Function at 0x44e160
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10560
call fcn.004b9d80
push ebx
push esi
mov esi, dword [0x4e7de0]
xor ebx, ebx
push edi
mov dword [ebp - 0x14], esi
cmp esi, ebx
jne 0x44e1af
cmp dword [0x4ea190], 1
mov edi, dword [ebp + 8]
sete al
test al, al
sete al
movzx ecx, al
push ecx
mov dword [0x4ea190], ebx
call fcn.00449930
lea esp, [ebp - 0x1056c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4e7e3c]
mov edx, dword [0x4e7e38]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x855c]
xor ecx, ecx
mov dword [0x4ea1c4], eax
mov eax, dword [0x4e7e34]
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [0x4ea190], ebx
mov word [ebp - 0x855c], cx
mov word [ebp - 0x1055c], dx
mov dword [0x4ea1c8], ebx
mov dword [0x4ea1bc], 1
mov word [0x4ea1c0], cx
mov dword [0x4ea1cc], 0x3fff
mov dword [ebp - 0x10], eax
movzx eax, word [eax]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 6], cl
cmp ax, bx
je 0x44e39c
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x44e230
movzx edi, ax
test edi, 0xffffff80
jne 0x44e24e
push 2
push edi
call dword [sym.imp.MSVCR100.dll__isctype]
add esp, 8
cmp eax, ebx
je 0x44e24e
and edi, 0xffffffdf
movzx eax, di
add eax, 0xffffffd6
cmp eax, 0x2c
ja case.0x44e264.43
movzx edx, byte [eax + 0x44edc0]
jmp dword [edx*4 + 0x44ed94]
push ebx
push 1
mov ecx, esi
call fcn.00401220
lea edx, [eax + 2]
jmp 0x44e280
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44e280
sub eax, edx
sar eax, 1
je case.0x44e264.43
push ebx
push 1
mov ecx, esi
call fcn.00401220
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x44e2a2
sub eax, edx
sar eax, 1
mov dword [0x4ea1c8], eax
cmp eax, 0x3fff
jle 0x44e2c7
mov eax, 0x3fff
mov dword [0x4ea1c8], eax
push eax
push ebx
push 1
mov ecx, esi
call fcn.00401220
push eax
lea eax, [ebp - 0x855c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
xor eax, eax
jmp 0x44e2f0
movzx ecx, word [ebp + eax - 0x855c]
mov word [ebp + eax - 0x1055c], cx
add eax, 2
cmp cx, bx
jne 0x44e2f0
jmp case.0x44e264.43
mov byte [0x4ea1bc], bl
jmp case.0x44e264.43
mov byte [0x4ea1bd], 1
jmp case.0x44e264.43
mov byte [0x4ea1be], 1
jmp case.0x44e264.43
mov byte [0x4ea1bf], 1
jmp case.0x44e264.43
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.MSVCR100.dll__wtoi]
add esp, 4
mov dword [0x4ea1cc], eax
cmp eax, 0x3fff
jle case.0x44e264.43
mov dword [0x4ea1cc], 0x3fff
jmp case.0x44e264.43
mov esi, dword [ebp - 0xc]
call fcn.00426960
fmul qword [0x4de800]
call fcn.004b9c20
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jmp case.0x44e264.43
mov byte [0x4ea1c0], 1
jmp case.0x44e264.43
mov byte [0x4ea1c1], 1
jmp case.0x44e264.43
mov byte [ebp - 6], 1
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], 2
add eax, 2
mov dword [ebp - 0x10], eax
movzx eax, word [eax]
cmp ax, bx
jne 0x44e230
push 0xff
lea edx, [ebp - 0x35b]
push ebx
push edx
mov byte [ebp - 0x35c], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0x55b]
push ebx
push eax
mov byte [ebp - 0x55c], bl
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x20]
xor ecx, ecx
add esp, 0xc
mov word [ebp - 0x16], cx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], eax
cmp word [eax], bx
je 0x44e51e
mov eax, dword [ebp - 0x10]
xor edx, edx
mov word [ebp - 0x18], dx
movzx ecx, word [eax]
mov eax, ecx
sub eax, 0x7b
je 0x44e43b
sub eax, 2
je 0x44e50b
cmp byte [ebp - 6], dl
je 0x44e413
inc dword [ebp - 0xc]
jmp 0x44e50b
push 0
mov word [ebp - 0x18], cx
mov byte [ebp - 5], dl
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
lea ecx, [ebp - 5]
push 1
push ecx
lea eax, [ebp - 0x18]
call fcn.0041c480
add esp, 0xc
mov bl, al
jmp 0x44e4d2
mov ebx, dword [ebp - 0x10]
lea edi, [ebx + 2]
push 0x7d
push edi
call dword [sym.imp.MSVCR100.dll_wcschr]
mov esi, eax
add esp, 8
test esi, esi
je 0x44e50b
sub eax, ebx
sar eax, 1
dec eax
jne 0x44e46e
cmp word [esi + 2], 0x7d
jne 0x44e50b
add esi, 2
jmp 0x44e473
cmp eax, 1
jne 0x44e488
cmp byte [ebp - 6], 0
je 0x44e481
inc dword [ebp - 0xc]
jmp 0x44e50b
mov dx, word [edi]
mov word [ebp - 0x18], dx
xor eax, eax
push eax
mov word [esi], ax
mov byte [ebp - 5], al
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
lea ecx, [ebp - 5]
push 1
push ecx
mov eax, edi
call fcn.0041c480
mov bl, al
add esp, 0xc
test bl, bl
jne 0x44e4c7
mov eax, edi
call fcn.0041c3c0
movzx eax, ax
test ax, ax
je 0x44e4c7
mov edx, eax
mov byte [ebp + edx - 0x55c], 1
mov eax, 0x7d
mov word [esi], ax
mov dword [ebp - 0x10], esi
test bl, bl
je 0x44e50b
movzx esi, bl
or byte [ebp + esi - 0x35c], 1
cmp word [ebp - 0x18], 0
lea esi, [ebp + esi - 0x35c]
je 0x44e50b
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_IsCharAlphaW]
test eax, eax
jne 0x44e50b
test byte [ebp - 5], 0x30
je 0x44e508
or byte [esi], 2
jmp 0x44e50b
or byte [esi], 4
mov eax, dword [ebp - 0x10]
add eax, 2
cmp word [eax], 0
mov dword [ebp - 0x10], eax
jne 0x44e3ea
mov eax, dword [ebp - 0xc]
mov dword [0x4ea19c], 0x4bd2c4
test eax, eax
je 0x44e5a8
lea eax, [eax + eax + 2]
call fcn.004b9db0
mov esi, dword [ebp - 0x20]
mov eax, esp
mov dword [0x4ea19c], eax
cmp word [esi], 0
mov ebx, eax
je 0x44e5a3
lea ebx, [ebx]
movzx ecx, word [esi]
mov eax, ecx
sub eax, 0x7b
je 0x44e567
sub eax, 2
je 0x44e59a
mov word [ebx], cx
add ebx, 2
jmp 0x44e59a
lea edi, [esi + 2]
push 0x7d
push edi
call dword [sym.imp.MSVCR100.dll_wcschr]
add esp, 8
test eax, eax
je 0x44e59a
cmp eax, edi
jne 0x44e588
cmp word [eax + 2], 0x7d
jne 0x44e588
add eax, 2
add esi, 4
cmp eax, esi
jne 0x44e598
mov dx, word [edi]
mov word [ebx], dx
add ebx, 2
mov esi, eax
add esi, 2
cmp word [esi], 0
jne 0x44e550
xor eax, eax
mov word [ebx], ax
mov ecx, dword [ebp - 0x24]
mov dword [0x4ea1ac], 0
cmp word [ecx], 0
je 0x44e782
cmp dword [0x4ea1a8], 0
mov esi, dword [sym.imp.MSVCR100.dll_malloc]
jne 0x44e60e
push 0x1000
call esi
add esp, 4
mov dword [0x4ea1a8], eax
test eax, eax
jne 0x44e604
mov ecx, dword [ebp + 8]
push 0x4bd2c4
push 0
push 0x4bd2fc
call fcn.00449ae0
lea esp, [ebp - 0x1056c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x4ea1b0], 0x400
mov ebx, dword [ebp + 8]
mov edi, 3
mov ecx, ebx
call fcn.0043cc30
inc eax
cmp eax, dword [0x4ea1b8]
jbe 0x44e68d
mov dword [0x4ea1b8], eax
cmp eax, 0x1000
ja 0x44e63c
mov dword [0x4ea1b8], 0x1000
mov eax, dword [0x4ea1b4]
test eax, eax
je 0x44e64f
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov edx, dword [0x4ea1b8]
lea eax, [edx + edx]
push eax
call esi
add esp, 4
mov dword [0x4ea1b4], eax
test eax, eax
jne 0x44e692
push 0x4bd2c4
push eax
push 0x4bd2fc
mov ecx, ebx
mov dword [0x4ea1b8], eax
call fcn.00449ae0
lea esp, [ebp - 0x1056c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x4ea1b4]
mov ecx, dword [0x4ea1ac]
mov edx, dword [0x4ea1a8]
mov edi, dword [ebp - 0x24]
mov dword [edx + ecx*4], eax
cmp word [edi], 0
mov esi, dword [0x4ea1b4]
je 0x44e762
mov ebx, dword [sym.imp.MSVCR100.dll_realloc]
lea ebx, [ebx]
movzx eax, word [edi]
cmp eax, 0x2c
je 0x44e6d3
mov word [esi], ax
add esi, 2
jmp 0x44e755
cmp word [edi + 2], 0x2c
jne 0x44e6ea
mov eax, 0x2c
mov word [esi], ax
add esi, 2
add edi, 2
jmp 0x44e755
xor ecx, ecx
mov word [esi], cx
mov ecx, dword [0x4ea1a8]
mov eax, dword [0x4ea1ac]
mov edx, dword [ecx + eax*4]
cmp word [edx], 0
je 0x44e71f
inc eax
mov dword [0x4ea1ac], eax
add esi, 2
mov dword [ecx + eax*4], esi
xor eax, eax
mov word [esi], ax
mov eax, dword [0x4ea1ac]
mov ecx, dword [0x4ea1a8]
cmp word [edi + 2], 0
je 0x44e755
mov edx, dword [0x4ea1b0]
cmp eax, edx
jb 0x44e755
lea edx, [edx*4 + 0x1000]
push edx
push ecx
call ebx
add esp, 8
test eax, eax
je 0x44e5e1
add dword [0x4ea1b0], 0x400
mov dword [0x4ea1a8], eax
add edi, 2
cmp word [edi], 0
jne 0x44e6c0
xor eax, eax
mov word [esi], ax
mov ecx, dword [0x4ea1a8]
mov edx, dword [0x4ea1ac]
mov eax, dword [ecx + edx*4]
cmp word [eax], 0
je 0x44e782
inc dword [0x4ea1ac]
cmp byte [0x4e804d], 0
je 0x44e7c0
mov ecx, dword [0x4e7ef0]
push 0xc
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x44e7a5
mov byte [0x4e804d], 0
push 0x10
call dword [sym.imp.USER32.dll_GetQueueStatus]
shr eax, 0x10
test al, 0x10
je 0x44e7c0
push 1
push 0xffffffffffffffff
call fcn.00401510
add esp, 8
xor edi, edi
lea edx, [ebp - 0x35c]
lea eax, [ebp - 0x55c]
mov dword [0x4ea194], edx
mov dword [0x4ea198], eax
mov dword [0x4ea190], 1
cmp dword [0x4ea1c8], edi
jne 0x44e852
mov esi, dword [ebp - 0x14]
cmp byte [esi + 0x17], 0
jne 0x44e801
mov ecx, dword [esi + 0xc]
push edi
xor al, al
call fcn.004a2de0
jmp 0x44e852
mov al, byte [esi + 0x15]
test al, 2
je 0x44e817
and al, 0x3d
mov byte [esi + 0x15], al
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
movzx eax, byte [esi + 0x14]
and byte [esi + 0x15], 0x82
dec eax
mov dword [esi + 0xc], edi
je 0x44e84a
dec eax
jne 0x44e852
cmp dword [esi + 0x10], edi
je 0x44e852
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
and byte [esi + 0x15], 0x7f
mov dword [esi + 0x10], edi
mov dword [esi + 8], 0x4e9868
jmp 0x44e852
mov ecx, dword [esi + 8]
xor edx, edx
mov word [ecx], dx
or byte [0x4e8902], 1
mov byte [0x4e8048], 1
cmp dword [0x4e8020], edi
jne 0x44e879
mov eax, dword [0x4e5d74]
movzx ecx, word [eax]
push ecx
call fcn.00411870
add esp, 4
mov eax, dword [ebp - 0x1c]
cmp eax, edi
jle 0x44e8b2
cmp byte [0x4e804d], 0
jne 0x44e8b2
cmp eax, 0xa
jge 0x44e893
mov eax, 0xa
mov edx, dword [0x4e7ef0]
push 0x403c50
push eax
push 0xc
push edx
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x4e804d], al
mov ecx, dword fs:[0x24]
mov dword [ebp + 8], ecx
lea esp, [esp]
mov edx, dword [ebp + 8]
cmp dword [0x4ea158], edx
jne 0x44e8dc
push 1
push 0x8000012f
call fcn.00401510
add esp, 8
jmp 0x44e8e4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [ebp - 0x14]
push 0
push 1
mov ecx, edi
call fcn.00401220
mov ebx, eax
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e8f7
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x3fff
jle 0x44e919
mov esi, 0x3fff
mov eax, esi
jmp 0x44e926
test esi, esi
je 0x44e921
mov eax, esi
jmp 0x44e926
mov eax, 1
push eax
push 0
push 1
mov ecx, edi
call fcn.00401220
push eax
lea eax, [ebp - 0x1055c]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x44ea16
lea ecx, [ebp - 0x855c]
lea eax, [ebp - 0x1055c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e97d
test dx, dx
je 0x44e979
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e97d
add eax, 4
add ecx, 4
test dx, dx
jne 0x44e957
xor edi, edi
jmp 0x44e982
sbb edi, edi
sbb edi, 0xffffffff
test edi, edi
jne 0x44e9c7
lea ecx, [ebp - 0x855c]
mov eax, ebx
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e9b6
test dx, dx
je 0x44e9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e9b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x44e990
xor eax, eax
jmp 0x44e9bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44ea13
test edi, edi
je 0x44ea63
mov edx, dword [ebp - 0x14]
push 1
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x855c]
push ecx
push edx
call fcn.004a2810
xor eax, eax
cmp dword [0x4ea1c8], eax
je 0x44ea0a
jmp 0x44e9f0
movzx ecx, word [ebp + eax - 0x855c]
mov word [ebp + eax - 0x1055c], cx
add eax, 2
test cx, cx
jne 0x44e9f0
jmp 0x44ea63
mov word [ebp - 0x1055c], ax
jmp 0x44ea63
mov edi, dword [ebp - 0x14]
push esi
push 0
push 1
mov ecx, edi
mov dword [0x4ea1c8], esi
call fcn.00401220
mov edi, dword [sym.imp.MSVCR100.dll_wcsncpy]
push eax
lea ecx, [ebp - 0x855c]
push ecx
call edi
add esp, 0xc
push esi
lea eax, [ebp - 0x855c]
push eax
lea ecx, [ebp - 0x1055c]
xor edx, edx
push ecx
mov word [ebp + esi*2 - 0x855c], dx
call edi
add esp, 0xc
xor edx, edx
mov word [ebp + esi*2 - 0x1055c], dx
mov eax, dword [0x4ea190]
cmp eax, 1
je 0x44e8c0
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x44ea7d
jmp dword [eax*4 + 0x44edf0]
mov eax, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push str.Timeout
push eax
jmp 0x44ecc0
mov ecx, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push str.Match
push ecx
jmp 0x44ecc0
mov eax, dword [0x4d9f14]
mov edx, dword [str.EndKey:]
mov ecx, dword [0x4d9f18]
push 0xf0
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x12c], edx
mov edx, dword [0x4d9f1c]
lea eax, [ebp - 0x11c]
push 0
push eax
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], edx
call sub.MSVCR100.dll_memset
mov ax, word [0x4ea1a4]
add esp, 0xc
test ax, ax
je 0x44eb16
xor ecx, ecx
mov word [ebp - 0x11e], ax
mov word [ebp - 0x11c], cx
jmp 0x44ec85
cmp byte [0x4ea1a7], 0
je 0x44ebe3
push 0xff
lea edx, [ebp - 0x25b]
push 0
push edx
mov byte [ebp - 0x25c], 0
call sub.MSVCR100.dll_memset
or byte [ebp - 0x24c], 0x80
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x44eb8c
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x15c]
push eax
push esi
mov dword [ebp - 0x15c], 0x30
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x44eb8c
mov eax, dword [ebp - 0x150]
test eax, eax
je 0x44eb8c
push 0
push eax
call edi
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
cmp dword [0x4e8080], ecx
push eax
setne cl
lea edx, [ebp - 0x11e]
lea eax, [ebp - 0x25c]
xor bl, bl
push ecx
movzx ecx, byte [0x4ea1a0]
push 2
push edx
push eax
push ecx
call fcn.0041ca10
movzx edx, ax
movzx eax, byte [0x4ea1a0]
add esp, 4
push edx
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor ecx, ecx
mov word [ebp + eax*2 - 0x11e], cx
jmp 0x44ec85
cmp byte [0x4ea1a6], 0
je 0x44ec45
mov cx, word [0x4ea1a2]
xor eax, eax
cmp word [eax*8 + 0x4e5c1c], cx
je 0x44ec23
inc eax
cmp eax, 0xd
jl 0x44ebf5
movzx edx, cx
push edx
push str.sc_03X
mov esi, 0x79
lea edi, [ebp - 0x11e]
call fcn.0049e5c0
add esp, 8
jmp 0x44ec60
mov edx, dword [eax*8 + 0x4e5c18]
push 0x78
push edx
lea eax, [ebp - 0x11e]
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x2e], cx
jmp 0x44ec60
mov bl, byte [0x4ea1a0]
push 1
mov eax, 0x79
lea ecx, [ebp - 0x11e]
call fcn.0041c210
add esp, 4
mov eax, dword [ebp - 0x11e]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x44ec85
cmp word [ebp - 0x11c], 0
jne 0x44ec85
mov ecx, 0xffe0
add word [ebp - 0x11e], cx
mov eax, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x12c]
push edx
push eax
jmp 0x44ecc0
mov ecx, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push 0x4d48ec
push ecx
jmp 0x44ecc0
mov edx, dword [0x4e86f0]
push 1
push 0
push 0xffffffffffffffff
push str.NewInput
push edx
call fcn.004a2810
cmp byte [0x4e804d], 0
mov dword [0x4ea190], 0
je 0x44ed0c
mov eax, dword [0x4e7ef0]
push 0xc
push eax
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x44ecf1
mov byte [0x4e804d], 0
push 0x10
call dword [sym.imp.USER32.dll_GetQueueStatus]
shr eax, 0x10
test al, 0x10
je 0x44ed0c
push 1
push 0xffffffffffffffff
call fcn.00401510
add esp, 8
lea eax, [ebp - 0x855c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44ed15
mov ecx, dword [ebp - 0x14]
sub eax, edx
sar eax, 1
jne 0x44ed72
cmp byte [ecx + 0x17], 0
jne 0x44ed34
mov eax, dword [ecx + 0xc]
jmp 0x44ed36
mov eax, ecx
cmp byte [eax + 0x17], 2
jne 0x44ed43
mov eax, dword [0x4ea188]
jmp 0x44ed46
mov eax, dword [eax + 0x10]
test eax, 0xfffffffe
je 0x44ed72
push 1
push 0
push 0xffffffffffffffff
push 0x4bd2c4
push ecx
call fcn.004a2810
mov eax, 1
lea esp, [ebp - 0x1056c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x855c]
push edx
push ecx
call fcn.004a2810
lea esp, [ebp - 0x1056c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4