fcn.00476245
pop ecx
pop ecx
mov ecx, esi
call fcn.004753e3
mov edx, dword [esp + 0x34]
jmp 0x475f8a
and dword [esp + 0x38], 0
mov ecx, dword [esp + 0x28]
cmp ecx, 2
jl 0x475fb7
test byte [ebx + 2], 0x80
je 0x475fb7
mov eax, dword [edi + 8]
push dword [eax + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
call fcn.0048e517
pop ecx
mov ebx, eax
pop ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x34], ebx
jmp 0x475fc6
test ecx, ecx
jle 0x475fc2
mov eax, dword [edi + 8]
push dword [eax]
jmp 0x475f9f
mov ebx, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x24], eax
test ecx, ecx
jle 0x476048
xor edx, edx
mov dword [esp + 0x2c], edx
cmp eax, 0x20
jge 0x47600a
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [ecx + eax]
inc edx
call fcn.00474713
mov edx, dword [esp + 0x2c]
test eax, eax
je 0x476002
mov ecx, dword [esp + 0x24]
xor eax, eax
inc eax
shl eax, cl
or dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
test byte [ebx + 3], 8
je 0x476038
cmp dword [esp + 0x1c], 0
jne 0x476038
mov edx, dword [edi + 8]
mov ecx, dword [esp + 0x2c]
mov edx, dword [edx + ecx]
mov ecx, esi
call fcn.00473683
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
inc eax
add edx, 0x18
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edx
cmp eax, ecx
jl 0x475fd6
test byte [ebx + 3], 8
je 0x47608a
cmp dword [esp + 0x1c], 0
jne 0x476060
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x10]
push 0
push 0
push 0
push 0x11
pop edx
mov ecx, ebx
call fcn.00467132
add esp, 0xc
mov edx, eax
push 0xfffffffffffffffc
push dword [esp + 0x20]
mov ecx, ebx
call fcn.004675b9
pop ecx
pop ecx
jmp 0x47608e
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
push 0xfffffffffffffffb
push eax
push dword [ebp + 8]
mov ecx, ebx
push edi
push dword [esp + 0x30]
push 0x12
pop edx
call fcn.00467183
mov edx, dword [esp + 0x3c]
add esp, 0x14
mov ecx, ebx
call fcn.0046744f
mov eax, edx
test eax, eax
je 0x4760ca
push eax
mov edx, edi
mov ecx, esi
call fcn.00476d13
pop ecx
mov ebx, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
call fcn.00476cb4
mov edx, dword [esp + 0x3c]
call fcn.00476cb4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret