Function at 0x100257b1
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x100601d2
call fcn.1005f0d0
sub esp, 0x188
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x54], cl
je 0x100257fe
test cl, cl
je 0x100257ef
mov byte [ebp + 0x23], 0
cmp byte [ebp + 0x23], 0
je 0x10026292
call fcn.10026730
jmp 0x10026292
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10026292
cmp byte [ebp + 0x14], 0
je 0x1002627f
mov eax, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp + 0x20], 0x31713b91
mov dword [ebp - 0x14], 0xfff8
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], 0x9d982735
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x58], eax
mov dword [ebp + 0x20], ebx
jmp 0x100258e9
push 1
lea ecx, [ebp - 0xd0]
call fcn.100152de
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0x3923ccde
mov dword [ebp - 0x1c], ebx
jmp 0x10025872
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0x9d4346
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1002585f
mov eax, dword [ebp + 0x20]
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x20]
cmp eax, ecx
mov eax, dword [ebp + 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xd0]
setle cl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xfffffffb
test eax, eax
jne 0x100258bc
cmp dword [ebp + 0x20], ebx
jne 0x100258bc
mov eax, ebx
jmp 0x100258bf
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov ecx, 0xc7d95faa
mov eax, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
call fcn.100230ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.10015361
dec dword [ebp + 0x20]
cmp dword [ebp + 0x20], 0xfffffff4
je 0x10025843
xor eax, eax
mov dword [ebp - 0x8c], 7
mov dword [ebp - 0x90], ebx
mov word [ebp - 0xa0], ax
push 2
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 1
call fcn.100152de
push 3
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 2
call fcn.100152de
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 0x30e7
cmp dword [ebp - 0x14], 0x32a5
jle 0x100259e8
push ebx
push 0xf9d
push 0x1204
push 0x1499
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp + 0x20], ebx
mov esi, ebx
mov edi, ebx
mov eax, esi
cdq
idiv edi
mov eax, dword [ebp - 0x18]
lea eax, [ecx + eax]
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x134]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002598f
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x134]
push ebx
push 1
call fcn.10015918
mov ecx, dword [ebp + 0x20]
inc edi
cmp edi, 0x37d3
jl 0x10025968
inc esi
cmp esi, 0x5506
jl 0x10025966
inc ecx
mov dword [ebp + 0x20], ecx
cmp ecx, 0x12eb
jl 0x10025964
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x5364
jl 0x1002595f
push 0xd32
push 0x376
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 3
lea ecx, [ebp - 0xe8]
call fcn.100152de
cmp dword [ebp - 0x14], 0x2fcb
jge 0x10025a09
push str.ixxuzciou_lfsl_bsdlmla_vmi_igsrvnhwc_jzobvavu_iorqkgner
call fcn.1004881f
pop ecx
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp + 0x20], eax
cmp dword [ebp + 0x20], 0xcf
jle 0x10025a62
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x17c]
or eax, esi
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025a3b
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x17c]
call fcn.10015918
inc edi
cmp edi, 0x1a14
jl 0x10025a1f
inc esi
cmp esi, 0x338f
jl 0x10025a1d
mov dword [ebp - 0x14], 0xfffffff8
cmp dword [ebp + 0x20], 0xfffffe2e
jge 0x10025a7d
push str.vbcpd_iqe_jexeq_rjtnrp_pxuqjocqe_lye
call fcn.1004881f
pop ecx
push ecx
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 4
push eax
sub esp, 0x14
mov dword [ebp + 0x20], 0xc248bdd0
lea eax, [ebp - 0x28]
push eax
push ecx
push ecx
call fcn.1002309f
add esp, 0x20
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xac]
push 0x1cb2
push 1
call fcn.100225af
add esp, 0x10
mov dword [ebp - 0x28], ebx
jmp 0x10025ad1
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10025abe
mov eax, dword [ebp - 0x68]
mov edi, 0xffff
mov dword [eax], 0xffffffec
cmp dword [eax], 0x1b
jg 0x10025cf5
mov dword [ebp - 0x30], 0x7689351f
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x5c], 0x486cae8e
mov dword [ebp - 0x24], 0x5f9ba4ae
mov dword [ebp - 0x30], 0xfffffffa
cmp dword [ebp - 0x30], 0xffffffe2
jle 0x10025ceb
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x14], 0x23ac
cmp dword [ebp - 0x14], 0x271e
jle 0x10025b81
mov esi, ebx
mov edi, ebx
mov dword [ebp + 0x20], 0x7f22
mov eax, edi
lea ecx, [ebp - 0x14c]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025b57
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x14c]
call fcn.10015918
add edi, esi
dec dword [ebp + 0x20]
jne 0x10025b3d
inc esi
cmp esi, 0x2c36
jl 0x10025b34
mov edi, 0xffff
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
cmp dword [ebp - 0x14], 0x21c9
jge 0x10025bad
push str.ayfo_xltk_jtmjuxus_osisrts_vqzmd_qin
call fcn.1004881f
pop ecx
push 2
pop eax
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xf4]
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x20], 0x856065d6
push eax
call fcn.100152de
push ecx
push ecx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0xf4]
call fcn.10023767
pop ecx
pop ecx
lea eax, [ebp - 0x68]
mov edx, 0x3db1
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xac]
push eax
push 0x5602
push 0x6796
lea eax, [ebp - 0x5c]
push 0x59f3
push eax
lea ecx, [ebp - 0x44]
call fcn.10023925
mov eax, dword [ebp - 0x30]
xor edx, edx
imul ecx, dword [ebp - 0x24], 0xa093
add esp, 0x24
mov esi, dword [ebp - 0xac]
mov eax, dword [ebp - 0x68]
mov dword [esi + 8], 1
cmp ecx, dword [eax]
setge dl
xor ecx, ecx
mov dword [ebp - 0xfc], edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x5c]
cmp eax, 0xffff0001
setl cl
lea eax, [ecx + 0x2551ad04]
mov ecx, dword [ebp - 0x30]
imul ecx, eax
test ecx, ecx
jne 0x10025c6d
cmp dword [esi + 8], ebx
jne 0x10025c6d
mov edx, ebx
jmp 0x10025c70
xor edx, edx
inc edx
mov eax, dword [ebp - 0xe8]
xor ecx, ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
mov dword [ebp + 0x20], ecx
mov eax, dword [ebp + 0x20]
cmp edi, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
cmp eax, ecx
setge dl
mov dword [ebp + 0x20], edx
xor edx, edx
mov eax, dword [ebp + 0x20]
cmp eax, 0xb61f
mov eax, dword [ebp - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 7
jne 0x10025cc6
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
mov eax, dword [eax]
mov dword [ebp + 0x20], eax
mov byte [ebp - 4], 4
call fcn.10015361
dec dword [ebp - 0x30]
jmp 0x10025b11
mov eax, dword [ebp - 0x68]
inc dword [eax]
jmp 0x10025ae5
lea ecx, [ebp - 0xe8]
call fcn.10015361
lea ecx, [ebp - 0xac]
call fcn.10015361
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 1
call fcn.10015361
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 0x20]
cmp edi, esi
ja 0x10025eb2
mov dword [ebp - 0x14], 1
mov dword [ebp + 0x20], 3
mov dword [ebp - 0x20], 0xf6e229ed
mov dword [ebp + 0x20], 0xfffffff7
mov dword [ebp - 0x24], 6
mov dword [ebp + 0x20], 0x7c769867
mov dword [ebp - 0x1c], 0x5719
cmp dword [ebp - 0x1c], 0x57a8
jle 0x10025dd2
mov edi, ebx
mov eax, ebx
mov dword [ebp + 0x20], ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x18], 0x480c
mov dword [ebp - 0x14], ecx
add eax, edi
xor eax, ecx
lea ecx, [ebp - 0x164]
cdq
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025d90
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x164]
call fcn.10015918
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x20]
add ecx, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x10025d74
inc esi
cmp esi, 0x67da
jl 0x10025d68
inc eax
mov dword [ebp + 0x20], eax
cmp eax, 0x45e5
jl 0x10025d66
inc edi
cmp edi, 0x60a5
jl 0x10025d61
mov dword [ebp + 0x20], 0x24b13b10
cmp dword [ebp - 0x1c], 0x5445
jge 0x10025ded
push str.nru_fkrn_jdnj_agoprhf_byympo
call fcn.1004881f
pop ecx
mov dword [ebp - 4], 1
mov dword [ebp + 0x20], ebx
jmp 0x10025e07
mov eax, dword [ebp + 0x20]
mov dword [ebp + eax*4 - 0x50], 0x99cfe04
inc dword [ebp + 0x20]
cmp dword [ebp + 0x20], 3
jl 0x10025df9
xor cl, cl
call fcn.100243a2
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x20]
cmp dword [ebp - 0x20], eax
je 0x10025e49
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
add eax, 0x3134d13b
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x50]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 0x20]
cmp eax, 0xeb47
setge dl
mov dword [ebp + 0x20], edx
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xa0]
cmp eax, ecx
je 0x10025e9f
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.10015af1
push ebx
push 1
lea ecx, [ebp - 0xa0]
call fcn.10015c21
jmp 0x10026292
mov dword [ebp + 0x20], 0x9841b3c6
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], 0x85ed0657
mov dword [ebp - 0x14], ebx
push 3
call fcn.100152de
mov byte [ebp - 4], 0xe
mov dword [ebp + 0x20], 0x168a
cmp dword [ebp + 0x20], 0x1859
jle 0x10025f16
mov esi, ebx
mov edi, esi
mov ebx, 0x249a
mov eax, edi
mov ecx, 0x10079cd8
cdq
push edx
push eax
call fcn.10015096
dec edi
dec ebx
jne 0x10025ef4
inc esi
cmp esi, 0x75e6
jl 0x10025eed
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xffff
mov byte [ebp - 4], 0xf
cmp dword [ebp + 0x20], 0x14b1
jge 0x10025f6f
mov edx, str.oxklzlwd_aycjcw_qhkxhrpd_evcih_pndv_decxxsnj_jfkge_exbevc_jlxuxftoc_ixjugre
mov ecx, 0x10079cd8
call fcn.1001996e
jmp 0x10025f6f
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x38], ebx
jmp 0x10025f89
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x80], 1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 1
jl 0x10025f7b
lea eax, [ebp - 0xb8]
push eax
lea edx, [ebp - 0x38]
call fcn.1002288b
pop ecx
mov dword [ebp + 0x20], ebx
jmp 0x10026010
push 4
lea ecx, [ebp - 0xc4]
call fcn.100152de
push 0x139
sub esp, 0xc
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0xc4]
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x10c], ebx
push eax
push ecx
push ebx
push ecx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x58], ebx
push ecx
call fcn.100225ee
mov eax, dword [ebp - 0xc4]
lea ecx, [ebp - 0xc4]
add esp, 0x24
mov byte [ebp - 4], 0xe
mov dword [eax + 0xc], 0xffffffea
call fcn.10015361
dec dword [ebp + 0x20]
cmp dword [ebp + 0x20], 0xffffffe8
jne 0x10025fa4
cmp dword [ebp + 0x20], ebx
je 0x1002607f
cmp dword [ebp - 0x18], ebx
jne 0x10026029
cmp dword [ebp + 0x20], ebx
jne 0x10026029
mov ecx, ebx
jmp 0x1002602c
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x86a0
setge al
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
test eax, eax
jne 0x1002604c
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x20]
mov eax, dword [ebp - 0x1c]
test eax, eax
mov eax, dword [ebp - 0x14]
sets dl
mov dword [ebp - 0x80], eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xb8]
setg cl
cmp ecx, dword [eax]
jne 0x1002607f
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jne 0x10026093
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x20], 0xffff0008
jmp 0x10026135
mov dword [ebp + 0x20], 0xefd
cmp dword [ebp + 0x20], 0xf4e
jle 0x100260fe
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x194]
push edx
push eax
call fcn.10001ac3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100260cb
mov eax, dword [eax]
push eax
call fcn.1004881f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x194]
call fcn.10015918
inc edi
cmp edi, 0x848
jl 0x100260b0
inc esi
cmp esi, 0x1ef8
jl 0x100260ae
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x2a], bl
cmp dword [ebp + 0x20], 0xce0
jge 0x10026115
push str.nmkevsj_fdcvj_xizjqt_qjauyrst_lgxx_ulrxm_jrrjrdlb_nqcnvszb_zptyut_prqwiqhsw_ofkt_poshmon_dbcj
call fcn.1004881f
pop ecx
push ecx
push ecx
lea eax, [ebp - 0x2a]
mov dword [ebp - 4], 0xe
push eax
push ebx
mov edx, 0x1f81
mov ecx, 0x3a1e
call fcn.100225af
add esp, 0x10
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.10015361
mov eax, edi
lea ecx, [ebp - 0xa0]
sub eax, esi
sar eax, 1
push eax
call fcn.1001aaaa
jmp 0x100261b7
push ecx
push ecx
mov dword [ebp - 0x3c], 0xcea5d6c0
lea ecx, [ebp - 0x3c]
call fcn.100244b6
pop ecx
pop ecx
mov dword [ebp - 0x3c], 0xfffffff4
jmp 0x10026198
lea eax, [ebp - 0x29]
mov byte [ebp - 0x29], bl
push eax
sub esp, 0xc
mov edx, 0x6c72
push 0x7947
push ecx
push 1
push ecx
push ecx
call fcn.100225ee
add esp, 0x24
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffffc
jne 0x10026174
mov ecx, esi
add esi, 2
call fcn.10022567
movzx eax, ax
lea ecx, [ebp - 0xa0]
push eax
call fcn.1001db60
cmp esi, edi
jb 0x10026158
push 2
lea ecx, [ebp - 0xdc]
call fcn.100152de
push 8
pop eax
mov byte [ebp - 4], 0x14
mov edx, 0x246a
mov dword [ebp - 0x78], eax
mov ecx, 0x646c
mov dword [ebp - 0x74], eax
push ebx
mov dword [ebp - 0x70], eax
push 1
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x34]
push 0x1542
push eax
lea eax, [ebp - 0xdc]
mov dword [ebp + 0x20], 0xb9dd952e
push eax
push 1
mov dword [ebp + 0x20], 0xfffffffd
push 0x430a
call fcn.10022951
add esp, 0x1c
mov dword [ebp - 0x34], ebx
jmp 0x10026228
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x7c], 0xfffffffe
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 1
jl 0x1002621a
mov dword [ebp - 0x78], 1
cmp dword [ebp - 0x78], ebx
jl 0x1002626b
mov ecx, dword [ebp - 0x78]
xor edx, edx
mov eax, dword [ebp - 0xdc]
cmp dword [eax + ecx*4], ebx
setne dl
mov dword [ebp - 0x7c], edx
mov dword [ebp + 0x20], edx
mov byte [ebp + 0x23], bl
cmp byte [ebp + 0x23], 0
je 0x10026266
mov edx, 0x2a6f
xor cl, cl
call fcn.100228d5
dec dword [ebp - 0x78]
jns 0x1002623a
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.10015361
jmp 0x10025e87
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x10026292
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret