Function at 0x409ee0
Capabilities:
Check os version
Contain obfuscated stackstrings
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438238
mov eax, dword fs:[0]
push eax
sub esp, 0x70c
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x644], ecx
push 0
push 0x25
lea eax, [ebp - 0x410]
push eax
call fcn.0041aee6
add esp, 0xc
and dword [ebp - 4], 0
mov dword [ebp - 0x648], str._sc.exe
mov eax, dword [ebp - 0x648]
add eax, 2
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x648]
mov ax, word [eax]
mov word [ebp - 0x64e], ax
add dword [ebp - 0x648], 2
cmp word [ebp - 0x64e], 0
jne 0x409f43
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x64c]
sar eax, 1
mov dword [ebp - 0x654], eax
push dword [ebp - 0x654]
push str._sc.exe
lea ecx, [ebp - 0x410]
call fcn.004073b3
push str.DoInstall.cpp
lea ecx, [ebp - 0x48]
call fcn.00408211
mov byte [ebp - 4], 1
push str.Install_driver_start
lea eax, [ebp - 0x2c]
push eax
call fcn.00419558
pop ecx
pop ecx
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 2
push 1
push dword [ebp - 0x65c]
push 3
push 0xb9
lea eax, [ebp - 0x48]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 3
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402ad2
mov byte [ebp - 4], 1
mov byte [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00402ad2
mov byte [ebp - 4], 0
push 0
push 0
push str.stop_iphlpsvc
lea ecx, [ebp - 0x410]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x644]
call fcn.0040ee19
mov ecx, dword [ebp - 0x644]
call fcn.00414d65
mov ecx, dword [ebp - 0x644]
mov byte [ecx + 8], al
mov eax, dword [ebp - 0x644]
movzx eax, byte [eax + 8]
test eax, eax
je 0x40a291
mov ecx, dword [ebp - 0x644]
call fcn.0040eae6
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x644]
call fcn.00413860
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 2
jne 0x40a291
push 1
push str.DefaultInstall
push 0x43b7a8
push 0x80000001
call fcn.0041b3d2
add esp, 0x10
push str.DoInstall.cpp
lea ecx, [ebp - 0x80]
call fcn.00408211
mov byte [ebp - 4], 5
push str.Driver_exception__stop_it_restart_pc.
lea eax, [ebp - 0x64]
push eax
call fcn.00419558
pop ecx
pop ecx
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 6
push 1
push dword [ebp - 0x664]
push 3
push 0xc7
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00402ad2
mov byte [ebp - 4], 5
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.00402ad2
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x644]
mov byte [eax + 8], 0
mov esi, str.stop
lea edi, [ebp - 0x534]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0xf4
push 0
lea eax, [ebp - 0x528]
push eax
call fcn.0041d130
add esp, 0xc
lea eax, [ebp - 0x534]
dec eax
dec eax
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov ax, word [eax + 2]
mov word [ebp - 0x66a], ax
add dword [ebp - 0x668], 2
cmp word [ebp - 0x66a], 0
jne 0x40a15d
mov edi, dword [ebp - 0x668]
mov esi, str.YSDrv
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x410]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x100
push 0
lea eax, [ebp - 0x534]
push eax
call fcn.0041d130
add esp, 0xc
mov dword [ebp - 0x670], str.delete
lea eax, [ebp - 0x534]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x678], eax
mov eax, dword [ebp - 0x670]
mov ax, word [eax]
mov word [ebp - 0x67a], ax
mov eax, dword [ebp - 0x674]
mov cx, word [ebp - 0x67a]
mov word [eax], cx
mov eax, dword [ebp - 0x670]
inc eax
inc eax
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x674]
inc eax
inc eax
mov dword [ebp - 0x674], eax
cmp word [ebp - 0x67a], 0
jne 0x40a1e9
lea eax, [ebp - 0x534]
dec eax
dec eax
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x680]
mov ax, word [eax + 2]
mov word [ebp - 0x682], ax
add dword [ebp - 0x680], 2
cmp word [ebp - 0x682], 0
jne 0x40a23d
mov edi, dword [ebp - 0x680]
mov esi, str.YSDrv
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x410]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0x644]
call fcn.00409410
push str.DoInstall.cpp
lea ecx, [ebp - 0xb8]
call fcn.00408211
mov byte [ebp - 4], 9
push str.Kill_Process
lea eax, [ebp - 0x9c]
push eax
call fcn.00419558
pop ecx
pop ecx
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x68c], eax
mov byte [ebp - 4], 0xa
push 1
push dword [ebp - 0x68c]
push 3
push 0xd5
lea eax, [ebp - 0xb8]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.00402ad2
mov byte [ebp - 4], 9
mov byte [ebp - 4], 0xc
push 0
push 1
lea ecx, [ebp - 0xb8]
call fcn.00402ad2
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x644]
call fcn.004125e5
push str.DoInstall.cpp
lea ecx, [ebp - 0xf0]
call fcn.00408211
mov byte [ebp - 4], 0xd
push 0x43bb64
push str.Delete__s
lea eax, [ebp - 0xd4]
push eax
call fcn.00419558
add esp, 0xc
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x694], eax
mov byte [ebp - 4], 0xe
push 1
push dword [ebp - 0x694]
push 3
push 0xd7
lea eax, [ebp - 0xf0]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0xf
push 0
push 1
lea ecx, [ebp - 0xd4]
call fcn.00402ad2
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0x10
push 0
push 1
lea ecx, [ebp - 0xf0]
call fcn.00402ad2
mov byte [ebp - 4], 0
push 0
push 0
push str.stop_XQHDrv
lea ecx, [ebp - 0x410]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0x43bb24
lea ecx, [ebp - 0x410]
call fcn.00416ddb
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x26
lea eax, [ebp - 0x3f4]
push eax
call fcn.0041aee6
add esp, 0xc
mov byte [ebp - 4], 0x11
push 0x43bb20
lea ecx, [ebp - 0x29c]
call fcn.00408e1f
mov byte [ebp - 4], 0x12
push 0x43b782
lea ecx, [ebp - 0x42c]
call fcn.00408211
mov byte [ebp - 4], 0x13
push 0x43b782
lea ecx, [ebp - 0x244]
call fcn.00408211
mov byte [ebp - 4], 0x14
push 0x43bb1c
lea ecx, [ebp - 0x2b8]
call fcn.00408e1f
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x3f4]
push eax
call fcn.00408632
pop ecx
pop ecx
mov dword [ebp - 0x698], 0x43bb18
mov eax, dword [ebp - 0x698]
inc eax
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x698]
mov al, byte [eax]
mov byte [ebp - 0x69d], al
inc dword [ebp - 0x698]
cmp byte [ebp - 0x69d], 0
jne 0x40a4a5
mov eax, dword [ebp - 0x698]
sub eax, dword [ebp - 0x69c]
mov dword [ebp - 0x6a4], eax
push dword [ebp - 0x6a4]
push 0x43bb18
push 2
push 1
lea ecx, [ebp - 0x42c]
call fcn.00416775
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.00408591
pop ecx
pop ecx
push 0x445c98
lea eax, [ebp - 0x280]
push eax
call fcn.0041bc7d
pop ecx
pop ecx
mov byte [ebp - 4], 0x16
push 0x445c60
lea eax, [ebp - 0x264]
push eax
call fcn.0041bc7d
pop ecx
pop ecx
mov byte [ebp - 4], 0x17
push str.DoInstall.cpp
lea ecx, [ebp - 0x128]
call fcn.00408211
mov byte [ebp - 4], 0x18
push str.Start_Extract_File
lea eax, [ebp - 0x10c]
push eax
call fcn.00419558
pop ecx
pop ecx
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 4], 0x19
push 1
push dword [ebp - 0x6ac]
push 3
push 0xfb
lea eax, [ebp - 0x128]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0x1a
push 0
push 1
lea ecx, [ebp - 0x10c]
call fcn.00402ad2
mov byte [ebp - 4], 0x18
mov byte [ebp - 4], 0x1b
push 0
push 1
lea ecx, [ebp - 0x128]
call fcn.00402ad2
mov byte [ebp - 4], 0x17
push str.DoInstall.cpp
lea ecx, [ebp - 0x160]
call fcn.00408211
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x264]
call fcn.004169b1
mov dword [ebp - 0x5e0], eax
lea ecx, [ebp - 0x280]
call fcn.004169b1
mov dword [ebp - 0x5e4], eax
push dword [ebp - 0x5e0]
push dword [ebp - 0x5e4]
push str.Extract_file_path:_s__install_path_s
lea eax, [ebp - 0x144]
push eax
call fcn.00419558
add esp, 0x10
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b4], eax
mov byte [ebp - 4], 0x1d
push 1
push dword [ebp - 0x6b4]
push 3
push 0xfc
lea eax, [ebp - 0x160]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0x1e
push 0
push 1
lea ecx, [ebp - 0x144]
call fcn.00402ad2
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x1f
push 0
push 1
lea ecx, [ebp - 0x160]
call fcn.00402ad2
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x644]
call fcn.00409781
lea eax, [ebp - 0x3d8]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x558], esp
push 0x445c60
call fcn.00416670
mov dword [ebp - 0x6b8], eax
mov byte [ebp - 4], 0x20
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x55c], esp
push 0x445c98
call fcn.00416670
mov byte [ebp - 4], 0x17
call fcn.004087ab
add esp, 0x3c
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x228], eax
push str.DoInstall.cpp
lea ecx, [ebp - 0x198]
call fcn.00408211
mov byte [ebp - 4], 0x21
push dword [ebp - 0x228]
push str.Extract_file_result___d
lea eax, [ebp - 0x17c]
push eax
call fcn.00419558
add esp, 0xc
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 0x22
push 1
push dword [ebp - 0x6c4]
push 3
push 0x100
lea eax, [ebp - 0x198]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0x23
push 0
push 1
lea ecx, [ebp - 0x17c]
call fcn.00402ad2
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x24
push 0
push 1
lea ecx, [ebp - 0x198]
call fcn.00402ad2
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x644]
call fcn.00409781
push 0x114
push 0
lea eax, [ebp - 0x3d4]
push eax
call fcn.0041d130
add esp, 0xc
mov dword [ebp - 0x3d4], 0x114
lea eax, [ebp - 0x3d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x3d0], 6
jb 0x40a8a7
cmp dword [ebp - 0x3cc], 1
jb 0x40a8a7
push str.Bignox
push 0x445c60
lea eax, [ebp - 0x550]
push eax
call fcn.00417892
add esp, 0xc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x550]
call fcn.00416ddb
mov dword [ebp - 0x60c], eax
push dword [ebp - 0x60c]
call fcn.00408b16
pop ecx
mov dword [ebp - 0x554], eax
push str.DoInstall.cpp
lea ecx, [ebp - 0x1d0]
call fcn.00408211
mov byte [ebp - 4], 0x26
push dword [ebp - 0x554]
push str.Security___d
lea eax, [ebp - 0x1b4]
push eax
call fcn.00419558
add esp, 0xc
mov dword [ebp - 0x6c8], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 4], 0x27
push 1
push dword [ebp - 0x6cc]
push 3
push 0x10b
lea eax, [ebp - 0x1d0]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0x28
push 0
push 1
lea ecx, [ebp - 0x1b4]
call fcn.00402ad2
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x29
push 0
push 1
lea ecx, [ebp - 0x1d0]
call fcn.00402ad2
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x2a
push 0
push 1
lea ecx, [ebp - 0x550]
call fcn.004050af
mov byte [ebp - 4], 0x17
push dword [ebp - 0x3d8]
push dword [ebp - 0x228]
mov ecx, dword [ebp - 0x644]
call fcn.004130f4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x560], esp
push 0x445c60
call fcn.00416670
call fcn.00409279
add esp, 0x1c
call fcn.0041b5de
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
and eax, 0xffff
movzx eax, ax
test eax, eax
jne 0x40a90e
mov eax, dword [ebp - 0x248]
shr eax, 0x10
and eax, 0xffff
movzx eax, ax
cmp eax, 0xa
je 0x40a91e
mov eax, dword [ebp - 0x644]
cmp dword [eax + 0xc], 0x1f
jne 0x40a9ce
push str.DoInstall.cpp
lea ecx, [ebp - 0x208]
call fcn.00408211
mov byte [ebp - 4], 0x2b
push str.win10_do_copy
lea eax, [ebp - 0x1ec]
push eax
call fcn.00419558
pop ecx
pop ecx
mov dword [ebp - 0x6d0], eax
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x6d4], eax
mov byte [ebp - 4], 0x2c
push 1
push dword [ebp - 0x6d4]
push 3
push 0x120
lea eax, [ebp - 0x208]
push eax
mov ecx, 0x44621c
call fcn.0041952f
mov byte [ebp - 4], 0x2d
push 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.00402ad2
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2e
push 0
push 1
lea ecx, [ebp - 0x208]
call fcn.00402ad2
mov byte [ebp - 4], 0x17
call fcn.00415521
mov eax, dword [ebp - 0x644]
cmp dword [eax + 0xc], 0x1f
jne 0x40a9ce
mov dword [0x446288], 2
mov eax, dword [ebp - 0x644]
and dword [eax + 0xc], 0
mov dword [ebp - 0x6d8], 0x43bb20
mov eax, dword [ebp - 0x6d8]
add eax, 2
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x6d8]
mov ax, word [eax]
mov word [ebp - 0x6de], ax
add dword [ebp - 0x6d8], 2
cmp word [ebp - 0x6de], 0
jne 0x40a9e7
mov eax, dword [ebp - 0x6d8]
sub eax, dword [ebp - 0x6dc]
sar eax, 1
mov dword [ebp - 0x6e4], eax
push dword [ebp - 0x6e4]
push 0x43bb20
lea ecx, [ebp - 0x29c]
call fcn.0040606c
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00407683
mov dword [ebp - 0x6e8], 0x43ba2c
mov eax, dword [ebp - 0x6e8]
add eax, 2
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x6e8]
mov ax, word [eax]
mov word [ebp - 0x6ee], ax
add dword [ebp - 0x6e8], 2
cmp word [ebp - 0x6ee], 0
jne 0x40aa65
mov eax, dword [ebp - 0x6e8]
sub eax, dword [ebp - 0x6ec]
sar eax, 1
mov dword [ebp - 0x6f4], eax
push dword [ebp - 0x6f4]
push 0x43ba2c
lea ecx, [ebp - 0x29c]
call fcn.004073b3
mov dword [ebp - 0x6f8], str.NetWorkUninstaller.exe
mov eax, dword [ebp - 0x6f8]
add eax, 2
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6f8]
mov ax, word [eax]
mov word [ebp - 0x6fe], ax
add dword [ebp - 0x6f8], 2
cmp word [ebp - 0x6fe], 0
jne 0x40aac9
mov eax, dword [ebp - 0x6f8]
sub eax, dword [ebp - 0x6fc]
sar eax, 1
mov dword [ebp - 0x704], eax
push dword [ebp - 0x704]
push str.NetWorkUninstaller.exe
lea ecx, [ebp - 0x29c]
call fcn.004073b3
mov dword [ebp - 0x708], 0x43bb20
mov eax, dword [ebp - 0x708]
add eax, 2
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x708]
mov ax, word [eax]
mov word [ebp - 0x70e], ax
add dword [ebp - 0x708], 2
cmp word [ebp - 0x70e], 0
jne 0x40ab2d
mov eax, dword [ebp - 0x708]
sub eax, dword [ebp - 0x70c]
sar eax, 1
mov dword [ebp - 0x714], eax
push dword [ebp - 0x714]
push 0x43bb20
lea ecx, [ebp - 0x29c]
call fcn.004073b3
push 0x7530
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x564], esp
lea eax, [ebp - 0x29c]
push eax
call fcn.00416670
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp - 0x644]
call fcn.0040d183
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x640], eax
mov byte [ebp - 4], 0x2f
push dword [ebp - 0x640]
lea ecx, [ebp - 0x244]
call fcn.00406f0c
mov byte [ebp - 4], 0x30
push 0
push 1
lea ecx, [ebp - 0x224]
call fcn.00402ad2
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x644]
call fcn.0040acb8
mov byte [ebp - 4], 0x31
push 0
push 1
lea ecx, [ebp - 0x264]
call fcn.00402ad2
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 0x32
push 0
push 1
lea ecx, [ebp - 0x280]
call fcn.00402ad2
mov byte [ebp - 4], 0x15
mov byte [ebp - 4], 0x33
push 0
push 1
lea ecx, [ebp - 0x2b8]
call fcn.004050af
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0x34
push 0
push 1
lea ecx, [ebp - 0x244]
call fcn.00402ad2
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x35
push 0
push 1
lea ecx, [ebp - 0x42c]
call fcn.00402ad2
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x36
push 0
push 1
lea ecx, [ebp - 0x29c]
call fcn.004050af
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 0x37
push 0
push 1
lea ecx, [ebp - 0x3f4]
call fcn.004050af
mov byte [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.00404d88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c438
leave
ret