Function at 0x40e5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x470ed4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
mov eax, dword [0x492f50]
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0xec0]
mov dword [esp + 0x15c], eax
mov eax, dword [esi + 0xe60]
test eax, eax
push edi
mov dword [esp + 0x8c], ebp
je 0x40fd33
mov eax, dword [esi + 0xe70]
test eax, eax
lea edx, [esi + 0xe70]
jle 0x40fd33
mov eax, dword [esi + 0x1020]
test eax, eax
je 0x40fd33
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40fd33
lea eax, [esi + 0xe88]
xor ebp, ebp
mov dword [esp + 0x2c], eax
mov ecx, eax
mov edi, edx
mov ebx, 5
lea ebx, [ebx]
cmp dword [edi], 0
jle 0x40e681
cmp dword [ecx + 4], 0
ja 0x40e680
cmp dword [ecx], 0
jbe 0x40e681
inc ebp
add edi, 4
add ecx, 8
dec ebx
jne 0x40e670
cmp ebp, 4
jge 0x40e6cf
xor ecx, ecx
mov dword [esi + 0xec8], ecx
mov dword [esi + 0xecc], ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
jmp 0x40ff06
lea eax, [esp + 0x150]
push eax
push str.image_jpeg
call fcn.00428cd0
mov edi, dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
add esp, 8
lea ecx, [esp + 0x38]
push ecx
xor ebx, ebx
push 1
push ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x44], ebx
call edi
test eax, eax
jl 0x40e710
lea edx, [esp + 0x4c]
push edx
push 1
push ebx
call edi
test eax, eax
jge 0x40e71c
mov ecx, esi
call fcn.0040c1c0
jmp 0x40ff06
cmp dword [esi + 0x40], 1
jne 0x40e89c
mov eax, dword [esi + 0x102c]
cmp eax, ebx
jne 0x40e738
mov eax, dword [esi + 0x1020]
jmp 0x40e73f
mov eax, dword [esi + eax*4 + 0x1008]
lea ecx, [esp + 0x18]
push ecx
xor edi, edi
push eax
mov dword [esp + 0x44], 0x4770f8
mov dword [esp + 0x20], edi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edx
mov eax, dword [esi + 0x64]
movzx ebp, byte [esi + 0x64]
mov edx, dword [esi + 0x68]
movzx ebx, byte [esi + 0x68]
shr eax, 8
movzx ecx, al
mov dword [esp + 0x30], ecx
shr edx, 8
mov dword [esp + 0x16c], edi
lea ecx, [esp + 0x3c]
mov dword [esp + 0x28], ebp
movzx edi, dl
call fcn.00406290
lea ecx, [esp + 0x3c]
mov dword [esp + 0x10], eax
call fcn.004062c0
add ebp, 0xfffffffb
mov dword [esp + 0x34], eax
jns 0x40e7ae
xor ebp, ebp
mov ecx, dword [esp + 0x30]
lea eax, [ecx - 5]
test eax, eax
mov dword [esp + 0x30], eax
jge 0x40e7c5
mov dword [esp + 0x30], 0
sub ebx, dword [esp + 0x28]
add ebx, 0xa
lea eax, [ebx + ebp]
cmp eax, 0x64
jle 0x40e7db
mov ebx, 0x64
sub ebx, ebp
mov eax, dword [esp + 0x30]
sub edi, ecx
add edi, 0xa
lea ecx, [edi + eax]
cmp ecx, 0x64
jle 0x40e7f3
mov edi, 0x64
sub edi, eax
lea ecx, [esp + 0x3c]
call fcn.004062f0
imul edi, dword [esp + 0x34]
imul ebx, dword [esp + 0x10]
push eax
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [esi + 0x60]
imul edx, dword [esp + 0x38]
push ecx
mov ecx, dword [esi + 0x5c]
mov eax, 0x51eb851f
imul ecx, ebp
mul edx
shr edx, 5
push edx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
push edx
lea ecx, [esp + 0x50]
call fcn.00406a70
xor edi, edi
xor ebx, ebx
xor ebp, ebp
test eax, eax
je 0x40e885
mov ecx, dword [esp + 0x38]
push ebp
lea edx, [esp + 0x154]
push edx
push ecx
mov ecx, eax
call fcn.00406260
mov eax, dword [esp + 0x38]
mov edx, dword [eax]
push ebp
push ebp
push ebx
push edi
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x170], 0xffffffff
call sub.gdiplus.dll_GdipDisposeImage
jmp 0x40e8b6
mov ecx, dword [esi + 0xe4c]
mov eax, dword [esi + ecx*4 + 0x1004]
mov edx, dword [eax]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [edx + 0x34]
xor ebp, ebp
cmp dword [esi + 0xe68], ebp
je 0x40e8cd
mov edx, dword [esi + 0xe4c]
mov eax, dword [esi + edx*4 + 0x1008]
jmp 0x40e8da
mov eax, dword [esi + 0xe4c]
mov eax, dword [esi + eax*4 + 0x1000]
mov ecx, dword [eax]
lea edx, [esp + 0x4c]
push edx
push eax
call dword [ecx + 0x34]
mov eax, dword [esi + 0xe4c]
mov eax, dword [esi + eax*4 + 0x1000]
lea ecx, [esp + 0x18]
push ecx
mov edi, 0x4770f8
push eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], edx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push ecx
mov dword [esp + 0x174], 1
mov dword [esp + 0xfc], edi
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x18]
mov dword [esp + 0xfc], eax
mov dword [esp + 0xf8], edx
mov eax, dword [esi + 0xe4c]
mov eax, dword [esi + eax*4 + 0x1008]
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x10c], edi
mov dword [esp + 0x20], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10c], eax
mov dword [esp + 0x108], edx
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x30]
push eax
push ecx
mov dword [esp + 0x13c], edi
mov dword [esp + 0x38], ebp
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov edx, dword [esp + 0x30]
mov dword [esp + 0x13c], eax
mov dword [esp + 0x138], edx
mov eax, dword [esi + 0x40]
cmp eax, ebp
jne 0x40e9cf
lea ecx, [esp + 0x3c]
call fcn.00406290
lea ecx, [esp + 0x3c]
lea edi, [eax + eax*2]
call fcn.004062c0
shl eax, 2
jmp 0x40e9fb
cmp eax, 1
jne 0x40e9ed
lea ecx, [esp + 0x3c]
call fcn.00406290
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.004062c0
lea eax, [eax + eax*2]
jmp 0x40e9fb
mov edi, dword [esp + 0x8c]
mov eax, dword [esp + 0x8c]
push 0x21808
push eax
push edi
lea ecx, [esp + 0x120]
call fcn.00406320
mov eax, dword [esp + 0x11c]
cmp eax, ebp
mov dword [esp + 0x11c], ebp
jne 0x40fce6
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x5c]
call fcn.00406860
mov eax, dword [esp + 0x5c]
cmp eax, ebp
mov dword [esp + 0x5c], ebp
jne 0x40f6ea
lea ecx, [esp + 0x3c]
call fcn.004062c0
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00406290
xor ebx, ebx
push ebx
push ebx
push ebx
push 2
lea ecx, [esp + 0x4c]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edi
call fcn.004062c0
push eax
lea ecx, [esp + 0x50]
call fcn.00406290
push eax
push ebx
push ebx
lea ecx, [esp + 0x94]
push ecx
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x80]
call fcn.00406980
lea ecx, [esp + 0x3c]
call fcn.00406290
mov ebp, eax
cmp dword [esi + 0x40], 1
mov dword [esp + 0x18], ebp
mov dword [esp + 0x10], ebx
jne 0x40ead7
xor ebp, ebp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x18], ebp
call fcn.004062c0
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x3c]
call fcn.004062c0
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.00406290
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
mov dword [esp + 0x84], ecx
push 2
lea ecx, [esp + 0x104]
mov dword [esp + 0x84], ebp
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edi
call fcn.004062c0
push eax
lea ecx, [esp + 0x108]
call fcn.00406290
push eax
push 0
push 0
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x80]
call fcn.00406980
lea ecx, [esp + 0x3c]
call fcn.00406290
mov edi, eax
mov eax, dword [esi + 0x40]
xor ebx, ebx
shl edi, 1
cmp eax, 1
mov dword [esp + 0x28], ebx
jne 0x40eb7b
lea ecx, [esp + 0x3c]
xor edi, edi
call fcn.004062c0
mov ebx, eax
shl ebx, 1
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x3c]
call fcn.004062c0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], eax
call fcn.00406290
mov ecx, dword [esp + 0x1c]
push 0
push 0
push 0
mov dword [esp + 0x8c], ecx
push 2
lea ecx, [esp + 0x114]
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], eax
call fcn.004062c0
push eax
lea ecx, [esp + 0x118]
call fcn.00406290
push eax
push 0
push 0
lea edx, [esp + 0x94]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x80]
call fcn.00406980
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x40f21b
lea ecx, [esp + 0x3c]
xor ebx, ebx
call fcn.004062c0
mov ebp, eax
cmp dword [esi + 0x40], 1
jne 0x40ec1e
lea ecx, [esp + 0x3c]
call fcn.00406290
mov ebx, eax
xor ebp, ebp
lea ecx, [esp + 0x3c]
call fcn.004062c0
lea ecx, [eax + eax*2]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x3c]
call fcn.00406290
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
lea eax, [eax + eax*2]
push 2
lea ecx, [esp + 0x4c]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], edx
call fcn.004062c0
push eax
lea ecx, [esp + 0x50]
call fcn.00406290
push eax
push 0
push 0
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x158]
push ecx
lea ecx, [esp + 0x80]
call fcn.00406980
lea edx, [esp + 0x50]
push edx
push 0
push 0x477188
mov dword [esp + 0x5c], 0
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [esp + 0x54], eax
push 2
push 1
push 0x41f40000
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406a00
push 2
push 1
push 0x42a10000
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0xac]
call fcn.00406a00
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x78]
mov dword [esp + 0x20], 0xa0b4b4b4
call fcn.00406790
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
add eax, 5
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
add ecx, 5
mov dword [esp + 0x1c], ecx
fstp dword [esp + 0xe4]
add edi, 5
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc4], 0x40a00000
mov dword [esp + 0xc8], 0x40a00000
fstp dword [esp + 0xe8]
mov dword [esp + 0xcc], 0x4440c000
fild dword [esp + 0x1c]
mov dword [esp + 0xd0], 0x42be0000
mov dword [esp + 0xec], 0x4440c000
mov dword [esp + 0xf0], 0x42be0000
fstp dword [esp + 0xd4]
add edx, 5
mov dword [esp + 0x1c], edx
fild dword [esp + 0x1c]
add ebx, 5
mov dword [esp + 0x1c], ebx
fstp dword [esp + 0xd8]
add ebp, 5
fild dword [esp + 0x1c]
mov dword [esp + 0x1c], ebp
push 0
push 0
fstp dword [esp + 0xbc]
lea ecx, [esp + 0x68]
fild dword [esp + 0x24]
mov dword [esp + 0xe4], 0x4440c000
mov dword [esp + 0xe8], 0x42be0000
mov dword [esp + 0xc4], 0x44c46000
fstp dword [esp + 0xc0]
mov dword [esp + 0xc8], 0x4455c000
call fcn.004061f0
push 0
lea ecx, [esp + 0x64]
call fcn.00406840
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x94]
mov dword [esp + 0x20], 0xffb432dc
call fcn.00406790
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x148]
mov dword [esp + 0x20], 0xff000000
call fcn.00406790
mov edx, dword [esi + 0xe94]
mov eax, dword [esi + 0xe90]
push 0
push 0x3e8
push edx
push eax
call fcn.0044baa0
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00403250
mov ecx, dword [esi + 0xe94]
mov edx, dword [esi + 0xe90]
push 0
push 0x3e8
push ecx
mov bl, 0xe
push edx
mov byte [esp + 0x17c], bl
call fcn.0044ac60
mov dword [esp + 0x84], eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x8c]
mov dword [esp + 0x90], edx
call fcn.0040c140
mov ecx, dword [eax]
push edi
push ecx
lea edx, [esp + 0x18]
push str._s__03d
push edx
mov byte [esp + 0x17c], 0xf
call fcn.00403c50
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.00408520
mov eax, dword [eax]
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0xcc]
push ecx
lea edx, [esp + 0x78]
push edx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x1c]
call fcn.00407240
mov ecx, dword [esi + 0xe9c]
mov eax, dword [esi + 0xe98]
push 0
push 0x3e8
push ecx
push eax
call fcn.0044ba00
mov dword [esp + 0xa4], eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x20]
mov edi, ecx
push eax
lea ecx, [esp + 0xac]
mov dword [esp + 0x28], ebx
mov dword [esp + 0xb0], edx
call fcn.0040c140
mov ecx, dword [eax]
push edi
push ecx
lea edx, [esp + 0x18]
push str._s__03d
push edx
mov byte [esp + 0x17c], 0x10
call fcn.00403c50
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], 0xe
call fcn.00407240
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.00408520
mov eax, dword [eax]
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x78]
push edx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x1c]
call fcn.00407240
mov ecx, dword [esi + 0xea4]
mov eax, dword [esi + 0xea0]
push 0
push 0x3e8
push ecx
push eax
call fcn.0044ba00
mov dword [esp + 0xac], eax
push str._Y__m__d__H:_M:_S
lea eax, [esp + 0x20]
mov edi, ecx
push eax
lea ecx, [esp + 0xb4]
mov dword [esp + 0x28], ebx
mov dword [esp + 0xb8], edx
call fcn.0040c140
mov byte [esp + 0x16c], 0x11
push edi
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x18]
push str._s__03d
push edx
call fcn.00403c50
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16c], 0xe
call fcn.00407240
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
call fcn.00408520
mov eax, dword [eax]
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0xdc]
push ecx
lea edx, [esp + 0x78]
push edx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x1c]
call fcn.00407240
lea ecx, [esp + 0x18]
call fcn.00403250
lea ecx, [esp + 0x28]
call fcn.00403250
push 2
lea eax, [esp + 0x6c]
lea edi, [esi + 0xed4]
mov bl, 0x13
push eax
mov ecx, edi
mov byte [esp + 0x174], bl
call fcn.00403830
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x170], 0x14
call fcn.00403d30
lea ecx, [esp + 0x68]
mov byte [esp + 0x16c], bl
call fcn.00407240
push 2
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
call fcn.0040b760
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x170], 0x15
call fcn.00403d30
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov edx, dword [esi + 0xe94]
mov eax, dword [esi + 0xe90]
push 0
push 0x3e8
push edx
push eax
call fcn.0044baa0
push str._Y__m__d__H:_M:_S
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x8c]
mov edi, eax
call fcn.0040c140
mov edx, dword [esi + 0xe5c]
mov byte [esp + 0x16c], 0x16
push edx
mov ecx, dword [esi + 0xe64]
mov edx, dword [esp + 0x1c]
mov eax, dword [eax]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esi + 0xe58]
push ecx
mov ecx, dword [esi + 0x34]
push edx
mov edx, dword [esi + 0x2c]
push ecx
push edx
push edi
push eax
lea ecx, [esp + 0x34]
push 0x477328
push ecx
call fcn.00403c50
add esp, 0x2c
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
call fcn.00408520
mov eax, dword [eax]
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xa8]
push edx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x14]
call fcn.00407240
lea ecx, [esp + 0x28]
call fcn.00407240
lea ecx, [esp + 0x18]
call fcn.00407240
lea ecx, [esp + 0x10]
call fcn.00407240
mov eax, dword [esp + 0x148]
push eax
call sub.gdiplus.dll_GdipDeleteBrush
mov ecx, dword [esp + 0x94]
push ecx
call sub.gdiplus.dll_GdipDeleteBrush
mov edx, dword [esp + 0x60]
push edx
call sub.gdiplus.dll_GdipDeleteStringFormat
mov eax, dword [esp + 0x78]
push eax
call sub.gdiplus.dll_GdipDeleteBrush
mov ecx, dword [esp + 0x9c]
push ecx
call sub.gdiplus.dll_GdipDeleteFont
mov edx, dword [esp + 0x6c]
push edx
call sub.gdiplus.dll_GdipDeleteFont
mov eax, dword [esp + 0x50]
push eax
jmp 0x40f6e5
cmp eax, 1
jne 0x40f6ea
lea ecx, [esp + 0x50]
push ecx
push 0
push 0x477188
mov dword [esp + 0x5c], 0
call sub.gdiplus.dll_GdipCreateFontFamilyFromName
mov dword [esp + 0x54], eax
push 2
push 1
push 0x41f40000
lea edx, [esp + 0x5c]
push edx
lea ecx, [esp + 0x94]
call fcn.00406a00
push 2
push 1
push 0x42a10000
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406a00
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x78]
mov dword [esp + 0x18], 0xa0b4b4b4
call fcn.00406790
mov edx, dword [esp + 0x10]
add ebp, 5
mov dword [esp + 0x14], ebp
fild dword [esp + 0x14]
add edx, 5
mov dword [esp + 0x14], edx
fstp dword [esp + 0xe4]
add edi, 5
fild dword [esp + 0x14]
mov dword [esp + 0x14], edi
add ebx, 5
lea ecx, [esp + 0x3c]
fstp dword [esp + 0xe8]
mov dword [esp + 0xd4], 0x40a00000
fild dword [esp + 0x14]
mov dword [esp + 0x14], ebx
mov dword [esp + 0xd8], 0x40a00000
mov dword [esp + 0xdc], 0x44c46000
fstp dword [esp + 0xc4]
mov dword [esp + 0xe0], 0x4455c000
fild dword [esp + 0x14]
mov dword [esp + 0xec], 0x44c46000
mov dword [esp + 0xf0], 0x4455c000
mov dword [esp + 0xcc], 0x44c46000
fstp dword [esp + 0xc8]
mov dword [esp + 0xd0], 0x4455c000
call fcn.00406290
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x40f347
fadd dword [0x477324]
push 0
fstp dword [esp + 0xc0]
push 0
lea ecx, [esp + 0x68]
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc8], 0
call fcn.004061f0
push 0
lea ecx, [esp + 0x64]
call fcn.00406840
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x94]
mov dword [esp + 0x18], 0xffb432dc
call fcn.00406790
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00406790
lea edx, [esp + 0xb4]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x60]
call fcn.00406f80
mov ecx, dword [esi + 0xe4c]
mov edx, dword [esi + ecx*8 + 0xe7c]
mov eax, dword [esi + ecx*8 + 0xe78]
push 0
push 0x3e8
push edx
push eax
call fcn.0044baa0
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00403250
mov ecx, dword [esi + 0xe4c]
mov edx, dword [esi + ecx*8 + 0xe7c]
mov eax, dword [esi + ecx*8 + 0xe78]
push 0
push 0x3e8
push edx
mov bl, 0x1e
push eax
mov byte [esp + 0x17c], bl
call fcn.0044ac60
push str._Y__m__d__H:_M:_S
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], edx
call fcn.0040c140
mov edx, dword [esi + 0xe6c]
mov ecx, dword [esi + 0xe58]
push edx
mov edx, dword [esi + 0x34]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [eax]
push ecx
push edi
push edx
lea eax, [esp + 0x28]
push 0x4772ec
push eax
mov byte [esp + 0x18c], 0x1f
call fcn.00403c50
add esp, 0x20
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00408520
mov eax, dword [eax]
lea edx, [esp + 0x90]
push edx
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xdc]
push edx
lea ecx, [esp + 0x78]
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x14]
call fcn.00407240
mov edx, dword [esi + 0xe4c]
mov eax, dword [esi + edx*8 + 0xe8c]
mov ecx, dword [esi + edx*8 + 0xe88]
push 0
lea edi, [esi + edx*8 + 0xe88]
push 0x3e8
push eax
push ecx
call fcn.0044ac60
push 0
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], edx
mov edx, dword [edi + 4]
mov eax, dword [edi]
push 0x3e8
push edx
push eax
call fcn.0044baa0
push str._Y__m__d__H:_M:_S
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xb4]
mov edi, eax
call fcn.0040c140
mov edx, dword [esi + 0xe5c]
mov ecx, dword [esi + 0xe58]
push edx
mov edx, dword [esi + 0x34]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [eax]
push ecx
push edi
push edx
lea eax, [esp + 0x28]
push 0x4772ec
push eax
mov byte [esp + 0x18c], 0x20
call fcn.00403c50
add esp, 0x20
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00408520
mov eax, dword [eax]
lea edx, [esp + 0x90]
push edx
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xec]
push edx
lea ecx, [esp + 0x78]
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x14]
call fcn.00407240
mov edx, dword [esi + 0xe4c]
mov eax, dword [esi + edx*8 + 0xe8c]
mov ecx, dword [esi + edx*8 + 0xe88]
push 0
lea edi, [esi + edx*8 + 0xe88]
push 0x3e8
push eax
push ecx
call fcn.0044ac60
push 0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], edx
mov edx, dword [edi + 4]
mov eax, dword [edi]
push 0x3e8
push edx
push eax
call fcn.0044baa0
push str._Y__m__d__H:_M:_S
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xac]
mov edi, eax
call fcn.0040c140
mov edx, dword [esi + 0xe5c]
mov ecx, dword [esi + 0xe58]
push edx
mov edx, dword [esi + 0x34]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [eax]
push ecx
push edi
push edx
lea eax, [esp + 0x28]
push 0x4772ec
push eax
mov byte [esp + 0x18c], 0x21
call fcn.00403c50
add esp, 0x20
lea ecx, [esp + 0x14]
mov byte [esp + 0x16c], bl
call fcn.00407240
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.00408520
mov eax, dword [eax]
lea edx, [esp + 0x90]
push edx
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0xcc]
push edx
lea ecx, [esp + 0x78]
push ecx
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x70]
call fcn.004068e0
lea ecx, [esp + 0x14]
call fcn.00407240
lea ecx, [esp + 0x10]
call fcn.00407240
mov edx, dword [esp + 0x20]
push edx
call sub.gdiplus.dll_GdipDeleteBrush
mov eax, dword [esp + 0x94]
push eax
call sub.gdiplus.dll_GdipDeleteBrush
mov ecx, dword [esp + 0x60]
push ecx
call sub.gdiplus.dll_GdipDeleteStringFormat
mov edx, dword [esp + 0x78]
push edx
call sub.gdiplus.dll_GdipDeleteBrush
mov eax, dword [esp + 0x6c]
push eax
call sub.gdiplus.dll_GdipDeleteFont
mov ecx, dword [esp + 0x84]
push ecx
call sub.gdiplus.dll_GdipDeleteFont
mov edx, dword [esp + 0x50]
push edx
call sub.gdiplus.dll_GdipDeleteFontFamily
lea ecx, [esp + 0x10]
call fcn.00403250
lea ecx, [esp + 0x28]
call fcn.00403250
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push 0
push 0x3e8
push ecx
push eax
mov byte [esp + 0x17c], 0x23
call fcn.0044ba00
mov dword [esp + 0x124], eax
push str._Y_m_d_H_M_S
lea eax, [esp + 0x30]
mov edi, ecx
push eax
lea ecx, [esp + 0x12c]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x130], edx
call fcn.0040c140
mov ecx, dword [eax]
push edi
push ecx
lea edx, [esp + 0x30]
push str._s__03d.jpg
push edx
mov byte [esp + 0x17c], 0x24
call fcn.00403c50
mov bl, 0x23
add esp, 0x10
lea ecx, [esp + 0x2c]
mov byte [esp + 0x16c], bl
call fcn.00407240
lea eax, [esi + 0x38]
push eax
lea ecx, [esp + 0x14]
call fcn.00403d30
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
cmp eax, 1
push ecx
mov ecx, esp
jge 0x40f94f
mov dword [esp + 0x30], esp
xor ebp, ebp
push ebp
call fcn.00404830
sub esp, 8
mov eax, esp
mov dword [esp + 0x74], esp
push ecx
lea edx, [esi + 0x88]
mov ecx, esp
mov dword [esp + 0x78], esp
push edx
mov byte [esp + 0x180], 0x25
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.00403270
push ecx
lea eax, [esi + 0x8c]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0x184], 0x26
call fcn.00403270
push ecx
lea edx, [esi + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
mov byte [esp + 0x188], 0x27
call fcn.00403270
lea edi, [esi + 0x41c]
mov ecx, edi
mov byte [esp + 0x184], bl
call fcn.00436aa0
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push ebp
call fcn.00404830
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebp
mov byte [esp + 0x17c], 0x28
call fcn.00404830
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push ebp
mov byte [esp + 0x180], 0x29
call fcn.00404830
sub esp, 8
mov eax, esp
mov dword [esp + 0x9c], esp
push ecx
mov ecx, esp
mov dword [esp + 0xa0], esp
push ebp
mov byte [esp + 0x18c], 0x2a
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.00404830
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push ebp
mov byte [esp + 0x190], 0x2b
call fcn.00404830
push ebp
sub esp, 8
mov byte [esp + 0x198], 0x2c
mov dword [esp + 0x7c], esp
mov eax, esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x8c], esp
push ebp
mov dword [eax], ebp
mov dword [eax + 4], ebp
call fcn.00404830
push ecx
mov ecx, esp
mov dword [esp + 0xa0], esp
push ebp
mov byte [esp + 0x1b0], 0x2d
call fcn.00404830
lea eax, [esp + 0x6c]
push eax
mov ecx, edi
mov byte [esp + 0x1b0], bl
call fcn.00437510
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0x2e
call fcn.00403d30
lea ecx, [esp + 0x2c]
mov byte [esp + 0x16c], bl
call fcn.00407240
push 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040b5e0
push 0x5c
push eax
call fcn.0040b5c0
add esp, 8
lea ecx, [esp + 0x14]
mov bl, al
call fcn.00407240
test bl, bl
je 0x40f93c
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0040b640
push 0x4772c4
lea ecx, [esp + 0x14]
call fcn.0040bab0
jmp 0x40faf1
mov dword [esp + 0x64], esp
push 0
call fcn.00404830
sub esp, 8
mov eax, esp
mov dword [esp + 0x5c], esp
push ecx
lea edi, [esi + 0x88]
mov ecx, esp
mov dword [esp + 0x60], esp
push edi
mov byte [esp + 0x180], 0x2f
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00403270
push ecx
mov ecx, esp
mov dword [esp + 0x80], esp
push 0
mov byte [esp + 0x184], 0x30
call fcn.00404830
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x9c], esp
push edx
mov byte [esp + 0x188], 0x31
call fcn.00403270
lea ebp, [esi + 0x41c]
mov ecx, ebp
mov byte [esp + 0x184], bl
call fcn.00436aa0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push 0
call fcn.00404830
push ecx
lea eax, [esi + 0x14]
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
mov byte [esp + 0x17c], 0x32
call fcn.00403270
push ecx
mov ecx, esp
mov dword [esp + 0x7c], esp
push 0
mov byte [esp + 0x180], 0x33
call fcn.00404830
sub esp, 8
mov eax, esp
mov dword [esp + 0x9c], esp
push ecx
mov ecx, esp
mov dword [esp + 0xa0], esp
push edi
mov byte [esp + 0x18c], 0x34
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00403270
push ecx
lea edx, [esi + 0x8c]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
mov byte [esp + 0x190], 0x35
call fcn.00403270
push 1
sub esp, 8
mov byte [esp + 0x198], 0x36
mov dword [esp + 0x94], esp
mov eax, esp
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, esp
mov dword [esp + 0xa4], esp
push 2
lea edi, [esi + 0xed4]
push eax
mov ecx, edi
call fcn.00403830
push ecx
mov ecx, esp
mov dword [esp + 0x5c], esp
push 2
push ecx
mov ecx, edi
mov byte [esp + 0x1b4], 0x37
call fcn.0040b760
lea edx, [esp + 0x6c]
push edx
mov ecx, ebp
mov byte [esp + 0x1b0], bl
call fcn.00437510
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x170], 0x38
call fcn.00403d30
lea ecx, [esp + 0x2c]
mov byte [esp + 0x16c], bl
call fcn.00407240
xor ebp, ebp
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.0040b5e0
push 0x5c
push eax
call fcn.0040b5c0
add esp, 8
lea ecx, [esp + 0x2c]
mov bl, al
call fcn.00407240
test bl, bl
je 0x40fb26
push 0x5c
lea ecx, [esp + 0x14]
call fcn.0040b640
lea ecx, [esp + 0x10]
call fcn.004032f0
push eax
call dword [sym.imp.dbghelp.dll_MakeSureDirectoryPathExists]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00402ec0
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x14]
call fcn.00405a50
lea edx, [esp + 0x34]
push edx
push 1
push ebp
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jge 0x40fbf1
mov ecx, esi
call fcn.0040c1c0
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x40fb7e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x40fb90
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esp + 0x38], ebp
lea ecx, [esp + 0x28]
call fcn.00407240
lea ecx, [esp + 0x10]
call fcn.00407240
mov eax, dword [esp + 0x58]
push eax
call sub.gdiplus.dll_GdipDeleteGraphics
mov ecx, dword [esp + 0x118]
push ecx
call sub.gdiplus.dll_GdipDisposeImage
mov edx, dword [esp + 0x30]
push edx
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [esp + 0x108]
push eax
call sub.gdiplus.dll_GdipDisposeImage
mov ecx, dword [esp + 0xf8]
push ecx
call sub.gdiplus.dll_GdipDisposeImage
mov edx, dword [esp + 0x40]
push edx
call sub.gdiplus.dll_GdipDisposeImage
mov eax, 0x8007000e
jmp 0x40ff08
mov ecx, dword [esp + 0x34]
push ebp
lea eax, [esp + 0x154]
push eax
push ecx
lea ecx, [esp + 0x120]
xor edi, edi
call fcn.00406260
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
lea ecx, [esp + 0x12c]
push ecx
push 1
push edi
push ebp
push eax
call dword [edx + 0x14]
mov eax, dword [esp + 0x12c]
push eax
mov dword [esp + 0x1c], eax
call fcn.0045c28b
mov edx, dword [esp + 0x14]
push 0x4772c0
push edx
mov edi, eax
call fcn.0044b9e3
mov ebx, eax
add esp, 0xc
cmp ebx, ebp
je 0x40fc94
cmp edi, ebp
je 0x40fc94
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [esp + 0x34]
push ebp
push ebp
xor eax, eax
push eax
push ebp
push edx
call dword [ecx + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push ebp
push edx
push edi
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x18]
push ebx
push eax
push 1
push edi
call fcn.0044b93b
push ebx
call fcn.0044b7e3
push edi
call fcn.0045c286
add esp, 0x18
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x40fca6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x4c], ebp
mov eax, dword [esp + 0x38]
cmp eax, ebp
je 0x40fcb8
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esp + 0x38], ebp
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x40fcca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x34], ebp
lea ecx, [esp + 0x28]
call fcn.00407240
lea ecx, [esp + 0x10]
call fcn.00407240
mov edx, dword [esp + 0x58]
push edx
call sub.gdiplus.dll_GdipDeleteGraphics
mov eax, dword [esp + 0x118]
push eax
call sub.gdiplus.dll_GdipDisposeImage
mov ecx, dword [esp + 0x30]
push ecx
call sub.gdiplus.dll_GdipDisposeImage
mov edx, dword [esp + 0x108]
push edx
call sub.gdiplus.dll_GdipDisposeImage
mov eax, dword [esp + 0xf8]
push eax
call sub.gdiplus.dll_GdipDisposeImage
mov ecx, dword [esp + 0x40]
push ecx
mov dword [esp + 0x170], 0xffffffff
call sub.gdiplus.dll_GdipDisposeImage
mov ebp, dword [esp + 0x8c]
mov al, byte [esi + 0x74]
test al, al
jns 0x40fd6a
mov ecx, dword [esi + 0x10]
xor eax, eax
cmp ecx, eax
je 0x40fd6a
mov dword [esi + 0xec8], eax
mov dword [esi + 0xecc], eax
xor edx, edx
add esi, 0xe70
mov dword [esi], edx
mov dword [esi + 4], edx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], edx
jmp 0x40ff06
cmp dword [esi + 0xeb0], ebp
jne 0x40fd93
cmp dword [esi + 0xeb4], ebp
je 0x40fd8a
mov eax, dword [esi + 0x1024]
mov edx, dword [eax]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [edx + 0x18]
mov ecx, esi
call fcn.0040d5a0
jmp 0x40fdb3
mov eax, dword [esi + 0x1008]
mov ecx, dword [eax]
xor ebx, ebx
push ebx
xor edi, edi
push edi
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x1024]
mov edx, dword [eax]
push ebx
push edi
push eax
call dword [edx + 0x18]
cmp dword [esi + 0xeb8], ebp
jne 0x40fdcf
test byte [esi + 0x74], 2
je 0x40fdef
mov eax, dword [esi + 0x1000]
mov dword [esi + 0x10a4], eax
jmp 0x40fdef
mov eax, dword [esi + 0xffc]
mov ecx, dword [eax]
xor ebx, ebx
push ebx
xor edi, edi
push edi
push eax
call dword [ecx + 0x18]
mov eax, dword [esi + 0x1000]
mov edx, dword [eax]
push ebx
push edi
push eax
call dword [edx + 0x18]
cmp dword [esi + 0xebc], ebp
jne 0x40fe00
mov ecx, esi
call fcn.0040b220
jmp 0x40fe10
mov eax, dword [esi + 0x101c]
mov edx, dword [eax]
xor ecx, ecx
push ecx
push ecx
push eax
call dword [edx + 0x18]
cmp dword [esi + 0xec0], ebp
jne 0x40fe1f
mov ecx, esi
call fcn.0040b970
mov eax, dword [esi + 0xec8]
mov ecx, dword [esi + 0xecc]
mov dword [esi + 0x1048], eax
mov dword [esi + 0x104c], ecx
lea ebx, [esi + 0x1048]
lea edi, [esi + 0xe70]
mov eax, edi
mov ecx, dword [eax]
lea edx, [esi + 0x1060]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [edx + 0xc], ecx
mov ecx, dword [esi + 0x1004]
mov dword [edx + 0x10], eax
lea edx, [esi + 0x14]
mov dword [esi + 0x1074], ecx
push edx
lea ecx, [esi + 0x1058]
mov dword [esi + 0x105c], ebp
call fcn.00403d30
lea eax, [esi + 0x88]
push eax
lea ecx, [esi + 0x1054]
call fcn.00403d30
lea ecx, [esi + 0x8c]
push ecx
lea ecx, [esi + 0x1050]
call fcn.00403d30
mov ecx, dword [esi + 0x10b8]
mov edx, dword [esp + 0x174]
xor ebp, ebp
cmp ecx, ebp
mov dword [esi + 0x1088], edx
je 0x40fecb
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
mov ecx, esi
call fcn.0040bf70
xor ecx, ecx
mov dword [esi + 0xec8], ebp
mov dword [esi + 0xecc], ebp
mov dword [edi], ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
push ebp
mov dword [edi + 0x10], ecx
push 0x476ba8
lea ecx, [esi + 0xff4]
call fcn.00403ad0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [esp + 0x164]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x160]
call fcn.00449c1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x160
ret 4