Function at 0x1001d6cf
Capabilities:
Accept command line arguments
Create process on windows
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100874ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x34], ecx
push 2
lea ecx, [esp + 0xa0]
mov dword [esp + 0x30], edi
call fcn.1001b841
xor ebx, ebx
mov dword [esp + 0x1c], 0xbeb0647d
mov dword [esp + 0x1c], ebx
jmp 0x1001d731
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0xca631852
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d71b
xor esi, esi
inc esi
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x1001d76b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x9c]
cmp dword [eax + ecx*4], ebx
jne 0x1001d76b
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001d765
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
dec dword [esp + 0x1c]
jns 0x1001d745
lea ecx, [esp + 0x9c]
call fcn.1001c062
push 2
mov edx, 0xffff
mov dword [esp + 0x2c], edx
pop ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], 0xb457102d
mov dword [esp + 0x10], 0x6748f69f
mov dword [esp + 0x10], 0x14b733c6
mov dword [esp + 0x10], 0x6b6eb6b9
mov dword [esp + 0x10], 0xaa29c146
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x10], 0x182abbf9
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], 0x5a519d81
mov dword [esp + 0x1c], ebx
jmp 0x1001d7ec
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xc0], 0x865b49d5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001d7d9
dec dword [esp + 0x10]
mov dword [esp + 0xc0], 0x4145c174
mov dword [esp + 0x10], 0xc9ca3191
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
push ecx
mov dword [esp + 0x14], 0xcd53bc6e
lea ecx, [esp + 0xac]
mov dword [esp + 0x1c], edx
call fcn.1001b841
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x10], 0x9e13c95
mov dword [esp + 0x1c], ebx
jmp 0x1001d862
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d850
mov eax, dword [esp + 0x48]
mov dword [esp + 0x44], eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jne 0x1001d8a0
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
inc eax
jne 0x1001d8a0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001d951
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1001d951
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0x8dc5
mov dword [esp + 0x20], 0xb35f1971
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001d8c8
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x44]
sub edx, eax
mov eax, dword [esp + 0xa8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x7d6b
setne cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
cmp eax, ecx
setl dl
mov dword [esp + 0x48], edx
cmp edx, dword [esp + 0x1c]
jle 0x1001d918
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setle dl
cmp edx, 0x5c6a81d6
jl 0x1001d94b
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1001d94d
mov eax, esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
imul eax, dword [esp + 0x18]
cmp eax, 0x7e12fd89
setl cl
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0xa8]
call fcn.1001c062
push 2
pop eax
mov dword [esp + 0x40], eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x1c], 9
mov dword [esp + 0x14], ebx
push eax
call fcn.1001b841
mov dword [esp + 0x10], 0xb0cadfb1
mov dword [esp + 0x18], ebx
jmp 0x1001d9b2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001d99f
mov dword [esp + 0x18], ebx
jmp 0x1001d9d2
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xe8], 0xb56cef3c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001d9bf
cmp dword [esp + 0x14], ebx
je 0x1001da7b
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x14]
jle 0x1001d9f5
mov edi, esi
cmp dword [esp + 0x14], ebx
jne 0x1001d9f7
mov edi, ebx
mov eax, dword [esp + 0x6c]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov esi, dword [eax]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
imul eax, edi
lea ecx, [esi + 1]
sub edx, eax
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x10], edx
xor edx, edx
cmp dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
setne dl
mov dword [eax], ecx
cmp esi, edx
jge 0x1001da3f
xor esi, esi
inc esi
mov eax, esi
jmp 0x1001da44
xor esi, esi
mov eax, ebx
inc esi
cmp eax, dword [esp + 0x14]
jle 0x1001da52
mov ecx, esi
cmp dword [esp + 0x14], ebx
jne 0x1001da54
mov ecx, ebx
mov eax, dword [esp + 0x14]
add eax, ecx
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
cmp eax, esi
jbe 0x1001da6f
mov eax, dword [esp + 0x6c]
cmp dword [eax], ebx
jne 0x1001da73
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x2c]
mov eax, esi
jmp 0x1001da7d
mov eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xf0], 0xffffffff
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001daab
push 0x5f5
push 0x12b4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [esp + 0x6c]
call fcn.1001c062
mov eax, dword [esp + 0x28]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setne dl
xor ecx, ecx
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setge cl
xor edx, edx
cmp ecx, 0xfffffff6
setge dl
sub eax, edx
cmp eax, esi
jg 0x1001daf9
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x28]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setne dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sete dl
imul ecx, edx
imul eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 0xffffffe5
cmp dword [esp + 0x1c], 2
jg 0x1001e049
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor edi, edi
inc edi
mov dword [esp + 0x14], 0x7e17f75
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x14]
jle 0x1001db7f
cmp dword [esp + 0x14], ebx
je 0x1001db87
mov eax, edi
cmp dword [esp + 0x14], ebx
jne 0x1001db89
mov eax, ebx
xor ecx, ecx
cmp eax, 0x87a7525d
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xce008fb0
setle cl
cmp eax, ecx
mov eax, dword [esp + 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xffffffec
jmp 0x1001dbea
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001dbe6
push 0x420
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x32
jl 0x1001dbcc
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x1000c9f0]
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0xe0]
mov dword [esp + 0x20], 2
push eax
mov dword [esp + 0x1c], 0x664a1160
lea ecx, [esp + 0x6c]
mov dword [esp + 0x30], edi
push ebx
movdqu xmmword [esp + 0xe8], xmm0
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call fcn.1001cdeb
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001dc66
push ebx
push 0x533
push 0x1962
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov eax, dword [esp + 0x18]
mov edx, ebx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x1001dc78
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
imul eax, dword [esp + 0x18]
add eax, dword [esp + 0x18]
cmp eax, edx
setl cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x18]
jne 0x1001dcb0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], 0xf69a
mov dword [esp + 0x20], 0x40c8
cmp dword [esp + 0x10], ebx
jne 0x1001dcce
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x60]
sub ecx, 0x379a1d12
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 8]
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x60]
or dword [esp + 0x10c], 0xffffffff
call fcn.1001c062
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x1000ca60]
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xd0]
mov byte [esp + 0x3b], bl
push eax
mov dword [esp + 0x20], 0xed680444
lea ecx, [esp + 0x60]
mov dword [esp + 0x2c], 7
push ebx
movdqu xmmword [esp + 0xd8], xmm0
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.1001cdeb
xor edx, edx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x14]
setne dl
cmp edx, 7
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
setle dl
mov dword [esp + 0x10], edx
xor edx, edx
cmp ecx, eax
setl dl
cmp edi, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp dword [esp + 0x10], eax
setl cl
xor eax, eax
cmp ecx, 0x977a
setl al
cmp eax, dword [esp + 0x14]
jg 0x1001dde1
cmp dword [esp + 0x20], ebx
jne 0x1001dde1
mov dword [esp + 0x14], ebx
jmp 0x1001ddd5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0xd3ed23c5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001ddc2
jmp 0x1001de6e
mov dword [esp + 0x18], ebx
jmp 0x1001ddfa
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x90], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001dde7
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x14]
add ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x94]
mov dword [esp + 0x10], ecx
xor ecx, ecx
cmp dword [esp + 0x10], eax
setne cl
add ecx, 0xebf3
cmp ecx, 0x1355fff8
jge 0x1001de52
mov eax, edi
cmp dword [esp + 0x94], ebx
jne 0x1001de54
mov eax, ebx
cmp eax, 0xffff
mov eax, dword [esp + 0x94]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x54]
call fcn.1001c062
lea eax, [esp + 0x33]
push eax
push 0x354d
push ebx
push 0x5bc2
push 0x7c30
push 0x3a5c
push 0x439e
push 0x183
call fcn.10020b61
mov dword [esp + 0x34], 0x9fdf99ff
add esp, 0x20
mov dword [esp + 0x20], ebx
jmp 0x1001dec4
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xf4], 0x7812a3cc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001deb1
mov dword [esp + 0x14], ebx
jmp 0x1001e010
mov dword [esp + 0x18], edi
imul eax, dword [esp + 0x18], 0xffff
test eax, eax
jne 0x1001df12
mov eax, dword [esp + 0x18]
xor edx, edx
cmp eax, edi
setl dl
sub edx, 8
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, ebx
setle cl
cmp ecx, 0xfffffff7
jne 0x1001df14
mov eax, edi
mov dword [esp + 0xf8], eax
mov dword [esp + 0x18], ebx
jmp 0x1001e001
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001dff2
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], ebx
jmp 0x1001dfc4
push edi
lea ecx, [esp + 0x88]
call fcn.1001b841
mov dword [esp + 0x20], ebx
jmp 0x1001df67
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1001df55
mov eax, dword [esp + 0x84]
mov dword [eax], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001df93
push 0x1804
push ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x84]
inc dword [eax]
cmp dword [eax], 2
jle 0x1001df76
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001dfb4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
lea ecx, [esp + 0x84]
call fcn.1001c062
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x1001df42
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001dfee
push ebx
push ebx
push ebx
push ebx
push 0xd64
push edi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001df31
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 7
jle 0x1001df24
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffea
jg 0x1001ded4
push ebx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x48]
push eax
push 0x51bf
call fcn.10021418
add esp, 0x10
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1001db56
mov edi, dword [esp + 0x2c]
xor esi, esi
inc esi
mov dword [esp + 0x18], 0x1824a8c6
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0xfa1a8f1
mov dword [esp + 0x2c], 0xb6b7be2d
mov dword [esp + 0x18], ebx
jmp 0x1001e0ff
mov dword [esp + 0x10], ebx
jmp 0x1001e084
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001e074
mov dword [esp + 0x3c], 0xffffffe8
jmp 0x1001e0df
mov dword [esp + 0x2c], 0x717be9fb
mov dword [esp + 0x10], ebx
jmp 0x1001e0b3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], 0xccb03629
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001e0a3
mov dword [esp + 0x78], ebx
jmp 0x1001e0d4
mov dword [esp + 0x2c], 0x250d
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
inc dword [esp + 0x78]
cmp dword [esp + 0x78], 0x1c
jle 0x1001e0c0
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xfffffffa
je 0x1001e095
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov eax, dword [esp + 0x3c]
cmp ecx, eax
setge dl
neg edx
mov dword [esp + 0x1c], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xf
jle 0x1001e06e
mov dword [esp + 0x18], 3
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
neg eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x8254
setl cl
add ecx, dword [esp + 0x14]
jne 0x1001e159
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001e1cb
push esi
lea ecx, [esp + 0xb8]
call fcn.1001b841
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001e194
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001e17e
mov ecx, dword [esp + 0xb4]
xor edx, edx
cmp dword [ecx], ebx
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
sete dl
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xb4]
call fcn.1001c062
jmp 0x1001e1df
mov dword [esp + 0x2c], 0x4e5477a
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x34]
mov edi, edx
mov esi, eax
call fcn.1001d65d
mov ecx, dword [esp + 0x104]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret