Function at 0x5dae30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x95b363
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
call fcn.00911f0c
xor ebx, ebx
lea ecx, [esp + 0x94]
mov dword [esp + 0xb0], ebx
call fcn.00911f0c
lea ecx, [esp + 0x98]
mov byte [esp + 0xb0], 1
call fcn.00911f0c
lea ecx, [esp + 0x60]
mov byte [esp + 0xb0], 2
call fcn.00911f0c
push ebx
mov ecx, esi
mov byte [esp + 0xb4], 3
call fcn.005d8ad0
mov eax, dword [esi + 0x30c]
mov dword [esi + 0x2a8], eax
push eax
lea eax, [esp + 0x14]
push 0xa761d8
push eax
call fcn.00911f42
mov eax, dword [esi + 0x2a8]
add esp, 0xc
cmp eax, ebx
jle 0x5dba80
cmp eax, 0x186a0
jge 0x5dba80
lea edi, [eax - 1]
push 1
mov ecx, esi
mov dword [esp + 0x94], edi
call fcn.005d8ad0
lea ecx, [esi + 0x314]
push ecx
lea ecx, [esp + 0x64]
call fcn.00911f06
movsx edx, word [esi + 0x2f2]
mov eax, dword [esi + 0x2c4]
mov ecx, esi
push eax
mov dword [esp + 0x84], edx
call fcn.005d8650
mov ecx, dword [esi + 0x2c4]
push ecx
mov ecx, esi
call fcn.005d8690
cmp edi, ebx
jle 0x5db552
lea edx, [ebx + 2]
mov ecx, esi
push edx
call fcn.005d8ad0
fld qword [esi + 0x2f8]
movsx ebp, word [esi + 0x38e]
call fcn.00912a20
mov ecx, dword [esi + 0x304]
mov edi, eax
mov eax, dword [esi + 0x300]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], eax
mov eax, dword [0xa8e7a0]
cmp edi, eax
jle 0x5db05f
mov edx, edi
mov ecx, esi
sub edx, eax
push edx
call fcn.005d8610
mov ecx, dword [0xa8e7a0]
mov eax, edi
sub eax, ecx
mov ecx, esi
push eax
call fcn.005d85d0
mov ecx, dword [0xa8e7a0]
sub edi, ecx
mov ecx, esi
push edi
call fcn.005d8a70
jmp 0x5db077
push edi
mov ecx, esi
call fcn.005d8550
push edi
mov ecx, esi
call fcn.005d8590
push edi
mov ecx, esi
call fcn.005d86d0
cmp ebp, 0x11
jne 0x5db0c3
fld qword [esi + 0x2a0]
fcomp qword [0x9cb958]
fnstsw ax
test ah, 0x41
jne 0x5db0c3
fild dword [esi + 0x29c]
fsub qword [esi + 0x2a0]
fdiv qword [esi + 0x2a0]
fadd qword [0x9cb960]
fld st(0)
fmul qword [esi + 0x660]
fmul qword [esp + 0x44]
fstp qword [esp + 0x14]
fmul qword [esi + 0x668]
fmul qword [esp + 0x44]
jmp 0x5db0db
fld qword [esp + 0x44]
fmul qword [esi + 0x660]
fstp qword [esp + 0x14]
fld qword [esp + 0x44]
fmul qword [esi + 0x668]
mov eax, dword [esp + 0x80]
fstp qword [esp + 0x2c]
test eax, eax
jne 0x5db163
push 0xa7bf04
lea ecx, [esp + 0x64]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x5db13e
push 0xa7bf0c
lea ecx, [esp + 0x64]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x5db13e
push 0xa7e804
lea ecx, [esp + 0x64]
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x5db13e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 3
push ecx
push edx
mov ecx, esi
call fcn.005d7610
fstp qword [esp + 0x14]
push 3
jmp 0x5db1ab
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 2
push edx
push eax
mov ecx, esi
call fcn.005d7610
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
fstp qword [esp + 0x14]
push 2
push ecx
push edx
jmp 0x5db1b5
mov eax, dword [esi + 0x2d4]
test eax, eax
jle 0x5db1c0
cmp eax, 6
jge 0x5db1c0
mov eax, dword [0xa8e838]
mov edi, 0xa7e7fc
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x5db1a0
test cl, cl
je 0x5db19c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x5db1a0
add eax, 2
add edi, 2
test cl, cl
jne 0x5db17c
xor eax, eax
jmp 0x5db1a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x5db1c0
push 2
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
mov ecx, esi
call fcn.005d7610
fstp qword [esp + 0x2c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.008f5ce0
fcomp qword [0x9ccd50]
fnstsw ax
test ah, 0x41
jne 0x5db1ee
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov ecx, esi
call fcn.008f5ce0
fcomp qword [0x9ccd50]
fnstsw ax
test ah, 0x41
jne 0x5db21c
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov al, byte [0xa8e771]
test al, al
je 0x5db255
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x210]
fcompp
fnstsw ax
test ah, 0x41
jne 0x5db255
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
cmp ebp, 0x11
jne 0x5db277
fld qword [esp + 0x4c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x4c]
fld qword [esp + 0x54]
fadd qword [esp + 0x2c]
fstp qword [esp + 0x54]
jmp 0x5db542
cmp ebp, dword [esi + 0x234]
je 0x5db50c
cmp ebp, 0x15
je 0x5db50c
cmp ebp, 0x17
je 0x5db50c
cmp ebp, 0x18
je 0x5db50c
cmp ebp, 0x1a
je 0x5db50c
cmp ebp, 0x13
jne 0x5db2c9
fld qword [esp + 0x24]
fadd qword [esp + 0x14]
fstp qword [esp + 0x24]
fld qword [esp + 0x1c]
fadd qword [esp + 0x2c]
fstp qword [esp + 0x1c]
jmp 0x5db542
cmp ebp, dword [esi + 0x238]
jne 0x5db2e8
fld qword [esp + 0x9c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x9c]
jmp 0x5db542
cmp ebp, dword [esi + 0x23c]
jne 0x5db301
fld qword [esp + 0x74]
fadd qword [esp + 0x14]
fstp qword [esp + 0x74]
jmp 0x5db542
cmp ebp, 0x29
jne 0x5db317
fld qword [esp + 0x6c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x6c]
jmp 0x5db542
cmp ebp, dword [esi + 0x240]
jne 0x5db353
fild dword [esi + 0x26c]
fld qword [esp + 0x44]
fmul qword [esp + 0x84]
fdiv st(1)
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
fld qword [esp + 0x64]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x3c]
fstp qword [esp + 0x3c]
fstp st(0)
jmp 0x5db542
cmp ebp, 0x1c
jne 0x5db389
fild dword [esi + 0x26c]
fld qword [esp + 0x44]
fmul qword [esp + 0x24]
fdiv st(1)
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0x1c]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
fstp st(0)
jmp 0x5db542
cmp ebp, 0x1d
jne 0x5db3af
fild dword [esi + 0x26c]
fld qword [esp + 0x44]
fmul qword [esp + 0x84]
fdiv st(1)
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0x64]
jmp 0x5db374
cmp ebp, 0x1e
jne 0x5db3d5
fild dword [esi + 0x26c]
fld qword [esp + 0x44]
fmul qword [esp + 0x24]
fdiv st(1)
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
fld qword [esp + 0x1c]
jmp 0x5db33e
cmp ebp, 0x1f
jne 0x5db3ff
fld qword [esp + 0x44]
fmul qword [esp + 0x4c]
fidiv dword [esi + 0x26c]
fld st(0)
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
fadd qword [esp + 0x3c]
fstp qword [esp + 0x3c]
jmp 0x5db542
cmp ebp, 0x20
jne 0x5db429
fld qword [esp + 0x44]
fmul qword [esp + 0x4c]
fidiv dword [esi + 0x26c]
fld st(0)
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
jmp 0x5db542
cmp ebp, 0x23
jne 0x5db45f
fild dword [esi + 0x26c]
fld qword [esp + 0x24]
fadd qword [esp + 0x34]
fadd qword [esp + 0x4c]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
fld qword [esp + 0x1c]
fadd qword [esp + 0x3c]
fadd qword [esp + 0x54]
jmp 0x5db33e
cmp ebp, 0x24
jne 0x5db4a5
fild dword [esi + 0x26c]
fld qword [esp + 0x24]
fadd qword [esp + 0x34]
fadd qword [esp + 0x4c]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x24]
fstp qword [esp + 0x24]
fld qword [esp + 0x1c]
fadd qword [esp + 0x3c]
fadd qword [esp + 0x54]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x1c]
fstp qword [esp + 0x1c]
fstp st(0)
jmp 0x5db542
cmp ebp, 0x28
jne 0x5db4d3
fild dword [esi + 0x26c]
fld qword [esp + 0x24]
fadd qword [esp + 0x4c]
fmul qword [esp + 0x44]
fdiv st(1)
fadd qword [esp + 0x34]
fstp qword [esp + 0x34]
fld qword [esp + 0x1c]
fadd qword [esp + 0x54]
jmp 0x5db33e
cmp ebp, 0x25
jne 0x5db4e6
fld qword [esp + 0x4c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x4c]
jmp 0x5db542
cmp ebp, 0x26
jne 0x5db4f9
fld qword [esp + 0x4c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x4c]
jmp 0x5db542
cmp ebp, 0x27
jne 0x5db542
fld qword [esp + 0x4c]
fadd qword [esp + 0x14]
fstp qword [esp + 0x4c]
jmp 0x5db542
fld qword [esp + 0x34]
fadd qword [esp + 0x14]
fstp qword [esp + 0x34]
fld qword [esp + 0x3c]
fadd qword [esp + 0x2c]
fstp qword [esp + 0x3c]
fld qword [esp + 0x84]
fadd qword [esp + 0x14]
fstp qword [esp + 0x84]
fld qword [esp + 0x64]
fadd qword [esp + 0x2c]
fstp qword [esp + 0x64]
mov eax, dword [esp + 0x90]
inc ebx
cmp ebx, eax
jl 0x5daff3
mov eax, dword [esp + 0x80]
test eax, eax
jle 0x5db652
mov eax, dword [esi + 0x2dc]
test eax, eax
jle 0x5db652
cmp eax, 6
jge 0x5db652
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
fstp qword [esp + 0x50]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
fstp qword [esp + 0x38]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push eax
fstp qword [esp + 0x28]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
push eax
fstp qword [esp + 0x78]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
push eax
fstp qword [esp + 0x58]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
fstp qword [esp + 0x40]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
mov eax, dword [esi + 0x2dc]
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
push eax
fstp qword [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.005d7610
fstp qword [esp + 0x6c]
fld qword [esp + 0x6c]
fadd qword [esp + 0x74]
push 2
mov ecx, esi
sub esp, 8
fadd qword [esp + 0x30]
fadd qword [esp + 0x40]
fadd qword [esp + 0x58]
fstp qword [esp]
call fcn.005d7610
fstp qword [esp + 0x64]
fld qword [esp + 0x6c]
fadd qword [esp + 0x1c]
push 2
mov ecx, esi
sub esp, 8
fadd qword [esp + 0x48]
fadd qword [esp + 0x60]
fadd qword [esp + 0x80]
fstp qword [esp]
call fcn.005d7610
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x4c]
fld qword [esi + 0x5f0]
fcomp qword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov dword [esi + 0x5d0], eax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x5d8], edx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x5dc], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x5d4], ecx
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x5e8], eax
fnstsw ax
mov dword [esi + 0x5e0], ecx
mov ecx, dword [esp + 0x28]
test ah, 0x41
mov dword [esi + 0x5e4], edx
mov dword [esi + 0x5ec], ecx
je 0x5db713
fld dword [esi + 0x208]
fcomp qword [esi + 0x5f0]
fnstsw ax
test ah, 0x41
jne 0x5db727
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov dword [esi + 0x5f0], edx
mov dword [esi + 0x5f4], eax
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x610], ecx
fcom qword [esi + 0x628]
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x614], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x618], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x620], edx
fst qword [esi + 0x608]
mov dword [esi + 0x624], eax
mov dword [esi + 0x61c], ecx
fnstsw ax
test ah, 1
jne 0x5db789
fld dword [esi + 0x208]
fcomp qword [esi + 0x628]
fnstsw ax
test ah, 0x41
jne 0x5db791
fstp qword [esi + 0x628]
jmp 0x5db793
fstp st(0)
mov eax, dword [esi + 0x2c4]
test eax, eax
jle 0x5dba80
push eax
mov ecx, esi
call fcn.005dab40
mov ecx, dword [esi + 0x2c4]
push ecx
mov ecx, esi
call fcn.005dab80
lea edi, [esi + 0x27c4]
mov ecx, edi
call fcn.007a6630
mov ecx, edi
mov ebp, eax
call fcn.007a65f0
push 1
mov ecx, edi
mov ebx, eax
call fcn.007a6610
push 9
mov ecx, edi
call fcn.007a6650
mov edx, dword [esi + 0x5d4]
mov eax, dword [esi + 0x5d0]
push edx
push eax
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5db828
mov ecx, dword [esi + 0x5d4]
mov edx, dword [esi + 0x5d0]
mov eax, dword [0xa8e7d4]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00911f42
add esp, 0x10
jmp 0x5db83a
lea edx, [esp + 0x10]
push 0xa907a4
push edx
call fcn.00911f42
add esp, 8
mov eax, dword [esp + 0x10]
mov ecx, edi
push eax
call fcn.007a6740
push 0xa
mov ecx, edi
call fcn.007a6650
mov ecx, dword [esi + 0x60c]
mov edx, dword [esi + 0x608]
push ecx
push edx
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5db897
mov eax, dword [esi + 0x60c]
mov ecx, dword [esi + 0x608]
mov edx, dword [0xa8e7d4]
push eax
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00911f42
add esp, 0x10
jmp 0x5db8a9
lea ecx, [esp + 0x10]
push 0xa907a4
push ecx
call fcn.00911f42
add esp, 8
mov edx, dword [esp + 0x10]
mov ecx, edi
push edx
call fcn.007a6740
push 0xb
mov ecx, edi
call fcn.007a6650
mov eax, dword [esi + 0x5dc]
mov ecx, dword [esi + 0x5d8]
push eax
push ecx
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5db906
mov edx, dword [esi + 0x5dc]
mov eax, dword [esi + 0x5d8]
mov ecx, dword [0xa8e7d4]
push edx
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00911f42
add esp, 0x10
jmp 0x5db918
lea eax, [esp + 0x10]
push 0xa907a4
push eax
call fcn.00911f42
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, edi
call fcn.007a6740
push 0xc
mov ecx, edi
call fcn.007a6650
mov edx, dword [esi + 0x5e4]
mov eax, dword [esi + 0x5e0]
push edx
push eax
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5db974
mov ecx, dword [esi + 0x5e4]
mov edx, dword [esi + 0x5e0]
mov eax, dword [0xa8e7d4]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00911f42
add esp, 0x10
jmp 0x5db986
lea edx, [esp + 0x10]
push 0xa907a4
push edx
call fcn.00911f42
add esp, 8
mov eax, dword [esp + 0x10]
mov ecx, edi
push eax
call fcn.007a6740
push 0xd
mov ecx, edi
call fcn.007a6650
mov ecx, dword [esi + 0x5ec]
mov edx, dword [esi + 0x5e8]
push ecx
push edx
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5db9e3
mov eax, dword [esi + 0x5ec]
mov ecx, dword [esi + 0x5e8]
mov edx, dword [0xa8e7d4]
push eax
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00911f42
add esp, 0x10
jmp 0x5db9f5
lea ecx, [esp + 0x10]
push 0xa907a4
push ecx
call fcn.00911f42
add esp, 8
mov edx, dword [esp + 0x10]
mov ecx, edi
push edx
call fcn.007a6740
push 0xe
mov ecx, edi
call fcn.007a6650
mov eax, dword [esi + 0x5f4]
mov ecx, dword [esi + 0x5f0]
push eax
push ecx
mov ecx, esi
call fcn.008f5ce0
fld dword [esi + 0x208]
fcompp
fnstsw ax
test ah, 1
je 0x5dba52
mov edx, dword [esi + 0x5f4]
mov eax, dword [esi + 0x5f0]
mov ecx, dword [0xa8e7d4]
push edx
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.00911f42
add esp, 0x10
jmp 0x5dba64
lea eax, [esp + 0x10]
push 0xa907a4
push eax
call fcn.00911f42
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, edi
call fcn.007a6740
push ebp
mov ecx, edi
call fcn.007a6650
push ebx
mov ecx, edi
call fcn.007a6610
lea ecx, [esp + 0x60]
mov byte [esp + 0xb0], 2
call fcn.00911ee2
lea ecx, [esp + 0x98]
mov byte [esp + 0xb0], 1
call fcn.00911ee2
lea ecx, [esp + 0x94]
mov byte [esp + 0xb0], 0
call fcn.00911ee2
lea ecx, [esp + 0x10]
mov dword [esp + 0xb0], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0xa8]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret