Function at 0x401edf
Capabilities:
Create directory
Delete file
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d1c
call fcn.0041b470
push ebx
push esi
push edi
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x42f378
push edi
call esi
push 0x42f388
push edi
mov dword [0x43954c], eax
call esi
push 0x42f398
push edi
mov dword [0x439550], eax
call esi
mov ecx, dword [0x439550]
xor ebx, ebx
mov dword [0x439554], eax
cmp eax, ebx
mov eax, dword [0x43954c]
je 0x401f44
cmp eax, ebx
je 0x401f54
cmp ecx, ebx
jne 0x401f6c
jmp 0x401f50
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x439554], edx
cmp eax, ebx
jne 0x401f5e
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [0x43954c], eax
cmp ecx, ebx
jne 0x401f6c
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x439550], eax
push 0x63
lea eax, [ebp - 0x357]
push ebx
push eax
mov byte [ebp - 0x358], bl
call fcn.00416e30
add esp, 0xc
push 0x63
lea eax, [ebp - 0x2ef]
push ebx
push eax
mov byte [ebp - 0x2f0], bl
call fcn.00416e30
add esp, 0xc
mov edi, 0x103
push edi
lea eax, [ebp - 0x23f]
push ebx
push eax
mov byte [ebp - 0x240], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x987]
push ebx
push eax
mov byte [ebp - 0x988], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x87f]
push ebx
push eax
mov byte [ebp - 0x880], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0xda7]
push ebx
push eax
mov byte [ebp - 0xda8], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0xfb7]
push ebx
push eax
mov byte [ebp - 0xfb8], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0xb97]
push ebx
push eax
mov byte [ebp - 0xb98], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0xc9f]
push ebx
push eax
mov byte [ebp - 0xca0], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x16e7]
push ebx
push eax
mov byte [ebp - 0x16e8], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0xeaf]
push ebx
push eax
mov byte [ebp - 0xeb0], bl
call fcn.00416e30
add esp, 0xc
push edi
mov byte [ebp - 0x778], bl
push ebx
lea eax, [ebp - 0x777]
push eax
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x14d7]
push ebx
push eax
mov byte [ebp - 0x14d8], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x66f]
push ebx
push eax
mov byte [ebp - 0x670], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x567]
push ebx
push eax
mov byte [ebp - 0x568], bl
call fcn.00416e30
add esp, 0xc
push edi
lea eax, [ebp - 0x11c7]
push ebx
push eax
mov byte [ebp - 0x11c8], bl
call fcn.00416e30
add esp, 0xc
push 0xff
push str.gamevancelib32.dll
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call fcn.00409fae
lea esi, [edi + 1]
test al, al
je 0x402115
lea ebx, [ebp - 0x568]
call fcn.00404705
xor ebx, ebx
jmp 0x402123
push esi
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x42f274
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x568]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push str.grsclass
push str.gamerockstar
call dword [sym.imp.USER32.dll_FindWindowA]
neg eax
sbb eax, eax
neg eax
push edi
mov dword [0x43953c], eax
lea eax, [ebp - 0x45f]
push ebx
push eax
mov byte [ebp - 0x460], bl
call fcn.00416e30
add esp, 0xc
lea ebx, [ebp - 0x240]
call fcn.00404705
lea eax, [ebp - 0x988]
push eax
call fcn.004046b5
mov edi, dword [sym.imp.SHLWAPI.dll_StrNCatA]
pop ecx
push esi
push 0x42f274
lea eax, [ebp - 0x988]
push eax
call edi
push esi
push 0x42f31c
lea eax, [ebp - 0x988]
push eax
call edi
push esi
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
call fcn.00409e1d
test eax, eax
mov eax, ebx
je 0x4021ed
push 1
push eax
call fcn.004051aa
jmp 0x4021f6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.00409fae
mov edi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
test al, al
lea eax, [ebp - 0x240]
je 0x402223
push str.gamevance32.exe
push eax
mov ebx, 0x43c2cc
push ebx
lea eax, [ebp - 0x670]
push esi
push eax
call edi
jmp 0x40223d
push 0x42e158
push eax
push 0x43c2cc
lea eax, [ebp - 0x670]
push esi
push eax
call edi
mov ebx, 0x43c2cc
add esp, 0x14
call fcn.00409fae
test al, al
lea eax, [ebp - 0x240]
je 0x4022b9
push 0x437fb0
push eax
push ebx
lea eax, [ebp - 0xda8]
push esi
push eax
call edi
add esp, 0x14
push 0x437fc0
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0xb98]
push esi
push eax
call edi
add esp, 0x14
push 0x437fcc
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0xfb8]
push esi
push eax
call edi
add esp, 0x14
push 0x437fd8
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0xeb0]
push esi
push eax
call edi
lea eax, [ebp - 0x240]
jmp 0x40240e
push 0x438020
push eax
push ebx
lea eax, [ebp - 0x138]
push esi
push eax
call edi
add esp, 0x14
push 0x43805c
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x1b08]
push esi
push eax
call edi
add esp, 0x14
push 0x438068
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x18f8]
push esi
push eax
call edi
add esp, 0x14
push 0x438074
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x12d0]
push esi
push eax
call edi
add esp, 0x14
push 0x438044
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x1c10]
push esi
push eax
call edi
add esp, 0x14
push 0x438030
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x1a00]
push esi
push eax
call edi
add esp, 0x14
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0x1b08]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0x18f8]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0x1c10]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0x1a00]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0x12d0]
push eax
call fcn.0040a053
push 0x438020
lea eax, [ebp - 0x880]
push eax
push ebx
lea eax, [ebp - 0xda8]
push esi
push eax
call edi
add esp, 0x14
push 0x437fc0
lea eax, [ebp - 0x880]
push eax
push ebx
lea eax, [ebp - 0xb98]
push esi
push eax
call edi
add esp, 0x14
push 0x437fcc
lea eax, [ebp - 0x880]
push eax
push ebx
lea eax, [ebp - 0xfb8]
push esi
push eax
call edi
add esp, 0x14
push 0x437fd8
lea eax, [ebp - 0x880]
push eax
push ebx
lea eax, [ebp - 0xeb0]
push esi
push eax
call edi
lea eax, [ebp - 0x880]
add esp, 0x14
push 0x437fe4
push eax
push ebx
lea eax, [ebp - 0xca0]
push esi
push eax
call edi
add esp, 0x14
push 0x103
lea eax, [ebp - 0x10bf]
push 0
push eax
mov byte [ebp - 0x10c0], 0
call fcn.00416e30
add esp, 0xc
push 0x438014
lea eax, [ebp - 0x988]
push eax
push ebx
lea eax, [ebp - 0x16e8]
push esi
push eax
call edi
add esp, 0x14
push 0x438014
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x10c0]
push esi
push eax
call edi
add esp, 0x14
push str.gvun.exe
lea eax, [ebp - 0x240]
push eax
push ebx
lea eax, [ebp - 0x778]
push esi
push eax
call edi
add esp, 0x14
push 0x438080
lea eax, [ebp - 0x988]
push eax
push ebx
lea eax, [ebp - 0x14d8]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp - 0x10c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [ebp - 0x10c0]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0xda8]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0xfb8]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0xb98]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0xca0]
push eax
call fcn.0040a053
push 0
lea eax, [ebp - 0xeb0]
push eax
call fcn.0040a053
call fcn.00409fae
test al, al
je 0x402550
lea eax, [ebp - 0x138]
push eax
call fcn.004045c0
push 0x43c894
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402550
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.0040a053
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x568]
push eax
call fcn.00405117
test al, al
lea eax, [ebp - 0x568]
jne 0x4025cd
push eax
push 0x43c8a8
lea eax, [ebp - 0x460]
push esi
push eax
call fcn.00416f6e
add esp, 0x10
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x460]
push eax
call fcn.00405117
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.0040a053
push esi
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [0x439538], 1
jmp 0x4025dc
push esi
push eax
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x103
lea eax, [ebp - 0x17ef]
push 0
push eax
mov byte [ebp - 0x17f0], 0
call fcn.00416e30
add esp, 0xc
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x670]
push eax
call fcn.00404ff1
test al, al
jne 0x402674
lea eax, [ebp - 0x670]
push eax
push 0x43c8b4
lea eax, [ebp - 0x460]
push esi
push eax
call fcn.00416f6e
add esp, 0x10
push esi
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x17f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x460]
push eax
call fcn.00404ff1
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.0040a053
mov byte [0x439538], 1
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x778]
push eax
call fcn.00405084
test al, al
jne 0x4026d3
lea eax, [ebp - 0x778]
push eax
push 0x43c8b4
lea eax, [ebp - 0x460]
push esi
push eax
call fcn.00416f6e
add esp, 0x10
call fcn.004019f7
call fcn.004019f7
lea eax, [ebp - 0x460]
push eax
call fcn.00405084
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.0040a053
push str.Gamevance
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push ebx
lea eax, [ebp - 0x1d18]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1d18]
push eax
push 0x80000002
call dword [0x43954c]
push str.Gamevance
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Gamevance
push 1
push 0
push 0x43c8bc
push dword [ebp - 8]
call dword [0x439550]
lea eax, [ebp - 0x778]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x778]
push eax
push 1
push 0
push 0x43c8c8
push dword [ebp - 8]
call dword [0x439550]
lea eax, [ebp - 0x778]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x778]
push eax
push 1
push 0
push 0x43c8d8
push dword [ebp - 8]
call dword [0x439550]
push dword [ebp - 8]
call dword [0x439554]
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x43c8e4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], 5
test eax, eax
je 0x4027ae
push 0x439530
lea ecx, [ebp - 0x2c]
push ecx
push ecx
call eax
push 2
call fcn.0040a08c
test eax, eax
jne 0x40285b
inc eax
cmp dword [ebp - 0xc], 0
jne 0x4027c6
xor eax, eax
mov byte [ebp - 0x358], 0
test eax, eax
je 0x40285b
mov ecx, dword [0x439530]
mov eax, dword [ecx]
push 0
push 0x64
lea edx, [ebp - 0x358]
push edx
call dword [eax]
push 0x43c003
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402812
mov ecx, dword [0x439530]
mov eax, dword [ecx]
push 0
push 0x4382cc
call dword [eax + 4]
mov ecx, dword [0x439530]
mov eax, dword [ecx]
push 0
push 0x64
lea edx, [ebp - 0x2f0]
push edx
call dword [eax + 0x18]
lea eax, [ebp - 0x2f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x40285b
push 0x64
lea eax, [ebp - 0x2f0]
push eax
call fcn.00409fdc
mov ecx, dword [0x439530]
mov eax, dword [ecx]
push 0
lea edx, [ebp - 0x2f0]
push edx
call dword [eax + 0x1c]
lea eax, [ebp - 0x670]
push eax
push 0x43c8f8
lea eax, [ebp - 0x138]
push esi
push eax
call edi
add esp, 0x10
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [0x43954c]
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push 0
push dword [0x437f38]
push dword [ebp - 4]
call dword [0x439550]
push dword [ebp - 4]
call dword [0x439554]
call fcn.00409e1d
test eax, eax
je 0x402912
push 0x103
lea eax, [ebp - 0x137]
push 0
push eax
mov byte [ebp - 0x138], 0
call fcn.00416e30
add esp, 0xc
lea ebx, [ebp - 0x138]
call fcn.00404705
push esi
push 0x43c900
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
mov eax, ebx
push eax
call fcn.0040a68e
lea eax, [ebp - 0x240]
push eax
call fcn.0040a68e
mov ebx, 0x43c2cc
call fcn.00409e1d
test eax, eax
jne 0x402a64
lea eax, [ebp - 4]
push eax
push 0x43c910
push 0x80000002
call dword [0x43954c]
push dword [ebp - 4]
call dword [0x439554]
push 0x43c95c
push 0x43c910
push ebx
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.00416f6e
add esp, 0x14
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [0x43954c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.Gamevance
call ebx
push eax
push str.Gamevance
push 1
push 0
push 0
push dword [ebp - 4]
call dword [0x439550]
push dword [ebp - 4]
call dword [0x439554]
push 0x43c95c
push 0x43c984
lea eax, [ebp - 0x138]
push esi
push eax
call edi
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x80000000
call dword [0x43954c]
push str.Gamevance
call ebx
push eax
push str.Gamevance
push 1
push 0
push 0
push dword [ebp - 4]
call dword [0x439550]
push dword [ebp - 4]
call dword [0x439554]
push 0x43c95c
push 0x43c990
lea eax, [ebp - 0x138]
push esi
push eax
call fcn.00416f6e
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x138]
push eax
push 0x80000000
call dword [0x43954c]
lea eax, [ebp - 0x568]
push eax
call ebx
push eax
lea eax, [ebp - 0x568]
push eax
push 1
push 0
push 0
push dword [ebp - 4]
call dword [0x439550]
push 0x43c9a8
call ebx
push eax
push 0x43c9a8
push 1
push 0
push 0x43c9b4
push dword [ebp - 4]
call dword [0x439550]
push dword [ebp - 4]
call dword [0x439554]
jmp 0x402a6a
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call fcn.0040462f
push 0x4382cc
push str.locid
call fcn.004040e3
push str.HKABw11oGrCiUoZEuW0a
push str.ticket
call fcn.004040e3
push str.LILILILI
push str.lpid
call fcn.004041a5
call fcn.00401a31
and dword [ebp - 4], 0
cmp byte [0x439538], 0
jne 0x402b8b
push 0x207
lea eax, [ebp - 0x13cf]
push 0
push eax
mov byte [ebp - 0x13d0], 0
call fcn.00416e30
add esp, 0xc
lea eax, [ebp - 0x670]
push eax
push 0x43c9c4
lea eax, [ebp - 0x13d0]
push 0x208
push eax
call edi
push 0x44
pop ebx
push 0x10
xor edi, edi
lea eax, [ebp - 0x1c]
push edi
push eax
mov dword [ebp - 0x288], ebx
call fcn.00416e30
add esp, 0x1c
push ebx
lea eax, [ebp - 0x288]
push edi
push eax
call fcn.00416e30
add esp, 0xc
xor eax, eax
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x288]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
lea eax, [ebp - 0x13d0]
push eax
push edi
mov dword [ebp - 0x25c], 1
call dword [0x439500]
test eax, eax
jne 0x402b5c
mov dword [ebp - 4], edi
mov dword [0x439534], edi
jmp 0x402bdc
push 0x7d0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.grsclass
push str.gamerockstar
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x402bdc
push 0x21
pop eax
mov dword [ebp - 4], eax
mov dword [0x439534], eax
jmp 0x402bdc
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call dword [0x43954c]
lea eax, [ebp - 0x670]
push eax
call ebx
push eax
lea eax, [ebp - 0x670]
push eax
push 1
push 0
push 0x42e318
push dword [ebp - 0xc]
call dword [0x439550]
push dword [ebp - 0xc]
call dword [0x439554]
mov eax, dword [0x439530]
test eax, eax
je 0x402bdc
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x7c]
lea ebx, [ebp - 0x15e0]
call fcn.00404705
push 0x43c9d4
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, ebx
push eax
push 0x68
call fcn.00404541
pop ecx
pop ecx
call fcn.00409197
push 2
call fcn.0040a08c
xor ebx, ebx
test eax, eax
jne 0x402c44
mov eax, dword [0x439548]
cmp dword [0x43953c], ebx
je 0x402c28
mov ecx, dword [eax + 0x68]
mov eax, dword [eax + 4]
jmp 0x402c3b
cmp dword [ebp - 4], 0x20
jge 0x402c36
mov ecx, dword [eax + 0x74]
mov eax, dword [eax + 0xc]
jmp 0x402c3b
mov ecx, dword [eax + 0x70]
mov eax, ecx
push eax
push ecx
call fcn.0040613a
pop ecx
pop ecx
push esi
lea eax, [ebp - 0x12d0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
lea eax, [ebp - 0x12d0]
push eax
call fcn.0040a053
push 0x103
lea eax, [ebp - 0xa8f]
push ebx
push eax
mov byte [ebp - 0xa90], bl
call fcn.00416e30
add esp, 0xc
lea ebx, [ebp - 0xa90]
call fcn.00404705
push 0x43c9f4
mov eax, ebx
push esi
push eax
call fcn.004172c8
add esp, 0xc
push str.gvff.tmp
mov eax, ebx
push esi
push eax
call fcn.004172c8
add esp, 0xc
mov eax, ebx
push eax
call fcn.0040543e
movzx eax, byte [0x439538]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 2
pop ebx
leave
ret