Function at 0x429900
Capabilities:
Create directory
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a8200
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x695e80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov edi, edi
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42996b
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x42995d
mov ecx, eax
call fcn.00428600
jmp 0x42995f
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x282], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x4299b1
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4299a3
mov ecx, eax
call fcn.00428600
jmp 0x4299a5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x1c6], 0
cmp esi, 5
jge 0x429a97
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429a00
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4299f2
mov ecx, eax
call fcn.00428600
jmp 0x4299f4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x142], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429a46
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 3
test eax, eax
je 0x429a38
mov ecx, eax
call fcn.00428600
jmp 0x429a3a
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x192], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429a8c
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x429a7e
mov ecx, eax
call fcn.00428600
jmp 0x429a80
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x24e], 1
cmp esi, 4
jge 0x429b72
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429adb
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 5
test eax, eax
je 0x429acd
mov ecx, eax
call fcn.00428600
jmp 0x429acf
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x156], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429b21
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 6
test eax, eax
je 0x429b13
mov ecx, eax
call fcn.00428600
jmp 0x429b15
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x1a6], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429b67
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 7
test eax, eax
je 0x429b59
mov ecx, eax
call fcn.00428600
jmp 0x429b5b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x262], 5
cmp esi, 2
jge 0x429d1f
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429bb6
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 8
test eax, eax
je 0x429ba8
mov ecx, eax
call fcn.00428600
jmp 0x429baa
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x166], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429bfc
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 9
test eax, eax
je 0x429bee
mov ecx, eax
call fcn.00428600
jmp 0x429bf0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x16e], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429c42
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xa
test eax, eax
je 0x429c34
mov ecx, eax
call fcn.00428600
jmp 0x429c36
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x1b6], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429c88
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xb
test eax, eax
je 0x429c7a
mov ecx, eax
call fcn.00428600
jmp 0x429c7c
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x272], 5
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429cce
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xc
test eax, eax
je 0x429cc0
mov ecx, eax
call fcn.00428600
jmp 0x429cc2
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x1be], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429d14
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xd
test eax, eax
je 0x429d06
mov ecx, eax
call fcn.00428600
jmp 0x429d08
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + esi*4 + 0x27a], 5
inc esi
cmp esi, 6
jl 0x429930
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429d64
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xe
test eax, eax
je 0x429d56
mov ecx, eax
call fcn.00428600
jmp 0x429d58
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x232], 0x1e
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429da9
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0xf
test eax, eax
je 0x429d9b
mov ecx, eax
call fcn.00428600
jmp 0x429d9d
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x176], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429dee
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x10
test eax, eax
je 0x429de0
mov ecx, eax
call fcn.00428600
jmp 0x429de2
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x17a], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429e33
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x11
test eax, eax
je 0x429e25
mov ecx, eax
call fcn.00428600
jmp 0x429e27
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x21a], 0xfa
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429e78
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x12
test eax, eax
je 0x429e6a
mov ecx, eax
call fcn.00428600
jmp 0x429e6c
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x21e], 0xfa
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429ebd
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x13
test eax, eax
je 0x429eaf
mov ecx, eax
call fcn.00428600
jmp 0x429eb1
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x17e], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429f02
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x14
test eax, eax
je 0x429ef4
mov ecx, eax
call fcn.00428600
jmp 0x429ef6
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x182], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429f47
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x15
test eax, eax
je 0x429f39
mov ecx, eax
call fcn.00428600
jmp 0x429f3b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x242], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429f8c
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x16
test eax, eax
je 0x429f7e
mov ecx, eax
call fcn.00428600
jmp 0x429f80
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x246], 3
mov eax, dword [0x6b7944]
test eax, eax
jne 0x429fd1
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x17
test eax, eax
je 0x429fc3
mov ecx, eax
call fcn.00428600
jmp 0x429fc5
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x186], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a016
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x18
test eax, eax
je 0x42a008
mov ecx, eax
call fcn.00428600
jmp 0x42a00a
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x126], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a05b
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x19
test eax, eax
je 0x42a04d
mov ecx, eax
call fcn.00428600
jmp 0x42a04f
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0xea], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a0a0
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1a
test eax, eax
je 0x42a092
mov ecx, eax
call fcn.00428600
jmp 0x42a094
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0xee], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a0e5
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1b
test eax, eax
je 0x42a0d7
mov ecx, eax
call fcn.00428600
jmp 0x42a0d9
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0xf2], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a12a
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1c
test eax, eax
je 0x42a11c
mov ecx, eax
call fcn.00428600
jmp 0x42a11e
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x18a], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a16f
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1d
test eax, eax
je 0x42a161
mov ecx, eax
call fcn.00428600
jmp 0x42a163
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x18e], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a1b4
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1e
test eax, eax
je 0x42a1a6
mov ecx, eax
call fcn.00428600
jmp 0x42a1a8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x20a], 5
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a1f9
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x1f
test eax, eax
je 0x42a1eb
mov ecx, eax
call fcn.00428600
jmp 0x42a1ed
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x212], 5
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a23e
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x20
test eax, eax
je 0x42a230
mov ecx, eax
call fcn.00428600
jmp 0x42a232
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x20e], 5
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a283
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x21
test eax, eax
je 0x42a275
mov ecx, eax
call fcn.00428600
jmp 0x42a277
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x24a], 3
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a2c8
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x22
test eax, eax
je 0x42a2ba
mov ecx, eax
call fcn.00428600
jmp 0x42a2bc
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1f6], 5
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a30d
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x23
test eax, eax
je 0x42a2ff
mov ecx, eax
call fcn.00428600
jmp 0x42a301
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0xf6], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a352
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x24
test eax, eax
je 0x42a344
mov ecx, eax
call fcn.00428600
jmp 0x42a346
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x106], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a397
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x25
test eax, eax
je 0x42a389
mov ecx, eax
call fcn.00428600
jmp 0x42a38b
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x10a], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a3dc
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x26
test eax, eax
je 0x42a3ce
mov ecx, eax
call fcn.00428600
jmp 0x42a3d0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x112], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a421
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x27
test eax, eax
je 0x42a413
mov ecx, eax
call fcn.00428600
jmp 0x42a415
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x11a], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a466
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x28
test eax, eax
je 0x42a458
mov ecx, eax
call fcn.00428600
jmp 0x42a45a
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x29a], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a4ab
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x29
test eax, eax
je 0x42a49d
mov ecx, eax
call fcn.00428600
jmp 0x42a49f
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1de], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a4f0
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2a
test eax, eax
je 0x42a4e2
mov ecx, eax
call fcn.00428600
jmp 0x42a4e4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1e2], 0
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a535
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2b
test eax, eax
je 0x42a527
mov ecx, eax
call fcn.00428600
jmp 0x42a529
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1e6], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a57a
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2c
test eax, eax
je 0x42a56c
mov ecx, eax
call fcn.00428600
jmp 0x42a56e
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1ea], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a5bf
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2d
test eax, eax
je 0x42a5b1
mov ecx, eax
call fcn.00428600
jmp 0x42a5b3
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1ee], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a604
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2e
test eax, eax
je 0x42a5f6
mov ecx, eax
call fcn.00428600
jmp 0x42a5f8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [0x6b7944], eax
mov dword [eax + 0x1f2], 1
mov eax, dword [0x6b7944]
test eax, eax
jne 0x42a642
push 0x1d7a
call fcn.0058554c
add esp, 4
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 0x2f
test eax, eax
je 0x42a63b
mov ecx, eax
call fcn.00428600
jmp 0x42a63d
xor eax, eax
mov dword [0x6b7944], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.data
mov dword [eax + 0x29e], 0x3c
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x6c9eb4]
movzx eax, word [eax + 0x125]
push eax
lea eax, [ebp - 0x50]
push str.._data_aiconfig__d.dat
push eax
call fcn.0058729c
push 0x5b8368
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.005870e0
mov eax, dword [ebp - 0x54]
add esp, 0x18
test eax, eax
je 0x42a6ba
push eax
push 1
lea eax, [edi + 0xe6]
push 0x1c5c
push eax
call fcn.0058798e
push dword [ebp - 0x54]
call fcn.00586f90
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00585d34
mov esp, ebp
pop ebp
ret