Function at 0x54e29f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103aa259
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebp, ebp
mov dword [esp + 0x30], ebp
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x5c], ebp
call fcn.0057fe9f
mov eax, 1
add dword [esp + 0x68], eax
add dword [esp + 0x6c], eax
add esi, 0x5c
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
mov dword [esp + 0x5c], ebp
sar eax, 2
test eax, eax
jbe 0x54e62e
mov ebx, dword [esp + 0x14]
add ebx, 0x58
push ebp
mov ecx, ebx
xor edi, edi
call fcn.00536bdf
mov ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x14]
sar ecx, 2
test ecx, ecx
jbe 0x54e61c
jmp 0x54e32f
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov edx, dword [eax + 8]
push ebp
mov ecx, ebx
mov dword [esp + 0x2c], edx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x68], ecx
mov eax, dword [eax + 0x10]
mov dword [esp + 0x18], eax
jg 0x54e401
mov edx, eax
cmp dword [esp + 0x6c], edx
jl 0x54e504
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x54e39d
xor eax, eax
jmp 0x54e3a9
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 0x14]
sub eax, ecx
sar eax, 2
mov edx, dword [esp + 0x64]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x1c], edx
sub edx, ecx
sar edx, 2
cmp edx, eax
jae 0x54e3d6
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x64]
mov dword [eax], ecx
add eax, 4
mov dword [edx + 0x10], eax
jmp 0x54e504
cmp ecx, dword [esp + 0x1c]
jbe 0x54e3e1
call fcn.00776e71
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0047928f
jmp 0x54e504
mov ecx, dword [esp + 0x68]
cmp ecx, dword [esp + 0x18]
jg 0x54e504
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x20]
push edx
mov ecx, eax
call fcn.0066ebaf
mov eax, dword [esp + 0x68]
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x68]
dec edx
push ebp
mov ecx, ebx
mov dword [esp + 0x24], edx
call fcn.00536bdf
lea ecx, [esp + 0x20]
push ecx
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, eax
call fcn.0060575f
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x68]
cmp edx, dword [eax + 8]
jg 0x54e4fb
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov ecx, dword [esp + 0x6c]
cmp ecx, dword [eax + 0x10]
jl 0x54e4fb
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], edx
call fcn.0065557f
mov ecx, dword [esp + 0x68]
dec ecx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x28]
jl 0x54e602
cmp eax, dword [esp + 0x18]
jge 0x54e602
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
mov edx, dword [esp + 0x28]
push edx
mov ecx, eax
call fcn.0066ebaf
mov eax, dword [esp + 0x6c]
inc eax
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x6c]
push ebp
mov ecx, ebx
mov dword [esp + 0x2c], edx
call fcn.00536bdf
lea ecx, [esp + 0x28]
push ecx
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, eax
call fcn.0060575f
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov edx, dword [esp + 0x68]
cmp edx, dword [eax + 8]
jg 0x54e602
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, dword [esp + 0x6c]
cmp ecx, dword [eax + 0x10]
jl 0x54e602
push ebp
mov ecx, ebx
call fcn.00536bdf
push edi
lea ecx, [eax + 4]
call fcn.0053624f
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], eax
call fcn.0065557f
push ebp
mov ecx, ebx
inc edi
call fcn.00536bdf
mov ecx, dword [eax + 0x18]
sub ecx, dword [eax + 0x14]
sar ecx, 2
cmp edi, ecx
jb 0x54e32f
mov edx, dword [esi + 0x10]
sub edx, dword [esi + 0xc]
inc ebp
sar edx, 2
cmp ebp, edx
jb 0x54e30f
mov ebx, dword [esp + 0x64]
mov edi, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov ecx, edi
sub ecx, eax
test ecx, 0xfffffffc
je 0x54ec2e
cmp eax, edi
jbe 0x54e651
call fcn.00776e71
mov ebp, dword [ebx]
mov ebx, dword [ebx + 0xc]
mov edx, dword [esp + 0x64]
cmp ebx, dword [edx + 0x10]
jbe 0x54e664
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
test ebp, ebp
je 0x54e672
cmp ebp, eax
je 0x54e677
call fcn.00776e71
mov ecx, edi
sub ecx, ebx
push 0x1011dd30
sar ecx, 2
push ecx
push edi
push ebx
call fcn.0052cd2f
xor ebx, ebx
push 4
mov dword [esp + 0x30], ebx
call fcn.00776c63
add esp, 0x14
cmp eax, ebx
je 0x54e6a7
lea edx, [esp + 0x3c]
mov dword [eax], edx
jmp 0x54e6a9
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov ebp, dword [esp + 0x64]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x5c], 2
cmp edi, dword [ebp + 0x10]
jbe 0x54e6d2
call fcn.00776e71
mov eax, dword [ebp]
cmp eax, ebx
jne 0x54e7a9
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x54e6ee
call fcn.00776e71
mov eax, dword [edi]
mov edi, dword [esp + 0x68]
cmp dword [eax + 8], edi
jle 0x54e7ed
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
mov ecx, esi
mov dword [esp + 0x28], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edi, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jbe 0x54e73b
call fcn.00776e71
mov eax, dword [ebp]
cmp eax, ebx
jne 0x54e7b0
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x54e753
call fcn.00776e71
mov edx, dword [edi]
mov eax, dword [edx + 8]
dec eax
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
cmp eax, ebx
je 0x54e7b4
cmp byte [eax + 0x18], 0
je 0x54e7b4
mov ecx, dword [ecx + 0x200]
call fcn.004f6c0f
mov ecx, eax
call fcn.004d8ecf
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
jmp 0x54e7ba
mov eax, dword [eax]
jmp 0x54e6e4
mov eax, dword [eax]
jmp 0x54e749
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov ebx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], ebx
jbe 0x54e7fa
call fcn.00776e71
mov edx, dword [esp + 0x64]
mov edi, dword [edx]
mov ebp, edi
mov dword [esp + 0x38], ebx
test edi, edi
jne 0x54e821
call fcn.00776e71
xor eax, eax
lea ecx, [ebx - 4]
cmp ecx, dword [eax + 0x10]
ja 0x54e82c
test edi, edi
je 0x54e825
mov edi, dword [edi]
jmp 0x54e827
mov eax, dword [edi]
jmp 0x54e811
xor edi, edi
cmp ecx, dword [edi + 0xc]
jae 0x54e831
call fcn.00776e71
lea edi, [ebx - 4]
test ebp, ebp
jne 0x54e8ec
call fcn.00776e71
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x54e84d
call fcn.00776e71
mov eax, dword [edi]
mov edi, dword [esp + 0x6c]
cmp dword [eax + 0x10], edi
jge 0x54e933
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
mov ecx, dword [esp + 0x64]
call fcn.0058411f
mov eax, dword [eax]
mov ecx, dword [eax + 0x10]
inc ecx
mov dword [esp + 0x6c], ecx
mov ecx, esi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea edx, [esp + 0x6c]
push edx
mov ecx, eax
call fcn.0066cf9f
mov ecx, esi
mov dword [esp + 0x6c], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x54e8f4
cmp byte [eax + 0x18], 0
je 0x54e8f4
mov ecx, dword [ecx + 0x200]
call fcn.004f6c0f
mov ecx, eax
call fcn.004d8ecf
mov dword [esp + 0x6c], eax
fild dword [esp + 0x6c]
jmp 0x54e8fa
mov eax, dword [ebp]
jmp 0x54e843
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
mov edi, dword [eax + 0xc]
dec ebp
cmp edi, dword [eax + 0x10]
jbe 0x54e949
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov ebx, dword [eax]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
jmp 0x54e95f
mov eax, dword [esp + 0x64]
mov edi, dword [eax + 0x10]
cmp dword [eax + 0xc], edi
jbe 0x54e970
call fcn.00776e71
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
test ebx, ebx
je 0x54e97e
cmp ebx, eax
je 0x54e983
call fcn.00776e71
cmp dword [esp + 0x2c], edi
je 0x54eb66
test ebx, ebx
jne 0x54ea6c
call fcn.00776e71
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp edx, dword [eax + 0x10]
jb 0x54e9aa
call fcn.00776e71
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [eax]
mov ebx, dword [ecx + 8]
test edi, edi
jne 0x54ea73
call fcn.00776e71
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp edx, dword [eax + 0x10]
jb 0x54e9d4
call fcn.00776e71
test ebx, ebx
jle 0x54eb15
lea edi, [ebp + 1]
lea eax, [ebx - 1]
cmp eax, edi
jl 0x54eb11
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
mov ecx, esi
mov dword [esp + 0x68], edi
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0066cf9f
dec ebx
mov ecx, esi
mov dword [esp + 0x68], ebx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea edx, [esp + 0x68]
push edx
mov ecx, eax
call fcn.0060575f
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x54ea7a
cmp byte [eax + 0x18], 0
je 0x54ea7a
mov ecx, dword [ecx + 0x200]
call fcn.004f6c0f
mov ecx, eax
call fcn.004d8ecf
mov dword [esp + 0x68], eax
fild dword [esp + 0x68]
jmp 0x54ea80
mov eax, dword [ebx]
jmp 0x54e99c
mov eax, dword [edi]
jmp 0x54e9c6
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x20]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x20]
mov eax, dword [eax]
fstp qword [eax + 0x18]
add eax, 0x18
mov ecx, esi
mov byte [eax + 8], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov ecx, dword [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0x68], eax
test ecx, ecx
jne 0x54eac8
xor edi, edi
jmp 0x54ead1
mov edi, dword [esp + 0x50]
sub edi, ecx
sar edi, 2
mov edx, dword [esp + 0x4c]
mov ebx, edx
sub ebx, ecx
sar ebx, 2
cmp ebx, edi
jae 0x54eaed
mov ecx, edx
add ecx, 4
mov dword [edx], eax
mov dword [esp + 0x4c], ecx
jmp 0x54eb11
mov edi, edx
cmp ecx, edx
jbe 0x54eaf8
call fcn.00776e71
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x68]
push ecx
push edi
push eax
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x4c]
call fcn.0047928f
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x54eb5e
call fcn.00776e71
xor eax, eax
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [eax + 0x10]
jb 0x54eb2e
call fcn.00776e71
mov edx, dword [esp + 0x2c]
mov eax, dword [edx]
mov ebp, dword [eax + 0x10]
test edi, edi
jne 0x54eb62
call fcn.00776e71
xor eax, eax
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [eax + 0x10]
jb 0x54eb50
call fcn.00776e71
add dword [esp + 0x2c], 4
mov ebx, dword [esp + 0x28]
jmp 0x54e95f
mov eax, dword [edi]
jmp 0x54eb20
mov eax, dword [edi]
jmp 0x54eb42
mov edi, dword [esp + 0x4c]
cmp dword [esp + 0x48], edi
jbe 0x54eb75
call fcn.00776e71
mov esi, dword [esp + 0x48]
cmp esi, dword [esp + 0x4c]
jbe 0x54eb84
call fcn.00776e71
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x64]
mov ebx, dword [esp + 0x64]
mov byte [esp + 0x68], 0
mov edx, dword [esp + 0x68]
push edx
push eax
push ecx
push ebx
push edi
lea edx, [esp + 0x7c]
push esi
push edx
call fcn.0053571f
mov edx, dword [esp + 0x38]
xor edi, edi
add esp, 0x1c
cmp edx, edi
je 0x54ebff
mov ecx, dword [ebx + 0xc]
cmp ecx, edi
jne 0x54ebc1
xor eax, eax
jmp 0x54ebc9
mov eax, dword [ebx + 0x14]
sub eax, ecx
sar eax, 2
mov esi, dword [ebx + 0x10]
mov ebp, esi
sub ebp, ecx
sar ebp, 2
cmp ebp, eax
jae 0x54ebe1
mov dword [esi], edx
add esi, 4
mov dword [ebx + 0x10], esi
jmp 0x54ebff
cmp ecx, esi
jbe 0x54ebea
call fcn.00776e71
mov eax, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
push esi
push eax
lea edx, [esp + 0x40]
push edx
mov ecx, ebx
call fcn.0047928f
mov eax, dword [esp + 0x48]
cmp eax, edi
je 0x54ec10
push eax
call fcn.00776c58
add esp, 4
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
call fcn.00776c58
add esp, 4
jmp 0x54ed55
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x14]
test ecx, 0xfffffffc
jne 0x54ec48
lea ecx, [edi + 4]
call fcn.005444ef
mov ecx, esi
call fcn.0058411f
mov ecx, dword [eax]
call fcn.0054414f
mov edx, dword [esp + 0x68]
mov ecx, esi
mov dword [esp + 0x68], edx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0066cf9f
mov edx, dword [esp + 0x6c]
mov ecx, esi
mov dword [esp + 0x68], edx
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [esp + 0x68]
push ecx
mov ecx, eax
call fcn.0060575f
mov eax, dword [edi + 0x54]
test eax, eax
je 0x54eccd
cmp byte [eax + 0x18], 0
je 0x54eccd
mov ecx, dword [edi + 0x200]
call fcn.004f6c0f
mov ecx, eax
call fcn.004d8ecf
mov dword [esp + 0x68], eax
fild dword [esp + 0x68]
jmp 0x54ecd3
fld qword [0x10474e40]
mov ecx, esi
fstp qword [esp + 0x28]
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
fld qword [esp + 0x28]
mov eax, dword [eax]
mov ecx, esi
fstp qword [eax + 0x18]
mov byte [eax + 0x20], 1
call fcn.0058411f
mov eax, dword [eax]
lea ecx, [eax + 8]
call fcn.0058411f
mov edx, dword [eax]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x68], edx
test eax, eax
jne 0x54ed17
xor ecx, ecx
jmp 0x54ed1f
mov ecx, dword [ebx + 0x14]
sub ecx, eax
sar ecx, 2
mov esi, dword [ebx + 0x10]
mov edi, esi
sub edi, eax
sar edi, 2
cmp edi, ecx
jae 0x54ed37
mov dword [esi], edx
add esi, 4
mov dword [ebx + 0x10], esi
jmp 0x54ed55
cmp eax, esi
jbe 0x54ed40
call fcn.00776e71
mov eax, dword [ebx]
lea edx, [esp + 0x68]
push edx
push esi
push eax
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call fcn.0047928f
mov eax, ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0xc