Function at 0x42eaa0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xe]
call fcn.00421500
lea ecx, [ebp - 0xf]
call fcn.0042f8e0
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x10]
call fcn.0042f990
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f29f]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x15]
call fcn.0042fa40
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42eb58
lea eax, [ebp - 0x14]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x42eb55
lea ecx, [ebp - 0x1d]
call fcn.0042faf0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x1c]
lea ecx, [ebp - 0x1e]
call fcn.0042fba0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
call fcn.0042fc50
lea ecx, [ebp - 0x1f]
call fcn.004310b0
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x20]
call fcn.00431160
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2a3]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x25]
call fcn.00431210
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42ec0e
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x42ec0b
lea ecx, [ebp - 0x2d]
call fcn.004312c0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x2c]
lea ecx, [ebp - 0x2e]
call fcn.00431370
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x2f]
call fcn.00431420
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x30]
call fcn.004314d0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2a7]
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x35]
call fcn.00431580
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42ecbf
lea eax, [ebp - 0x34]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x42ecbc
lea ecx, [ebp - 0x3d]
call fcn.00431630
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x3c]
lea ecx, [ebp - 0x3e]
call fcn.004316e0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
mov dword [ebp - 0x44], 0x63
lea ecx, [ebp - 0x45]
call fcn.00431790
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x46]
call fcn.00431840
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2ab]
mov dword [ebp - 0x4a], eax
lea ecx, [ebp - 0x4b]
call fcn.004318f0
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42ed77
lea eax, [ebp - 0x4a]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x42ed74
lea ecx, [ebp - 0x51]
call fcn.004319a0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x50]
lea ecx, [ebp - 0x52]
call fcn.00431a50
mov ecx, eax
call fcn.00401e00
mov ecx, eax
mov eax, esp
mov dword [eax], ecx
call fcn.00401450
mov dword [ebp - 0x58], 0x7ffe0004
mov dword [ebp - 0x5c], 0x7ffe0324
mov dword [ebp - 0x60], 0x7ffe0320
mov eax, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
imul eax, ecx
shl eax, 8
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mul ecx
mov ecx, eax
mov eax, dword [ebp - 0x164]
shld edx, ecx, 8
add eax, edx
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x68]
cmp eax, 0x64
jbe 0x42ee1b
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x64]
cmp eax, 0x64
jbe 0x42ee1b
mov dword [esp], 0x64
mov dword [esp + 4], 0xc8
call fcn.0042a720
add eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
jmp 0x42f551
lea ecx, [ebp - 0x69]
call fcn.00431b00
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x6a]
call fcn.00431bb0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2af]
mov dword [ebp - 0x6e], eax
lea ecx, [ebp - 0x6f]
call fcn.00431c60
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42eeb5
lea eax, [ebp - 0x6e]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x42eeb2
lea ecx, [ebp - 0x75]
call fcn.00431d10
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x74]
lea ecx, [ebp - 0x76]
call fcn.00431dc0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea eax, [ebp - 0x80]
mov dword [esp], eax
call fcn.00415390
lea ecx, [ebp - 0x80]
call fcn.004153b0
mov dword [esp], eax
call fcn.0040bf50
lea ecx, [ebp - 0x81]
call fcn.00431e70
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x82]
call fcn.00431f20
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2b3]
mov dword [ebp - 0x86], eax
lea ecx, [ebp - 0x87]
call fcn.00431fd0
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42ef9c
lea eax, [ebp - 0x86]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x42ef96
lea ecx, [ebp - 0x8d]
call fcn.00432080
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x8c]
lea ecx, [ebp - 0x8e]
call fcn.00432130
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea eax, [ebp - 0x9b]
mov dword [esp], eax
call fcn.00415620
lea ecx, [ebp - 0x9b]
call fcn.00415640
mov dword [esp], eax
call fcn.0040bf50
lea ecx, [ebp - 0x9c]
call fcn.004321e0
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x9d]
call fcn.00432290
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2b7]
mov dword [ebp - 0xa1], eax
lea ecx, [ebp - 0xa2]
call fcn.00432340
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f08c
lea eax, [ebp - 0xa1]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jne 0x42f086
lea ecx, [ebp - 0xa9]
call fcn.004323f0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0xa8]
lea ecx, [ebp - 0xaa]
call fcn.004324a0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea eax, [ebp - 0xb9]
mov dword [esp], eax
call fcn.00432550
lea ecx, [ebp - 0xb9]
call fcn.00432570
mov dword [esp], eax
call fcn.0040bf50
lea ecx, [ebp - 0xba]
call fcn.00432580
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xbb]
call fcn.00432630
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2bb]
mov dword [ebp - 0xbf], eax
lea ecx, [ebp - 0xc0]
call fcn.004326e0
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f17c
lea eax, [ebp - 0xbf]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jne 0x42f176
lea ecx, [ebp - 0xc5]
call fcn.00432790
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0xc4]
lea ecx, [ebp - 0xc6]
call fcn.00432840
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea eax, [ebp - 0xd3]
mov dword [esp], eax
call fcn.00415620
lea ecx, [ebp - 0xd3]
call fcn.00415640
mov dword [esp], eax
call fcn.004153f0
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0xe0]
mov dword [esp], eax
call fcn.004328f0
lea ecx, [ebp - 0xe0]
call fcn.00432910
mov ecx, dword [ebp - 0x168]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00428d30
cmp eax, 1
jle 0x42f1fd
mov dword [ebp - 4], 0
jmp 0x42f8c9
lea ecx, [ebp - 0xe1]
call fcn.00432920
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xe2]
call fcn.004329d0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2bf]
mov dword [ebp - 0xe6], eax
lea ecx, [ebp - 0xe7]
call fcn.00432a80
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f2b2
lea eax, [ebp - 0xe6]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jne 0x42f2ac
lea ecx, [ebp - 0xed]
call fcn.00432b30
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0xec]
lea ecx, [ebp - 0xee]
call fcn.00432be0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xe]
call fcn.00432c90
lea ecx, [ebp - 0xef]
call fcn.00432fb0
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xf0]
call fcn.00433060
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2c3]
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0xf5]
call fcn.00433110
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f389
lea eax, [ebp - 0xf4]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jne 0x42f383
lea ecx, [ebp - 0xfd]
call fcn.004331c0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0xfc]
lea ecx, [ebp - 0xfe]
call fcn.00433270
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xe]
call fcn.00433320
lea ecx, [ebp - 0xff]
call fcn.00433500
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x100]
call fcn.004335b0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2c7]
mov dword [ebp - 0x104], eax
lea ecx, [ebp - 0x105]
call fcn.00433660
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f460
lea eax, [ebp - 0x104]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x42f45a
lea ecx, [ebp - 0x10d]
call fcn.00433710
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x10c]
lea ecx, [ebp - 0x10e]
call fcn.004337c0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0xe]
call fcn.00433870
lea ecx, [ebp - 0x10f]
call fcn.00433c20
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x110]
call fcn.00433cd0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2cb]
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0x115]
call fcn.00433d80
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f537
lea eax, [ebp - 0x114]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x42f531
lea ecx, [ebp - 0x11d]
call fcn.00433e30
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x11c]
lea ecx, [ebp - 0x11e]
call fcn.00433ee0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x11f]
call fcn.00433f90
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x120]
call fcn.00434040
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2cf]
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x125]
call fcn.004340f0
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f606
lea eax, [ebp - 0x124]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x42f600
lea ecx, [ebp - 0x12d]
call fcn.004341a0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x12c]
lea ecx, [ebp - 0x12e]
call fcn.00434250
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0x64
call fcn.0042a720
mov dword [esp], eax
call fcn.0041bbe0
cmp dword [ebp - 0x44], 0x64
jge 0x42f724
lea ecx, [ebp - 0x12f]
call fcn.00434300
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x130]
call fcn.004343b0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2d3]
mov dword [ebp - 0x134], eax
lea ecx, [ebp - 0x135]
call fcn.00434460
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f6fd
lea eax, [ebp - 0x134]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jne 0x42f6f7
lea ecx, [ebp - 0x13d]
call fcn.00434510
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x13c]
lea ecx, [ebp - 0x13e]
call fcn.004345c0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
call fcn.0042ce80
mov dword [ebp - 4], eax
jmp 0x42f8c9
lea ecx, [ebp - 0x13f]
call fcn.00434670
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x140]
call fcn.00434720
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2d7]
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x145]
call fcn.004347d0
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f7d9
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0x42f7d3
lea ecx, [ebp - 0x14d]
call fcn.00434880
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x14c]
lea ecx, [ebp - 0x14e]
call fcn.00434930
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x14f]
call fcn.004349e0
mov ecx, eax
call fcn.00401a80
mov dword [esp], eax
call fcn.00401450
lea ecx, [ebp - 0x150]
call fcn.00434a90
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401450
mov eax, dword [0x48f2db]
mov dword [ebp - 0x154], eax
lea ecx, [ebp - 0x155]
call fcn.00434b40
mov ecx, eax
call fcn.00421730
mov dword [esp], eax
call sub.msvcrt.dll_getenv
cmp eax, 0
je 0x42f8a8
lea eax, [ebp - 0x154]
mov dword [esp], eax
call fcn.00401c40
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jne 0x42f8a2
lea ecx, [ebp - 0x15d]
call fcn.00434bf0
mov ecx, eax
call fcn.00401b50
mov dword [esp], eax
call fcn.00401c50
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GlobalFlags]
sub esp, 4
call dword [ebp - 0x15c]
lea ecx, [ebp - 0x15e]
call fcn.00434ca0
mov ecx, eax
call fcn.00401e00
mov dword [esp], eax
call fcn.00401450
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x170
pop ebp
ret