Function at 0x811528
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3e
push 0
push 0
dec ecx
jne 0x811530
push ebx
push esi
push edi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x44]
mov edx, dword [0x80ba68]
call fcn.0040b4b4
lea eax, [ebp - 0x74]
mov edx, dword [0x80ba68]
call fcn.0040b4b4
xor eax, eax
push ebp
push 0x8130d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x8116c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x84ced0]
cmp dword [eax], 6
jge 0x8115e2
lea eax, [ebp - 8]
call fcn.00813c10
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 8]
call fcn.00422720
mov edx, dword [ebp - 0xb4]
mov eax, 0x8130f4
call fcn.0042ac6c
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b048
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 8]
call fcn.008138ac
mov edx, dword [ebp - 0xb8]
lea eax, [ebp - 8]
call fcn.0040a384
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.00813e90
mov eax, dword [0x84ced0]
cmp dword [eax], 6
jl 0x81164f
lea eax, [ebp - 8]
call fcn.00813c58
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 8]
call fcn.00422720
mov edx, dword [ebp - 0xbc]
mov eax, 0x8130f4
call fcn.0042ac6c
mov ecx, eax
add ecx, 3
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040b048
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 8]
call fcn.008138ac
mov edx, dword [ebp - 0xc0]
lea eax, [ebp - 8]
call fcn.0040a384
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 8]
call fcn.00813e90
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x81310c
call fcn.00423f0c
mov edx, eax
inc edx
mov ecx, 0x7fffffff
mov eax, dword [ebp - 8]
call fcn.0040b048
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 4]
call fcn.00422720
mov edx, dword [ebp - 0xc4]
mov eax, 0x8130f4
call fcn.0042ac6c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b048
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 4]
call fcn.00422720
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 4]
call fcn.0040a384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8116d2
mov dl, 1
mov eax, dword [0x68842c]
call fcn.0068e94c
mov dword [ebp - 0x8c], eax
xor eax, eax
push ebp
push 0x811766
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xd0]
mov eax, dword [0x84ced0]
mov eax, dword [eax]
call fcn.004231c8
push dword [ebp - 0xd0]
push 0x81311c
lea edx, [ebp - 0xd4]
mov eax, dword [0x84d668]
mov eax, dword [eax]
call fcn.004231c8
push dword [ebp - 0xd4]
lea eax, [ebp - 0xcc]
mov edx, 3
call fcn.0040af60
mov eax, dword [ebp - 0xcc]
push eax
mov ecx, 0x81312c
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811790
xor eax, eax
push ebp
push 0x8117db
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x84d2dc]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x687ecc]
call fcn.0068e394
push eax
mov ecx, 0x813148
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d900
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811812
xor eax, eax
push ebp
push 0x81185a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xd8]
call fcn.00810d1c
mov eax, dword [ebp - 0xd8]
push eax
mov ecx, 0x813160
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811884
xor eax, eax
push ebp
push 0x8118cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xdc]
call fcn.00810e64
mov eax, dword [ebp - 0xdc]
push eax
mov ecx, 0x813174
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8118f6
xor eax, eax
push ebp
push 0x81193e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe0]
call fcn.00811334
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, 0x813188
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811968
xor eax, eax
push ebp
push 0x8119b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe4]
call fcn.008108b4
mov eax, dword [ebp - 0xe4]
push eax
mov ecx, 0x8131a0
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8119da
xor eax, eax
push ebp
push 0x811a22
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe8]
call fcn.00810910
mov eax, dword [ebp - 0xe8]
push eax
mov ecx, 0x8131b4
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811a4c
xor eax, eax
push ebp
push 0x811a94
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xec]
call fcn.00810ce8
mov eax, dword [ebp - 0xec]
push eax
mov ecx, 0x8131cc
mov dl, 1
mov eax, dword [0x687794]
call fcn.0068d954
mov edx, eax
mov eax, dword [ebp - 0x8c]
call fcn.0068eb8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811abe
mov dl, 1
mov eax, dword [0x68842c]
call fcn.0068e94c
mov dword [ebp - 0x7c], eax
lea edx, [ebp - 0x10]
mov eax, 0x8131e4
call fcn.0042ca4c
cmp dword [ebp - 0x10], 0
jne 0x811aed
lea edx, [ebp - 0x10]
mov eax, 0x813208
call fcn.0042ca4c
xor eax, eax
push ebp
push 0x811b1a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x84d8b0]
mov ecx, dword [ecx]
mov edx, 0x813230
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811b33
xor eax, eax
push ebp
push 0x811b97
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x84d914]
cmp byte [eax], 0
jne 0x811b6d
mov ecx, 0x56
mov dl, 1
mov eax, dword [0x687ecc]
call fcn.0068e394
mov ecx, eax
mov edx, 0x813244
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
jmp 0x811b8d
mov ecx, 0x40
mov dl, 1
mov eax, dword [0x687ecc]
call fcn.0068e394
mov ecx, eax
mov edx, 0x813244
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811bbe
xor eax, eax
push ebp
push 0x811bf4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xf0]
call fcn.00810844
mov ecx, dword [ebp - 0xf0]
mov edx, 0x813270
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811c0d
xor eax, eax
push ebp
push 0x811c56
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xf8]
xor eax, eax
call fcn.00406f90
mov eax, dword [ebp - 0xf8]
lea edx, [ebp - 0xf4]
call fcn.004240f4
mov ecx, dword [ebp - 0xf4]
mov edx, 0x813294
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811c6f
xor eax, eax
push ebp
push 0x811caa
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x84d2dc]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x687ecc]
call fcn.0068e394
mov ecx, eax
mov edx, 0x8132b8
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811cd1
xor eax, eax
push ebp
push 0x811d0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x84d92c]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x687ecc]
call fcn.0068e394
mov ecx, eax
mov edx, 0x8132d4
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811d33
xor eax, eax
push ebp
push 0x811d7f
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x8132f8]
push eax
lea eax, [ebp - 0xfc]
push eax
mov ecx, 0x813308
mov edx, 0x81310c
mov eax, dword [ebp - 8]
call fcn.0042ae5c
mov ecx, dword [ebp - 0xfc]
mov edx, 0x813320
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811d98
xor eax, eax
push ebp
push 0x811dda
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x24], 0
je 0x811dbe
mov ecx, dword [ebp - 0x24]
mov edx, 0x81334c
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
jmp 0x811dd0
mov ecx, 0x81337c
mov edx, 0x81334c
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811df6
xor eax, eax
push ebp
push 0x811ec2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x40], 0
je 0x811e68
lea ecx, [ebp - 0x104]
mov edx, 0x81338c
mov eax, 0x8133a4
call fcn.008146b0
push dword [ebp - 0x104]
lea ecx, [ebp - 0x108]
mov edx, 0x8133b8
mov eax, 0x8133d0
call fcn.008146b0
push dword [ebp - 0x108]
push 0x8133e4
lea eax, [ebp - 0x100]
mov edx, 3
call fcn.0040af60
mov edx, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
jmp 0x811eb8
lea ecx, [ebp - 0x10c]
mov edx, 0x8133fc
mov eax, 0x813414
call fcn.008146b0
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x110]
mov edx, 0x81342c
mov eax, 0x813448
call fcn.008146b0
mov edx, dword [ebp - 0x110]
pop eax
call fcn.0040ae80
mov edx, dword [ebp - 0x10c]
mov ecx, 0x81337c
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811f1c
xor eax, eax
push ebp
push 0x811f57
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x11c]
mov eax, 0x813450
call fcn.00813b00
mov ecx, dword [ebp - 0x11c]
mov edx, 0x813464
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811f70
xor edx, edx
push ebp
push 0x811fdd
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x90], 0x101
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x90]
call fcn.0040ae00
push 0
push 0
call sub.user32.dll_GetWindowLongW
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xc]
call fcn.0040a4dc
push eax
call sub.advapi32.dll_GetUserNameW
mov edx, dword [ebp - 0x90]
dec edx
lea eax, [ebp - 0xc]
call fcn.0040ae00
mov ecx, dword [ebp - 0xc]
mov edx, 0x813480
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x811ff6
xor eax, eax
push ebp
push 0x81201e
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x8134a0
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x812037
xor eax, eax
push ebp
push 0x812062
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x8c]
mov edx, 0x813230
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x81207b
xor eax, eax
push ebp
push 0x8120a7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00810ebc
mov ecx, eax
mov edx, 0x8134bc
mov eax, dword [ebp - 0x7c]
call fcn.0068ebd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8120c0
xor eax, eax
push ebp
push 0x8120f6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x120]
call fcn.008109a4
mov ecx, dword [ebp - 0x120]
mov edx, 0x8134d0
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x81210f
xor eax, eax
push ebp
push 0x812145
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x124]
call fcn.00810cdc
mov ecx, dword [ebp - 0x124]
mov edx, 0x8134e4
mov eax, dword [ebp - 0x7c]
call fcn.0068ec0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x81215e
mov dl, 1
mov eax, dword [0x68958c]
call fcn.0068fce0
mov dword [ebp - 0x84], eax
xor eax, eax
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x80ab80]
call fcn.0080b224
mov dword [ebp - 0x94], eax
mov dl, 1
mov eax, dword [0x491920]
call fcn.004b5bc8
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov byte [eax + 0x39], 0
mov dl, 1
mov eax, dword [0x491920]
call fcn.004b5bc8
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov byte [eax + 0x39], 0
xor eax, eax
push ebp
push 0x812ceb
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0080e758
test al, al
je 0x812935
mov ecx, 0xf023f
mov dl, 1
mov eax, dword [0x5084d8]
call fcn.00509668
mov dword [ebp - 0xa8], eax
xor eax, eax
push ebp
push 0x8123ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xa8]
call fcn.0050970c
mov edx, 0x8134f8
mov eax, dword [ebp - 0xa8]
call fcn.00509998
mov dl, 1
mov eax, dword [0x491920]
call fcn.004b5bc8
mov dword [ebp - 0xac], eax
xor eax, eax
push ebp
push 0x81238c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
call fcn.00509ddc
mov eax, dword [ebp - 0xa8]
call fcn.005096dc
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x81237e
inc esi
xor ebx, ebx
cmp dword [ebp - 0xb0], 0
jne 0x812292
mov dl, 1
mov eax, dword [0x68958c]
call fcn.0068fce0
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0x12c]
mov edx, ebx
mov eax, dword [ebp - 0xac]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
mov edx, 0x81356c
call fcn.0040aed8
mov edx, dword [ebp - 0x128]
mov eax, dword [ebp - 0xa8]
call fcn.00509998
test al, al
je 0x81236b
lea ecx, [ebp - 0x130]
mov edx, 0x8135e4
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
cmp dword [ebp - 0x130], 0
je 0x81236b
lea ecx, [ebp - 0x138]
mov edx, 0x813608
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0042249c
mov edx, dword [ebp - 0x134]
mov ecx, 1
mov eax, 0x813628
call fcn.0040b258
test eax, eax
jne 0x81236b
lea ecx, [ebp - 0x140]
mov edx, 0x8135e4
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x13c]
call fcn.00811460
mov edx, dword [ebp - 0x13c]
mov eax, dword [ebp - 0xb0]
call fcn.00690000
mov eax, dword [ebp - 0xa8]
call fcn.005096dc
inc ebx
dec esi
jne 0x812277
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x812393
ret
mov ecx, 0xf003f
mov dl, 1
mov eax, dword [0x5084d8]
call fcn.00509668
mov dword [ebp - 0xa8], eax
xor eax, eax
push ebp
push 0x812b04
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 0xa8]
call fcn.0050970c
mov edx, 0x8134f8
mov eax, dword [ebp - 0xa8]
call fcn.00509998
mov dl, 1
mov eax, dword [0x491920]
call fcn.004b5bc8
mov dword [ebp - 0xac], eax
xor eax, eax
push ebp
push 0x812ae4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
call fcn.00509ddc
mov eax, dword [ebp - 0xa8]
call fcn.005096dc
mov eax, dword [ebp - 0xac]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x812ad6
inc esi
xor ebx, ebx
cmp dword [ebp - 0xb0], 0
jne 0x8129ea
mov dl, 1
mov eax, dword [0x68958c]
call fcn.0068fce0
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0x19c]
mov edx, ebx
mov eax, dword [ebp - 0xac]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x19c]
lea eax, [ebp - 0x198]
mov edx, 0x81356c
call fcn.0040aed8
mov edx, dword [ebp - 0x198]
mov eax, dword [ebp - 0xa8]
call fcn.00509998
test al, al
je 0x812ac3
lea ecx, [ebp - 0x1a0]
mov edx, 0x8135e4
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
cmp dword [ebp - 0x1a0], 0
je 0x812ac3
lea ecx, [ebp - 0x1a8]
mov edx, 0x813608
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.0042249c
mov edx, dword [ebp - 0x1a4]
mov ecx, 1
mov eax, 0x813628
call fcn.0040b258
test eax, eax
jne 0x812ac3
lea ecx, [ebp - 0x1b0]
mov edx, 0x8135e4
mov eax, dword [ebp - 0xa8]
call fcn.0050a224
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.00811460
mov edx, dword [ebp - 0x1ac]
mov eax, dword [ebp - 0xb0]
call fcn.00690000
mov eax, dword [ebp - 0xa8]
call fcn.005096dc
inc ebx
dec esi
jne 0x8129cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x812aeb
ret