Function at 0x42af3c
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Check for unmoving mouse cursor
Log keystrokes via polling
Suspend thread

Disassembly:
push ebp
lea ebp, [esp - 0x4c0]
sub esp, 0x53c
mov eax, dword [0x47e5d0]
xor eax, ebp
mov dword [ebp + 0x4bc], eax
mov eax, dword [ebp + 0x4cc]
push ebx
mov ebx, dword [ebp + 0x4c8]
push esi
push edi
push 0x207
mov dword [ebp - 0x64], eax
xor edi, edi
lea eax, [ebp + 0x2b5]
push edi
push eax
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x55], 0
mov byte [ebp + 0x2b4], 0
call fcn.00452e00
mov esi, 0x103
push esi
lea eax, [ebp + 0x1b1]
push edi
push eax
mov byte [ebp + 0x1b0], 0
call fcn.00452e00
push esi
lea eax, [ebp - 0x53]
push edi
push eax
mov byte [ebp - 0x54], 0
call fcn.00452e00
mov dword [ebp - 0x7c], edi
xor eax, eax
and dword [ebp - 0x74], eax
and dword [0x480324], eax
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
lea esi, [ebx*4 + 0x481990]
mov ebx, dword [ebp - 0x64]
add esp, 0x24
imul ebx, ebx, 0xf54
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x64]
lea eax, [eax + ebx + 0x15c]
push dword [ebp - 0x68]
push eax
call fcn.00442c90
push edi
push edi
push dword [0x485434]
call fcn.0041e488
fmul qword [0x4663b8]
add esp, 0xc
call fcn.00454810
mov dword [ebp - 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x60], eax
mov eax, dword [esi]
add eax, ebx
push str.Freeze
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b055
push dword [0x485434]
push str.____Duration:__s_second_s_
call fcn.0042604a
pop ecx
pop ecx
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
jmp 0x42bae3
mov eax, dword [esi]
add eax, ebx
push 0x46a4e0
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b0db
push dword [0x485434]
push str.____Duration:__s_second_s_
call fcn.0042604a
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
call edi
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jae 0x42b04d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 0xfa
push 0
call esi
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], ebx
jl 0x42b0a5
mov eax, ebx
push eax
call esi
movzx eax, byte [0x47e00c]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x42b373
cmp dword [0x480338], 0
jne 0x42b373
call edi
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jb 0x42b097
jmp 0x42b04d
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
mov edi, str.Mouse
test eax, eax
jne 0x42b826
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b826
mov eax, dword [esi]
add eax, ebx
push str.Restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b37b
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2b4]
lea eax, [eax + 0x4804f8]
push ecx
push eax
mov dword [ebp - 0x5c], eax
call fcn.00411eca
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1b0]
push eax
xor edi, edi
push edi
push edi
push edi
push 1
call fcn.0044ad45
mov dword [ebp - 0x60], eax
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Remove
push eax
call fcn.004010ff
add esp, 0x28
test eax, eax
je 0x42b1b9
lea eax, [ebp + 0x1b0]
push eax
push edi
push edi
push edi
push 4
call fcn.0044ad45
lea eax, [ebp + 0x2b4]
push eax
push str.____Successfully_removed_restart_entry_for___s_
call fcn.0042604a
add esp, 0x1c
jmp 0x42b04d
push 0x103
lea eax, [ebp + 0x2b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x465ee0
push edi
push 0
lea eax, [ebp + 0x2b4]
push eax
call fcn.00449673
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2b4]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b220
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b250
push str.__r__
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [ebp - 0x64]
inc eax
push eax
lea eax, [ebp - 0x54]
push 0x464bf8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
cmp byte [eax], 0
mov edi, str.Temp
je 0x42b2c2
push str.Perm
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b2c2
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b2da
cmp dword [ebp - 0x60], 0
jne 0x42b2da
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp + 0x2b4]
push 0
push eax
call fcn.0044dba4
add esp, 0xc
push 0x103
lea eax, [ebp - 0x54]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp - 0x60], 0
je 0x42b355
push 0x466178
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b323
lea eax, [ebp - 0x54]
push str.vTask.EXE
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b355
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b04d
lea eax, [ebp + 0x1b0]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.0044ad45
add esp, 0x14
jmp 0x42b04d
push str.____Successfully_saved_restart_configuration
call fcn.0042604a
lea eax, [ebp + 0x2b4]
push eax
push str.____Script_will_be_launched_next_time_Windows_is_started___s_
call fcn.0042604a
add esp, 0xc
or eax, 0xffffffff
jmp 0x42bae3
mov eax, dword [esi]
add eax, ebx
push str.Window
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b40d
mov eax, dword [esi]
lea eax, [eax + ebx + 0x364]
push 0x465c0c
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b40d
mov eax, dword [esi]
xor edi, edi
push edi
push edi
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.00442c90
push edi
push dword [0x4800c0]
push dword [0x485434]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
call fcn.00424e7a
or eax, 0x4000
push eax
call fcn.0044e40c
mov dword [ebp - 0x60], eax
cmp eax, edi
je 0x42b40d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42b40d
cmp dword [0x480108], edi
jne 0x42b04d
mov eax, dword [ebp - 0x60]
mov dword [0x480108], eax
jmp 0x42b04d
mov eax, dword [ebp - 0x68]
mov dword [section..data], eax
mov eax, dword [ebp - 0x64]
mov dword [0x47e004], eax
mov eax, dword [esi]
and dword [eax + ebx + 0xf28], 0
xor eax, eax
mov edi, 0x4804c4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ecx, 0x4817b8
stosd dword es:[edi], eax
mov byte [ecx], 0
add ecx, 0x20
cmp ecx, 0x481858
jl 0x42b438
mov eax, dword [esi]
add eax, ebx
push str.Idle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b4be
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0xff
push edi
lea eax, [ebp + 0xb1]
push 0
push eax
mov byte [ebp + 0xb0], 0
call fcn.00452e00
push 0x100
lea eax, [ebp + 0xb0]
push 0
push eax
call fcn.00452e00
add esp, 0x18
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x5c], 0
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edi
jl 0x42b4a8
jmp 0x42b733
mov eax, dword [esi]
add eax, ebx
push str.Type
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b5bd
push 0x100
push 0
push 0x4840a8
call fcn.00452e00
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
push 0x90
call edi
test al, 1
je 0x42b503
mov byte [0x484138], 1
push 0x14
call edi
test al, 1
je 0x42b512
mov byte [0x4840bc], 1
push 0x91
call edi
test al, 1
je 0x42b524
mov byte [0x484139], 1
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.00442c90
push dword [0x485434]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
lea ecx, [eax + 1]
push 0x1f
pop eax
cmp ecx, eax
jg 0x42b55a
push dword [0x485434]
call edi
inc eax
push eax
push dword [0x485434]
push 0x4817b8
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
and dword [ebp - 0x5c], 0
push 0x4817b8
call edi
mov ecx, dword [ebp - 0x5c]
lea ecx, [ecx + 0x4817b8]
mov dl, byte [ecx]
dec eax
mov byte [ebp - 0x56], dl
test dl, dl
je 0x42b5a5
cmp dword [ebp - 0x5c], eax
jge 0x42b5a5
mov dl, byte [eax + 0x4817b8]
inc dword [ebp - 0x5c]
mov byte [ecx], dl
mov cl, byte [ebp - 0x56]
mov byte [eax + 0x4817b8], cl
jmp 0x42b577
push 0x4817b8
call edi
mov byte [0x4817d8], al
mov byte [0x484310], 0
jmp 0x42b733
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b717
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b717
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
push 0xc
lea ecx, [ebp + 0x2b4]
lea eax, [eax + 0x4804f8]
push ecx
push eax
mov dword [ebp - 0x5c], eax
call fcn.00411eca
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x103
lea eax, [ebp + 0x2b4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, 0x465ee0
push edi
push 0
lea eax, [ebp + 0x2b4]
push eax
call fcn.00449673
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x2b4]
push str.vTask.exe
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
jne 0x42b695
push str..VXM
push dword [ebp - 0x5c]
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b6c5
push str.__r__
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x5c]
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
lea eax, [ebp + 0x2b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
lea eax, [ebp + 0x2b4]
push eax
call edi
mov eax, dword [ebp - 0x64]
inc eax
push eax
lea eax, [ebp - 0x54]
push 0x464bf8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x2b4]
push eax
call edi
lea eax, [ebp + 0x1b0]
push eax
lea eax, [ebp + 0x2b4]
push 0
push eax
call fcn.0044dba4
add esp, 0xc
jmp 0x42b733
mov eax, dword [esi]
add eax, ebx
push str.File
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b733
or dword [0x4804c4], 0xffffffff
cmp dword [ebp - 0x6c], 0
mov edi, dword [sym.imp.USER32.dll_SetTimer]
jle 0x42b751
push 0
push dword [ebp - 0x6c]
push 0x806e
push dword [0x4800c0]
call edi
mov eax, dword [esi]
push 0
add eax, ebx
push str.Type
push eax
call fcn.004010ff
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0xfffffd12
add eax, 0x3e8
push eax
push 0x806c
push dword [0x4800c0]
call edi
push dword [0x4800c0]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push dword [0x4800c0]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x480260]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi]
add eax, ebx
push str.Date_Time
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b81c
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.restart
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b81c
push 0xc
lea eax, [ebp + 0x2b4]
push eax
mov eax, dword [ebp - 0x68]
imul eax, eax, 0x104
add eax, 0x4804f8
push eax
call fcn.00411eca
lea eax, [ebp + 0x2b4]
push eax
lea eax, [ebp + 0x1b0]
push str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x1b0]
push eax
xor eax, eax
push eax
push eax
push eax
push 4
call fcn.0044ad45
add esp, 0x20
mov eax, dword [0x480324]
jmp 0x42bae3
mov eax, dword [esi]
push 0
push 0
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [eax + ebx + 0x50]
call fcn.00442c90
mov eax, dword [0x485434]
cmp byte [eax], 0
je 0x42b878
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
call fcn.0044065c
mov ecx, dword [esi]
cmp dword [ecx + ebx + 0xf28], 1
mov byte [ebp - 0x56], al
jg 0x42b87c
movzx eax, al
push eax
push dword [0x485434]
push str.____Waiting_for_keypress__s___d_
call fcn.0042604a
add esp, 0xc
jmp 0x42b87c
mov byte [ebp - 0x56], 0
push 0x15e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xff
lea eax, [ebp + 0xb1]
push 0
push eax
mov byte [ebp + 0xb0], 0
call fcn.00452e00
push 0x100
lea eax, [ebp + 0xb0]
push 0
push eax
call fcn.00452e00
add esp, 0x18
lea eax, [ebp + 0xb0]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x5c], 0
push dword [ebp - 0x5c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 0xff
jl 0x42b8c8
mov eax, dword [esi]
add eax, ebx
push str.Keypress
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b8fb
mov byte [ebp - 0x55], 1
jmp 0x42b9ef
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b936
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Move
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b936
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x55], 2
jmp 0x42b9ef
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b967
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Left
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b967
mov byte [ebp - 0x55], 4
jmp 0x42b9ef
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b995
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Right
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b995
mov byte [ebp - 0x55], 8
jmp 0x42b9ef
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b9c3
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push str.Middle
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b9c3
mov byte [ebp - 0x55], 0x10
jmp 0x42b9ef
mov eax, dword [esi]
add eax, ebx
push edi
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b9ef
mov eax, dword [esi]
lea eax, [eax + ebx + 0x58]
push 0x464bdc
push eax
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x42b9ef
mov byte [ebp - 0x55], 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jae 0x42bae1
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
inc edi
cmp byte [ebp - 0x55], 0
je 0x42bae1
movzx eax, byte [0x47e00c]
push eax
call esi
test ax, ax
jne 0x42b373
cmp dword [0x480338], 0
jne 0x42b373
push 0
call ebx
push 0xfa
call ebx
movzx eax, byte [ebp - 0x55]
dec eax
je 0x42ba98
dec eax
je 0x42ba7e
dec eax
dec eax
je 0x42ba7b
sub eax, 4
je 0x42ba77
sub eax, 8
je 0x42ba73
sub eax, 0x10
jne 0x42bacf
push edi
call esi
test ax, ax
jne 0x42baaa
push 2
call esi
test ax, ax
jne 0x42baaa
push 4
jmp 0x42baa3
push 2
jmp 0x42baa3
push edi
jmp 0x42baa3
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x74]
jne 0x42baaa
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x70]
jmp 0x42baa8
cmp byte [ebp - 0x56], 0
je 0x42baae
movzx eax, byte [ebp - 0x56]
push eax
call esi
test ax, ax
je 0x42bacf
mov eax, edi
jmp 0x42bae3
xor edi, edi
lea eax, [edi - 8]
cmp eax, 0x97
ja 0x42bac6
push edi
call esi
test ax, ax
jne 0x42b04d
inc edi
cmp edi, 0xff
jl 0x42bab0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c]
jb 0x42ba0d
xor eax, eax
mov ecx, dword [ebp + 0x4bc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452dee
add ebp, 0x4c0
leave
ret 8