Function at 0x421760
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x844
mov edx, ecx
cmp byte [edx + 0x484c], 0
mov dword [ebp - 0x14], edx
jne 0x422308
mov eax, dword [ebp + 0xc]
mov ecx, dword [sym.imp.USER32.dll_GetForegroundWindow]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
xor esi, esi
push edi
mov byte [ebp - 0x10], 0
mov edi, str.Unknown
mov dword [ebp - 0x18], esi
cmp eax, 7
jne 0x42180f
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x148]
push str.WM_SETFOCUS_From0x_08X_
push ecx
mov byte [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [0x52fe34]
add esp, 0xc
cmp byte [edx + 0x125fa], 1
jb 0x421805
mov eax, dword [0x52fe2c]
test eax, eax
je 0x421805
mov ecx, dword [eax + 0x40b0]
test ecx, ecx
je 0x421805
push 1
push esi
push 1
lea eax, [ebp - 0x148]
push eax
call fcn.004c77f0
mov edi, str.WM_SETFOCUS
jmp 0x421d4e
cmp eax, 6
jne 0x421b8b
mov esi, dword [ebp + 0x10]
cmp si, 1
je 0x42182b
mov byte [ebp - 0x10], 0
cmp si, 2
jne 0x42182f
mov byte [ebp - 0x10], 1
test si, si
mov esi, dword [ebp + 0x14]
jne 0x421a09
call ecx
test esi, esi
je 0x421846
mov dword [ebp - 0x18], esi
jmp 0x42184b
mov esi, eax
mov dword [ebp - 0x18], eax
push esi
call fcn.004b7150
add esp, 4
test al, al
je 0x4219b2
mov byte [ebp - 0x10], 1
call fcn.004b8680
test al, al
jne 0x42194f
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 0x24]
xor esi, esi
call fcn.004bc8c0
lea edx, [ebp - 0x24]
push edx
push esi
mov dword [ebp - 4], esi
call fcn.004b74d0
add esp, 8
test al, al
je 0x421940
mov edi, dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
lea ecx, [ecx]
lea ecx, [ebp - 0x24]
call fcn.004bc9d0
push eax
call fcn.004b6d30
add esp, 4
lea ecx, [ebp - 0x24]
test al, al
je 0x42190f
call fcn.004bc9d0
mov ecx, eax
call fcn.004bcc90
xor ecx, ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x48]
push ecx
push eax
call edi
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
push edx
push eax
lea ecx, [ebp - 0x48]
push ecx
call ebx
test eax, eax
je 0x42190c
lea ecx, [ebp - 0x24]
call fcn.004bc9d0
mov ecx, dword [ebp - 0x14]
push eax
call fcn.0040ee50
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
lea ecx, [ebp - 0x24]
inc esi
call fcn.004bc8c0
lea edx, [ebp - 0x24]
push edx
push esi
mov dword [ebp - 4], 0
call fcn.004b74d0
add esp, 8
test al, al
jne 0x4218b0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1220], 0
je 0x421989
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x40ee], 0
je 0x421989
mov eax, dword [ebp + 0x10]
cmp ax, 1
jne 0x421979
shr eax, 0x10
test eax, eax
jne 0x421994
cmp byte [ecx + 0x4854], 0
jne 0x421989
push 1
call fcn.004200a0
cmp word [ebp + 0x10], 1
jne 0x421b4f
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x148]
push str.WM_ACTIVATE_From0x_08X_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x421b6d
test esi, esi
je 0x421a09
call fcn.004b6dc0
test al, al
je 0x421a09
push 0x104
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x421a09
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.ConsoleWindowClass
lea ecx, [ebp - 0x450]
push ecx
call esi
test eax, eax
je 0x421a00
push str.WineConsoleClass
lea edx, [ebp - 0x450]
push edx
call esi
test eax, eax
jne 0x421a09
mov byte [ebp - 0x10], 1
jmp 0x42194f
cmp byte [ebp - 0x10], 0
jne 0x42194f
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1236], 0
je 0x421989
mov edi, dword [ebp - 0x14]
cmp dword [edi + 0x47ec], 0
je 0x421989
push 1
call ebx
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x421a5f
push 2
call ebx
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x421989
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
test esi, esi
je 0x421989
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 0x7f
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x421b0f
mov ecx, str.WorkerW
lea eax, [ebp - 0x248]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421acc
test dx, dx
je 0x421ac8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421acc
add eax, 4
add ecx, 4
test dx, dx
jne 0x421aa6
xor eax, eax
jmp 0x421ad1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x421b21
mov ecx, str.Progman
lea eax, [ebp - 0x248]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421b06
test dx, dx
je 0x421b02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421b06
add eax, 4
add ecx, 4
test dx, dx
jne 0x421ae0
xor eax, eax
jmp 0x421b0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x421b21
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x421a87
jmp 0x421989
lea ecx, [ebp + 0x18]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [ebp + 0x18]
cmp edx, dword [edi + 0x47f0]
sete al
test al, al
je 0x421989
mov dword [edi + 0x47f4], 0
jmp 0x421989
movzx eax, byte [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
push eax
push ecx
lea edx, [ebp - 0x148]
push str.WM_ACTIVATE.WA_INACTIVE_To0x_08X__OurFocus_i
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x148]
push 1
push eax
call fcn.0040d530
mov esi, dword [ebp - 0x18]
add esp, 8
mov edi, str.WM_ACTIVATE
jmp 0x421d4e
cmp eax, 0x1c
jne 0x421c42
cmp dword [ebp + 0x10], esi
setne bl
mov byte [ebp - 0x10], bl
test bl, bl
jne 0x421bf8
call ecx
mov ecx, dword [ebp + 0x14]
mov esi, eax
movzx eax, bl
push eax
push ecx
lea edx, [ebp - 0x148]
push str.WM_ACTIVATEAPP.Deactivate_ToTID_i__OurFocus_i
push edx
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x148]
push 1
push eax
call fcn.0040d530
add esp, 8
test bl, bl
jne 0x421c13
push esi
call fcn.004b7150
add esp, 4
test al, al
je 0x421c35
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0x10], 1
mov edi, str.WM_ACTIVATEAPP
jmp 0x421d4e
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x148]
push str.WM_ACTIVATEAPP.Activate_FromTID_i_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x421bc5
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1220], 0
je 0x421c35
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x4854], 0
jne 0x421c35
push 3
call fcn.004200a0
mov esi, dword [ebp - 0x18]
mov edi, str.WM_ACTIVATEAPP
jmp 0x421d4e
cmp eax, 8
jne 0x421ca1
mov edi, str.WM_KILLFOCUS
call ecx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x421c5c
mov eax, esi
mov dword [ebp - 0x18], esi
jmp 0x421c5f
mov dword [ebp - 0x18], eax
push eax
call fcn.004b7150
add esp, 4
test al, al
je 0x421c70
mov byte [ebp - 0x10], 1
movzx edx, byte [ebp - 0x10]
push edx
push esi
lea eax, [ebp - 0x148]
push str.WM_KILLFOCUS_To0x_08X__OurFocus_i
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x148]
push 1
push ecx
call fcn.0040d530
mov esi, dword [ebp - 0x18]
add esp, 0x18
jmp 0x421d4e
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x421caa
mov edi, eax
mov eax, dword [0x52fe30]
cmp byte [eax + 0x1236], 0
je 0x421cc3
push edi
mov ecx, edx
call fcn.0040c440
mov edx, dword [ebp - 0x14]
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1236], 0
jne 0x422305
cmp dword [edx + 0x40a4], esi
jne 0x422305
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push esi
mov dword [ebp - 0x18], esi
call fcn.004b7150
mov edx, dword [ebp - 0x14]
mov bl, al
add esp, 4
mov byte [ebp - 0x10], bl
cmp byte [edx + 0x4099], bl
je 0x421d11
mov eax, dword [ebp - 0x10]
push eax
mov ecx, edx
call fcn.0041dc70
test bl, bl
jne 0x421d3e
cmp dword [ebp + 0x18], str.TIMER_QUAKE_AUTOHIDE_ID
jne 0x4222b5
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x4850], 0
je 0x4222b5
mov dword [eax + 0x4850], 0
jmp 0x421d4e
mov ecx, dword [ebp - 0x14]
cmp byte [ecx + 0x484d], 0
jne 0x4222b2
mov ecx, dword [ebp - 0x14]
push edi
call fcn.0040c440
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x18], 0
call fcn.004bc8c0
lea edx, [ebp - 0x38]
push 0
push edx
mov dword [ebp - 4], 1
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x421da0
lea ecx, [ebp - 0x38]
call fcn.004bc9d0
mov dword [ebp + 0x18], eax
test eax, eax
je 0x421da0
mov ecx, eax
call fcn.004bcc80
mov ecx, eax
call fcn.00488d20
mov ebx, eax
jmp 0x421da2
xor ebx, ebx
test esi, esi
je 0x421ddc
cmp esi, dword [0x52fe14]
je 0x421ddc
cmp esi, ebx
je 0x421ddc
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x421ddc
nop
cmp eax, ebx
je 0x421dd9
cmp eax, dword [0x52fe14]
je 0x421fbc
push eax
mov esi, eax
call edi
test eax, eax
jne 0x421dc0
mov dword [ebp - 0x18], esi
cmp byte [ebp - 0x10], 0
jne 0x421eb1
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test esi, esi
jne 0x421e68
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x421e20
push 2
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x421eb1
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
mov dword [ebp - 0x28], 0
test edi, edi
je 0x421eb1
lea eax, [ebp - 0x28]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x421eb1
call ebx
cmp dword [ebp - 0x28], eax
je 0x421eb1
mov esi, edi
mov dword [ebp - 0x18], esi
lea ecx, [ebp + 0x10]
push ecx
push esi
mov dword [ebp + 0x10], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call ebx
cmp dword [ebp + 0x10], eax
je 0x421ead
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x421eb1
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.004accc0
cmp esi, eax
je 0x421ead
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.00487160
cmp dword [ebp + 0x10], eax
jne 0x421eb1
mov byte [ebp - 0x10], 1
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push 1
push edi
mov ecx, esi
call fcn.0040d640
mov bl, byte [ebp - 0x10]
mov byte [esi + 0x484d], bl
mov edx, str.mb_LastConEmuFocusState_set_to_TRUE
test bl, bl
jne 0x421ed8
mov edx, str.mb_LastConEmuFocusState_set_to_FALSE
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 1
jb 0x421f05
mov eax, dword [0x52fe2c]
test eax, eax
je 0x421f05
mov ecx, dword [eax + 0x40b0]
test ecx, ecx
je 0x421f05
push 1
push 0
push 1
push edx
call fcn.004c77f0
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x1153], 0
je 0x421f35
mov dl, byte [ecx + 0x1152]
cmp dl, byte [ecx + 0x1154]
je 0x421f35
call fcn.0044d680
test al, al
je 0x421f35
push edi
push 1
mov ecx, esi
call fcn.0041bf30
test bl, bl
jne 0x422010
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x421f59
mov ecx, edi
call fcn.004bcc80
push eax
push 0
lea ecx, [esi + 0x118]
call fcn.0042c2e0
mov ecx, dword [esi + 0x40a0]
call fcn.004a8480
push 0
mov ecx, esi
call fcn.00409f20
mov eax, dword [esi + 0x7884]
test eax, eax
je 0x422023
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x7884], 0
mov eax, dword [0x52fe34]
cmp byte [eax + 0x125fa], 0
je 0x422023
mov ecx, dword [esi + 0x40b0]
test ecx, ecx
je 0x422023
push 0
push 1
push 0
push 1
push str.CConEmuMain::UnRegisterHooks___done
call fcn.004c87c0
jmp 0x422023
push 0xfffffffffffffff0
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80cf0000
jne 0x421ddc
mov eax, dword [0x52fe14]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
mov dword [ebp - 0x18], esi
cmp esi, dword [0x52fe14]
jne 0x422007
push 1
push str.Focus_was_returned_to_ConEmu
call fcn.0040d530
add esp, 8
cmp esi, dword [0x52fe14]
sete byte [ebp - 0x10]
jmp 0x421ddc
cmp byte [esi + 0x7880], 0
jne 0x422020
mov ecx, esi
call fcn.00415c80
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x422048
mov ecx, edi
call fcn.004bcc80
test eax, eax
je 0x422048
mov ecx, dword [ebp + 0x1c]
movzx edx, bl
push ecx
push edx
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.00490380
mov ecx, dword [0x52fe30]
call fcn.0044e5b0
test al, al
je 0x4221a2
test bl, bl
jne 0x4221a2
push 0
push 1
push 1
mov ecx, esi
call fcn.004169e0
test al, al
jne 0x4221a2
push 0
mov ecx, esi
call fcn.004098e0
test al, al
jne 0x4221a2
mov eax, dword [0x52fe14]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4221a2
mov esi, dword [ebp - 0x18]
xor ecx, ecx
mov word [ebp - 0x448], cx
mov byte [ebp + 0x13], cl
mov byte [ebp + 0x17], cl
cmp dword [ebp + 0xc], ecx
je 0x422114
test esi, esi
je 0x422114
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, dword [sym.imp.USER32.dll_GetClassNameW]
push 0xff
lea edx, [ebp - 0x448]
push edx
push esi
call ebx
push str.Shell_TrayWnd
lea eax, [ebp - 0x448]
push eax
call edi
test eax, eax
je 0x42210a
push str.TrayNotifyWnd
lea ecx, [ebp - 0x448]
push ecx
call edi
test eax, eax
jne 0x4220fb
mov byte [ebp + 0x17], 1
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x4220c4
jmp 0x42210e
mov byte [ebp + 0x13], 1
mov bl, byte [ebp - 0x10]
mov edi, dword [ebp + 0x18]
mov edx, dword [0x52fe34]
cmp byte [edx + 0x125fa], 0
mov esi, dword [ebp - 0x14]
je 0x422161
mov eax, dword [esi + 0x4850]
movzx ecx, byte [ebp + 0x17]
movzx edx, byte [ebp + 0x13]
push eax
push ecx
push edx
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x850]
push str.MinimizeOnFocusLose:_Class_s__IsTaskbar_u__IsTrayNotifyWnd_u__Timer_u
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x850]
push 1
push edx
call fcn.0040d530
add esp, 0x20
cmp byte [ebp + 0x13], 0
jne 0x42217b
cmp byte [esi + 0x4854], 0
jne 0x4221a2
push 7
mov ecx, esi
call fcn.004200a0
jmp 0x4221a2
cmp dword [esi + 0x4850], 0
jne 0x4221a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0x64
mov dword [esi + 0x4850], eax
mov eax, dword [0x52fe14]
push 9
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [0x52fe30]
cmp byte [ecx + 0x11295], 0
mov esi, dword [ebp - 0x14]
je 0x422221
test edi, edi
je 0x42220c
test bl, bl
jne 0x4221cd
push 0
push 1
push 0
mov ecx, esi
call fcn.004169e0
test al, al
je 0x4221cf
mov al, 1
mov edx, dword [0x52fe30]
cmp byte [edx + 0x11295], 0
mov bl, byte [edi + 0x14ec]
je 0x4221f5
test al, al
jne 0x4221f5
call fcn.004b9e10
test al, al
jne 0x4221f5
mov al, 1
jmp 0x4221f7
xor al, al
cmp bl, al
je 0x42220c
mov ecx, dword [ebp + 0x18]
mov byte [ecx + 0x14ec], al
add ecx, 8
call fcn.004b37a0
mov ecx, dword [esi + 0x40a8]
push 0
push 1
call fcn.004a3780
mov edi, dword [ebp + 0x18]
mov bl, byte [ebp - 0x10]
lea ecx, [esi + 0x4148]
call fcn.00408880
test bl, bl
je 0x42227c
test edi, edi
je 0x42227c
mov ecx, dword [0x52fe30]
call fcn.0044eb70
test al, al
je 0x42227c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x52fe14]
jne 0x42227c
cmp dword [esi + 0x7938], 0
jne 0x42227c
mov eax, dword [esi + 0x7934]
push 0
push 0
mov dword [esi + 0x7938], 1
mov ecx, dword [0x52fe14]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [0x52fe30]
cmp byte [edx + 0x11628], 0
jne 0x4222a1
test edi, edi
je 0x4222a1
movzx eax, bl
push eax
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.004901d0
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
jmp 0x422305
mov bl, byte [ebp - 0x10]
mov ecx, dword [0x52fe34]
cmp byte [ecx + 0x125fa], 2
jb 0x422305
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [0x52fe14]
push eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x484d]
push esi
push edx
push ecx
movzx edx, bl
push edx
lea eax, [ebp - 0x248]
push str.Focus_event_skipped__lbSetFocus_u__mb_LastConEmuFocusState_u__ghWndx_08X__hForex_08X__hFocusx_08X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x248]
push 2
push ecx
call fcn.0040d530
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18