Function at 0x100f6354
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x1016f640]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor edx, edx
and dword [ebp - 0xa8], 0
and dword [ebp - 0xac], 0
and dword [ebp - 0xb0], 0
push esi
push edi
mov eax, dword [ebp + 0xc]
lea edi, [ecx + 0x27c]
lea esi, [ebp - 0xb0]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x90], ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x98], edx
movsd dword es:[edi], dword [esi]
lea edi, [ecx + 0x288]
lea esi, [ebp - 0xb0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ecx
mov eax, dword [esi + 0x164]
test eax, eax
je 0x100f5cbd
and dword [eax + 0xa0], edx
mov edi, dword [ebp - 0x9c]
push edi
mov eax, dword [edi]
call dword [eax + 0x98]
test al, al
je 0x100f67e8
mov eax, dword [edi]
lea ecx, [ebp - 0xb4]
push ecx
push edi
call dword [eax + 0x94]
movzx eax, ax
mov ecx, 0x100a
mov dword [ebp - 0xa4], eax
movzx eax, ax
cmp eax, ecx
jg 0x100f5ef7
je 0x100f5edd
add ecx, 0xfffffffb
cmp eax, ecx
jg 0x100f5dc1
je 0x100f5d97
sub eax, 0x100
je 0x100f5d85
sub eax, 0xf01
je 0x100f5d7d
dec eax
je 0x100f5d6b
dec eax
je 0x100f6223
dec eax
jne 0x100f66e7
cmp dword [esi + 0xe8], eax
jne 0x100f5d4a
push 0x10
push 0x20
call sym.rt3d.dll_public:_static_class_e3_COLLECTION____stdcall_e3_COLLECTION::Create_int__int_
mov dword [esi + 0xe8], eax
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov ecx, dword [esi + 0xe8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x30]
jmp 0x100f66e7
lea eax, [esi + 0x288]
push edi
push eax
call fcn.1003dd22
jmp 0x100f66e7
lea eax, [esi + 0x27c]
jmp 0x100f5d71
push dword [ebp - 0x94]
push edi
push esi
call fcn.1003dd22
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov ecx, eax
mov dword [esi + 0xf8], ecx
test ecx, ecx
je 0x100f66e7
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
jmp 0x100f66e7
sub eax, 0x1006
je 0x100f5eb5
dec eax
je 0x100f5e78
dec eax
je 0x100f5df7
dec eax
jne 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov dword [ebp - 0x98], eax
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
test byte [esi + 0x15a], 1
mov edx, eax
mov dword [ebp - 0x8c], edx
jne 0x100f5e4c
mov ecx, dword [esi + 0xe0]
push 0
push ecx
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x2cc]
mov eax, dword [esi + 0xe0]
mov edx, dword [ebp - 0x8c]
push edx
mov dword [esi + 0x170], edx
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x1c]
jmp 0x100f5e59
mov eax, dword [esi + 0xe0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov eax, dword [esi]
push esi
call dword [eax + 0x258]
push dword [ebp - 0x8c]
mov eax, dword [esi]
push 0xbbe
push esi
call dword [eax + 0x34]
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov ecx, dword [ebp - 0x90]
mov esi, eax
push esi
mov ecx, dword [ecx + 0xe0]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x90]
push esi
push 0xbbe
mov esi, eax
mov ecx, dword [eax]
push esi
call dword [ecx + 0x34]
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov dword [esi + 0xfc], eax
test eax, eax
je 0x100f66e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov dword [ebp - 0xa0], eax
jmp 0x100f66e7
mov ecx, 0x100f
cmp eax, ecx
jg 0x100f6580
je 0x100f6260
sub eax, 0x100b
je 0x100f6237
dec eax
je 0x100f6214
dec eax
je 0x100f6260
dec eax
jne 0x100f66e7
cmp dword [esi + 0x164], eax
je 0x100f66e7
mov eax, dword [edi]
lea ecx, [ebp - 0x85]
push 1
push ecx
push edi
call dword [eax + 0x3c]
mov eax, dword [esi + 0x164]
movzx ecx, byte [ebp - 0x85]
push 1
mov dword [eax + 0x14], ecx
lea ecx, [ebp - 0x85]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x3c]
mov eax, dword [esi + 0x164]
movzx ecx, byte [ebp - 0x85]
push 1
mov dword [eax + 0x1c], ecx
lea ecx, [ebp - 0x85]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x3c]
mov eax, dword [esi + 0x164]
movzx ecx, byte [ebp - 0x85]
push 1
mov dword [eax + 0x20], ecx
lea ecx, [ebp - 0x85]
mov eax, dword [edi]
push ecx
push edi
call dword [eax + 0x3c]
mov ecx, dword [esi + 0x164]
mov al, byte [ebp - 0x85]
push edi
mov byte [ecx + 0x2e], al
mov eax, dword [esi + 0x164]
and dword [eax + 0x28], 0xffffbfff
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x24]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x50]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x54]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x58]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x90]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push edi
fstp dword [eax + 0x94]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x164]
push 4
push 4
fstp dword [eax + 0x94]
mov eax, dword [esi + 0x164]
mov ecx, dword [edi]
sub eax, 0xffffff80
push eax
push edi
call dword [ecx + 0xb8]
mov eax, dword [esi + 0x164]
mov ecx, dword [edi]
add eax, 0x70
push 4
push 4
push eax
push edi
call dword [ecx + 0xb8]
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov esi, eax
mov eax, dword [ebp - 0x90]
mov edx, dword [eax + 0x164]
mov ecx, dword [edx + 0x18]
xor ecx, esi
and ecx, 1
xor dword [edx + 0x18], ecx
mov edx, esi
mov ecx, dword [eax + 0x164]
shr edx, 1
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 1
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 2
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 4
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 8
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 0x10
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 0x20
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 0x40
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 0x80
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
and eax, 0x100
xor dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, edx
mov edx, dword [ebp - 0x90]
and eax, 0x200
xor dword [ecx + 0x28], eax
mov ecx, dword [edx + 0x164]
mov eax, esi
shr esi, 2
shl eax, 5
xor eax, dword [ecx + 0x28]
and eax, 0x10000
xor dword [ecx + 0x28], eax
mov ecx, dword [edx + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, esi
and eax, 0x400
xor dword [ecx + 0x28], eax
mov ecx, dword [edx + 0x164]
mov eax, dword [ecx + 0x28]
xor eax, esi
mov esi, edx
and eax, 0x800
xor dword [ecx + 0x28], eax
mov eax, dword [esi + 0x164]
mov dword [eax + 0xa0], 1
jmp 0x100f6202
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x94]
mov ecx, 0x1024
cmp ax, cx
jne 0x100f61f9
mov eax, dword [edi]
push edi
call dword [eax + 0x64]
mov ecx, dword [esi + 0x164]
mov byte [ecx + 0x60], al
mov eax, dword [edi]
push edi
call dword [eax + 0xa4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
test al, al
jne 0x100f61d5
jmp 0x100f66e7
mov eax, dword [esi]
push 1
push 0
push 0x3f2
push esi
call dword [eax + 0x18]
mov eax, dword [edi]
push edi
call dword [eax + 0xe0]
fstp dword [esi + 0x294]
jmp 0x100f66e7
push dword [ebp - 0x94]
mov eax, dword [edi]
mov esi, dword [esi]
push edi
call dword [eax + 0xd0]
push eax
push dword [ebp - 0x90]
call dword [esi + 0x334]
mov esi, dword [ebp - 0x90]
jmp 0x100f66e7
and dword [ebp - 0x8c], 0
jmp 0x100f656a
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x94]
movzx eax, ax
add eax, 0xffffeff7
cmp eax, 0x1f
ja case.0x100f628f.4107
movzx eax, byte [eax + 0x100f6858]
jmp dword [eax*4 + 0x100f6804]
mov ecx, dword [ebp - 0x8c]
push 0xffffffffffffffff
push ecx
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov ecx, dword [edi]
push edi
mov dword [ebp - 0x9c], eax
call dword [ecx + 0x98]
test al, al
je case.0x100f628f.4107
mov esi, dword [ebp - 0x94]
mov ecx, dword [edi]
push 0
push edi
call dword [ecx + 0x94]
mov ecx, 0x1029
cmp ax, cx
jne 0x100f62f2
mov eax, dword [edi]
push esi
push edi
call dword [eax + 0xd0]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx], eax
test eax, eax
je 0x100f62f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [edi]
push edi
call dword [eax + 0xa4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
test al, al
jne 0x100f62c1
mov esi, dword [ebp - 0x90]
jmp case.0x100f628f.4107
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x2c], eax
jmp case.0x100f628f.4107
mov eax, dword [ebp - 0x8c]
mov dword [eax + 0x7c], 2
jmp case.0x100f628f.4107
mov eax, dword [ebp - 0x8c]
mov dword [eax + 0x7c], 1
jmp case.0x100f628f.4107
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov esi, dword [esi + 0x10c]
mov edx, eax
mov eax, dword [ebp - 0x90]
push 0
push 0x20
push 0x20
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0x9c], edx
call dword [ecx + 0x314]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov dword [eax + 0x10c], esi
test ecx, ecx
je 0x100f67fd
mov esi, dword [ebp - 0x90]
mov eax, 0x100f
cmp word [ebp - 0xa4], ax
jne 0x100f63da
test byte [esi + 0x15a], 1
jne 0x100f63da
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x31c]
mov ecx, dword [ebp - 0x9c]
cmp dword [ecx + 0x4c], 0
jne case.0x100f628f.4107
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0xb8]
jmp case.0x100f628f.4107
mov eax, dword [ebp - 0x8c]
push edi
add eax, 0x24
push eax
call fcn.1003dd22
jmp case.0x100f628f.4107
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x18], eax
jmp case.0x100f628f.4107
push dword [ebp - 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
mov edx, eax
mov eax, dword [ebp - 0x8c]
mov dword [eax + 0x10], edx
cmp dword [edx + 0x4c], 0
jne case.0x100f628f.4107
mov ecx, dword [esi]
push edx
push esi
call dword [ecx + 0xb8]
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
push edi
mov dword [ecx + 0x6c], eax
mov eax, dword [edi]
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
push edi
mov dword [ecx + 0x70], eax
mov eax, dword [edi]
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
push edi
mov dword [ecx + 0x74], eax
mov eax, dword [edi]
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x78], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x40], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x38], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x44], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x48], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x4c], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x50], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x54], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x58], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x5c], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x60], eax
jmp case.0x100f628f.4107
mov eax, dword [edi]
push edi
call dword [eax + 0x6c]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x64], eax
mov eax, dword [edi]
push edi
call dword [eax + 0xa4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
test al, al
jne 0x100f626c
jmp 0x100f66e7
sub eax, 0x101d
je 0x100f66d2
dec eax
dec eax
je 0x100f66c4
dec eax
je 0x100f65d9
sub eax, 0xa
jne 0x100f66e7
test byte [esi + 0x15a], 1
jne 0x100f66e7
mov ecx, dword [edi]
lea eax, [esi + 0x118]
push 4
push 3
push eax
push edi
call dword [ecx + 0xb8]
mov ecx, dword [edi]
lea eax, [esi + 0x124]
push 4
push 3
push eax
push edi
call dword [ecx + 0xb8]
jmp 0x100f66e7
mov eax, dword [esi + 0x164]
push 1
push esi
or dword [eax + 0x28], 0x4000
mov eax, dword [esi]
call dword [eax + 0x2f8]
jmp 0x100f66b1
mov eax, dword [edi]
push 0
push edi
call dword [eax + 0x94]
movzx eax, ax
sub eax, 0x1021
je 0x100f6683
dec eax
jne 0x100f66a8
mov eax, dword [esi + 0x2a8]
push edi
mov esi, dword [eax + 0x70]
mov eax, dword [edi]
call dword [eax + 0xe0]
mov eax, dword [esi + 0x62]
fstp dword [ebp - 0xa4]
movss xmm0, dword [ebp - 0xa4]
movaps xmm1, xmm0
xorps xmm1, xmmword [0x10131350]
movss dword [eax], xmm1
mov eax, dword [esi + 0x62]
movss dword [eax + 4], xmm0
mov eax, dword [esi + 0x62]
movss dword [eax + 0xc], xmm0
mov eax, dword [esi + 0x62]
movss dword [eax + 0x10], xmm0
mov eax, dword [esi + 0x62]
movss dword [eax + 0x18], xmm0
mov eax, dword [esi + 0x62]
movss dword [eax + 0x1c], xmm1
mov eax, dword [esi + 0x62]
movss dword [eax + 0x24], xmm1
mov eax, dword [esi + 0x62]
mov esi, dword [ebp - 0x90]
movss dword [eax + 0x28], xmm1
jmp 0x100f66a8
push edi
lea eax, [ebp - 0x84]
push eax
call fcn.1003dd22
mov eax, dword [esi + 0x2a8]
lea edx, [ebp - 0x84]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov eax, dword [edi]
push edi
call dword [eax + 0xa4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
test al, al
jne 0x100f65f6
jmp 0x100f66e7
mov eax, dword [edi]
push edi
call dword [eax + 0x64]
mov byte [esi + 0x349], al
jmp 0x100f66e7
test byte [esi + 0x15a], 1
jne 0x100f66e7
mov eax, dword [edi]
push edi
call dword [eax + 0x64]
mov byte [esi + 0x348], al
mov eax, dword [edi]
push edi
call dword [eax + 0xa4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
test al, al
jne 0x100f5cd4
mov edx, dword [ebp - 0x98]
mov edi, dword [ebp - 0xa0]
test edx, edx
jne 0x100f6719
test edi, edi
je 0x100f67e8
mov eax, dword [esi + 0x28]
cmp dword [eax + 0x10c], 0
jne 0x100f67c8
mov ecx, dword [ebp - 0x94]
call fcn.100ada3d
test al, al
je 0x100f67c8
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x100f6758
cmp dword [ecx + 0x28], 0
jne 0x100f6758
push dword [esi + 0x28]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x84]
test edi, edi
je 0x100f676e
cmp dword [edi + 0x28], 0
jne 0x100f676e
push dword [esi + 0x28]
mov eax, dword [edi]
push edi
call dword [eax + 0x84]
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x100f6788
cmp dword [ecx + 0x4c], 0
jne 0x100f6788
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0xb8]
test edi, edi
je 0x100f679c
cmp dword [edi + 0x4c], 0
jne 0x100f679c
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xb8]
mov eax, dword [esi + 0x28]
mov edx, dword [ebp - 0x98]
push 0
push 0xf0
mov ecx, dword [eax]
push 0x140
push edx
push eax
call dword [ecx + 0x314]
test edi, edi
je 0x100f67c8
mov dword [eax + 0x10], edi
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x100f67de
mov eax, dword [eax]
mov edx, dword [ebp - 0x98]
push edx
call dword [eax + 8]
test edi, edi
je 0x100f67e8
mov ecx, dword [edi]
push edi
call dword [ecx + 8]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1012364c
mov esp, ebp
pop ebp
ret 0xc
push 0xfffffffffffffff4
pop eax
jmp 0x100f67eb