Function at 0x1003edb9
Capabilities:
Get keyboard layout

Disassembly:
mov eax, 0x10065857
call fcn.10063a38
sub esp, 0x19c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003f8a9
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x1003f007
mov dword [ebp - 0x1c], 0x42dc
cmp dword [ebp - 0x1c], 0x4600
jle 0x1003ee89
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, esi
mov esi, dword [ebp - 0x18]
cdq
idiv edi
mov edi, ebx
mov eax, edx
mov dword [ebp - 0x30], eax
lea ecx, [eax + edi]
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x168]
cdq
push edx
push eax
call fcn.10003a70
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ee38
mov eax, dword [eax]
push eax
call fcn.1004bc39
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x168]
call fcn.10003049
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x5676
jl 0x1003ee19
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x6582
jl 0x1003ee0a
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1438
jl 0x1003ee05
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x54f1
jl 0x1003ee00
push 2
lea ecx, [ebp - 0x104]
call fcn.10002861
cmp dword [ebp - 0x1c], 0x3ef9
jge 0x1003eeaa
push str.lcpuylcf_rko_nbf_karah_gfcxa_waqqos_hqinike_plhfu
call fcn.1004bc39
pop ecx
push 0x6151
lea eax, [ebp - 0x104]
mov dword [ebp - 4], ebx
push eax
push 0x1bcc
mov dword [ebp - 0x18], 0xc29000d4
lea edx, [ebp - 0x8c]
mov dword [ebp - 0x3c], 0xffffffff
push 1
call fcn.1003cd66
add esp, 0x10
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
jl 0x1003eff7
mov dword [ebp - 0x3c], 0x7e55059b
mov dword [ebp - 0x3c], 0x5934215e
mov dword [ebp - 0x28], 0x7e59
cmp dword [ebp - 0x28], 0x7f67
jle 0x1003ef3a
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10081ef8
cdq
push edx
push eax
call fcn.10003ea0
inc edi
cmp edi, 0x7fc3
jl 0x1003ef0e
inc esi
cmp esi, 0x11ce
jl 0x1003ef0c
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 0x3c], 0x21009d43
mov byte [ebp - 4], 3
cmp dword [ebp - 0x28], 0x7e22
jge 0x1003ef7b
mov edx, str.ptfqhh_igyhe_rmocrh_jlqox
mov ecx, 0x10081ef8
call fcn.10005908
jmp 0x1003ef7b
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x138]
push dword [ebp - 0x8c]
movdqa xmm0, xmmword [0x10073810]
lea ecx, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x148]
mov dword [ebp - 0x3c], 0x2a82a10a
push eax
mov dword [ebp - 0x3c], 0x4c38b6b0
push ebx
movdqu xmmword [ebp - 0x148], xmm0
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
call fcn.10002972
mov byte [ebp - 4], 5
lea edx, [ebp - 0x80]
mov dword [ebp - 0x80], 0xffff
call fcn.1003f961
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.100028c3
dec dword [ebp - 0x18]
jmp 0x1003eee3
lea ecx, [ebp - 0x104]
call fcn.100028c3
jmp 0x1003f950
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x40], 0x68ec0ae9
push 6
pop esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x68], 0xfffffffd
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x58], 0x222c7e12
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], 0xffffffe3
jmp 0x1003f222
mov dword [ebp - 0x9c], 0x6941fc9a
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x60], 0x6eea5306
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x54], 0xa50887c5
push 3
call fcn.10002861
push 0x2835
push 0x21f1
push 0x33f4
push 0x2267
push 0x1576
push ebx
push 0x2c2e
lea eax, [ebp - 0x118]
mov dword [ebp - 4], esi
push eax
push ebx
push 1
lea eax, [ebp - 0xe8]
mov edx, 0x79ff
push eax
push 0x181e
mov ecx, 0x76ad
call fcn.10040121
add esp, 0x2c
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x9c]
push eax
push ecx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x34]
push eax
push 1
lea ecx, [ebp - 0x40]
call fcn.1003ea4e
mov eax, dword [ebp - 0x68]
add esp, 0x24
mov eax, dword [ebp - 0x34]
mov ecx, 0x2e633725
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
sub ecx, eax
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0x848298bb
je 0x1003f11d
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x60], ebx
je 0x1003f15a
push 0x300f
push ebx
lea edx, [ebp - 0x37]
mov byte [ebp - 0x37], bl
xor cl, cl
call fcn.1003ac86
push 0x68dc
lea eax, [ebp - 0x54]
mov edx, 0x5fb7
push 0x686e
push eax
xor cl, cl
call fcn.1003fa8d
add esp, 0x14
jmp 0x1003f210
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x94], 0x1b3d
mov dword [ebp - 0x34], ebx
jmp 0x1003f206
push 0x36de
lea eax, [ebp - 0x94]
mov dword [ebp - 0x84], 0xa796fb6c
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x98], 0xb3dad933
push eax
push 0x1a4c
lea eax, [ebp - 0xe8]
mov cl, 1
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x6fd7
lea eax, [ebp - 0x60]
push eax
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x2bd0
push 0x77c3
push 0x49d8
lea eax, [ebp - 0x34]
push eax
push 0xd2
push 0x4c7d
lea eax, [ebp - 0x98]
push eax
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0xa0]
call fcn.1003defb
add esp, 0x58
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jle 0x1003f176
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.100028c3
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x16
je 0x1003f047
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1003f24a
push 1
push 0x6fec
mov edx, 0x5f6d
xor cl, cl
call fcn.1003cd25
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0x2971c1e
lea ecx, [ebp - 0xdc]
push 1
call fcn.10002861
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 7
push ebx
push eax
lea edx, [ebp - 0xdc]
call fcn.1003adb6
pop ecx
pop ecx
mov dword [ebp - 0x44], ebx
jmp 0x1003f28d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x18c], 0x76038591
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 3
jl 0x1003f27c
mov dword [ebp - 0x14], 0x83
cmp dword [ebp - 0x14], 0x19d
jle 0x1003f309
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
mov dword [ebp - 0x28], ebx
and eax, edi
mov dword [ebp - 0x30], eax
mov edi, eax
mov esi, ebx
mov ebx, dword [ebp - 0x28]
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10081ef8
or eax, edi
cdq
push edx
push eax
call fcn.10003ea0
inc esi
cmp esi, 0x753f
jl 0x1003f2be
inc ebx
push 0
mov dword [ebp - 0x28], ebx
cmp ebx, 0x6671
pop ebx
jl 0x1003f2b9
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x112d
jl 0x1003f2ad
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2bde
jl 0x1003f2a8
push ebx
mov ecx, 0x710f
call fcn.1003aa3f
mov byte [ebp - 4], 8
cmp dword [ebp - 0x14], 0xfffffd4e
pop ecx
jge 0x1003f34f
mov edx, str.xcrut_wcpkg_urnm_wcfgsw_unphwshim_kqkkpthz_cfzl_wcbhvok_otvwxwduq
mov ecx, 0x10081ef8
call fcn.10005908
jmp 0x1003f34f
xor edx, edx
mov dword [ebp - 4], 7
inc edx
cmp dword [ebp - 0x1c], ebx
je 0x1003f37e
push ecx
push ebx
push ecx
push 0x221c
push 0x2a50
lea ecx, [ebp - 0x36]
mov byte [ebp - 0x36], bl
call fcn.1003c922
add esp, 0x14
jmp 0x1003f46c
mov dword [ebp - 0x78], 0x19f23e52
mov dword [ebp - 0x14], ebx
jmp 0x1003f397
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003f38a
mov dword [ebp - 0x14], ebx
jmp 0x1003f3ab
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x70], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1003f3a1
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0xdc]
mov dword [eax], ecx
mov dword [ebp - 0x1c], 0xffffffef
cmp dword [ebp - 0x1c], 8
jne 0x1003f46c
jmp 0x1003f3d4
xor edx, edx
inc edx
push dword [ebp - 0x70]
movdqa xmm0, xmmword [0x10073820]
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x30], edx
push eax
push ebx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc4], ebx
movdqu xmmword [ebp - 0x138], xmm0
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
call fcn.10002972
xor dl, dl
mov byte [ebp - 4], 0xa
call fcn.1003a938
push 0x7d63
push 1
push 0x72f6
push 0xf15
push 0x4d1f
lea eax, [ebp - 0x78]
mov edx, 0x5e2b
push eax
push 0x6a8e
push ebx
xor cl, cl
call fcn.1003c94b
add esp, 0x20
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc4]
call fcn.100028c3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 8
je 0x1003f3d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.100028c3
mov eax, dword [ebp - 0x5c]
mov edx, 0x1ff4
xor cl, cl
movzx eax, word [eax]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
push 0x3a9a
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x1d32
call fcn.1003cdb8
add esp, 0x14
mov dword [ebp - 0x28], ebx
mov ecx, ebx
cmp ecx, 2
jae 0x1003f7b6
mov dword [ebp - 0x1c], 0x9ac7
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x30], 0x14ba09a1
push 1
call fcn.10002861
push ecx
lea eax, [ebp - 0x114]
mov dword [ebp - 4], 0xb
push eax
push ecx
push ecx
mov dword [ebp - 0x7c], 0x6c14
lea edx, [ebp - 0xf8]
xor cl, cl
call fcn.1003d371
add esp, 0x10
cmp dword [ebp - 0x1c], ebx
je 0x1003f603
push 1
lea ecx, [ebp - 0xac]
call fcn.10002861
push ecx
lea eax, [ebp - 0x108]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x30], 0x312b9482
lea ecx, [ebp - 0xac]
push eax
call fcn.10040701
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1003f5e9
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], 0xffffffee
jmp 0x1003f591
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
jmp 0x1003f588
mov dword [ebp - 0x18], 0x76881957
mov dword [ebp - 0x18], ebx
jmp 0x1003f580
push 0x6693
push 1
mov edx, 0x2487
xor cl, cl
call fcn.1003ac86
inc dword [ebp - 0x18]
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
jle 0x1003f568
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffe
je 0x1003f55c
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jge 0x1003f54c
cmp dword [ebp - 0x1c], 0x272b
jg 0x1003f5d1
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0xac]
mov esi, dword [eax]
mov eax, dword [ebp - 0x14]
cmp eax, 1
setle cl
xor edx, edx
cmp ecx, esi
setle dl
xor eax, eax
add edx, esi
cmp edx, 0xfffffff8
setge al
cmp eax, dword [ebp - 0x14]
jg 0x1003f5d1
xor eax, eax
inc eax
jmp 0x1003f5d3
mov eax, ebx
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 0x3ae5d5ec
setne cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jl 0x1003f53c
lea ecx, [ebp - 0xac]
call fcn.100028c3
jmp 0x1003f788
mov dword [ebp - 0x30], 0x127420ea
mov dword [ebp - 0x1c], 0x534
cmp dword [ebp - 0x1c], 0x778
jle 0x1003f678
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov ecx, esi
lea ebx, [edi + eax]
mov edi, dword [ebp - 0x30]
sar ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10081ef8
cdq
push edx
push eax
call fcn.10003ea0
inc edi
cmp edi, 0x4b10
jl 0x1003f633
mov edi, dword [ebp - 0x20]
inc esi
mov eax, dword [ebp - 0x18]
push 0
pop ebx
cmp esi, 0x5f13
jl 0x1003f626
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x45b6
jl 0x1003f624
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x4992
jl 0x1003f61f
mov dword [ebp - 0x30], 0x56a42623
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x1c], 0x4c6
jge 0x1003f6b9
mov edx, str.lave_prf_nxthake_tibwz_avkenmch_swpllmpj_ezdcvuu_uqimg_sszx_zzitz
mov ecx, 0x10081ef8
call fcn.10005908
jmp 0x1003f6b9
push 0x1ac4
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x35]
xor eax, eax
xor dl, dl
inc eax
push 0x45ad
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
push ebx
mov dword [ebp - 0x120], eax
push eax
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x35], bl
push 0x654c
call fcn.1003c34b
mov dword [ebp - 0x18], 0x519c
add esp, 0x14
cmp dword [ebp - 0x18], 0x52b0
jle 0x1003f766
push 0x2463
push 0x1c9c
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x180]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10003a70
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f73f
mov eax, dword [eax]
push eax
call fcn.1004bc39
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x180]
call fcn.10003049
inc edi
cmp edi, 0x2059
jl 0x1003f720
inc esi
cmp esi, 0x6944
jl 0x1003f71e
push ebx
push ecx
lea eax, [ebp - 0x7c]
push eax
call fcn.1003aa0a
add esp, 0xc
cmp dword [ebp - 0x18], 0x5097
jge 0x1003f788
push str.bhph_wsagjebzl_cqgm_ozxnjgat_lzy_izcaqzew_qpdeu_jslgajl_huwji_kjub_qpnt_szyuod
call fcn.1004bc39
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.100028c3
mov eax, dword [ebp - 0x28]
mov dl, 0x39
mov esi, dword [ebp - 0x5c]
mov cl, byte [eax + esi]
call fcn.100454cf
mov ecx, dword [ebp - 0x28]
mov byte [ecx + esi], al
inc ecx
mov dword [ebp - 0x28], ecx
jmp 0x1003f4ab
push 4
lea ecx, [ebp - 0xd0]
call fcn.10002861
push 3
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], 0x11
call fcn.10002861
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2c], ebx
jmp 0x1003f7f1
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x150], 0x62fd41e5
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1003f7e0
push 0x388c
push ecx
lea eax, [ebp - 0x2c]
mov edx, 0x57b7
push eax
push ebx
push ecx
lea ecx, [ebp - 0xd0]
call fcn.1003cb59
pop ecx
pop ecx
push 0x514a
push ecx
lea eax, [ebp - 0xf4]
push eax
push ecx
push 0x4106
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
xor cl, cl
call fcn.1003e083
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
add esp, 0x2c
inc ecx
jmp 0x1003f84a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jl 0x1003f840
push ecx
push ecx
push 0x52cb
xor dl, dl
lea ecx, [ebp - 0xf4]
call fcn.100412b2
add esp, 0xc
mov dword [ebp - 0x48], ebx
jmp 0x1003f87e
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0x11151c3c
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 4
jl 0x1003f86b
lea ecx, [ebp - 0xf4]
call fcn.100028c3
lea ecx, [ebp - 0xd0]
call fcn.100028c3
mov eax, dword [ebp - 0x3c]
mov cx, word [ebp - 0x50]
mov word [eax], cx
jmp 0x1003f950
cmp byte [ebp + 8], 0
je 0x1003f948
xor ebx, ebx
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], bl
je 0x1003f8c8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x28], 0x3d9a
cmp dword [ebp - 0x28], 0x3dc1
jle 0x1003f932
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x50], ebx
xor eax, edi
lea ecx, [ebp - 0x1a4]
or eax, esi
cdq
push edx
push eax
call fcn.10003a70
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f8fd
mov eax, dword [eax]
push eax
call fcn.1004bc39
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1a4]
call fcn.10003049
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 0x5e85
jl 0x1003f8e1
inc edi
cmp edi, 0x3bc0
jl 0x1003f8dc
inc esi
cmp esi, 0x2660
jl 0x1003f8da
cmp dword [ebp - 0x28], 0x39e4
jge 0x1003f950
push str.efvujr_beae_ytj_qbfayjty_vcf_dyme
call fcn.1004bc39
pop ecx
jmp 0x1003f950
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret