Function at 0x100054b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 1
xor eax, eax
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x10018968
lock cmpxchg dword [ebx], ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x100054f2
cmp edi, 0x20
jae 0x100054de
push 0
jmp 0x100054e0
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x100054d5
cmp dword [0x1001896c], 0
jne 0x10006003
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x1001896c], eax
xor ecx, ecx
xchg dword [ebx], ecx
test eax, eax
je 0x10006007
mov ecx, dword [0x10018960]
mov edx, 0x100050a0
push 0x100188e0
mov dword [0x10018900], ecx
call fcn.1000e929
test eax, eax
je 0x10005560
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_original_IR_OnMouseWheelTarget_hook._n
push 0x57
jmp 0x10006023
mov ebx, dword [0x10018900]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100055a2
nop dword [eax]
cmp edi, 0x20
jae 0x10005589
push 0
jmp 0x1000558b
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10005580
cmp dword [0x1001896c], 0
je 0x10005fe1
test ebx, ebx
jne 0x100055bf
lea ecx, [ebx + 1]
call fcn.1000e84e
mov edi, eax
jmp 0x100055e4
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x100055df
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x10005640
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x100055d3
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10005fe5
push 0x10018918
mov edx, 0x10005100
mov dword [0x10018908], 0x1000de80
mov ecx, 0x1000de80
call fcn.1000e929
test eax, eax
je 0x10005707
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_orginal_CLevel_IR_OnMouseWheelTarget_hook._n
push 0x62
jmp 0x10006023
cmp edx, 0xffffffff
je 0x100055df
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
jne 0x100056fd
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x100055e4
add ebx, dword [0x10018ea0]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100056ad
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x100055e4
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x100056c8
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x100055e4
mov edi, 5
jmp 0x100055e4
mov ebx, dword [0x10018908]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10005745
cmp edi, 0x20
jae 0x1000572c
push 0
jmp 0x1000572e
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10005723
cmp dword [0x1001896c], 0
je 0x10005fbf
test ebx, ebx
jne 0x10005762
lea ecx, [ebx + 1]
call fcn.1000e84e
mov edi, eax
jmp 0x10005787
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x10005782
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x100057e0
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10005776
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10005fc3
mov ecx, dword [0x1001895c]
mov edx, 0x100050c0
push 0x1001890c
mov dword [0x10018914], ecx
call fcn.1000e929
test eax, eax
je 0x100058a3
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_original_CUIMapWnd_updateZoomTarget_hook._n
push 0x78
jmp 0x10006023
cmp edx, 0xffffffff
je 0x10005782
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
jne 0x10005899
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005787
add ebx, dword [0x10018ea0]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005849
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10005787
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x10005864
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10005787
mov edi, 5
jmp 0x10005787
mov ebx, dword [0x10018914]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100058e2
nop
cmp edi, 0x20
jae 0x100058c9
push 0
jmp 0x100058cb
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100058c0
cmp dword [0x1001896c], 0
je 0x10005f9d
test ebx, ebx
jne 0x100058ff
lea ecx, [ebx + 1]
call fcn.1000e84e
mov edi, eax
jmp 0x10005924
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x1000591f
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x10005980
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10005913
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10005fa1
mov ecx, dword [0x10018950]
mov edx, 0x10005110
push 0x100188f4
mov dword [0x10018910], ecx
call fcn.1000e929
test eax, eax
je 0x10005a47
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_original_CUIMapWnd_SetTargetMapTarget_hook._n
push 0x83
jmp 0x10006023
cmp edx, 0xffffffff
je 0x1000591f
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
jne 0x10005a3d
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005924
add ebx, dword [0x10018ea0]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100059ed
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10005924
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x10005a08
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10005924
mov edi, 5
jmp 0x10005924
mov ebx, dword [0x10018910]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10005a85
cmp edi, 0x20
jae 0x10005a6c
push 0
jmp 0x10005a6e
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10005a63
cmp dword [0x1001896c], 0
je 0x10005f71
test ebx, ebx
jne 0x10005aa2
lea ecx, [ebx + 1]
call fcn.1000e84e
mov edi, eax
jmp 0x10005ac7
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x10005ac2
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x10005b23
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10005ab6
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10005f75
mov ecx, dword [0x10018958]
mov edx, 0x10005140
push 0x100188d8
mov dword [0x100188dc], ecx
call fcn.1000e929
test eax, eax
je 0x10005bea
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_original_CActor_OnPrevWeaponSlotTarget_hook._n
push 0x8e
jmp 0x10006023
cmp edx, 0xffffffff
je 0x10005ac2
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
jne 0x10005be0
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005ac7
add ebx, dword [0x10018ea0]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005b90
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10005ac7
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x10005bab
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10005ac7
mov edi, 5
jmp 0x10005ac7
mov ebx, dword [0x100188dc]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10005c28
cmp edi, 0x20
jae 0x10005c0f
push 0
jmp 0x10005c11
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10005c06
cmp dword [0x1001896c], 0
je 0x10005f45
test ebx, ebx
jne 0x10005c45
lea ecx, [ebx + 1]
call fcn.1000e84e
mov edi, eax
jmp 0x10005c71
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x10005c6c
mov edi, dword [0x10018ea0]
mov eax, edi
nop dword [eax]
cmp ebx, dword [eax]
je 0x10005ccd
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10005c60
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10005f49
mov ecx, dword [0x10018964]
mov edx, 0x10005190
push 0x100188f8
mov dword [0x100188f0], ecx
call fcn.1000e929
test eax, eax
je 0x10005d94
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_create_original_CActor_OnNextWeaponSlotTarget_hook._n
push 0x9a
jmp 0x10006023
cmp edx, 0xffffffff
je 0x10005c6c
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
jne 0x10005d8a
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10005c71
add ebx, dword [0x10018ea0]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005d3a
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10005c71
mov byte [edi], 0xe9
mov eax, dword [ebx + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [ebx + 0x14], 1
je 0x10005d55
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10005c71
mov edi, 5
jmp 0x10005c71
mov ebx, dword [0x100188f0]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10005dd2
cmp edi, 0x20
jae 0x10005db9
push 0
jmp 0x10005dbb
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10005db0
cmp dword [0x1001896c], 0
je 0x10005f19
test ebx, ebx
jne 0x10005def
lea ecx, [ebx + 1]
call fcn.1000e84e
mov esi, eax
jmp 0x10005e14
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x10005e0f
mov esi, dword [0x10018ea0]
mov eax, esi
cmp ebx, dword [eax]
je 0x10005e5d
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10005e03
mov esi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test esi, esi
jne 0x10005f1d
mov ecx, dword [0x10018264]
cmp dword [0x10018934], ecx
cmovg ecx, dword [0x10018934]
test ecx, ecx
js 0x10005e54
push str.Hooks_successfully_created_and_enabled._n
push 0xa3
push str.C:UsersTOTOMAN2_source_reposStalker_COP_Qols_Moddllmain.cpp
push esi
call fcn.1000ca20
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 0xffffffff
je 0x10005e0f
imul edi, edx, 0x2c
test byte [edi + esi + 0x14], 2
jne 0x10005f0f
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov esi, eax
add esp, 4
test esi, esi
jne 0x10005e14
add edi, dword [0x10018ea0]
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea esi, [eax - 5]
cmove esi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 8]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10005ec3
lea ecx, [ebp - 0x14]
lea esi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10005e14
mov byte [esi], 0xe9
mov eax, dword [edi + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [edi + 0x14], 1
je 0x10005ede
mov eax, dword [edi]
mov word [eax], 0xf9eb
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [edi + 0x14], 6
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.1000e72e
jmp 0x10005e14
mov esi, 5
jmp 0x10005e14
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_original_CActor_OnNextWeaponSlotTarget_failed.
push 0x9e
jmp 0x10006023
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_original_CActor_OnPrevWeaponSlotTarget_failed.
push 0x92
jmp 0x10006023
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_original_CUIMapWnd_SetTargetMapTarget_failed.
push 0x87
jmp 0x10006023
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_original_CUIMapWnd_updateZoomTarget_failed.
push 0x7c
jmp 0x10006023
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_orginal_CLevel_IR_OnMouseWheelTarget_failed.
push 0x66
jmp 0x10006023
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.MH_EnableHook:_original_IR_OnMouseWheelTarget_failed.
push 0x5b
jmp 0x10006023
xor eax, eax
xchg dword [ebx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006032
push str.Failed_to_initialize_MinHook._n
push 0x50
push str.C:UsersTOTOMAN2_source_reposStalker_COP_Qols_Moddllmain.cpp
push 0xfffffffffffffffe
call fcn.1000ca20
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret