Function at 0x41af90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x94c
mov eax, dword [0x49e7c0]
xor eax, esp
mov dword [esp + 0x948], eax
mov eax, dword [esp + 0x964]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x960]
mov ebx, ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0
call fcn.0041e6e0
mov ecx, dword [edi + 0x43c]
mov eax, dword [edi + 0x18]
mov esi, dword [edi + 0x444]
mov ebp, dword [edi + 0x448]
mov dword [esp + 0x14], ecx
movzx ecx, word [edi + 0x22]
imul eax, ecx
add esi, dword [esp + 0x964]
add ebp, dword [esp + 0x968]
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 3
and eax, 0xfffffffc
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x440]
cmp eax, 0x8000010
mov dword [esp + 0x1c], ecx
jg 0x41b497
je 0x41b407
cmp eax, 0x4000020
jg 0x41b3f4
je 0x41b4c3
sub eax, 0x4000010
je 0x41b117
sub eax, 8
jne 0x41b6d8
mov edx, dword [esp + 0x97c]
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x96c]
push 0
push edx
push 0
push 1
push 4
push eax
push ecx
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
mov eax, dword [edi + 0x1c]
mov edx, esi
and edx, 3
add dword [esp + 0x96c], edx
and esi, 0xfffffffc
test eax, eax
jge 0x41b0b1
mov eax, dword [esp + 0x10]
imul eax, ebp
lea ecx, [esi + esi*2]
add eax, ecx
add eax, dword [edi + 0x43c]
jmp 0x41b0ce
mov ecx, dword [esp + 0x10]
sub eax, ebp
sub eax, 1
imul eax, ecx
lea edx, [esi + esi*2]
add eax, edx
add eax, dword [edi + 0x43c]
neg ecx
mov dword [esp + 0x10], ecx
mov ecx, ebx
mov dword [esp + 0x14], eax
call fcn.00408f90
mov ecx, dword [esp + 0x970]
mov edx, dword [esp + 0x96c]
neg eax
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
push edx
mov ecx, ebx
call fcn.00408f90
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esp + 0x24]
sub ecx, 1
imul eax, ecx
add eax, dword [ebx + 0x43c]
push eax
push edx
call fcn.0041ca90
jmp 0x41bbe0
mov eax, dword [esp + 0x97c]
mov ecx, dword [esp + 0x970]
mov edx, dword [esp + 0x96c]
push 0
push eax
push 0
push 1
push 1
push ecx
push edx
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
mov eax, dword [edi + 0x1c]
test eax, eax
jge 0x41b172
mov eax, dword [esp + 0x10]
mov ecx, eax
imul ecx, ebp
lea ebp, [ecx + esi*2]
add ebp, dword [edi + 0x43c]
neg eax
mov dword [esp + 0x10], eax
jmp 0x41b185
sub eax, ebp
sub eax, 1
imul eax, dword [esp + 0x10]
lea ebp, [eax + esi*2]
add ebp, dword [edi + 0x43c]
mov ecx, ebx
call fcn.00408f90
mov edx, dword [ebx + 0x1c]
mov esi, eax
sub edx, 1
imul esi, edx
add esi, dword [ebx + 0x43c]
mov ecx, ebx
mov dword [esp + 0x20], esi
call fcn.00408f90
cmp dword [edi + 0x24], 3
mov dword [esp + 0x14], eax
jne 0x41b2f8
mov ecx, dword [edi + 0x40]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + 0x44]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], edx
xor ecx, ecx
lea ecx, [ecx]
mov eax, dword [esp + ecx + 0x30]
test eax, eax
mov dword [esp + ecx + 0x40], 0
je 0x41b1ed
test al, 1
jne 0x41b1ed
add dword [esp + ecx + 0x40], 1
shr eax, 1
jne 0x41b1e0
mov dword [esp + ecx + 0x4c], eax
add ecx, 4
cmp ecx, 0xc
jl 0x41b1d0
cmp dword [esp + 0x970], 0
mov dword [esp + 0x1c], 0
jle 0x41bbe0
mov ebx, dword [esp + 0x96c]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41b23d
mov ecx, dword [esp + 0x978]
mov edx, dword [esp + 0x970]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push ecx
call eax
test eax, eax
jne 0x41b9bd
xor esi, esi
test ebx, ebx
jle 0x41b2cf
jmp 0x41b250
movzx eax, word [ebp + esi*2]
mov ecx, dword [esp + 0x40]
movzx edi, ax
mov eax, edi
and eax, dword [esp + 0x30]
xor edx, edx
shr eax, cl
mov ecx, dword [esp + 0x44]
add esi, 1
imul eax, eax, 0xff
div dword [esp + 0x4c]
xor edx, edx
add al, al
mov byte [esp + 0x27], al
mov eax, edi
and eax, dword [esp + 0x34]
shr eax, cl
movzx ecx, byte [esp + 0x27]
imul eax, eax, 0xff
div dword [esp + 0x50]
mov dl, 0x2d
add al, cl
mov ecx, dword [esp + 0x48]
imul dl
mov byte [esp + 0x27], al
mov eax, edi
and eax, dword [esp + 0x38]
xor edx, edx
shr eax, cl
mov cl, 0x79
imul eax, eax, 0xff
div dword [esp + 0x54]
mov edx, dword [esp + 0x20]
imul cl
movzx ecx, byte [esp + 0x27]
add cl, al
cmp esi, ebx
mov byte [esi + edx - 1], cl
jl 0x41b250
mov eax, dword [esp + 0x14]
sub dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
sub ebp, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x970]
mov dword [esp + 0x1c], eax
jl 0x41b216
jmp 0x41bbe0
xor edi, edi
cmp dword [esp + 0x970], edi
mov dword [esp + 0x1c], edi
jle 0x41bbe0
mov ebx, dword [esp + 0x970]
add esi, 1
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x96c]
cmp dword [esp + 0x28], 0
je 0x41b33d
mov ecx, dword [esp + 0x978]
push ecx
push ebx
push edi
call dword [esp + 0x34]
test eax, eax
jne 0x41b9bd
test esi, esi
jle 0x41b3d4
mov ecx, dword [esp + 0x20]
add esi, 0xffffffff
shr esi, 1
mov edi, ebp
add esi, 1
mov eax, dword [edi]
mov edx, eax
shr edx, 0xa
and edx, 0x1f
imul edx, edx, 0x2645a
mov ebx, eax
shr ebx, 5
and ebx, 0x1f
imul ebx, ebx, 0x4b22d
add edx, ebx
mov ebx, eax
and ebx, 0x1f
imul ebx, ebx, 0xe979
add edx, ebx
shr edx, 0x10
mov byte [ecx - 1], dl
mov edx, eax
shr edx, 0x10
mov ebx, eax
and edx, 0x1f
shr ebx, 0x1a
imul edx, edx, 0xe979
shr eax, 0x15
and ebx, 0x1f
imul ebx, ebx, 0x2645a
and eax, 0x1f
imul eax, eax, 0x4b22d
add edx, ebx
add edx, eax
shr edx, 0x10
mov byte [ecx], dl
add edi, 4
add ecx, 2
sub esi, 1
jne 0x41b353
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x96c]
mov ebx, dword [esp + 0x970]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x20], eax
sub ebp, dword [esp + 0x10]
add edi, 1
cmp edi, ebx
mov dword [esp + 0x1c], edi
jl 0x41b320
jmp 0x41bbe0
mov ecx, eax
sub ecx, 0x8000008
je 0x41b451
sub ecx, 4
jne 0x41b6d8
cmp eax, 0x8000018
jne 0x41b580
mov edx, dword [esp + 0x97c]
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x96c]
push 0
push edx
push 0
push 1
push 4
push eax
push ecx
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
je 0x41bbe0
jmp 0x41bbe4
mov ecx, dword [esp + 0x97c]
mov edx, dword [esp + 0x978]
mov eax, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x974]
push edx
mov edx, dword [esp + 0x974]
push eax
mov eax, dword [esp + 0x974]
push ecx
mov ecx, dword [esp + 0x974]
push edx
push eax
push ecx
push edi
mov ecx, ebx
call fcn.0041ec70
mov dword [esp + 0x18], eax
jmp 0x41bbe0
cmp eax, 0x20000002
jg 0x41b6cc
cmp eax, 0x20000001
jge 0x41b6e5
cmp eax, 0x8000018
je 0x41b412
cmp eax, 0x10000020
jne 0x41b6d8
mov edx, dword [esp + 0x97c]
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x96c]
push 0
push edx
push 0
push 1
push 1
push eax
push ecx
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
mov eax, dword [edi + 0x1c]
test eax, eax
jge 0x41b516
mov edx, dword [esp + 0x10]
imul edx, ebp
lea esi, [edx + esi*4]
add esi, dword [edi + 0x43c]
jmp 0x41b531
mov ecx, dword [esp + 0x10]
sub eax, ebp
sub eax, 1
imul eax, ecx
lea esi, [eax + esi*4]
add esi, dword [edi + 0x43c]
neg ecx
mov dword [esp + 0x10], ecx
movzx eax, word [ebx + 0x22]
imul eax, dword [ebx + 0x18]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x10]
sar eax, 3
add eax, 3
and eax, 0xfffffffc
mov ecx, eax
neg ecx
push ecx
mov ecx, dword [esp + 0x974]
push edx
mov edx, dword [esp + 0x974]
push ecx
mov ecx, dword [ebx + 0x1c]
sub ecx, 1
imul ecx, eax
add ecx, dword [ebx + 0x43c]
push edx
push ecx
push esi
call fcn.0041c710
jmp 0x41bbe0
cmp eax, 0x8000010
jne 0x41b633
mov edx, dword [esp + 0x97c]
mov eax, dword [esp + 0x970]
mov ecx, dword [esp + 0x96c]
push 0
push edx
push 0
push 1
push 2
push eax
push ecx
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
movzx eax, word [edi + 0x22]
imul eax, dword [edi + 0x18]
add eax, 7
cdq
and edx, 7
add eax, edx
mov ecx, eax
movzx eax, word [ebx + 0x22]
imul eax, dword [ebx + 0x18]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x970]
sar eax, 3
add eax, 3
and eax, 0xfffffffc
push eax
sar ecx, 3
add ecx, 3
and ecx, 0xfffffffc
push ecx
imul ecx, ebp
mov eax, esi
and eax, 1
add eax, dword [esp + 0x974]
push edx
mov edx, dword [ebx + 0x43c]
push eax
and esi, 0xfffffffe
lea eax, [ecx + esi*2]
add eax, dword [edi + 0x43c]
push edx
push eax
call fcn.0041cae0
jmp 0x41bbe0
cmp eax, 0x800000c
jne 0x41bbe0
mov ecx, dword [esp + 0x97c]
mov edx, dword [esp + 0x970]
mov eax, dword [esp + 0x96c]
push 0
push ecx
push 0
push 2
push 8
push edx
push eax
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
mov ecx, ebx
call fcn.00408f90
push eax
mov ecx, edi
call fcn.00408f90
mov ecx, ebp
and ecx, 1
add ecx, dword [esp + 0x974]
push eax
mov eax, dword [ebx + 0x43c]
mov edx, esi
and edx, 7
add edx, dword [esp + 0x974]
push ecx
push edx
push eax
mov ecx, edi
call fcn.00408f90
and ebp, 0xfffffffe
imul eax, ebp
and esi, 0xfffffff8
add eax, esi
add eax, dword [edi + 0x43c]
push eax
call fcn.0041cb30
jmp 0x41bbe0
sub eax, 0x20000004
je 0x41b6e5
sub eax, 4
je 0x41b6e5
mov dword [esp + 0x18], 0xffffffff
jmp 0x41bbe0
mov edx, dword [edi + 0x34]
test edx, edx
mov dword [esp + 0x20], edx
jne 0x41b6fb
mov edx, 1
shl edx, cl
mov dword [esp + 0x20], edx
cmp dword [esp + 0x1c], 8
jne 0x41b78b
xor eax, eax
test edx, edx
jle 0x41b73b
lea ecx, [edi + 0x3d]
nop
movzx edx, byte [ecx - 1]
cmp edx, eax
jne 0x41b737
movzx edx, byte [ecx]
cmp edx, eax
jne 0x41b737
movzx edx, byte [ecx + 1]
cmp edx, eax
jne 0x41b737
mov edx, dword [esp + 0x20]
add eax, 1
add ecx, 4
cmp eax, edx
jl 0x41b710
jmp 0x41b73b
mov edx, dword [esp + 0x20]
cmp eax, edx
jne 0x41b78b
mov eax, dword [esp + 0x97c]
mov ecx, dword [esp + 0x978]
mov edx, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x974]
push ecx
mov ecx, dword [esp + 0x974]
push edx
mov edx, dword [esp + 0x974]
push eax
mov eax, dword [esp + 0x974]
push ecx
push edx
push eax
push edi
mov ecx, ebx
call fcn.0041ec70
mov dword [ebx + 0x440], 0x8000008
jmp 0x41bbe4
mov ecx, dword [esp + 0x97c]
mov edx, dword [esp + 0x970]
mov eax, dword [esp + 0x96c]
push 0
push ecx
push 0
push 1
push 8
push edx
push eax
push ebp
push esi
push 0x8000008
mov ecx, ebx
call fcn.0041e8e0
test eax, eax
mov dword [esp + 0x18], eax
jne 0x41bbe4
mov edx, dword [esp + 0x96c]
mov ecx, esi
and ecx, 7
lea eax, [ecx + edx + 7]
mov ecx, dword [edi + 0x1c]
and eax, 0xfffffff8
and esi, 0xfffffff8
test ecx, ecx
mov dword [esp + 0x96c], eax
jge 0x41b816
mov ecx, dword [esp + 0x1c]
mov eax, ecx
imul eax, esi
cdq
and edx, 7
add edx, eax
mov eax, dword [esp + 0x10]
mov esi, eax
imul esi, ebp
add esi, dword [esp + 0x14]
sar edx, 3
add esi, edx
neg eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
jmp 0x41b83e
mov eax, dword [esp + 0x1c]
imul eax, esi
sub ecx, ebp
cdq
sub ecx, 1
imul ecx, dword [esp + 0x10]
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0x14]
add eax, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
movzx eax, word [ebx + 0x22]
imul eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0x1c]
add eax, 7
cdq
and edx, 7
add edx, eax
sar edx, 3
add edx, 3
and edx, 0xfffffffc
sub esi, 1
imul esi, edx
add esi, dword [ebx + 0x43c]
xor eax, eax
mov dword [esp + 0x20], edx
add edi, 0x3d
movzx ebx, byte [edi - 1]
movzx ebp, byte [edi + 1]
imul ebx, ebx, 0x1d2f
imul ebp, ebp, 0x4c8b
add ebx, ebp
movzx ebp, byte [edi]
imul ebp, ebp, 0x9646
lea ebx, [ebx + ebp + 0x8000]
movzx ebp, byte [edi + 4]
sar ebx, 0x10
imul ebp, ebp, 0x9646
mov byte [esp + eax + 0x58], bl
movzx ebx, byte [edi + 3]
imul ebx, ebx, 0x1d2f
add ebx, ebp
movzx ebp, byte [edi + 5]
imul ebp, ebp, 0x4c8b
lea ebx, [ebx + ebp + 0x8000]
movzx ebp, byte [edi + 8]
sar ebx, 0x10
imul ebp, ebp, 0x9646
mov byte [esp + eax + 0x59], bl
movzx ebx, byte [edi + 7]
imul ebx, ebx, 0x1d2f
add ebx, ebp
movzx ebp, byte [edi + 9]
imul ebp, ebp, 0x4c8b
lea ebx, [ebx + ebp + 0x8000]
movzx ebp, byte [edi + 0xc]
sar ebx, 0x10
imul ebp, ebp, 0x9646
mov byte [esp + eax + 0x5a], bl
movzx ebx, byte [edi + 0xb]
imul ebx, ebx, 0x1d2f
add ebx, ebp
movzx ebp, byte [edi + 0xd]
imul ebp, ebp, 0x4c8b
lea ebx, [ebx + ebp + 0x8000]
sar ebx, 0x10
mov byte [esp + eax + 0x5b], bl
add eax, 4
add edi, 0x10
cmp eax, 0x100
jl 0x41b870
cmp ecx, 8
jne 0x41b9c7
xor ebp, ebp
cmp dword [esp + 0x970], ebp
jle 0x41bbe0
cmp dword [esp + 0x28], 0
je 0x41b974
mov eax, dword [esp + 0x978]
mov ecx, dword [esp + 0x970]
push eax
push ecx
push ebp
call dword [esp + 0x34]
test eax, eax
jne 0x41b9bd
mov edx, dword [esp + 0x20]
cmp dword [esp + 0x96c], 0
jle 0x41b9a2
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x96c]
mov eax, esi
sub ecx, esi
lea ecx, [ecx]
movzx ebx, byte [ecx + eax]
mov bl, byte [esp + ebx + 0x58]
mov byte [eax], bl
add eax, 1
sub edi, 1
jne 0x41b990
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebp, 1
sub esi, edx
cmp ebp, dword [esp + 0x970]
jl 0x41b950
jmp 0x41bbe0
mov eax, 0x63
jmp 0x41bbe4
cmp ecx, 1
jne 0x41bb21
xor eax, eax
mov ecx, eax
sar ecx, 7
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x158], cl
mov ecx, eax
sar ecx, 6
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x159], cl
mov ecx, eax
sar ecx, 5
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15a], cl
mov ecx, eax
sar ecx, 4
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15b], cl
mov ecx, eax
sar ecx, 3
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15c], cl
mov ecx, eax
sar ecx, 2
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15d], cl
mov ecx, eax
sar ecx, 1
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15e], cl
mov ecx, eax
and ecx, 1
movzx ecx, byte [esp + ecx + 0x58]
mov byte [esp + eax*8 + 0x15f], cl
add eax, 1
cmp eax, 0x100
jl 0x41b9d2
xor edi, edi
cmp dword [esp + 0x970], edi
mov dword [esp + 0x1c], edi
jle 0x41bbe0
nop
cmp dword [esp + 0x28], 0
je 0x41bab8
mov edx, dword [esp + 0x978]
mov eax, dword [esp + 0x970]
push edx
push eax
push edi
call dword [esp + 0x34]
test eax, eax
jne 0x41b9bd
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
xor ecx, ecx
cmp dword [esp + 0x96c], ecx
jle 0x41bafe
mov edi, esi
mov eax, ebx
sub edi, ebx
lea ecx, [ecx]
movzx ebp, byte [eax]
mov ebp, dword [esp + ebp*8 + 0x158]
mov dword [eax + edi], ebp
movzx ebp, byte [eax]
mov ebp, dword [esp + ebp*8 + 0x15c]
mov dword [esi + ecx + 4], ebp
add ecx, 8
add eax, 8
cmp ecx, dword [esp + 0x96c]
jl 0x41bad0
mov edi, dword [esp + 0x1c]
sub ebx, dword [esp + 0x10]
add edi, 1
sub esi, edx
cmp edi, dword [esp + 0x970]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], edi
jl 0x41ba90
jmp 0x41bbe0
mov ecx, dword [esp + 0x1c]
mov ebp, 1
shl ebp, cl
mov eax, 8
xor ebx, ebx
sub eax, ecx
sub ebp, 1
cmp dword [esp + 0x970], ebx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], ebx
jle 0x41bbe0
lea ecx, [ecx]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x41bb77
mov ecx, dword [esp + 0x978]
mov edx, dword [esp + 0x970]
push ecx
push edx
push ebx
call eax
test eax, eax
jne 0x41b9bd
mov edx, dword [esp + 0x20]
xor edi, edi
xor eax, eax
cmp dword [esp + 0x96c], edi
jle 0x41bbc2
movzx ecx, byte [esp + 0x3c]
mov ebx, dword [esp + 0x14]
mov dl, al
and dl, 7
sub cl, dl
mov edx, eax
add eax, dword [esp + 0x1c]
shr edx, 3
movzx edx, byte [edx + ebx]
shr edx, cl
add edi, 1
and edx, ebp
cmp edi, dword [esp + 0x96c]
movzx ecx, byte [esp + edx + 0x58]
mov byte [edi + esi - 1], cl
jl 0x41bb84
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add ebx, 1
sub esi, edx
cmp ebx, dword [esp + 0x970]
mov dword [esp + 0x2c], ebx
jl 0x41bb50
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x958]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004777ea
add esp, 0x94c
ret 0x20