Function at 0x41bcf0
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bed10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x830
mov edx, ecx
cmp byte [edx + 0x43ac], 0
mov dword [ebp - 0x14], edx
jne 0x41c884
mov eax, dword [ebp + 0xc]
mov ecx, dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
xor esi, esi
push edi
mov byte [ebp - 0x10], 0
mov edi, str.Unknown
mov dword [ebp - 0x18], esi
cmp eax, 7
jne 0x41bd9f
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x134]
push str.WM_SETFOCUS_From0x_08X_
push ecx
mov byte [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x50b3a4]
add esp, 0xc
cmp byte [edx + 0x127d2], 1
jb 0x41bd95
mov eax, dword [0x50b39c]
test eax, eax
je 0x41bd95
mov ecx, dword [eax + 0x4244]
test ecx, ecx
je 0x41bd95
push 1
push esi
push 1
lea eax, [ebp - 0x134]
push eax
call fcn.004adc30
mov edi, str.WM_SETFOCUS
jmp 0x41c2c8
cmp eax, 6
jne 0x41c11b
mov esi, dword [ebp + 0x10]
cmp si, 1
je 0x41bdbb
mov byte [ebp - 0x10], 0
cmp si, 2
jne 0x41bdbf
mov byte [ebp - 0x10], 1
test si, si
mov esi, dword [ebp + 0x14]
jne 0x41bf99
call ecx
test esi, esi
je 0x41bdd6
mov dword [ebp - 0x18], esi
jmp 0x41bddb
mov esi, eax
mov dword [ebp - 0x18], eax
push esi
call fcn.004a0050
add esp, 4
test al, al
je 0x41bf42
mov byte [ebp - 0x10], 1
call fcn.004a11c0
test al, al
jne 0x41bedf
xor eax, eax
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp + 0x18]
xor esi, esi
call fcn.004a4720
lea edx, [ebp + 0x18]
push edx
push esi
mov dword [ebp - 4], esi
call fcn.004a0300
add esp, 8
test al, al
je 0x41bed0
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
lea ecx, [ecx]
lea ecx, [ebp + 0x18]
call fcn.004a4800
push eax
call fcn.0049fc60
add esp, 4
lea ecx, [ebp + 0x18]
test al, al
je 0x41be9f
call fcn.004a4800
mov ecx, eax
call fcn.004a4a80
xor ecx, ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x34]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push edx
push eax
lea ecx, [ebp - 0x34]
push ecx
call ebx
test eax, eax
je 0x41be9c
lea ecx, [ebp + 0x18]
call fcn.004a4800
mov ecx, dword [ebp - 0x14]
push eax
call fcn.00405730
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
lea ecx, [ebp + 0x18]
inc esi
call fcn.004a4720
lea edx, [ebp + 0x18]
push edx
push esi
mov dword [ebp - 4], 0
call fcn.004a0300
add esp, 8
test al, al
jne 0x41be40
lea ecx, [ebp + 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov eax, dword [0x50b3a0]
cmp byte [eax + 0x1220], 0
je 0x41bf19
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x426a], 0
je 0x41bf19
mov eax, dword [ebp + 0x10]
cmp ax, 1
jne 0x41bf09
shr eax, 0x10
test eax, eax
jne 0x41bf24
cmp byte [ecx + 0x43b4], 0
jne 0x41bf19
push 1
call fcn.0041a8f0
cmp word [ebp + 0x10], 1
jne 0x41c0df
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x134]
push str.WM_ACTIVATE_From0x_08X_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x41c0fd
test esi, esi
je 0x41bf99
call fcn.0049fcd0
test al, al
je 0x41bf99
push 0x104
lea eax, [ebp - 0x43c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x41bf99
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.ConsoleWindowClass
lea ecx, [ebp - 0x43c]
push ecx
call esi
test eax, eax
je 0x41bf90
push str.WineConsoleClass
lea edx, [ebp - 0x43c]
push edx
call esi
test eax, eax
jne 0x41bf99
mov byte [ebp - 0x10], 1
jmp 0x41bedf
cmp byte [ebp - 0x10], 0
jne 0x41bedf
mov eax, dword [0x50b3a0]
cmp byte [eax + 0x1236], 0
je 0x41bf19
mov edi, dword [ebp - 0x14]
cmp dword [edi + 0x4350], 0
je 0x41bf19
push 1
call ebx
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x41bfef
push 2
call ebx
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x41bf19
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
test esi, esi
je 0x41bf19
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 0x7f
lea eax, [ebp - 0x234]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x41c09f
mov ecx, str.WorkerW
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c05c
test dx, dx
je 0x41c058
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c05c
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c036
xor eax, eax
jmp 0x41c061
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c0b1
mov ecx, str.Progman
lea eax, [ebp - 0x234]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c096
test dx, dx
je 0x41c092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c096
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c070
xor eax, eax
jmp 0x41c09b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41c0b1
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x41c017
jmp 0x41bf19
lea ecx, [ebp + 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp + 0x18]
cmp edx, dword [edi + 0x4354]
sete al
test al, al
je 0x41bf19
mov dword [edi + 0x4358], 0
jmp 0x41bf19
movzx eax, byte [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
push eax
push ecx
lea edx, [ebp - 0x134]
push str.WM_ACTIVATE.WA_INACTIVE_To0x_08X__OurFocus_i
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x134]
push 1
push eax
call fcn.00409880
mov esi, dword [ebp - 0x18]
add esp, 8
mov edi, str.WM_ACTIVATE
jmp 0x41c2c8
cmp eax, 0x1c
jne 0x41c1d2
cmp dword [ebp + 0x10], esi
setne bl
mov byte [ebp - 0x10], bl
test bl, bl
jne 0x41c188
call ecx
mov ecx, dword [ebp + 0x14]
mov esi, eax
movzx eax, bl
push eax
push ecx
lea edx, [ebp - 0x134]
push str.WM_ACTIVATEAPP.Deactivate_ToTID_i__OurFocus_i
push edx
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x134]
push 1
push eax
call fcn.00409880
add esp, 8
test bl, bl
jne 0x41c1a3
push esi
call fcn.004a0050
add esp, 4
test al, al
je 0x41c1c5
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x10], 1
mov edi, str.WM_ACTIVATEAPP
jmp 0x41c2c8
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x134]
push str.WM_ACTIVATEAPP.Activate_FromTID_i_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x41c155
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1220], 0
je 0x41c1c5
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x43b4], 0
jne 0x41c1c5
push 3
call fcn.0041a8f0
mov esi, dword [ebp - 0x18]
mov edi, str.WM_ACTIVATEAPP
jmp 0x41c2c8
cmp eax, 8
jne 0x41c231
mov edi, str.WM_KILLFOCUS
call ecx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x41c1ec
mov eax, esi
mov dword [ebp - 0x18], esi
jmp 0x41c1ef
mov dword [ebp - 0x18], eax
push eax
call fcn.004a0050
add esp, 4
test al, al
je 0x41c200
mov byte [ebp - 0x10], 1
movzx edx, byte [ebp - 0x10]
push edx
push esi
lea eax, [ebp - 0x134]
push str.WM_KILLFOCUS_To0x_08X__OurFocus_i
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x134]
push 1
push ecx
call fcn.00409880
mov esi, dword [ebp - 0x18]
add esp, 0x18
jmp 0x41c2c8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x41c23a
mov edi, eax
mov eax, dword [0x50b3a0]
cmp byte [eax + 0x1236], 0
je 0x41c253
push edi
mov ecx, edx
call fcn.00408980
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1236], 0
jne 0x41c881
cmp dword [edx + 0x4238], esi
jne 0x41c881
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call fcn.004a0050
mov bl, al
add esp, 4
mov byte [ebp - 0x10], bl
test bl, bl
jne 0x41c2b8
cmp dword [ebp + 0x18], str.TIMER_QUAKE_AUTOHIDE_ID
jne 0x41c831
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x43b0], 0
je 0x41c831
mov dword [eax + 0x43b0], 0
jmp 0x41c2c8
mov edx, dword [ebp - 0x14]
cmp byte [edx + 0x43ad], 0
jne 0x41c82e
mov ecx, dword [ebp - 0x14]
push edi
call fcn.00408980
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0x18], 0
call fcn.004a4720
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [ebp - 4], 1
call fcn.0049f8f0
add esp, 8
test eax, eax
jl 0x41c31a
lea ecx, [ebp - 0x1c]
call fcn.004a4800
mov dword [ebp + 0x18], eax
test eax, eax
je 0x41c31a
mov ecx, eax
call fcn.004a4a70
mov ecx, eax
call fcn.0049ca00
mov ebx, eax
jmp 0x41c31c
xor ebx, ebx
test esi, esi
je 0x41c35c
cmp esi, dword [0x50b384]
je 0x41c35c
cmp esi, ebx
je 0x41c35c
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x41c35c
lea esp, [esp]
cmp eax, ebx
je 0x41c359
cmp eax, dword [0x50b384]
je 0x41c53b
push eax
mov esi, eax
call edi
test eax, eax
jne 0x41c340
mov dword [ebp - 0x18], esi
cmp byte [ebp - 0x10], 0
jne 0x41c431
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test esi, esi
jne 0x41c3e8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x41c3a0
push 2
call esi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
jne 0x41c431
xor eax, eax
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
mov dword [ebp - 0x20], 0
test edi, edi
je 0x41c431
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x41c431
call ebx
cmp dword [ebp - 0x20], eax
je 0x41c431
mov esi, edi
mov dword [ebp - 0x18], esi
lea eax, [ebp + 0x10]
push eax
push esi
mov dword [ebp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call ebx
cmp dword [ebp + 0x10], eax
je 0x41c42d
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x41c431
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.00478be0
cmp esi, eax
je 0x41c42d
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.004771d0
cmp dword [ebp + 0x10], eax
jne 0x41c431
mov byte [ebp - 0x10], 1
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push edi
mov ecx, esi
call fcn.00409990
mov bl, byte [ebp - 0x10]
mov byte [esi + 0x43ad], bl
mov edx, str.mb_LastConEmuFocusState_set_to_TRUE
test bl, bl
jne 0x41c456
mov edx, str.mb_LastConEmuFocusState_set_to_FALSE
mov ecx, dword [0x50b3a4]
cmp byte [ecx + 0x127d2], 1
jb 0x41c484
mov eax, dword [0x50b39c]
test eax, eax
je 0x41c484
mov ecx, dword [eax + 0x4244]
test ecx, ecx
je 0x41c484
push 1
push 0
push 1
push edx
call fcn.004adc30
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x1153], 0
je 0x41c4b4
mov dl, byte [ecx + 0x1152]
cmp dl, byte [ecx + 0x1154]
je 0x41c4b4
call fcn.00442080
test al, al
je 0x41c4b4
push edi
push 1
mov ecx, esi
call fcn.00413230
test bl, bl
jne 0x41c590
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x41c4d8
mov ecx, edi
call fcn.004a4a70
push eax
push 0
lea ecx, [esi + 0x118]
call fcn.00425560
mov ecx, dword [esi + 0x4234]
call fcn.00495170
push 0
mov ecx, esi
call fcn.00405b40
mov eax, dword [esi + 0x73d8]
test eax, eax
je 0x41c5a3
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x73d8], 0
mov eax, dword [0x50b3a4]
cmp byte [eax + 0x127d2], 0
je 0x41c5a3
mov ecx, dword [esi + 0x4244]
test ecx, ecx
je 0x41c5a3
push 0
push 1
push 0
push 1
push str.CConEmuMain::UnRegisterHooks___done
call fcn.004ae810
jmp 0x41c5a3
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80cf0000
jne 0x41c35c
mov ecx, dword [0x50b384]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, dword [0x50b384]
jne 0x41c587
push 1
push str.Focus_was_returned_to_ConEmu
call fcn.00409880
add esp, 8
cmp esi, dword [0x50b384]
sete byte [ebp - 0x10]
jmp 0x41c35c
cmp byte [esi + 0x73d4], 0
jne 0x41c5a0
mov ecx, esi
call fcn.00411a80
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x41c5c8
mov ecx, edi
call fcn.004a4a70
test eax, eax
je 0x41c5c8
mov ecx, dword [ebp + 0x1c]
movzx edx, bl
push ecx
push edx
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.0047e9f0
mov ecx, dword [0x50b3a0]
call fcn.00442e00
test al, al
je 0x41c720
test bl, bl
jne 0x41c720
push 1
push 1
mov ecx, esi
call fcn.004068c0
test al, al
jne 0x41c720
push 0
mov ecx, esi
call fcn.00405600
test al, al
jne 0x41c720
mov eax, dword [0x50b384]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41c720
mov esi, dword [ebp - 0x18]
xor ecx, ecx
mov word [ebp - 0x434], cx
mov byte [ebp + 0x13], cl
mov byte [ebp + 0x17], cl
cmp dword [ebp + 0xc], ecx
je 0x41c692
test esi, esi
je 0x41c692
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
push 0xff
lea edx, [ebp - 0x434]
push edx
push esi
call ebx
push str.Shell_TrayWnd
lea eax, [ebp - 0x434]
push eax
call edi
test eax, eax
je 0x41c688
push str.TrayNotifyWnd
lea ecx, [ebp - 0x434]
push ecx
call edi
test eax, eax
jne 0x41c679
mov byte [ebp + 0x17], 1
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x41c642
jmp 0x41c68c
mov byte [ebp + 0x13], 1
mov bl, byte [ebp - 0x10]
mov edi, dword [ebp + 0x18]
mov edx, dword [0x50b3a4]
cmp byte [edx + 0x127d2], 0
mov esi, dword [ebp - 0x14]
je 0x41c6df
mov eax, dword [esi + 0x43b0]
movzx ecx, byte [ebp + 0x17]
movzx edx, byte [ebp + 0x13]
push eax
push ecx
push edx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x83c]
push str.MinimizeOnFocusLose:_Class_s__IsTaskbar_u__IsTrayNotifyWnd_u__Timer_u
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x83c]
push 1
push edx
call fcn.00409880
add esp, 0x20
cmp byte [ebp + 0x13], 0
jne 0x41c6f9
cmp byte [esi + 0x43b4], 0
jne 0x41c720
push 7
mov ecx, esi
call fcn.0041a8f0
jmp 0x41c720
cmp dword [esi + 0x43b0], 0
jne 0x41c720
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0x64
mov dword [esi + 0x43b0], eax
mov eax, dword [0x50b384]
push 9
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [0x50b3a0]
cmp byte [ecx + 0x11289], 0
mov esi, dword [ebp - 0x14]
je 0x41c79d
test edi, edi
je 0x41c788
test bl, bl
jne 0x41c749
push 1
push 0
mov ecx, esi
call fcn.004068c0
test al, al
je 0x41c74b
mov al, 1
mov edx, dword [0x50b3a0]
cmp byte [edx + 0x11289], 0
mov bl, byte [edi + 0x14f4]
je 0x41c771
test al, al
jne 0x41c771
call fcn.004a2460
test al, al
jne 0x41c771
mov al, 1
jmp 0x41c773
xor al, al
cmp bl, al
je 0x41c788
mov ecx, dword [ebp + 0x18]
mov byte [ecx + 0x14f4], al
add ecx, 8
call fcn.0049d200
mov ecx, dword [esi + 0x423c]
push 0
push 1
call fcn.0048f8c0
mov edi, dword [ebp + 0x18]
mov bl, byte [ebp - 0x10]
lea ecx, [esi + 0x42c0]
call fcn.004049c0
test bl, bl
je 0x41c7f8
test edi, edi
je 0x41c7f8
mov ecx, dword [0x50b3a0]
call fcn.00443430
test al, al
je 0x41c7f8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x50b384]
jne 0x41c7f8
cmp dword [esi + 0x7490], 0
jne 0x41c7f8
mov eax, dword [esi + 0x748c]
push 0
push 0
mov dword [esi + 0x7490], 1
mov ecx, dword [0x50b384]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x50b3a0]
cmp byte [edx + 0x11810], 0
jne 0x41c81d
test edi, edi
je 0x41c81d
movzx eax, bl
push eax
mov ecx, edi
call fcn.004a4a70
mov ecx, eax
call fcn.0047e840
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
jmp 0x41c881
mov bl, byte [ebp - 0x10]
mov ecx, dword [0x50b3a4]
cmp byte [ecx + 0x127d2], 2
jb 0x41c881
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [0x50b384]
push eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x43ad]
push esi
push edx
push ecx
movzx edx, bl
push edx
lea eax, [ebp - 0x234]
push str.Focus_event_skipped__lbSetFocus_u__mb_LastConEmuFocusState_u__ghWndx_08X__hForex_08X__hFocusx_08X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x234]
push 2
push ecx
call fcn.00409880
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18