Function at 0x40f1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x90
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], esi
call fcn.0040f050
mov eax, dword [esp + 0xa8]
push eax
call fcn.0040f0e0
mov edx, dword [esp + 0xa8]
mov ecx, dword [0x2544114]
add esp, 4
cmp edx, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], esi
mov eax, 1
jbe 0x40f295
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], eax
mov ecx, 8
mov eax, 0x2544110
cmp edx, dword [eax]
jbe 0x40f214
sub eax, 4
dec ecx
cmp eax, 0x25440f0
jge 0x40f205
inc ecx
cmp ecx, 9
jge 0x40f25c
mov edi, 9
mov edx, 0x25440e0
mov eax, 0x2544114
sub edi, ecx
mov esi, dword [eax - 4]
mov dword [eax], esi
lea esi, [edx - 0x10]
mov ebx, esi
add eax, 0xfffffffc
dec edi
mov ebp, dword [ebx]
mov dword [edx], ebp
mov ebp, dword [ebx + 4]
mov dword [edx + 4], ebp
mov ebp, dword [ebx + 8]
mov dword [edx + 8], ebp
mov ebx, dword [ebx + 0xc]
mov dword [edx + 0xc], ebx
mov edx, esi
jne 0x40f22b
mov edx, dword [esp + 0xa4]
xor esi, esi
mov eax, dword [0x43fde0]
mov dword [ecx*4 + 0x25440f0], edx
mov edx, ecx
mov dword [esp + 0x54], ecx
shl edx, 4
add edx, 0x2544050
mov dword [esp + 0x14], esi
mov dword [edx], eax
mov eax, dword [0x43fde4]
mov dword [edx + 4], eax
mov eax, dword [0x43fde8]
mov dword [edx + 8], eax
mov eax, dword [0x43fdec]
mov dword [edx + 0xc], eax
push esi
mov dword [esp + 0x40], 0x3da3d70a
mov dword [esp + 0x44], 0x3cda6613
mov dword [esp + 0x48], 0xbcda6613
mov dword [esp + 0x4c], 0x3d5a708f
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0xbd5a708f
call fcn.0040bed0
add esp, 4
mov esi, 3
mov ebx, 0x25440f0
mov edi, 0x2544050
push esi
push 7
push 0xffff
push 0x10
push edi
call fcn.0040bfa0
push esi
push 0x17
push 0xffff
push 0xa
push 0x43fdd4
call fcn.0040bfa0
mov edx, dword [ebx]
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.00409260
mov ebp, eax
mov eax, 0x21
sub eax, ebp
push esi
push eax
push 0xffff00
lea ecx, [esp + 0x6c]
push ebp
push ecx
call fcn.0040bfa0
add esp, 0x44
add edi, 0x10
add ebx, 4
inc esi
lea edx, [esi - 3]
cmp edx, 0xa
jl 0x40f2dd
push 1
push 0xf
push 0xff0000
push 0xb
push 0x43fdc8
call fcn.0040bfa0
push 2
push 7
push 0xff
push 0x1a
push 0x43e140
call fcn.0040bfa0
mov esi, dword [esp + 0xd0]
add esp, 0x28
push 2
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
push 0xd
push 7
push 0xff
push 0x1a
push 0x43e140
call fcn.0040bfa0
add esp, 0x28
push 0xd
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
push 0x3e99999a
push 0x3f333333
push 0xbec90fdb
push 0x3f490fdb
call fcn.0040e3c0
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
call fcn.0040c290
mov eax, dword [esp + 0x5c]
add esp, 0x3c
cmp eax, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], esi
je 0x40f417
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x30]
push eax
mov edx, dword [ecx*4 + 0x25440f0]
push edx
call fcn.00409260
add esp, 8
mov ebp, eax
mov dword [0x44fb44], 1
mov dword [esp + 0x24], 0
call fcn.0040eff0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40f6b1
mov eax, dword [0x2543970]
mov ecx, dword [esp + 0x5c]
lea edx, [ecx + eax*4]
add eax, edx
and eax, 0x7ff
mov dword [esp + 0x5c], eax
fld dword [eax*8 + 0x253c198]
fadd dword [0x43a280]
fmul dword [0x43a2ac]
fadd dword [0x43a2ec]
call fcn.00430d2c
mov ebx, eax
mov eax, dword [esp + 0x54]
lea edi, [eax + 3]
shl eax, 4
push edi
push 7
lea eax, [eax + 0x2544050]
push 0xffffff
push 0x10
push eax
mov dword [esp + 0x24], eax
call fcn.0040bfa0
push edi
push 0x17
push 0xffffff
push 0xa
push 0x43fdd4
call fcn.0040bfa0
mov esi, ebx
mov eax, 0x21
shl esi, 8
add esi, ebx
sub eax, ebp
shl esi, 8
add esi, ebx
push edi
mov dword [esp + 0x48], eax
push eax
push esi
lea eax, [esp + 0x64]
push ebp
push eax
call fcn.0040bfa0
mov ecx, dword [esp + 0x50]
push edi
add ecx, 7
push ecx
push esi
push 1
push 0x43fdc4
call fcn.0040bfa0
mov edx, dword [0x2543970]
mov eax, dword [esp + 0x68]
imul edx, dword [esp + 0x78]
add eax, edx
add esp, 0x50
cmp eax, 0x7c0
mov dword [esp + 0x18], eax
jle 0x40f972
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], 0x7c0
test eax, eax
jne 0x40f524
call fcn.00409430
mov dword [esp + 0x2c], 1
call fcn.004094d0
mov ebx, eax
test ebx, ebx
je 0x40f972
cmp ebx, 0x30
jb 0x40f53d
cmp ebx, 0x39
jbe 0x40f556
cmp ebx, 0x41
jb 0x40f547
cmp ebx, 0x5a
jbe 0x40f556
cmp ebx, 0x61
jb 0x40f551
cmp ebx, 0x7a
jbe 0x40f556
cmp ebx, 0x20
jne 0x40f578
mov esi, dword [esp + 0x14]
cmp esi, 0x10
jae 0x40f5b5
mov eax, dword [esp + 0x10]
inc esi
push 0x15
mov dword [esp + 0x18], esi
mov byte [eax + esi - 1], bl
call fcn.0040aea0
add esp, 4
jmp 0x40f5b5
cmp ebx, 8
je 0x40f5bc
cmp ebx, 0x1b
je 0x40f5b1
cmp ebx, 0xd
je 0x40f5b1
mov eax, dword [esp + 0x14]
cmp eax, 0x10
jae 0x40f972
mov ecx, dword [esp + 0x10]
inc eax
push 0x15
mov dword [esp + 0x18], eax
mov byte [ecx + eax - 1], 0x7e
call fcn.0040aea0
add esp, 4
jmp 0x40f972
mov esi, dword [esp + 0x14]
cmp ebx, 8
jne 0x40f5e4
jmp 0x40f5c0
mov esi, dword [esp + 0x14]
test esi, esi
jbe 0x40f972
mov edx, dword [esp + 0x10]
dec esi
push 0x15
mov dword [esp + 0x18], esi
mov byte [edx + esi], 0x2e
call fcn.0040aea0
add esp, 4
jmp 0x40f972
cmp ebx, 0x1b
jne 0x40f612
test esi, esi
jne 0x40f972
push 0x16
call fcn.0040aea0
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], eax
jmp 0x40f972
cmp ebx, 0xd
jne 0x40f972
mov edx, dword [esp + 0x10]
mov eax, 0xf
mov cl, byte [edx + eax]
cmp cl, 0x20
je 0x40f631
cmp cl, 0x2e
jne 0x40f638
mov byte [edx + eax], 0x2e
dec eax
jns 0x40f624
cmp eax, 0xffffffff
je 0x40f6a4
push 0x16
call fcn.0040aea0
call fcn.00409430
mov eax, dword [esp + 0xac]
mov dword [esp + 0x24], 0
push eax
call fcn.0040f110
mov ecx, dword [esp + 0x18]
push edi
push 7
push 0xffff
push 0x10
push ecx
call fcn.0040bfa0
push edi
push 0x17
push 0xffff
push 0xa
push 0x43fdd4
call fcn.0040bfa0
mov edx, dword [esp + 0x4c]
push edi
push edx
push 0xffff00
lea eax, [esp + 0x6c]
push ebp
push eax
call fcn.0040bfa0
add esp, 0x44
jmp 0x40f972
mov dword [esp + 0x14], 0
jmp 0x40f972
mov ecx, dword [0x2543970]
mov eax, dword [esp + 0x18]
imul ecx, dword [esp + 0x28]
add eax, ecx
cmp eax, 0x7c0
mov dword [esp + 0x18], eax
jle 0x40f96a
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x40f6e6
call fcn.00409430
mov dword [esp + 0x2c], 1
call fcn.00409460
mov esi, eax
cmp esi, 0x1b
mov dword [esp + 0x1c], esi
je 0x40f700
cmp esi, 8
je 0x40f700
cmp esi, 0xd
jne 0x40f712
push 0x16
call fcn.0040aea0
add esp, 4
mov dword [esp + 0x28], 0xfffffffc
cmp esi, 0x100
jbe 0x40f74c
cmp esi, dword [0x25b6114]
je 0x40f74c
cmp esi, dword [0x25b6110]
je 0x40f74c
cmp esi, dword [0x25b6118]
je 0x40f74c
cmp esi, dword [0x25b611c]
je 0x40f74c
push 0x16
call fcn.0040aea0
add esp, 4
mov dword [esp + 0x28], 0xfffffffc
cmp esi, 0x25
je 0x40f76a
cmp esi, 0x28
je 0x40f76a
cmp esi, dword [0x25b6118]
je 0x40f76a
cmp esi, dword [0x25b6114]
jne 0x40f856
push 0x15
call fcn.0040aea0
mov eax, dword [esp + 0xac]
add esp, 4
dec eax
mov dword [esp + 0xa8], eax
jns 0x40f794
mov edx, dword [0x25b4450]
add eax, edx
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0xa8]
push eax
call fcn.0040f0e0
add esp, 4
mov esi, 3
mov ebx, 0x25440f0
mov edi, 0x2544050
push esi
push 7
push 0xffff
push 0x10
push edi
call fcn.0040bfa0
push esi
push 0x17
push 0xffff
push 0xa
push 0x43fdd4
call fcn.0040bfa0
mov edx, dword [ebx]
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.00409260
mov ebp, eax
mov eax, 0x21
sub eax, ebp
push esi
push eax
push 0xffff00
lea ecx, [esp + 0x6c]
push ebp
push ecx
call fcn.0040bfa0
add esp, 0x44
add edi, 0x10
add ebx, 4
inc esi
lea edx, [esi - 3]
cmp edx, 0xa
jl 0x40f7b3
mov esi, dword [esp + 0xa8]
push 2
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
add esp, 0x14
push 0xd
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
mov esi, dword [esp + 0x30]
add esp, 0x14
cmp esi, 0x27
je 0x40f874
cmp esi, 0x26
je 0x40f874
cmp esi, dword [0x25b611c]
je 0x40f874
cmp esi, dword [0x25b6110]
jne 0x40f960
push 0x15
call fcn.0040aea0
mov eax, dword [esp + 0xac]
mov ecx, dword [0x25b4450]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0xa8], eax
jne 0x40f8a2
mov dword [esp + 0xa8], 0
mov eax, dword [esp + 0xa8]
push eax
call fcn.0040f0e0
add esp, 4
mov esi, 3
mov ebx, 0x25440f0
mov edi, 0x2544050
push esi
push 7
push 0xffff
push 0x10
push edi
call fcn.0040bfa0
push esi
push 0x17
push 0xffff
push 0xa
push 0x43fdd4
call fcn.0040bfa0
mov edx, dword [ebx]
lea ecx, [esp + 0x58]
push ecx
push edx
call fcn.00409260
mov ebp, eax
mov eax, 0x21
sub eax, ebp
push esi
push eax
push 0xffff00
lea ecx, [esp + 0x6c]
push ebp
push ecx
call fcn.0040bfa0
add esp, 0x44
add edi, 0x10
add ebx, 4
inc esi
lea edx, [esi - 3]
cmp edx, 0xa
jl 0x40f8c1
mov esi, dword [esp + 0xa8]
push 2
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
add esp, 0x14
push 0xd
push 0xf
push 0xffffff
push 0xb
push esi
call fcn.0040f140
add esp, 4
push eax
call fcn.0040bfa0
add esp, 0x14
mov dword [esp + 0x18], 0x7c0
jmp 0x40f972
test eax, eax
jl 0x40ff75
mov eax, dword [esp + 0x18]
sar eax, 3
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fstp dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
push eax
push eax
push eax
call fcn.0040c1d0
mov ecx, dword [0x2543970]
mov edx, dword [esp + 0x64]
add esp, 0xc
xor edi, edi
lea esi, [edx + ecx*4]
mov dword [esp + 0x58], esi
and esi, 0x7ff
lea eax, [edi + 0xf]
push 1
push eax
fld dword [esi*8 + 0x253c198]
fadd dword [0x43a280]
fmul dword [0x43a2ac]
fadd dword [0x43a2ec]
call fcn.00430d2c
mov ecx, eax
mov edx, 0xff0000
shl ecx, 8
sub ecx, eax
shl ecx, 8
sub edx, ecx
push edx
call fcn.0040c030
add esp, 0xc
add esi, 0x190
inc edi
cmp edi, 0xb
jl 0x40f9a7
mov eax, dword [0x2543970]
mov ecx, dword [esp + 0x60]
lea eax, [ecx + eax*2]
and eax, 0x7ff
mov dword [esp + 0x60], eax
fld dword [eax*8 + 0x253c198]
fadd dword [0x43a280]
fmul dword [0x43a2e8]
fadd dword [0x43a2ec]
call fcn.00430d2c
mov esi, eax
mov eax, dword [esp + 0x20]
push 0xe
push 0xc
test eax, eax
push 0xff0000
push 0xf
je 0x40fa62
push 0x43fdb4
call fcn.0040bfa0
mov edx, esi
push 0xe
shl edx, 8
add edx, esi
shl edx, 8
add edx, esi
push edx
call fcn.0040bff0
add esp, 0x1c
jmp 0x40fa6f
push 0x43fda4
call fcn.0040bfa0
add esp, 0x14
call fcn.00406080
test eax, eax
je 0x40f429
xor ebx, ebx
push ebx
call fcn.00405a20
mov eax, dword [0x44f2bc]
add esp, 4
cmp eax, ebx
je 0x40fb17
mov esi, dword [esp + 0x18]
push 1
sar esi, 4
call fcn.004059f0
mov eax, dword [0x2543970]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x94], eax
add esp, 4
fild qword [esp + 0x90]
fmul dword [0x43a2e4]
fadd dword [esp + 0x24]
fst dword [esp + 0x24]
fcomp dword [0x43a280]
fnstsw ax
test ah, 0x41
jne 0x40fae8
fld dword [esp + 0x24]
fsub dword [0x43a280]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
mov ecx, esi
shl ecx, 8
add ecx, esi
shl ecx, 8
fchs
fstp dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add ecx, esi
push ecx
push 0x40400000
push 0x40400000
push eax
push eax
call fcn.0040e410
add esp, 0x14
push 5
call fcn.004059f0
push 1
call fcn.00405a60
mov edx, dword [esp + 0x20]
sar edx, 6
push edx
call fcn.0040bf80
push ebx
call fcn.00405a60
push 3
call fcn.004059f0
mov eax, dword [0x2543970]
mov esi, dword [esp + 0x78]
lea ecx, [esp + 0x7c]
lea eax, [eax + eax*2]
push ecx
shr eax, 1
add esi, eax
mov dword [esp + 0x7c], esi
call fcn.004012b0
lea edx, [esp + 0x80]
push esi
push edx
call fcn.00401400
lea eax, [esp + 0x88]
push 0x190
push eax
call fcn.004012f0
mov edx, dword [0x2583250]
lea ecx, [esp + 0x90]
push ecx
push edx
call fcn.00401610
mov eax, dword [0x2581e78]
push 0x3da3d70a
push 0x3d449ba6
push 0x3d0f5c29
push eax
call fcn.0040c390
mov edx, dword [0x2583250]
add esp, 0x40
lea ecx, [esp + 0x68]
push 0x3da3d70a
push 0x3d449ba6
push 0x3d0f5c29
push ecx
push edx
push 0x3ecccccd
call fcn.0040e750
lea eax, [esp + 0x80]
push eax
call fcn.004012b0
mov ecx, 0xc8
lea edx, [esp + 0x84]
sub ecx, esi
push ecx
push edx
call fcn.00401400
lea eax, [esp + 0x8c]
push 0x190
push eax
call fcn.004012f0
mov edx, dword [0x2583250]
lea ecx, [esp + 0x94]
push ecx
push edx
call fcn.00401610
mov eax, dword [0x2581e78]
push 0x3da3d70a
push 0x3d449ba6
push 0xbd0f5c29
push eax
call fcn.0040c390
mov edx, dword [0x2583250]
add esp, 0x44
lea ecx, [esp + 0x68]
push 0x3da3d70a
push 0x3d449ba6
push 0xbd0f5c29
push ecx
push edx
push 0x3ecccccd
call fcn.0040e750
push 1
call fcn.00405a20
lea eax, [esp + 0x84]
push eax
call fcn.004012b0
lea ecx, [esp + 0x88]
push esi
push ecx
call fcn.00401400
mov edi, esi
lea edx, [esp + 0x90]
shr edi, 1
push edi
push edx
call fcn.004012f0
mov ecx, dword [0x25842ec]
lea eax, [esp + 0x98]
push eax
push ecx
call fcn.00401610
mov edx, dword [0x2543970]
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd0], edx
add esp, 0x38
fild qword [esp + 0x98]
lea ecx, [esp + 0x48]
mov edx, 3
fmul dword [0x43a2e0]
fld st(0)
fadd dword [ecx]
fst dword [esp + 0x10]
fstp dword [ecx]
fld dword [esp + 0x10]
fcomp qword [0x43a2d8]
fnstsw ax
test ah, 0x41
jne 0x40fcf9
fld dword [esp + 0x10]
fsub dword [0x43a2d0]
fstp dword [ecx]
add ecx, 4
dec edx
jne 0x40fcd2
lea ecx, [esp + 0x3c]
mov edx, 3
fld dword [ecx]
fsub st(1)
fst dword [esp + 0x10]
fstp dword [ecx]
fld dword [esp + 0x10]
fcomp qword [0x43a2c8]
fnstsw ax
test ah, 1
je 0x40fd2f
fld dword [esp + 0x10]
fadd dword [0x43a2d0]
fstp dword [ecx]
add ecx, 4
dec edx
jne 0x40fd08
mov ebx, dword [esp + 0x3c]
mov eax, dword [0x257de50]
push 0x3dcccccd
push ebx
push 0x3da3d70a
push eax
fstp st(0)
call fcn.0040c390
mov ecx, dword [esp + 0x50]
mov edx, dword [0x257de50]
push 0x3dcccccd
push ecx
push 0x3da3d70a
push edx
call fcn.0040c390
mov eax, dword [esp + 0x64]
mov ecx, dword [0x257de50]
push 0x3dcccccd
push eax
push 0x3da3d70a
push ecx
call fcn.0040c390
mov edx, dword [esp + 0x78]
mov eax, dword [0x257de50]
push 0x3dcccccd
push edx
push 0xbda3d70a
push eax
call fcn.0040c390
mov ecx, dword [esp + 0x8c]
mov edx, dword [0x257de50]
add esp, 0x40
push 0x3dcccccd
push ecx
push 0xbda3d70a
push edx
call fcn.0040c390
mov eax, dword [esp + 0x60]
mov ecx, dword [0x257de50]
push 0x3dcccccd
push eax
push 0xbda3d70a
push ecx
call fcn.0040c390
mov eax, dword [0x25842ec]
push 0x3dcccccd
push ebx
lea edx, [esp + 0x90]
push 0x3da3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
mov ecx, dword [esp + 0x78]
mov eax, dword [0x25842ec]
push 0x3dcccccd
push ecx
lea edx, [esp + 0xa8]
push 0x3da3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
mov ecx, dword [esp + 0x94]
mov eax, dword [0x25842ec]
add esp, 0x50
lea edx, [esp + 0x68]
push 0x3dcccccd
push ecx
push 0x3da3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
mov ecx, dword [esp + 0x60]
mov eax, dword [0x25842ec]
push 0x3dcccccd
push ecx
lea edx, [esp + 0x88]
push 0xbda3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
mov ecx, dword [esp + 0x7c]
mov eax, dword [0x25842ec]
push 0x3dcccccd
push ecx
lea edx, [esp + 0xa0]
push 0xbda3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
mov ecx, dword [esp + 0x98]
mov eax, dword [0x25842ec]
add esp, 0x48
lea edx, [esp + 0x68]
push 0x3dcccccd
push ecx
push 0xbda3d70a
push edx
push eax
push 0x3f000000
call fcn.0040e750
lea ecx, [esp + 0x80]
push ecx
call fcn.004012b0
lea edx, [esp + 0x84]
push esi
push edx
call fcn.00401400
lea eax, [esp + 0x8c]
push edi
push eax
call fcn.004012f0
mov edx, dword [0x257de0c]
lea ecx, [esp + 0x94]
push ecx
push edx
call fcn.00401610
mov eax, dword [0x2581fd8]
push 0x3e0f5c29
push 0xbdc28f5c
push 0x3da3d70a
push eax
call fcn.0040c390
mov edx, dword [0x257de14]
add esp, 0x44
lea ecx, [esp + 0x68]
push ecx
push edx
call fcn.00401610
mov eax, dword [0x2581fe0]
push 0x3e0f5c29
push 0xbdc28f5c
push 0xbda3d70a
push eax
call fcn.0040c390
push 1
call fcn.00405a60
push 6
call fcn.004059f0
call fcn.0040e9a0
push 0
call fcn.00405a60
add esp, 0x24
call fcn.00406110
jmp 0x40f429
mov eax, dword [esp + 0x38]
xor esi, esi
cmp eax, esi
je 0x40ff84
call fcn.0040f030
mov dword [0x44fb44], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x90
ret