Function at 0x428e00
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4486f7
mov eax, dword fs:[0]
push eax
mov eax, 0x1244
call fcn.00445a10
mov eax, dword [0x467040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1124], edx
mov esi, ecx
xor eax, eax
lea ecx, [ebp - 0x10e8]
mov dword [ebp - 0x10fc], eax
xorps xmm0, xmm0
push 4
push str._jar
mov dword [ebp - 0x1100], eax
movups xmmword [ebp - 0x10e8], xmm0
mov dword [ebp - 0x10d8], eax
mov dword [ebp - 0x10d4], eax
call fcn.004063e0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10d0]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x10c0], 0
push str.___Executed_file:
movups xmmword [ebp - 0x10d0], xmm0
mov dword [ebp - 0x10bc], 0
call fcn.004063e0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x10b8]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x10a8], 0
push str..bat
movups xmmword [ebp - 0x10b8], xmm0
mov dword [ebp - 0x10a4], 0
call fcn.004063e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10a0]
push 0x13
xorps xmm0, xmm0
mov dword [ebp - 0x1090], 0
push str.___Executed_file:
movups xmmword [ebp - 0x10a0], xmm0
mov dword [ebp - 0x108c], 0
call fcn.004063e0
lea ecx, [ebp - 0x10e8]
mov dword [ebp - 4], 3
push ecx
lea eax, [ebp - 0x1088]
push eax
push ecx
lea ecx, [ebp - 0x1140]
call fcn.004154c0
push fcn.00415400
push 2
push 0x30
lea eax, [ebp - 0x10e8]
mov byte [ebp - 4], 5
push eax
call fcn.00444e54
push ecx
push str.__A_Z_:______.exe_...__s_
lea ecx, [ebp - 0x1164]
call fcn.00420280
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1088]
call fcn.00412ce0
push 0xe
push str.memory.exe__p
push ecx
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.00415940
xorps xmm0, xmm0
mov dword [ebp - 0x1048], 0
movups xmmword [ebp - 0x1058], xmm0
mov dword [ebp - 0x1044], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x1058], xmm0
movq xmm0, qword [eax + 0x10]
xor ecx, ecx
movq qword [ebp - 0x1048], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov esi, dword [ebp - 0x1100]
or esi, 2
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1074]
cmp ecx, 7
jbe 0x42901c
mov edx, dword [ebp - 0x1088]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429012
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x429012
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1078], 0
push eax
mov word [ebp - 0x1088], ax
mov dword [ebp - 0x1130], eax
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x1104]
mov dword [ebp - 0x1074], 7
push eax
lea eax, [ebp - 0x10f8]
mov dword [ebp - 0x1134], 0xc
push eax
mov dword [ebp - 0x112c], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
push 0
push 1
push dword [ebp - 0x10f8]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0x40
lea eax, [ebp - 0x124c]
mov dword [ebp - 0x1250], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x1104]
lea ecx, [ebp - 0x1150]
or dword [ebp - 0x1224], 0x101
add esp, 0xc
mov dword [ebp - 0x1214], eax
xor eax, eax
cmp dword [ebp - 0x1044], 7
mov word [ebp - 0x1220], ax
lea eax, [ebp - 0x1058]
cmova eax, dword [ebp - 0x1058]
push ecx
lea ecx, [ebp - 0x1250]
push ecx
push 0
push 0
push 0x10
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4298d6
push dword [ebp - 0x1104]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x1000
lea eax, [ebp - 0x1010]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1108]
push 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x10f8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [eax]
test eax, eax
je 0x4298b0
nop dword [eax + eax]
cmp dword [ebp - 0x1108], 0
je 0x4298b0
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x429166
sub ecx, edx
mov dword [ebp - 0x1060], 0
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x105c], 0
add eax, ecx
lea edx, [ebp - 0x1010]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1070], xmm0
cmp edx, eax
jne 0x4291bc
xor edi, edi
mov dword [ebp - 0x105c], 7
xor eax, eax
mov dword [ebp - 0x1060], edi
mov word [ebp - 0x1070], ax
jmp 0x4291d6
push ecx
push ecx
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1070]
call fcn.00412240
mov edi, dword [ebp - 0x1060]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x11ac]
mov dword [ebp - 0x120c], 0x457928
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
push 0
push 0
lea eax, [ebp - 0x11fc]
mov byte [ebp - 4], 0xb
or esi, 1
lea ecx, [ebp - 0x120c]
push eax
mov dword [ebp - 0x1100], esi
mov dword [ebp - 0x10fc], esi
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t_____bool_]
mov dword [ebp - 4], 0xc
mov eax, dword [ebp - 0x120c]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x120c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1210], eax
lea eax, [ebp - 0x11fc]
mov ecx, eax
mov dword [ebp - 0x110c], eax
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x1070]
cmp dword [ebp - 0x105c], 7
mov ecx, dword [ebp - 0x1070]
cmova eax, ecx
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x10f0], eax
mov eax, 2
mov dword [ebp - 0x1128], ecx
cmp edi, 0x7fffffff
ja 0x4298aa
nop dword [eax]
test edi, edi
je 0x4292f3
lea edx, [ebp - 0x10f4]
mov dword [ebp - 0x10f4], edi
call fcn.00406ea0
add edi, edi
mov esi, eax
push edi
push dword [ebp - 0x10f0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x11f0]
lea ecx, [esi + edi]
mov dword [ebp - 0x11c4], ecx
add esp, 0xc
sar edi, 1
mov dword [eax], esi
mov eax, dword [ebp - 0x11e0]
mov dword [eax], esi
mov eax, dword [ebp - 0x11d0]
mov dword [eax], edi
mov eax, 3
jmp 0x4292fd
mov dword [ebp - 0x11c4], 0
mov dword ds:[ebp - 0x11c0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x1018], 0
xor eax, eax
mov dword [ebp - 0x1014], 7
movups xmmword [ebp - 0x1028], xmm0
mov word [ebp - 0x1028], ax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x120c]
mov eax, dword [ebp - 0x120c]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_wchar_t___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const]
movzx eax, ax
lea edx, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x120c]
call fcn.00421960
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x42976e
nop dword [eax]
nop word [eax + eax]
mov esi, dword [ebp - 0x1140]
xor al, al
mov byte [ebp - 0x10e9], al
mov eax, dword [ebp - 0x113c]
mov dword [ebp - 0x10fc], esi
mov dword [ebp - 0x110c], eax
cmp esi, eax
je 0x42963b
nop dword [eax + eax]
cmp dword [esi + 0x14], 7
lea eax, [esi + 0x18]
mov dword [ebp - 0x1120], eax
mov eax, dword [esi + 0x10]
jbe 0x4293cb
mov ecx, dword [esi]
mov edx, ecx
lea eax, [ecx + eax*2]
jmp 0x4293d0
lea eax, [esi + eax*2]
mov edx, esi
mov dword [ebp - 0x1030], 0
xorps xmm0, xmm0
mov dword [ebp - 0x102c], 0
movups xmmword [ebp - 0x1040], xmm0
cmp edx, eax
jne 0x429410
xor esi, esi
mov edi, 7
xor eax, eax
mov dword [ebp - 0x1030], esi
mov dword [ebp - 0x102c], edi
mov word [ebp - 0x1040], ax
jmp 0x429431
sub eax, edx
lea ecx, [ebp - 0x1040]
sar eax, 1
push eax
push edx
call fcn.004063e0
mov esi, dword [ebp - 0x1030]
mov edi, dword [ebp - 0x102c]
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x1028]
cmp dword [ebp - 0x1014], 7
push dword [ebp - 0x1018]
cmova eax, dword [ebp - 0x1028]
push eax
call fcn.00404f40
mov edx, dword [ebp - 0x1040]
add esp, 8
mov dword [ebp - 0x10f4], edx
test al, al
jne 0x4295ce
mov eax, dword ds:[ebp - 0x1018]
lea ecx, [ebp - 0x1040]
cmp edi, 7
lea edi, [ebp - 0x1028]
cmova ecx, edx
cmp dword [ebp - 0x1014], 7
mov dword [ebp - 0x10f0], ecx
cmova edi, dword [ebp - 0x1028]
mov dword [ebp - 0x111c], edi
cmp esi, eax
ja 0x4295ce
sub eax, esi
test esi, esi
je 0x429565
movzx esi, word [ecx]
inc eax
mov dword [ebp - 0x1114], esi
lea edx, [edi + eax*2]
mov eax, edi
mov dword [ebp - 0x1118], edx
sub edx, eax
mov edi, 0
sar edx, 1
je 0x4294fa
movzx ecx, word [eax]
cmp cx, si
je 0x4294f2
nop word [eax + eax]
cmp edx, 1
je 0x4294f4
movzx ecx, word [eax + 2]
add eax, 2
dec edx
cmp cx, si
jne 0x4294e0
mov edi, eax
mov ecx, dword [ebp - 0x10f0]
mov eax, edi
test eax, eax
je 0x4295c8
mov edi, dword [ebp - 0x1030]
mov esi, ecx
test edi, edi
je 0x429558
mov ecx, eax
sub ecx, dword [ebp - 0x10f0]
mov dword [ebp - 0x1110], ecx
movzx edx, word [ecx + esi]
movzx ecx, word [esi]
cmp dx, cx
jne 0x42953e
add esi, 2
sub edi, 1
je 0x429558
mov ecx, dword [ebp - 0x1110]
jmp 0x429522
mov esi, dword [ebp - 0x1114]
add eax, 2
mov ecx, dword [ebp - 0x10f0]
mov edx, dword [ebp - 0x1118]
jmp 0x4294c7
sub eax, dword [ebp - 0x111c]
sar eax, 1
cmp eax, 0xffffffff
je 0x4295c8
mov ecx, dword [ebp - 0x1120]
cmp dword [ecx + 0x14], 7
mov eax, dword [ecx + 0x10]
jbe 0x429576
mov ecx, dword [ecx]
mov edx, ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
push eax
call fcn.00408f60
cmp dword [ebp - 0x1014], 7
lea edx, [ebp - 0x1028]
push dword [ebp - 0x1018]
cmova edx, dword [ebp - 0x1028]
mov ecx, eax
call fcn.00408f60
add esp, 8
mov ecx, eax
push 0x408660
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, [ebp - 0x1028]
mov byte [ebp - 0x10e9], 1
call fcn.00404f20
mov edx, dword [ebp - 0x10f4]
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x102c]
cmp ecx, 7
jbe 0x429613
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429609
mov edx, dword ds:[eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42900c
push ecx
push edx
call fcn.00444ae8
add esp, 8
mov esi, dword [ebp - 0x10fc]
add esi, 0x30
mov dword [ebp - 0x10fc], esi
cmp esi, dword [ebp - 0x110c]
jne 0x4293b0
cmp byte [ebp - 0x10e9], 0
jne 0x429725
mov eax, dword [ebp - 0x1124]
mov edi, eax
cmp dword [eax + 0x14], 7
jbe 0x42964b
mov edi, dword [eax]
cmp dword [eax + 0x10], 7
jne 0x429679
mov edx, str.Winmgmt
mov esi, 7
sub edi, edx
nop dword [eax]
movzx ecx, word [edi + edx]
movzx eax, word [edx]
cmp cx, ax
jne 0x429679
add edx, 2
sub esi, 1
jne 0x429660
jmp 0x429725
cmp dword [ebp - 0x1014], 7
lea ecx, [ebp - 0x1028]
mov eax, dword [ebp - 0x1018]
cmova ecx, dword [ebp - 0x1028]
push ecx
push 0x10
lea edx, [ecx + eax*2]
lea eax, [ebp - 0x1164]
push eax
push ecx
call fcn.00421b00
add esp, 0x10
test al, al
je 0x429725
cmp dword [ebp - 0x1014], 7
lea eax, [ebp - 0x1028]
push dword [ebp - 0x1018]
cmova eax, dword [ebp - 0x1028]
push eax
call fcn.00404f40
add esp, 8
test al, al
jne 0x429725
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.___Executed_file_with_modified_extension:
nop
call fcn.00406160
cmp dword [ebp - 0x1014], 7
lea edx, [ebp - 0x1028]
push dword [ebp - 0x1018]
cmova edx, dword [ebp - 0x1028]
mov ecx, eax
call fcn.00408f60
add esp, 4
mov ecx, eax
push 0x408660
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea ecx, ds:[ebp - 0x1028]
call fcn.00404f20
mov eax, dword [ebp - 0x120c]
lea ecx, [ebp - 0x120c]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_wchar_t___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const]
movzx eax, ax
lea edx, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x120c]
call fcn.00421960
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
jne 0x429380
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x1014]
cmp ecx, 7
jbe 0x4297b3
mov edx, dword [ebp - 0x1028]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4297a9
mov edx, dword ds:[eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42900c
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1028], ax
mov eax, dword [ebp - 0x120c]
mov dword [ebp - 0x1014], 7
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_istringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x120c]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x60]
mov dword [ebp + ecx - 0x1210], eax
lea ecx, [ebp - 0x11fc]
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
call fcn.0042af60
lea ecx, [ebp - 0x11fc]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, ds:[ebp - 0x11f4]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x11ac]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov byte ds:[ebp - 4], 9
mov eax, dword [ebp - 0x105c]
cmp eax, 7
jbe 0x42987a
mov edx, dword [ebp - 0x1128]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x429870
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42900c
push ecx
push edx
call fcn.00444ae8
add esp, 8
push 0
lea eax, [ebp - 0x1108]
push eax
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x10f8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4298b0
mov esi, dword [ebp - 0x1100]
jmp 0x429150
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
push 0xffffffffffffffff
push dword [ebp - 0x1150]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1150]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x114c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword ds:[ebp - 0x10f8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1044]
cmp ecx, 7
jbe 0x429928
mov edx, dword [ebp - 0x1058]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x42991e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x42991e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00444ae8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1048], 0
lea ecx, [ebp - 0x1164]
mov dword [ebp - 0x1044], 7
mov word [ebp - 0x1058], ax
call fcn.00417bc0
mov edi, dword [ebp - 0x1154]
test edi, edi
je 0x429983
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x44b694]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x429983
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x44b694]
mov ecx, edi
call esi
lea ecx, [ebp - 0x1140]
call fcn.00415620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00444aa0
mov esp, ebp
pop ebp
ret