Function at 0x50fb20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0xf4
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0xf0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esp + 0x48], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xb0], edi
mov eax, dword [esi + 4]
mov edx, eax
mov dword [esp + 0xac], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x74], eax
mov eax, dword [esi + 0x20]
mov ebx, dword [esi]
bswap eax
shr eax, 8
mov dword [esp + 0x48], eax
mov eax, dword [esi + 0x28]
bswap eax
shr eax, 8
mov dword [esp + 0xd4], eax
mov eax, dword [esi + 0x24]
bswap eax
shr eax, 8
mov dword [esp + 0xe4], eax
mov eax, dword [esi + 0x2c]
bswap eax
imul edx, ebx
shr eax, 8
mov dword [esp + 0xd0], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x60], esi
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], edx
mov byte [esp + 0x3b], 0
mov dword [esp + 0xb8], ecx
test eax, eax
jne 0x50fbdd
lea eax, [edx*4]
push eax
push ecx
push edi
call fcn.00536b00
add esp, 0xc
jmp 0x50fbea
bswap eax
push edx
shr eax, 8
push eax
push edi
call sym.ProcessHacker.exe_PhFillMemoryUlong
cmp dword [esi + 0x14], 0
lea ecx, [ebx - 1]
fldz
xorps xmm3, xmm3
movss xmm2, dword [0x5b9678]
fst dword [esp + 0x88]
mov dword [esp + 0x44], ecx
mov dword [esp + 0xbc], 0x7fffffff
mov dword [esp + 0xcc], 0
mov dword [esp + 0x90], 0x7fffffff
mov dword [esp + 0x94], 0
jbe 0x50fd31
mov eax, dword [esi + 0x18]
movss xmm0, dword [eax]
comiss xmm3, xmm0
movss dword [esp + 0x34], xmm0
jbe 0x50fc57
mov dword [esp + 0x34], 0
jmp 0x50fc64
comiss xmm0, xmm2
jbe 0x50fc64
mov dword [esp + 0x34], 0x3f800000
mov eax, dword [esi + 4]
sub eax, 1
mov dword [esp + 0xa0], eax
fild dword [esp + 0xa0]
jns 0x50fc80
fadd dword [0x5b9734]
fstp dword [esp + 0x40]
fld dword [esp + 0x40]
fld dword [esp + 0x34]
fnstcw word [esp + 0x28]
movzx eax, word [esp + 0x28]
or eax, 0xc00
test byte [esi + 8], 0x10
mov dword [esp + 0x40], eax
fld st(0)
fmul st(2)
fldcw word [esp + 0x40]
fistp qword [esp + 0xa0]
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x80], eax
fldcw word [esp + 0x28]
je 0x50fd25
mov eax, dword [esi + 0x1c]
fadd dword [eax]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fxch st(2)
fcomi st(2)
fstp st(2)
jbe 0x50fce4
mov dword [esp + 0x2c], 0
jmp 0x50fcf7
movss xmm0, dword [esp + 0x2c]
comiss xmm0, xmm2
jbe 0x50fcf7
mov dword [esp + 0x2c], 0x3f800000
fmul dword [esp + 0x2c]
fnstcw word [esp + 0x28]
movzx eax, word [esp + 0x28]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0xa0]
mov edi, dword [esp + 0xa0]
fldcw word [esp + 0x28]
jmp 0x50fd3e
fstp st(0)
mov dword [esp + 0x2c], eax
fstp st(0)
mov edi, eax
jmp 0x50fd42
mov dword [esp + 0x80], 0
xor edi, edi
mov dword [esp + 0x2c], edi
test byte [esp + 0x74], 3
je 0x50fdae
movss xmm1, dword [esi + 0x38]
comiss xmm1, xmm3
movss dword [esp + 0xb4], xmm1
ja 0x50fd68
movaps xmm1, xmm3
movss dword [esp + 0xb4], xmm1
mov eax, dword [esi + 0x40]
xor edx, edx
mov dword [esp + 0x68], eax
movaps xmm0, xmm1
mov eax, dword [esi + 0x34]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x3c]
imul eax, dword [esi + 0xc]
movss dword [esp + 0x34], xmm1
movss dword [esp + 0x50], xmm0
div dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
sub eax, edx
mov edx, dword [esi + 0x30]
dec eax
bswap edx
shr edx, 8
mov dword [esp + 0x4c], eax
mov dword [esp + 0x98], edx
jmp 0x50fdde
mov eax, dword [esp + 0x48]
movss xmm0, dword [esp + 0x34]
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x48]
movss dword [esp + 0xb4], xmm0
movss xmm0, dword [esp + 0x50]
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x74]
fld dword [esp + 0x34]
and eax, 6
movss dword [esp + 0x5c], xmm0
fst dword [esp + 0x30]
cmp al, 6
jne 0x50ff3c
movss xmm0, dword [esi + 0x44]
comiss xmm0, xmm2
movss dword [esp + 0x34], xmm0
jbe 0x50ff23
fstp st(1)
fstp st(0)
fld dword [esp + 0x34]
fst dword [esp + 0x70]
call fcn.00556810
fstp qword [esp + 0xa0]
fld dword [esp + 0x30]
fst qword [esp + 0xd8]
call fcn.00556810
fchs
sub esp, 8
fdiv qword [esp + 0xa8]
fstp qword [esp]
call fcn.00553320
fsub qword [0x5b96a0]
add esp, 8
fmul qword [esp + 0xa0]
call fcn.005567c0
fmul qword [esp + 0xd8]
fstp dword [esp + 0x50]
fld dword [esp + 0x50]
fld dword [esp + 0x88]
fcomi st(1)
ja 0x50fef8
push ecx
fstp st(0)
fstp dword [esp]
call fcn.005569d1
add esp, 4
test ax, ax
jg 0x50feef
movss xmm1, dword ds:[esp + 0x50]
lea ecx, [ebx - 1]
fld dword [esp + 0x70]
xorps xmm3, xmm3
movss xmm2, dword [0x5b9678]
comiss xmm1, xmm2
fld dword [esp + 0x88]
fld dword [esp + 0x30]
movss dword [esp + 0x5c], xmm1
jbe 0x50fed1
movaps xmm1, xmm2
movss dword [esp + 0x5c], xmm1
movss dword [esp + 0x50], xmm1
fxch st(1)
fxch st(2)
mov eax, dword [esp + 0x74]
and eax, 0x1000
mov dword [esp + 0x40], eax
je 0x50ff4c
mov dword [esp + 0x8c], edi
xor eax, eax
jmp 0x50ff5b
fld dword [esp + 0x88]
jmp 0x50fefa
fstp st(1)
fld dword [esp + 0x70]
lea ecx, [ebx - 1]
fld dword [esp + 0x30]
xorps xmm3, xmm3
movss xmm2, dword [0x5b9678]
movaps xmm1, xmm3
movss dword [esp + 0x5c], xmm1
fxch st(1)
movss dword [esp + 0x50], xmm1
jmp 0x50fed5
fld dword [esp + 0x34]
movaps xmm1, xmm3
fst dword [esp + 0x70]
movss dword [esp + 0x5c], xmm1
movss dword [esp + 0x50], xmm1
jmp 0x50fed5
fld dword [esp + 0x34]
movss xmm1, dword [esp + 0x5c]
fst dword [esp + 0x70]
jmp 0x50fed5
mov eax, dword [esp + 0x48]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x48]
mov dword ds:[esp + 0x34], eax
test ecx, ecx
js 0x5104f8
mov eax, dword [esp + 0x74]
mov ecx, eax
and ecx, 1
mov dword [esp + 0xd8], ecx
mov ecx, eax
and ecx, 2
and eax, 0x10
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x58], eax
mov al, byte [esp + 0x3b]
mov dword [esp + 0xa0], ecx
jmp 0x50ffab
fxch st(2)
fxch st(1)
test al, al
jne 0x510122
mov edx, dword [esp + 0xb8]
mov ecx, edi
mov eax, dword [esp + 0x80]
inc edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0xb8], edx
cmp edx, dword [esi + 0x14]
jae 0x5100d7
lfence
mov eax, dword [esi + 0x18]
movss xmm0, dword [eax + edx*4]
comiss xmm3, xmm0
movss dword [esp + 0x30], xmm0
jbe 0x50ffff
mov dword [esp + 0x30], 0
jmp 0x51000c
comiss xmm0, xmm2
jbe 0x51000c
mov dword [esp + 0x30], 0x3f800000
mov eax, dword [esi + 4]
sub eax, 1
mov dword [esp + 0x78], eax
fild dword [esp + 0x78]
jns 0x510022
fadd dword [0x5b9734]
fstp dword ds:[esp + 0x64]
fld dword [esp + 0x64]
fld dword [esp + 0x30]
fnstcw word [esp + 0x28]
movzx eax, word [esp + 0x28]
or eax, 0xc00
test byte [esi + 8], 0x10
mov dword [esp + 0x30], eax
fld st(0)
fmul st(2)
fldcw word [esp + 0x30]
fistp qword [esp + 0x78]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x80], edi
fldcw word [esp + 0x28]
je 0x5100c5
mov eax, dword [esi + 0x1c]
fadd dword [eax + edx*4]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fxch st(4)
fcompi st(4)
fstp st(3)
jbe 0x510082
mov dword [esp + 0x2c], 0
jmp 0x510095
movss xmm0, dword [esp + 0x2c]
comiss xmm0, xmm2
jbe 0x510095
mov dword [esp + 0x2c], 0x3f800000
fld dword [esp + 0x2c]
fnstcw word [esp + 0x28]
movzx eax, word [esp + 0x28]
or eax, 0xc00
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
fmulp st(3)
fxch st(2)
fldcw word [esp + 0x30]
fistp qword [esp + 0x78]
mov edx, dword [esp + 0x78]
fldcw word [esp + 0x28]
jmp 0x5100e4
mov eax, dword [esp + 0x3c]
fstp st(0)
fstp st(0)
mov dword [esp + 0x2c], edi
fstp st(2)
mov edx, edi
jmp 0x5100e8
xor edi, edi
fstp st(2)
mov dword [esp + 0x80], edi
xor edx, edx
mov dword [esp + 0x2c], edx
add edi, eax
add ecx, edx
shr edi, 1
shr ecx, 1
cmp dword [esp + 0x40], 0
mov dword [esp + 0x64], edi
mov dword [esp + 0x30], ecx
je 0x51014a
mov ecx, dword [esp + 0xb8]
cmp ecx, dword [esi + 0x58]
jae 0x51014a
cmp dword [esp + 0x8c], edx
ja 0x51014a
mov dword ds:[esp + 0x8c], edx
mov dword [esp + 0x34], ecx
jmp 0x51014a
mov eax, dword [esp + 0x64]
fstp st(2)
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x84], ecx
lea ecx, [edi + eax]
mov dword [esp + 0x6c], eax
mov edi, dword [esp + 0xcc]
shr ecx, 1
mov edx, ecx
mov dword [esp + 0x78], edi
mov edi, dword [esp + 0x64]
imul edx, ebx
mov esi, dword [esp + 0xbc]
add edx, ebx
cmp edi, eax
cmovae eax, ecx
imul eax, ebx
mov dword [esp + 0x6c], eax
mov eax, ebx
imul eax, dword [esp + 0x3c]
mov ebx, edx
cmp edi, dword [esp + 0x3c]
mov edi, ecx
mov ecx, dword [esp + 0x64]
cmovae ebx, eax
cmp ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x6c]
cmovae edi, ecx
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0xc0]
imul edi, ebx
mov dword [esp + 0xcc], edi
mov edi, ebx
imul edi, ecx
cmp ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x28]
cmovae edi, edx
mov edx, dword [esp + 0x44]
cmp ecx, esi
mov dword [esp + 0xbc], edi
cmovg ecx, esi
cmp eax, dword [esp + 0x78]
cmovl eax, dword [esp + 0x78]
add ecx, edx
add eax, edx
mov dword [esp + 0x28], ecx
cmp dword [esp + 0xc8], 0
mov dword [esp + 0x6c], eax
je 0x5103d7
mov eax, dword ds:[esp + 0x84]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x94]
add ecx, eax
shr ecx, 1
mov edx, ecx
mov dword [esp + 0x78], edi
mov edi, dword [esp + 0x30]
imul edx, ebx
mov dword [esp + 0x58], eax
mov esi, dword [esp + 0x90]
add edx, ebx
cmp edi, eax
cmovae eax, ecx
imul eax, ebx
mov dword [esp + 0x58], eax
mov eax, ebx
imul eax, dword [esp + 0x84]
mov ebx, edx
cmp edi, dword [esp + 0x84]
mov edi, ecx
mov ecx, dword [esp + 0x30]
cmovae ebx, eax
cmp ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x58]
cmovae edi, ecx
mov dword [esp + 0x9c], ebx
mov ebx, dword [esp + 0xc0]
imul edi, ebx
mov dword [esp + 0x94], edi
mov edi, ecx
imul edi, ebx
cmp ecx, dword [esp + 0x84]
mov ecx, dword [esp + 0x9c]
cmovae edi, edx
mov edx, dword [esp + 0x44]
cmp ecx, esi
mov dword [esp + 0x90], edi
mov edi, dword [esp + 0xb0]
cmovg ecx, esi
cmp eax, dword [esp + 0x78]
cmovl eax, dword [esp + 0x78]
add ecx, edx
add eax, edx
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x6c]
add eax, ebx
cmp eax, ecx
jge 0x5102f0
mov esi, dword [esp + 0xd0]
mov dword [edi + eax*4], esi
add eax, ebx
cmp eax, ecx
jl 0x5102cb
mov eax, dword [esp + 0x90]
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0x28]
mov eax, edx
cmp edx, ecx
jge 0x51030a
mov esi, dword [esp + 0xd4]
mov dword [edi + eax*4], esi
add eax, ebx
cmp eax, ecx
jl 0x510301
cmp dword [esp + 0xd8], 0
je 0x510356
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x510342
mov eax, edx
cmp edx, dword [esp + 0xc4]
jge 0x51033e
mov esi, dword [esp + 0x98]
mov dword [edi + eax*4], esi
add eax, ebx
cmp eax, dword [esp + 0xc4]
jl 0x510330
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x60]
inc eax
cmp eax, dword [esi + 0x34]
mov esi, 0
cmove eax, esi
mov dword [esp + 0x4c], eax
cmp dword ds:[esp + 0xa0], 0
je 0x510466
mov esi, dword [esp + 0xac]
dec esi
test byte [esp + 0x74], 4
mov dword [esp + 0x78], esi
fild dword [esp + 0x78]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
je 0x5103e5
fld dword [esp + 0x50]
fmul st(1)
movss dword [esp + 0x3c], xmm1
call fcn.00555460
cmp eax, esi
jg 0x5103d0
fld dword [esp + 0x3c]
fdiv st(3)
mov ecx, eax
mov edx, dword [esp + 0x98]
mov esi, eax
imul ecx, ebx
fstp dword [esp + 0x3c]
fld dword [esp + 0x3c]
fld st(0)
fmul st(2)
add ecx, dword [esp + 0x44]
mov dword [edi + ecx*4], edx
call fcn.00555460
sub esi, dword [esp + 0x68]
cmp eax, esi
jle 0x51039e
fstp st(0)
fstp st(0)
jmp 0x51045e
mov edi, dword ds:[esp + 0xb0]
jmp 0x5102f4
movss xmm0, dword ds:[esp + 0xb4]
fstp st(2)
fld st(0)
movss dword [esp + 0x3c], xmm0
fld st(0)
fmul st(3)
call fcn.00555460
mov edx, eax
xor esi, esi
mov eax, dword [esp + 0xac]
dec eax
cmp edx, eax
jge 0x51045c
fld dword [esp + 0x3c]
mov ecx, dword ds:[esp + 0x68]
add ecx, esi
cmp edx, ecx
jl 0x510439
mov ecx, dword [esp + 0x98]
mov eax, edx
imul eax, ebx
mov esi, edx
add eax, dword [esp + 0x44]
mov dword [edi + eax*4], ecx
fadd st(1)
fstp dword [esp + 0x3c]
fld dword [esp + 0x3c]
fld st(0)
fmul st(4)
call fcn.00555460
mov edx, eax
mov eax, dword [esp + 0xac]
dec eax
cmp edx, eax
jl 0x510419
fstp st(0)
fstp st(2)
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x44]
cmp dword [esp + 0xc8], 0
fstp st(1)
je 0x5104a2
mov esi, dword ds:[esp + 0x9c]
mov eax, esi
cmp esi, dword [esp + 0x58]
jg 0x5104a2
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0xe4]
mov dword [edi + eax*4], ecx
add eax, ebx
cmp eax, esi
jle 0x510491
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x6c]
cmp ecx, eax
jg 0x5104b7
mov esi, dword [esp + 0x48]
mov dword [edi + ecx*4], esi
add ecx, ebx
cmp ecx, eax
jle 0x5104ae
mov al, byte [esp + 0x3b]
xorps xmm3, xmm3
fld dword [esp + 0x70]
xor al, 1
movss xmm1, dword [esp + 0x5c]
sub edx, 1
movss xmm2, dword [0x5b9678]
fld dword [esp + 0x88]
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x2c]
mov byte [esp + 0x3b], al
mov dword [esp + 0x44], edx
jns 0x50ffa7
fstp st(0)
fstp st(0)
jmp 0x5104fc
fstp st(2)
fstp st(1)
cmp dword [esp + 0x40], 0
fstp st(0)
je 0x510675
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esi + 0x14]
jae 0x510675
test byte [esp + 0x74], 0x10
lfence
mov eax, dword [esi + 0x18]
movss xmm0, dword [eax + ecx*4]
movss dword [esp + 0x68], xmm0
je 0x51053f
lfence
mov eax, dword [esi + 0x1c]
fld dword [eax + ecx*4]
fadd dword [esp + 0x68]
fstp dword [esp + 0x68]
fld dword [esi + 0x4c]
sub esp, 8
fstp dword [esp + 4]
fld dword [esp + 0x70]
fstp dword [esp]
push ecx
push esi
mov esi, dword [esi + 0x48]
mov ecx, esi
call dword [0x55890c]
call esi
mov esi, dword [esp + 0x60]
mov edi, eax
test edi, edi
je 0x510679
xor eax, eax
lfence
mov dword [esp + 0x40], eax
mov eax, dword [esi + 0x50]
test eax, eax
je 0x51058c
push eax
push dword [esp + 0x58]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x40], eax
push dword [esi + 0x54]
push dword [esp + 0x58]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 1
push dword [esp + 0x58]
call dword [sym.imp.GDI32.dll_SetBkMode]
lea eax, ds:[esp + 0xe4]
push eax
mov eax, dword [edi]
shr eax, 1
push eax
push dword [edi + 4]
push dword [esp + 0x60]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov edx, dword [esp + 0xac]
sub edx, dword [esp + 0x8c]
mov eax, dword [0x5c9514]
sub edx, eax
mov ecx, dword [esp + 0xe8]
mov dword [esp + 0xf8], edx
sub edx, ecx
mov dword [esp + 0xf0], edx
cmp edx, eax
jge 0x510606
mov dword [esp + 0xf0], eax
add eax, ecx
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x34]
mov ecx, ebx
add eax, eax
mov dword [esp + 0xec], 0
cmp eax, ebx
push 0x102
cmovl ecx, eax
lea eax, [esp + 0xf0]
push eax
mov eax, dword [edi]
sub ebx, ecx
sub ebx, dword [0x5c9518]
shr eax, 1
push eax
push dword [edi + 4]
mov dword [esp + 0x104], ebx
mov ebx, dword [esp + 0x64]
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x51065d
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x51067d
lfence
call fcn.004c1f60
jmp 0x51067d
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
cmp dword [esi + 0x60], 0
je 0x5106f9
mov eax, dword [esi + 0x84]
xor edi, edi
test eax, eax
je 0x51069d
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push 1
push ebx
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [esi + 0x8c]
push ebx
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push 0x12
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esi + 0x74]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push dword [esi + 0x88]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x100
lea eax, [esi + 0x64]
push eax
mov eax, dword [esi + 0x5c]
shr eax, 1
push eax
push dword [esi + 0x60]
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
test edi, edi
je 0x5106f9
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret 0xc