Function at 0x1000b06f
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100693bb
call fcn.10068cf8
sub esp, 0x17c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x48], edx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
jne 0x1000b094
xor al, al
jmp 0x1000bac4
mov dword [ebp - 0x18], 0x7f825e7a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000b0b0
push 0xa53
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
call fcn.1000adb0
mov eax, dword [ebp - 0x48]
push 3
pop edi
mov dword [eax], ebx
mov dword [ebp - 0x14], 0x8d327cb3
mov dword [ebp - 0x18], 0xc3707822
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], 0xe3edfa83
mov dword [ebp - 0x10], 0x5d36
mov dword [ebp - 0x18], 0x1b76e1ee
mov dword [ebp - 0x10], ebx
jmp 0x1000b101
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x158], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b0f0
cmp dword [ebp - 0x14], ebx
je 0x1000b207
push 2
lea ecx, [ebp - 0xa8]
call fcn.1000f19e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0x1cb4e76a
mov dword [ebp - 0x18], 0xde0980db
push edi
call fcn.1000f19e
mov dword [ebp - 0x20], 0x41ce3cb5
mov dword [ebp - 0x10], ebx
jmp 0x1000b174
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xe7d214c4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000b161
mov dword [ebp - 0x10], ebx
jmp 0x1000b192
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b17f
mov dword [ebp - 0x14], ebx
jmp 0x1000b1aa
mov byte [ebp - 0x31], bl
lea ecx, [ebp - 0x31]
call fcn.1000adcb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jge 0x1000b19c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x9c], 0
je 0x1000b1da
push dword [ebp - 0x9c]
call fcn.10050764
pop ecx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xa8], 0
je 0x1000b260
push dword [ebp - 0xa8]
call fcn.10050764
pop ecx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
jmp 0x1000b260
mov dword [ebp - 0xc8], 0x23dd
mov dword [ebp - 0x20], ebx
jmp 0x1000b24d
lea ecx, [ebp - 0xc8]
call fcn.1000adea
mov dword [ebp - 0x2c], ebx
jmp 0x1000b244
mov dword [ebp - 0x10], ebx
jmp 0x1000b23c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x158], 0x2e26595a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b22b
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 6
jg 0x1000b226
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffeb
jg 0x1000b216
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000b260
call fcn.1000adf1
cmp dword [esi + 0x14], 0x10
jb 0x1000b26a
mov ecx, dword [esi]
jmp 0x1000b26c
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x40], ecx
jb 0x1000b279
mov edx, dword [esi]
jmp 0x1000b27b
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1000ba48
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xcec79e67
mov dword [ebp - 0x18], 0xf592
mov dword [ebp - 0x2c], 0x40a16501
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x14]
cmp eax, 0x2d2c87a7
jle 0x1000b2bf
cmp dword [ebp - 0x10], ebx
je 0x1000b2bf
xor ecx, ecx
inc ecx
jmp 0x1000b2c1
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], eax
jne 0x1000b2e1
cmp dword [ebp - 0x10], ebx
je 0x1000b2e1
call fcn.1000ae01
jmp 0x1000b35d
mov dword [ebp - 0x20], ebx
jmp 0x1000b2f4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x54], 2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b2e6
mov dword [ebp - 0x10], ebx
jmp 0x1000b30a
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x54], ebx
jne 0x1000b310
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x1000b2fe
cmp dword [ebp - 0x54], ebx
je 0x1000b318
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
cmp eax, 0x9191
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 6
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x40]
mov al, byte [eax]
cmp al, 0x30
jl 0x1000b6d4
cmp al, 0x39
jg 0x1000b6d4
mov dword [ebp - 0x44], 0xeaa32b1c
lea ecx, [ebp - 0x60]
push 1
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffa
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x10], ebx
jmp 0x1000b3ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0xe81d534a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b39c
mov dword [ebp - 0x10], ebx
jmp 0x1000b3c7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x120], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000b3b6
lea edx, [ebp - 0x44]
lea ecx, [ebp - 0x60]
call fcn.1000ae1b
mov eax, dword [ebp - 0x60]
cmp dword [eax], ebx
je 0x1000b434
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x60]
cmp ecx, dword [eax]
setle dl
cmp edx, 0x9be9
jg 0x1000b3fd
cmp dword [ebp - 0x44], ebx
jne 0x1000b3fd
mov ecx, ebx
jmp 0x1000b400
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x60]
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x120]
sub ecx, 9
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setne dl
imul eax, edx
mov dword [ebp - 0x120], eax
test eax, eax
je 0x1000b434
mov eax, dword [ebp - 0x60]
cmp dword [eax], ebx
je 0x1000b434
xor ecx, ecx
inc ecx
jmp 0x1000b436
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x60]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x2c], ecx
call fcn.10050764
mov dword [esp], 0x3b7d
lea eax, [ebp - 0x40]
push ebx
push eax
push 0x2ed9
lea eax, [ebp - 0x48]
mov dword [ebp - 0x60], ebx
push eax
push 0x1afe
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.1000e4a8
mov dword [ebp - 0xd0], 0x921d
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0xe0], 0x814b
add esp, 0x18
mov dword [ebp - 0xd8], 0x4a1d2daf
mov dword [ebp - 0xd4], 0xaa9634d7
mov dword [ebp - 0x30], 0x3846f263
mov dword [ebp - 0x38], 0x699f
mov dword [ebp - 0xdc], 0x20a0
mov dword [ebp - 0xe4], 0xffffffff
push 4
call fcn.1000f19e
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 0x18188558
mov dword [ebp - 0x18], 0x1471c2aa
mov dword [ebp - 0x18], 0x1efc39fa
mov dword [ebp - 0x18], 0x7c19c50e
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], 0x24cec8e4
mov dword [ebp - 0x18], 0x37ead942
mov dword [ebp - 0x10], ebx
jmp 0x1000b521
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0xb19f88dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1000b511
mov dword [ebp - 0x10], ebx
jmp 0x1000b539
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x188], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b52c
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0xd0]
lea ecx, [ebp - 0xe4]
call fcn.1000ae7a
add esp, 0x18
mov dword [ebp - 0x38], ebx
jmp 0x1000b6a6
push 1
lea ecx, [ebp - 0xb4]
call fcn.1000f19e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
push 1
call fcn.1000f19e
mov dword [ebp - 0x18], 0x538e
mov dword [ebp - 0x28], ebx
jmp 0x1000b5c1
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xcfb11589
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x1000b5ae
mov dword [ebp - 0x28], ebx
jmp 0x1000b5dd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x14c], 0x8d98c683
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000b5cc
lea edx, [ebp - 0xc0]
lea ecx, [ebp - 0x28]
call fcn.1000af22
mov dword [ebp - 0x28], ebx
jmp 0x1000b606
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xf0], 0x1cf56e03
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x1000b5f5
mov dword [ebp - 0x30], ebx
jmp 0x1000b61f
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x6c]
call fcn.1000af41
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1000b611
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x38]
mov dword [eax], ebx
mov eax, dword [ebp - 0x6c]
imul edx, dword [eax + 4]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], edx
dec dword [ebp - 0xec]
test edx, edx
jns 0x1000b652
xor eax, eax
inc eax
jmp 0x1000b654
mov eax, ebx
cmp dword [ebp - 0xc0], 0
mov dword [ebp - 0x14c], eax
je 0x1000b681
push dword [ebp - 0xc0]
call fcn.10050764
pop ecx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov byte [ebp - 4], 1
push dword [ebp - 0xb4]
call fcn.10050764
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
inc dword [ebp - 0x38]
pop ecx
cmp dword [ebp - 0x38], edi
jle 0x1000b57e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x6c], 0
je 0x1000b6cb
push dword [ebp - 0x6c]
call fcn.10050764
pop ecx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov ecx, dword [ebp - 0x40]
inc ecx
jmp 0x1000b26c
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x54e4
call fcn.1000e4d5
add esp, 0xc
lea ecx, [ebp - 0x84]
push 4
call fcn.1000f19e
mov dword [ebp - 0xc4], 0x7d1afd06
lea edx, [ebp - 0x84]
mov dword [ebp - 0xcc], 9
lea ecx, [ebp - 0x3c]
call fcn.1000af4d
mov dword [ebp - 0x3c], ebx
jmp 0x1000b72b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x17c], 0xd1649bc0
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edi
jl 0x1000b71a
lea eax, [ebp - 0xc4]
push eax
lea edx, [ebp - 0x84]
lea ecx, [ebp - 0xcc]
call fcn.1000af69
cmp dword [ebp - 0x84], 0
pop ecx
je 0x1000b76a
push dword [ebp - 0x84]
call fcn.10050764
pop ecx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x18], 0x19ec
cmp dword [ebp - 0x18], 0xdd7
jge 0x1000b807
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x10007874
call fcn.1004fe8b
mov ebx, dword [ebp - 0x70]
add esp, 0x14
mov edx, dword [ebp - 0x74]
mov ecx, ebx
call fcn.1000b056
mov edi, dword [ebp - 0xe8]
mov ecx, eax
sub edi, dword [ebp - 0x78]
mov eax, edi
cdq
idiv ecx
test edx, edx
je 0x1000b7cd
push 0x10007884
call fcn.100507b6
mov ebx, dword [ebp - 0x70]
pop ecx
xor ecx, ecx
test edi, edi
je 0x1000b7ef
xor edx, edx
xor esi, esi
mov eax, esi
sub eax, edx
cmp eax, edi
jge 0x1000b7e4
inc ecx
add esi, ebx
jmp 0x1000b7e7
add edx, dword [ebp - 0x74]
mov eax, esi
sub eax, edx
cmp eax, edi
jne 0x1000b7d7
imul ecx, ebx
add ecx, dword [ebp - 0x78]
push ecx
push 0x10007888
call fcn.1005018c
pop ecx
pop ecx
push 3
xor ebx, ebx
pop edi
push 2
lea ecx, [ebp - 0xfc]
call fcn.1000f19e
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x10], 4
push edi
call fcn.1000f19e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x140]
mov eax, 0xa8b060d2
mov dword [ebp - 0x14], 0x6f1860ec
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x18], 0x8fe831e3
push 1
call fcn.1000f19e
lea edx, [ebp - 0xfc]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.1000afd3
lea edx, [ebp - 0x108]
call fcn.1000aff2
mov dword [ebp - 0x24], ebx
jmp 0x1000b899
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x160], 0x660f181e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1000b888
xor edx, edx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x1000b8b4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x134], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000b8a7
mov dword [ebp - 0x24], ebx
jmp 0x1000b8d1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xfffd
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1000b8be
dec dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x108]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x110], eax
jne 0x1000b906
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
mov dword [eax + 4], ecx
cmp dword [ebp - 0x10], ebx
je 0x1000b9e5
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x14], ebx
jmp 0x1000b9da
push 4
pop eax
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x90]
push eax
call fcn.1000f19e
push 4
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1000b950
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], 0x1bb1300c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b93f
mov dword [ebp - 0x10], ebx
jmp 0x1000b96d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0xa644184
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000b95a
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1000b9b0
mov dword [ebp - 0x20], edi
xor edx, edx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setl dl
sub eax, dword [ebp - 0x114]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x90]
setle cl
mov dword [eax], ecx
dec dword [ebp - 0x10]
jns 0x1000b97a
cmp dword [ebp - 0x90], 0
je 0x1000b9d7
push dword [ebp - 0x90]
call fcn.10050764
pop ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x1000b925
jmp 0x1000ba14
mov dword [ebp - 0x18], edx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b9f6
call fcn.1000b011
mov dword [ebp - 0x10], 0xffffffe8
jmp 0x1000ba0f
mov dword [ebp - 0x20], 0x4108
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b9ff
mov eax, dword [ebp - 0x140]
push eax
dec dword [eax]
call fcn.10050764
push dword [ebp - 0x108]
call fcn.10050764
cmp dword [ebp - 0xfc], 0
pop ecx
pop ecx
je 0x1000ba44
push dword [ebp - 0xfc]
call fcn.10050764
pop ecx
xor al, al
jmp 0x1000bac3
push 1
lea ecx, [ebp - 0x12c]
call fcn.1000f19e
mov dword [ebp - 0x14], 0xffffffff
lea edx, [ebp - 0x12c]
lea ecx, [ebp - 0x130]
call fcn.1000b01e
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1000ba85
mov byte [ebp - 0x32], bl
lea ecx, [ebp - 0x32]
call fcn.1000b03a
dec dword [ebp - 0x14]
jns 0x1000ba75
mov dword [ebp - 0x14], 0x11
jmp 0x1000baa6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000baa3
push 0xa35
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
jne 0x1000ba8e
cmp dword [ebp - 0x12c], 0
je 0x1000bac1
push dword [ebp - 0x12c]
call fcn.10050764
pop ecx
mov al, 1
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret