Function at 0x59036eb0
Capabilities:
Move file
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x59151312
push eax
mov dword fs:[0], esp
sub esp, 0x4f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50c]
test esi, esi
push edi
je 0x59037bbe
mov edi, dword [esp + 0x514]
test edi, edi
je 0x59037bbe
mov eax, dword [esp + 0x520]
test eax, eax
je 0x59036f00
mov dword [eax], 0
jmp 0x59036f23
mov eax, dword [0x591ae1c8]
test eax, eax
je 0x59036f23
push esi
push str.AnalyseMailQiye163EMailAttach___S_
push str.MailLog
push 0xffffffffffffffff
push 0x591ae15c
call fcn.590851e0
add esp, 0x14
mov eax, dword [esp + 0x518]
push eax
call fcn.59009f90
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x59037bbe
push 0x5918a2d4
push edi
push esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x54], edi
call fcn.5900f7b0
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
je 0x59037bbe
mov edi, 0x5918a2d4
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebx + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5918a2d4
add ecx, ebp
add ecx, esi
mov dword [esp + 0x1c], ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x514]
lea eax, [esp + 0x10]
not ecx
dec ecx
sub edi, ebp
sub edi, ecx
mov ecx, dword [ebx + 0xc]
push ecx
push edx
push ebp
push esi
push eax
call fcn.5901c360
add esp, 0x14
push 0x5918b164
lea ecx, [esp + 0x14]
mov dword [esp + 0x50c], 0
call fcn.590a8840
test eax, eax
jl 0x59036ff4
lea ecx, [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.590a9da0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x50c], 1
call fcn.590a77f0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x508], 0
call fcn.590a7660
mov eax, dword [0x591ae1c8]
test eax, eax
je 0x5903701b
mov edx, dword [esp + 0x10]
push edx
push str.AnalyseMailQiye163EMailAttach_wstrFlag__s_
push str.MailLog
push 0xffffffffffffffff
push 0x591ae15c
call fcn.590851e0
add esp, 0x14
push 0x5918993c
push str.func
push ebp
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.5901c360
mov ecx, dword [esp + 0x34]
push str.upload_3Aprepare
push ecx
mov byte [esp + 0x524], 2
call fcn.5908ac78
add esp, 0x1c
test eax, eax
jne 0x5903711b
mov eax, dword [esp + 0x520]
test eax, eax
jne 0x5903747b
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x48]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push edi
lea edx, [esp + 0x34]
push ecx
push edx
call fcn.5901c1f0
add esp, 0x14
mov eax, dword [0x591638c0]
mov byte [esp + 0x508], 3
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
push 0xfde9
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x510], 4
call fcn.590abac0
mov edx, dword [ebx + 0x54]
mov eax, dword [ebx + 0x50]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push edi
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.5901c360
add esp, 0x14
mov eax, dword [esp + 0x14]
mov byte [esp + 0x508], 5
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x590370e6
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x59037486
lea ecx, [esp + 0x18]
mov byte [esp + 0x508], 4
call fcn.590a7660
lea ecx, [esp + 0x14]
mov byte [esp + 0x508], 3
call fcn.590a7660
lea ecx, [esp + 0x28]
mov byte [esp + 0x508], 2
call fcn.590a22e0
jmp 0x59037144
mov edx, dword [esp + 0x20]
push str.upload_3AdirectData
push edx
call fcn.5908ac78
add esp, 8
test eax, eax
jne 0x59037b99
mov eax, dword [esp + 0x520]
test eax, eax
jne 0x5903747b
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
push eax
push ecx
push ebp
lea edx, [esp + 0x48]
push esi
push edx
call fcn.5901c360
mov eax, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x40]
push eax
push ecx
push ebp
lea edx, [esp + 0x6c]
push esi
push edx
mov byte [esp + 0x530], 7
call fcn.5901c360
mov eax, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
push eax
push ecx
push ebp
lea edx, [esp + 0x78]
push esi
push edx
mov byte [esp + 0x544], 8
call fcn.5901c360
mov eax, dword [esp + 0x80]
mov byte [esp + 0x544], 9
push eax
call fcn.5908ae09
mov edx, dword [esp + 0x50]
add esp, 0x40
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x518]
push 1
push ecx
push 0
push edx
lea ecx, [esp + 0x40]
push eax
push ecx
call fcn.5900a5a0
push 0x5918986c
push 0x5918b260
push ebp
lea edx, [esp + 0x5c]
push esi
push edx
mov byte [esp + 0x534], 0xa
call fcn.5901c1f0
add esp, 0x2c
mov edi, 0x5918a2d4
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x514]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x38]
mov byte [esp + 0x508], 0xb
not ecx
dec ecx
add ebp, ecx
mov ecx, dword [eax - 8]
add esi, ebp
sub ebx, ebp
test ecx, ecx
je 0x59037275
push 0x5918a2d4
push ebx
push esi
call fcn.5900f7b0
mov ebp, eax
add esp, 0xc
cmp ebp, 0xffffffff
je 0x59037275
mov edi, 0x5918a2d4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5918b25c
add ebp, ecx
mov ecx, dword [esp + 0x38]
add esi, ebp
mov edx, dword [ecx - 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, 0x5918986c
neg edx
lea eax, [ecx + ecx*2]
or ecx, 0xffffffff
sub edx, eax
xor eax, eax
sub edx, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
add ebx, edx
lea ecx, [esp + 0x84]
call fcn.590b4e60
mov ecx, dword [0x591638bc]
mov byte [esp + 0x508], 0xc
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x58]
mov byte [esp + 0x508], 0xd
call fcn.590acfe0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x508], 0xe
call fcn.590acfe0
mov edx, dword [esp + 0x30]
mov byte [esp + 0x508], 0xf
mov eax, dword [edx - 8]
test eax, eax
je 0x59037383
lea eax, [esp + 0x2c]
push 0x59189be8
push eax
call fcn.590593f0
add esp, 8
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x50c], 0x10
call fcn.590a2460
lea ecx, [esp + 0x2c]
mov byte [esp + 0x508], 0xf
call fcn.590a22e0
mov ecx, dword [esp + 0x34]
push 0x180
push 0x8101
push ecx
call fcn.5908a6ad
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x59037383
push ebx
push esi
push edi
call fcn.5908a4bd
push edi
call fcn.5908a3dd
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x98]
add esp, 0x10
lea ecx, [esp + 0x84]
push edx
push eax
call fcn.590b50a0
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x20]
call fcn.590a6d60
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x60]
mov byte [esp + 0x510], 0x11
call fcn.590ad5f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x508], 0xf
call fcn.590a7660
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x59037afd
mov eax, dword [0x591ae1c8]
test eax, eax
je 0x590373bb
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x30]
push ecx
push edx
push str.AnalyseMailQiye163EMailAttach___s___d_
push str.MailLog
push 0xffffffffffffffff
push 0x591ae15c
call fcn.590851e0
add esp, 0x18
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x30]
push eax
push ecx
lea ecx, [esp + 0x74]
call fcn.590ad5f0
mov ebp, dword [esp + 0x51c]
test ebp, ebp
jne 0x5903759c
lea edx, [esp + 0x40]
push ebp
push edx
call fcn.590593f0
lea eax, [esp + 0x74]
mov edx, dword [esp + 0x44]
push 1
lea ecx, [esp + 0x64]
push eax
mov eax, dword [esp + 0x50]
push ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
push eax
mov byte [esp + 0x53c], 0x27
call fcn.5900c510
add esp, 0x34
test eax, eax
je 0x59037465
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x40]
push edi
push esi
push ecx
call fcn.5900c300
add esp, 0xc
test eax, eax
je 0x59037465
push ebp
lea edx, [esp + 0x88]
push ebp
lea eax, [esp + 0x74]
push edx
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x64]
push eax
push ecx
mov eax, dword [esp + 0x54]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push edx
push 2
push 1
push eax
push edi
push esi
call fcn.5900e5d0
add esp, 0x44
lea ecx, [esp + 0x40]
mov byte [esp + 0x508], 0xf
call fcn.590a22e0
jmp 0x59037afd
mov dword [eax], 1
jmp 0x59037b99
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
push ecx
push edx
push ebp
lea eax, [esp + 0x30]
push esi
push eax
call fcn.5901c360
mov esi, dword [esp + 0x52c]
mov ecx, 0x106
xor eax, eax
lea edi, [esp + 0xfc]
mov byte [esp + 0x51c], 6
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x108]
push ecx
push edx
mov dword [esp + 0x104], esi
call fcn.5908873d
mov eax, dword [esp + 0x44]
push eax
push esi
call fcn.5900a090
mov ecx, dword [esp + 0x3c]
push 0x103
lea edx, [esp + 0x324]
push ecx
push edx
mov dword [esp + 0x11c], eax
call fcn.5908873d
mov eax, dword [esp + 0x4c]
push eax
call fcn.5908ae09
lea ecx, [esp + 0x11c]
mov dword [esp + 0x124], eax
push ecx
call fcn.5900a170
mov eax, dword [0x591ae1c8]
add esp, 0x3c
test eax, eax
je 0x59037553
mov edx, dword [esp + 0xec]
lea eax, [esp + 0x2f8]
push edx
push eax
push str.AnalyseMailQiye163EMailAttach_astrAttachName__s___d_
push str.MailLog
push 0xffffffffffffffff
push 0x591ae15c
call fcn.590851e0
add esp, 0x18
lea ecx, [esp + 0x24]
mov byte [esp + 0x508], 5
call fcn.590a7660
lea ecx, [esp + 0x18]
mov byte [esp + 0x508], 4
call fcn.590a7660
lea ecx, [esp + 0x14]
mov byte [esp + 0x508], 3
call fcn.590a7660
lea ecx, [esp + 0x28]
mov byte [esp + 0x508], 2
call fcn.590a22e0
jmp 0x59037b99
mov eax, dword [esp + 0x5c]
xor ebx, ebx
test eax, eax
jle 0x59037afd
mov eax, dword [0x591638c0]
mov dword [esp + 0xb8], eax
mov byte [esp + 0x508], 0x12
mov dword [esp + 0xbc], eax
mov byte [esp + 0x508], 0x13
mov dword [esp + 0xc0], eax
mov ecx, dword [0x591638bc]
mov byte [esp + 0x508], 0x14
mov dword [esp + 0xc8], ecx
mov byte [esp + 0x508], 0x15
mov dword [esp + 0xe0], eax
mov edx, dword [esp + 0x518]
lea eax, [esp + 0x10]
mov byte [esp + 0x508], 0x17
push eax
lea ecx, [esp + 0xbc]
mov dword [esp + 0xa0], edx
call fcn.590a77f0
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
mov eax, dword [ebp + 8]
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa0], ecx
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0xb0]
mov dword [esp + 0xa8], eax
push edx
mov dword [esp + 0xb0], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x58]
lea ecx, [eax + ebx*4]
push ecx
lea ecx, [esp + 0x20]
call fcn.590a6c60
push 0x5c
lea ecx, [esp + 0x20]
mov byte [esp + 0x50c], 0x18
call fcn.590a8810
inc eax
lea edx, [esp + 0x2c]
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.590a9950
lea eax, [esp + 0x94]
mov byte [esp + 0x508], 0x19
push eax
call fcn.5900d660
add esp, 4
mov eax, dword [eax]
lea ecx, [esp + 0x80]
push eax
mov byte [esp + 0x50c], 0x1a
call fcn.590a6d60
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x18]
push ecx
push eax
push edx
mov byte [esp + 0x514], 0x1b
call fcn.590a7c00
lea ecx, [esp + 0x80]
mov byte [esp + 0x508], 0x1e
call fcn.590a7660
lea ecx, [esp + 0x94]
mov byte [esp + 0x508], 0x1d
call fcn.590a22e0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax + ebx*4]
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea edx, [esp + 0x18]
lea ecx, [esp + 0xc0]
push edx
call fcn.590a77f0
push 0x2e
lea ecx, [esp + 0x1c]
call fcn.590a8810
push eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x20]
call fcn.590a9da0
push 0x5918a4a0
lea ecx, [esp + 0x54]
mov byte [esp + 0x50c], 0x1f
call fcn.590a82b0
mov ecx, dword [esp + 0x6c]
lea edx, [ecx + ebx*4]
lea ecx, [esp + 0xbc]
push edx
call fcn.590a77f0
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x50]
push edx
mov ecx, dword [eax + ebx*4]
mov dword [esp + 0xc8], ecx
lea ecx, [esp + 0x80]
call fcn.590a1b80
push eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0x50c], 0x20
call fcn.590a2460
lea ecx, [esp + 0x7c]
mov byte [esp + 0x508], 0x1f
call fcn.590a22e0
mov eax, dword [esp + 0xc8]
push 0x180
push 0x8101
push eax
call fcn.5908a6ad
mov ecx, dword [0x591638bc]
add esp, 0xc
mov edi, eax
mov dword [esp + 0x14], ecx
cmp edi, 0xffffffff
mov byte [esp + 0x508], 0x21
je 0x59037845
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x68]
push edx
push eax
push edi
call fcn.5908a4bd
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0xbc]
mov eax, dword [ebp + 0xc]
add esp, 0xc
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 4]
push eax
mov eax, dword [ebp]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str._r_n_r_nliTickBegin:_I64u__liTickEnd:_I64u__liTickRecord:_I64u
push ecx
call fcn.590a5140
mov edx, dword [esp + 0x34]
add esp, 0x20
lea ecx, [esp + 0x14]
mov eax, dword [edx - 8]
push eax
push 0
call fcn.590a2f70
push eax
push edi
call fcn.5908a4bd
push edi
call fcn.5908a3dd
add esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
mov eax, dword [eax - 8]
add eax, ecx
mov ecx, dword [0x591af024]
mov esi, ecx
mov dword [esp + 0xcc], eax
cmp esi, ecx
mov dword [esp + 0x24], esi
jl 0x59037a1e
lea edi, [esi + 1]
test edi, edi
jne 0x590378c4
mov edi, dword [0x591af020]
test edi, edi
je 0x590378b3
mov edx, ecx
dec ecx
test edx, edx
je 0x5903789b
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.59060790
add edi, 0x48
dec esi
jne 0x59037888
mov esi, dword [esp + 0x24]
mov eax, dword [0x591af020]
push eax
call fcn.5913e209
add esp, 4
mov dword [0x591af020], 0
xor eax, eax
mov dword [0x591af028], eax
mov dword [0x591af024], eax
jmp 0x59037a1e
mov eax, dword [0x591af020]
test eax, eax
jne 0x590378f9
lea ecx, [edi + edi*8]
shl ecx, 3
push ecx
call fcn.5913e1e0
push edi
push eax
mov dword [0x591af020], eax
call fcn.59060d30
add esp, 0xc
mov dword [0x591af028], edi
mov dword [0x591af024], edi
jmp 0x59037a1e
cmp edi, dword [0x591af028]
jg 0x59037958
cmp ecx, edi
jge 0x59037924
lea edx, [ecx + ecx*8]
sub edi, ecx
push edi
lea eax, [eax + edx*8]
push eax
call fcn.59060d30
lea eax, [esi + 1]
add esp, 8
mov dword [0x591af024], eax
jmp 0x59037a1e
jle 0x5903794b
lea edx, [edi + edi*8]
sub ecx, edi
lea edi, [eax + edx*8]
mov eax, ecx
dec ecx
test eax, eax
je 0x5903794b
lea esi, [ecx + 1]
push 0
mov ecx, edi
call fcn.59060790
add edi, 0x48
dec esi
jne 0x59037938
mov esi, dword [esp + 0x24]
lea eax, [esi + 1]
mov dword [0x591af024], eax
jmp 0x59037a1e
mov eax, dword [0x591af02c]
test eax, eax
jne 0x59037984
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x59037978
mov eax, 4
jmp 0x59037984
cmp eax, 0x400
jle 0x59037984
mov eax, 0x400
mov ecx, dword [0x591af028]
add eax, ecx
cmp edi, eax
jge 0x59037996
mov dword [esp + 0x28], eax
jmp 0x5903799c
mov dword [esp + 0x28], edi
mov eax, edi
lea edx, [eax + eax*8]
shl edx, 3
push edx
call fcn.5913e1e0
mov ecx, dword [0x591af024]
mov esi, dword [0x591af020]
mov edi, eax
mov dword [esp + 0x9c], eax
lea ecx, [ecx + ecx*8]
shl ecx, 3
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
lea esi, [ecx + 1]
mov ecx, dword [0x591af024]
mov edx, esi
sub edx, ecx
lea ecx, [ecx + ecx*8]
push edx
lea edx, [eax + ecx*8]
push edx
call fcn.59060d30
mov eax, dword [0x591af020]
push eax
call fcn.5913e209
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x38]
mov dword [0x591af024], esi
mov esi, dword [esp + 0x34]
add esp, 0x10
mov dword [0x591af020], ecx
mov dword [0x591af028], edx
mov edx, dword [0x591af020]
lea ecx, [esi + esi*8]
lea eax, [esp + 0x9c]
push eax
lea ecx, [edx + ecx*8]
call fcn.59060700
lea ecx, [esp + 0x14]
mov byte [esp + 0x508], 0x1f
call fcn.590a22e0
lea ecx, [esp + 0x50]
mov byte [esp + 0x508], 0x1d
call fcn.590a7660
lea ecx, [esp + 0x18]
mov byte [esp + 0x508], 0x19
call fcn.590a7660
lea ecx, [esp + 0x2c]
mov byte [esp + 0x508], 0x18
call fcn.590a7660
lea ecx, [esp + 0x1c]
mov byte [esp + 0x508], 0x17
call fcn.590a7660
lea ecx, [esp + 0xe0]
mov byte [esp + 0x508], 0x25
call fcn.590a7660
lea ecx, [esp + 0xc8]
mov byte [esp + 0x508], 0x24
call fcn.590a22e0
lea ecx, [esp + 0xc0]
mov byte [esp + 0x508], 0x23
call fcn.590a7660
lea ecx, [esp + 0xbc]
mov byte [esp + 0x508], 0x22
call fcn.590a7660
lea ecx, [esp + 0xb8]
mov byte [esp + 0x508], 0xf
call fcn.590a7660
mov eax, dword [esp + 0x5c]
inc ebx
cmp ebx, eax
jl 0x590375aa
lea ecx, [esp + 0x6c]
mov byte [esp + 0x508], 0xe
call fcn.590acff0
lea ecx, [esp + 0x58]
mov byte [esp + 0x508], 0xd
call fcn.590acff0
lea ecx, [esp + 0x34]
mov byte [esp + 0x508], 0xc
call fcn.590a22e0
lea ecx, [esp + 0x84]
mov byte [esp + 0x508], 0xb
call fcn.590b4e70
lea ecx, [esp + 0x38]
mov byte [esp + 0x508], 0xa
call fcn.590a22e0
lea ecx, [esp + 0x30]
mov byte [esp + 0x508], 9
call fcn.590a7660
lea ecx, [esp + 0x44]
mov byte [esp + 0x508], 8
call fcn.590a7660
lea ecx, [esp + 0x4c]
mov byte [esp + 0x508], 7
call fcn.590a7660
lea ecx, [esp + 0x3c]
mov byte [esp + 0x508], 2
call fcn.590a7660
lea ecx, [esp + 0x20]
mov byte [esp + 0x508], 0
call fcn.590a7660
lea ecx, [esp + 0x10]
mov dword [esp + 0x508], 0xffffffff
call fcn.590a7660
mov ecx, dword [esp + 0x500]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4fc
ret