Function at 0x401000
Capabilities:
Delete file
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x108
cmp eax, 3
push esi
push edi
je 0x401054
mov ecx, 0xfa
xor eax, eax
mov edi, 0x4542f4
rep stosd dword es:[edi], eax
mov edi, 0x4132f4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4542f4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4132d0
jmp 0x40132e
mov esi, dword [esp + 0x118]
mov eax, dword [esi + 4]
movsx ecx, byte [eax]
push ecx
call fcn.0040979d
add esp, 4
test eax, eax
je 0x40131b
mov edx, dword [esi + 8]
movsx eax, byte [edx]
push eax
call fcn.0040979d
add esp, 4
test eax, eax
je 0x401306
xor ecx, ecx
mov dword [0x4542d8], ecx
mov word [0x4542dc], cx
mov edx, dword [esi + 4]
push edx
call fcn.00409792
mov word [0x4542d8], ax
mov eax, dword [esi + 8]
push eax
call fcn.00409792
mov word [0x4542da], ax
call fcn.00405840
push str._n
call fcn.004096d6
push str._________________________________________________n
call fcn.004096d6
push 0x413228
call fcn.004096d6
push str._________________________________F300____________n
call fcn.004096d6
push str._________________________________________________n
call fcn.004096d6
push str._n
call fcn.004096d6
push 0x4131ec
call fcn.004096d6
lea ecx, [esp + 0x38]
mov esi, 0x4d
push ecx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], esi
call fcn.00403a10
mov eax, dword [esp + 0xd0]
add esp, 0x28
test eax, eax
jge 0x40113b
push 0
push str.at04410
push 0x4131c0
jmp 0x401361
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0xb
push edx
mov dword [esp + 0x1c], 0x12c
call fcn.00403a10
mov eax, dword [0x4542e8]
mov word [0x45841c], 0
mov ecx, 0x4131bc
add esp, 4
lea edx, [eax + 0x33a]
mov dx, word [eax + 0x33a]
cmp dx, word [ecx]
jne 0x4011a9
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov word [esp + 0x10], cx
mov dl, byte [eax + 0x37886]
lea eax, [esp + 8]
mov byte [esp + 8], dl
push eax
call fcn.00409792
add esp, 4
mov word [0x45841c], ax
call fcn.00402370
call fcn.00402490
call fcn.00402150
push str._tuc_file4410A.LOG
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [0x45841c], 1
je 0x4011d2
call fcn.004025b0
call 0x401370
test ax, ax
jge 0x40125a
mov ecx, 0x19
xor eax, eax
lea edi, [esp + 0xac]
push 0xbdb2a8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xb0]
push 0x413150
push ecx
call fcn.00409684
add esp, 0xc
lea edx, [esp + 0xac]
push 0x10
push 0x413140
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x63
push eax
call fcn.00403a10
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 9
push ecx
mov dword [esp + 0x20], esi
call fcn.00403a10
add esp, 8
jmp 0x401369
call fcn.00401e90
test eax, eax
je 0x40126d
call fcn.00402370
call fcn.00402490
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x63
push edx
call fcn.00403a10
mov ecx, 0x26
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 9
push eax
mov dword [esp + 0x20], esi
call fcn.00403a10
add esp, 8
call fcn.004036e0
call fcn.004034b0
call fcn.00402f60
call fcn.004031d0
test eax, eax
je 0x4012c2
call fcn.004036e0
push 1
push 0x14
push str.e__d__dH
call fcn.004096d6
push str._____
call fcn.004096d6
mov ecx, dword [0x4542e8]
add esp, 0x10
add ecx, 0x3a6
push 0
mov word [ecx], 0
mov edx, dword [0x4542e8]
mov al, byte [0x413118]
mov byte [edx + 0x3a6], al
call fcn.004095af
mov ecx, 0xfa
xor eax, eax
mov edi, 0x4542f4
rep stosd dword es:[edi], eax
mov edi, 0x4130f0
jmp 0x40132e
mov ecx, 0xfa
xor eax, eax
mov edi, 0x4542f4
rep stosd dword es:[edi], eax
mov edi, 0x4130c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, 0x4542f4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.at04410
and ecx, 3
push 0x4542f4
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call fcn.004095af
sub esp, 0xd4
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x2c], eax
push ebx
push ebp
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], ecx
push esi
push edi
mov dword [esp + 0x44], eax
mov byte [esp + 0x34], cl
mov ecx, 0xeb2
mov edi, 0x4546f0
mov byte [esp + 0x48], al
rep stosd dword es:[edi], eax
xor esi, esi
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x5c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
stosw word es:[edi], ax
call fcn.00402e30
mov ebx, eax
cmp ebx, 1
mov dword [esp + 0x58], ebx
jl 0x401c46
call fcn.00402eb0
movsx ebp, ax
cmp ebp, 1
mov dword [esp + 0x2c], ebp
jl 0x401c4a
cmp word [0x45841c], 1
je 0x401c4a
lea edx, [esp + 0x64]
push 3
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x68]
push edx
push 1
push ebx
rep stosd dword es:[edi], eax
call fcn.004059e0
add esp, 0x10
test ax, ax
jl 0x401c4a
mov dword [esp + 0x18], esi
mov ebx, dword [esp + 0x58]
lea eax, [esp + 0x64]
push 0
push eax
push ebx
call sub.F3CCISAM.dll_xism_readn
cmp eax, 1
jl 0x401c23
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x401756
mov ebx, eax
mov ecx, 0x17
shl ebx, 7
lea esi, [esp + 0x64]
xor edx, edx
lea ebp, [ebx + 0x4583a0]
mov edi, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x4015d4
mov cl, byte [ebp]
mov eax, 0x413354
cmp cl, byte [eax]
jne 0x4014c5
lea edx, [ebx + 0x4583b2]
mov ecx, 3
mov edi, 0x413350
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40148c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jl 0x4014c5
mov ecx, 3
mov edi, 0x41334c
mov esi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4014a7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jg 0x4014c5
lea edx, [esp + 0x14]
push edx
call fcn.00409792
movsx ecx, word [esp + 0x20]
add esp, 4
cmp eax, ecx
jl 0x40174e
mov al, byte [ebp]
mov edx, 0x413354
cmp al, byte [edx]
jne 0x401527
mov ecx, 3
mov edi, 0x413348
lea esi, [ebx + 0x4583b2]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401527
cmp word [esp + 0x1c], 0x64
jne 0x401527
mov ecx, 3
lea edi, [ebx + 0x4583a1]
lea esi, [esp + 0x65]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x401527
lea edx, [esp + 0x71]
lea ecx, [ebx + 0x4583ad]
mov eax, dword [edx]
mov edx, dword [ecx]
cmp eax, edx
jne 0x401527
lea ecx, [esp + 0x14]
push ecx
call fcn.00409792
add esp, 4
mov dword [esp + 0x1c], eax
mov al, byte [ebp]
mov edx, 0x413354
cmp al, byte [edx]
jne 0x4015a8
lea eax, [ebx + 0x4583b2]
mov ecx, 3
mov edi, 0x413344
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401550
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jl 0x4015a8
mov ecx, 3
mov edi, 0x413340
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40156b
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jg 0x4015a8
mov dx, word [eax]
xor ecx, ecx
mov al, byte [eax + 2]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov word [esp + 0x20], dx
mov word [esp + 0x28], cx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x2a], al
call fcn.00401c80
add esp, 8
cmp eax, 1
jne 0x40174e
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x40174e
mov ebx, dword [esp + 0x2c]
mov esi, 0x458420
mov edi, eax
push esi
push ebx
call sub.F3CCISAM.dll_xism_add
add esi, 0x80
dec edi
jne 0x4015bf
jmp 0x40174e
lea ecx, [esp + 0x7b]
lea eax, [esp + 0x14]
mov dx, word [ecx]
cmp dx, word [eax]
je 0x401756
mov cx, word [esp + 0x7b]
xor eax, eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
push edx
mov word [esp + 0x2c], ax
mov word [esp + 0x24], cx
call fcn.00409792
add esp, 4
cmp ax, word [0x4542d8]
jg 0x40169d
lea eax, [esp + 0x14]
push eax
call fcn.00409792
add esp, 4
cmp ax, word [0x4542da]
jge 0x40174e
lea edx, [esp + 0x64]
mov ecx, 0x413354
mov al, byte [edx]
mov dl, byte [ecx]
cmp al, dl
jne 0x401673
mov ecx, 3
mov edi, 0x413348
lea esi, [esp + 0x76]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401673
cmp word [esp + 0x1c], 0x64
jne 0x401673
lea eax, [esp + 0x14]
push eax
call fcn.00409792
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x40174e
mov ebx, dword [esp + 0x2c]
mov esi, 0x458420
push esi
push ebx
call sub.F3CCISAM.dll_xism_add
add esi, 0x80
dec edi
jne 0x401688
jmp 0x40174e
mov ecx, 0x413354
lea edx, [esp + 0x64]
mov dl, byte [edx]
mov bl, byte [ecx]
cmp dl, bl
jne 0x4016ef
mov ecx, 3
mov edi, 0x413350
lea esi, [esp + 0x76]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4016c7
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jl 0x4016ef
mov ecx, 3
mov edi, 0x41334c
lea esi, [esp + 0x76]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4016e4
sbb edx, edx
sbb edx, 0xffffffff
test edx, edx
jg 0x4016ef
cmp ax, word [esp + 0x1c]
jl 0x40174e
lea ecx, [esp + 0x64]
mov eax, 0x413354
mov dl, byte [ecx]
mov cl, byte [eax]
cmp dl, cl
jne 0x40172d
mov ecx, 3
mov edi, 0x413348
lea esi, [esp + 0x76]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40172d
cmp word [esp + 0x1c], 0x64
jne 0x40172d
lea ecx, [esp + 0x14]
push ecx
call fcn.00409792
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x40174e
mov ebx, dword [esp + 0x2c]
mov esi, 0x458420
push esi
push ebx
call sub.F3CCISAM.dll_xism_add
add esi, 0x80
dec edi
jne 0x40173e
mov dword [esp + 0x18], 0
lea eax, [esp + 0x64]
mov edx, 0x413354
mov cl, byte [eax]
mov al, byte [edx]
cmp cl, al
jne 0x4017de
mov ecx, 3
lea edi, [esp + 0x3c]
lea esi, [esp + 0x65]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x40178a
lea ecx, [esp + 0x71]
lea eax, [esp + 0x30]
mov edx, dword [ecx]
mov ecx, dword [eax]
cmp edx, ecx
je 0x4017de
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], eax
mov byte [esp + 0x34], cl
mov ecx, dword [esp + 0x6d]
mov dword [esp + 0x44], eax
mov byte [esp + 0x48], al
mov eax, dword [esp + 0x69]
mov edx, dword [esp + 0x65]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ecx
mov ecx, 0xeb2
xor eax, eax
mov edi, 0x4546f0
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x71]
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x30], edx
stosw word es:[edi], ax
mov ebp, dword [esp + 0x18]
mov ecx, 0x20
shl ebp, 7
lea esi, [esp + 0x64]
xor eax, eax
lea edi, [ebp + 0x458420]
lea edx, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov cx, word [esp + 0x7b]
mov word [esp + 0x14], ax
push edx
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x1a], al
mov word [esp + 0x18], cx
call fcn.00409792
mov ebx, eax
add esp, 4
cmp bx, 1
jl 0x40141d
mov eax, dword [0x4542da]
cmp bx, ax
jge 0x401843
xor eax, eax
movsx ecx, bx
mov word [esp + 0x10], ax
push ecx
mov byte [esp + 0x16], al
jmp 0x401883
mov si, word [0x4542d8]
cmp bx, si
jge 0x40186a
movsx edx, ax
xor ecx, ecx
push edx
mov word [esp + 0x14], cx
lea eax, [esp + 0x14]
push 0x413338
mov byte [esp + 0x1a], cl
push eax
jmp 0x40188d
xor ecx, ecx
mov word [esp + 0x10], cx
movsx edx, ax
movsx eax, si
mov byte [esp + 0x12], cl
sub edx, eax
movsx ecx, bx
add edx, ecx
push edx
lea edx, [esp + 0x14]
push 0x413338
push edx
call fcn.00409684
lea ecx, [esp + 0x70]
mov eax, 0x413334
add esp, 0xc
mov dl, byte [ecx]
mov cl, byte [eax]
cmp dl, cl
jne 0x4018f2
mov ecx, 3
mov edi, 0x413348
lea esi, [esp + 0x76]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4018d1
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], ebx
push ecx
call fcn.00409792
add esp, 4
mov dword [esp + 0x4c], eax
jmp 0x4018f2
cmp bx, word [esp + 0x50]
jge 0x4018f2
lea edx, [esp + 0x10]
push edx
call fcn.00409792
movsx ecx, word [esp + 0x50]
add esp, 4
cmp eax, ecx
je 0x40141d
mov dx, word [esp + 0x10]
dec ebx
mov dword [esp + 0x60], ebx
mov word [ebp + 0x458437], dx
lea ebx, [ebp + 0x458443]
mov dword [esp + 0x54], 7
mov edx, dword [esp + 0x38]
mov ecx, 0x413330
lea eax, [edx + 0x458420]
mov dl, byte [edx + 0x458420]
cmp dl, byte [ecx]
je 0x401940
mov ecx, 0x41332c
cmp dl, byte [ecx]
je 0x401940
mov ecx, 0x413354
cmp dl, byte [ecx]
jne 0x401bb3
mov eax, dword [esp + 0x38]
mov ecx, 3
mov edi, 0x41334c
xor edx, edx
lea ebp, [eax + 0x458432]
mov esi, ebp
repe cmpsb byte [esi], byte es:[edi]
jne 0x401a23
mov dx, word [ebx - 5]
lea ecx, [ebx - 5]
mov eax, 0x413328
cmp dx, word [eax]
jne 0x401a23
mov cx, word [ebx]
xor eax, eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
push edx
mov word [esp + 0x2c], ax
mov word [esp + 0x24], cx
call fcn.00409792
add esp, 4
cmp ax, 1
jl 0x401bb3
mov esi, dword [0x4542da]
cmp ax, si
jge 0x4019c9
movsx edx, ax
xor ecx, ecx
push edx
mov word [esp + 0x14], cx
lea eax, [esp + 0x14]
push 0x413338
mov byte [esp + 0x1a], cl
push eax
jmp 0x401a13
mov di, word [0x4542d8]
cmp ax, di
jge 0x4019f0
movsx edx, si
xor ecx, ecx
push edx
mov word [esp + 0x14], cx
lea eax, [esp + 0x14]
push 0x413338
mov byte [esp + 0x1a], cl
push eax
jmp 0x401a13
xor ecx, ecx
mov word [esp + 0x10], cx
mov byte [esp + 0x12], cl
movsx edx, si
movsx ecx, di
movsx eax, ax
sub edx, ecx
lea ecx, [esp + 0x10]
add edx, eax
push edx
push 0x413338
push ecx
call fcn.00409684
mov dx, word [esp + 0x1c]
add esp, 0xc
mov word [ebx], dx
mov edx, dword [esp + 0x38]
mov ecx, 0x413354
lea eax, [edx + 0x458420]
mov dl, byte [ecx]
mov al, byte [eax]
cmp al, dl
jne 0x401bb3
mov ecx, 3
mov edi, 0x413324
mov esi, ebp
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401a78
mov ecx, 3
mov edi, 0x413320
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401a78
mov ecx, 3
mov edi, 0x41331c
mov esi, ebp
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401bb3
mov dl, byte [ebx - 3]
lea ecx, [ebx - 3]
mov eax, 0x413318
cmp dl, byte [eax]
jne 0x401bb3
mov cx, word [ebx + 1]
xor eax, eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x20]
mov dword [esp + 0x24], eax
push edx
mov word [esp + 0x2c], ax
mov word [esp + 0x24], cx
call fcn.00409792
add esp, 4
cmp ax, 1
jl 0x401bb3
mov esi, dword [0x4542da]
cmp ax, si
jge 0x401ae0
movsx edx, ax
xor ecx, ecx
push edx
mov word [esp + 0x14], cx
lea eax, [esp + 0x14]
push 0x413338
mov byte [esp + 0x1a], cl
push eax
jmp 0x401b2a
mov di, word [0x4542d8]
cmp ax, di
jge 0x401b07
movsx edx, si
xor ecx, ecx
push edx
mov word [esp + 0x14], cx
lea eax, [esp + 0x14]
push 0x413338
mov byte [esp + 0x1a], cl
push eax
jmp 0x401b2a
xor ecx, ecx
mov word [esp + 0x10], cx
mov byte [esp + 0x12], cl
movsx edx, si
movsx ecx, di
movsx eax, ax
sub edx, ecx
lea ecx, [esp + 0x10]
add edx, eax
push edx
push 0x413338
push ecx
call fcn.00409684
mov dx, word [esp + 0x1c]
add esp, 0xc
mov ecx, 3
mov edi, 0x413324
mov esi, ebp
xor eax, eax
mov word [ebx + 1], dx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401bb3
lea ecx, [esp + 0x14]
push ecx
call fcn.00409792
add esp, 4
cmp word [0x4546f0], 0
jne 0x401b6d
mov word [0x4546f0], 1
mov esi, dword [esp + 0x60]
mov bp, word [esp + 0x20]
movsx dx, byte [ebx - 4]
movsx eax, si
sub edx, 0x41
lea ecx, [eax + eax*8]
movsx edx, dx
lea ecx, [eax + ecx*2]
shl ecx, 3
inc esi
lea edi, [ecx + edx*2]
mov word [edx + edi + 0x4546f4], bp
lea edi, [eax + eax*8]
lea eax, [eax + edi*2]
lea edx, [edx + eax*4]
mov al, byte [ebx + 3]
mov byte [edx*2 + 0x45474e], al
mov word [ecx + 0x4546f2], si
mov eax, dword [esp + 0x54]
add ebx, 0xe
dec eax
mov dword [esp + 0x54], eax
jne 0x401911
mov eax, dword [esp + 0x18]
inc eax
cmp eax, 0xea60
mov dword [esp + 0x18], eax
jle 0x40141d
xor ecx, ecx
mov edx, eax
mov dword [0xbdb2a8], ecx
mov ebx, dword [esp + 0x58]
shl edx, 7
mov dword [0xbdb2ac], ecx
mov dword [esp + 0x5c], 0xffffffff
mov dword [0xbdb2b0], ecx
lea eax, [edx + 0x4583a1]
mov byte [0xbdb2b4], cl
mov ecx, dword [eax]
mov dword [0xbdb2a8], ecx
mov edx, dword [eax + 4]
mov dword [0xbdb2ac], edx
mov eax, dword [eax + 8]
mov dword [0xbdb2b0], eax
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x401c46
mov ebp, dword [esp + 0x2c]
mov esi, 0x458420
push esi
push ebp
call sub.F3CCISAM.dll_xism_add
add esi, 0x80
dec edi
jne 0x401c34
jmp 0x401c4a
mov ebp, dword [esp + 0x2c]
push ebx
call fcn.00401d40
push ebp
call fcn.00401d40
mov ecx, dword [0x4542e8]
mov ax, word [esp + 0x64]
add esp, 8
mov byte [ecx + 0x3bc], 0x42
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret