Function at 0x43c8e0
Capabilities:
Enumerate processes
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a5056
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x538
mov eax, dword [0x4cfa1c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x360], esi
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x524], esi
xorps xmm0, xmm0
mov dword [ebp - 0x364], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x364], 1
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x340]
push 0x22c
push 0
push eax
call fcn.00499a10
add esp, 0xc
lea eax, [ebp - 0x340]
mov ecx, 0x22c
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x43c9d3
push ecx
push 2
mov dword [ebp - 0x340], 0x22c
mov dword [ebp - 0xd0], ecx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x384], edi
mov dword [ebp - 0xd0], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x43d5b2
cmp edi, 0xffffffff
je 0x43d5b2
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x43cbef
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x43cbef
nop dword [eax + eax]
mov dword [ebp - 0x390], 0xe8fe5278
mov dword [ebp - 0x38c], 0x239acc7d
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp - 0x38c]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x3b0], 0x6474cc01
mov dword [ebp - 0x3ac], 0xf94733b4
mov eax, dword [ebp - 0x3b0]
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x3a8], 0x8ca51ff8
mov dword [ebp - 0x3a4], 0x250e748a
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], ecx
mov dword [ebp - 0x3a0], 0xcdfec7f6
mov dword [ebp - 0x39c], 0xa2d9783b
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x504], ecx
mov dword [ebp - 0x380], 0xe88a522b
mov dword [ebp - 0x37c], 0x23fbcc18
mov eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x398], 0x645acc6c
mov dword [ebp - 0x394], 0xf93f33d1
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x394]
mov dword [ebp - 0x370], 0x8ca51f9d
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x36c], 0x250e748a
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x36c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x378], 0xcdfec7f6
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x374], 0xa2d9783b
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x374]
movaps xmm1, xmmword [ebp - 0x520]
pxor xmm1, xmmword [ebp - 0x40]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x520]
movaps xmmword [ebp - 0x520], xmm1
movaps xmm1, xmmword [ebp - 0x510]
push eax
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x31c]
pxor xmm1, xmmword [ebp - 0x30]
push eax
movaps xmmword [ebp - 0x510], xmm1
call fcn.0047d3f5
add esp, 8
test eax, eax
je 0x43cc02
lea eax, [ebp - 0x340]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x43ca50
mov dword [ebp - 0x364], 0
mov byte [ebp - 4], 1
jmp 0x43d5c4
mov eax, dword [ebp - 0x338]
test eax, eax
je 0x43cbef
push eax
push 0
push 0x1fffff
mov dword [ebp - 0xd4], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x36c], edi
mov dword [ebp - 0xd4], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x43d48b
cmp edi, 0xffffffff
je 0x43d48b
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x1c
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x94], 0
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x43d48b
nop dword [eax + eax]
cmp dword [ebp - 0x34c], 0x1000
mov edi, dword [ebp - 0x35c]
mov dword [ebp - 0x37c], edi
je 0x43cca3
add edi, dword [ebp - 0x350]
jmp 0x43d466
mov esi, dword [ebp - 0x350]
lea ecx, [ebp - 0xc0]
push 0
push esi
call fcn.004459d0
cmp dword [ebp - 0xac], 0x10
lea ecx, [ebp - 0x94]
push ecx
push esi
lea eax, [ebp - 0xc0]
cmovae eax, dword [ebp - 0xc0]
push eax
push edi
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x43d44b
mov dword [ebp - 0x378], 0x81cb2b4e
mov dword [ebp - 0x374], 0x5497847c
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x374]
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x3c0], 0x335a625
mov dword [ebp - 0x3bc], 0xa14f5898
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x3c8], 0xffec5ccb
mov dword [ebp - 0x3c4], 0x4d4437c3
mov eax, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x3d0], 0xa49d8094
mov dword [ebp - 0x3cc], 0xcb981174
mov eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x3d8], 0xc01d981d
mov dword [ebp - 0x3d4], 0xe9585831
mov eax, dword [ebp - 0x3d8]
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x488], 0x70ed5679
mov dword [ebp - 0x484], 0x6706475d
mov eax, dword [ebp - 0x488]
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x480], 0xe88a522b
mov dword [ebp - 0x47c], 0x23fbcc18
mov eax, dword [ebp - 0x480]
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x478], 0x645acc6c
mov dword [ebp - 0x474], 0xf93f33d1
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x468], 0x8ca51f9d
mov dword [ebp - 0x464], 0x250e748a
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x464]
mov dword [ebp - 0x460], 0xcdfec7f6
mov dword [ebp - 0x45c], 0xa2d9783b
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x458], 0x854fcf4f
mov dword [ebp - 0x454], 0x801d6864
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x454]
mov dword [ebp - 0x450], 0x70dd1e30
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x44c], 0x6706475d
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x44c]
movaps xmm1, xmmword [ebp - 0x500]
pxor xmm1, xmmword [ebp - 0x50]
movaps xmmword [ebp - 0x500], xmm1
movaps xmm1, xmmword [ebp - 0x4f0]
pxor xmm1, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x4f0], xmm1
movaps xmm1, xmmword [ebp - 0x4e0]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
pxor xmm1, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x4e0], xmm1
lea edx, [ebp - 0x500]
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x43cf17
sub edx, ecx
lea eax, [ebp - 0x500]
cmp dword [ebp - 0xac], 0x10
lea ecx, [ebp - 0xc0]
push edx
cmovae ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xb0]
push eax
push 0
call fcn.00449fa0
mov edx, eax
add esp, 0xc
cmp edx, 0xffffffff
je 0x43d460
xor ecx, ecx
lea eax, [edx - 0x64]
cmp edx, 0x64
push 0x3e8
cmovae ecx, eax
lea eax, [ebp - 0xec]
push ecx
push eax
lea ecx, [ebp - 0xc0]
call fcn.00445930
mov byte [ebp - 4], 4
xorps xmm0, xmm0
movups xmmword [ebp - 0xa8], xmm0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x448], 0xa9f33703
mov dword [ebp - 0x444], 0x4fb3a871
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x470], 0xb30851b
mov dword [ebp - 0x46c], 0x89547ab6
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x3e0], 0xc5e649c5
mov dword [ebp - 0x3dc], 0x6f4d3df9
mov eax, dword [ebp - 0x3e0]
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], ecx
mov dword [ebp - 0x3e8], 0xaeb9a59e
mov dword [ebp - 0x3e4], 0xe3b03752
mov eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x3f0], 0xd7189d26
mov dword [ebp - 0x3ec], 0xc52d3d21
mov eax, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x4ac], ecx
mov dword [ebp - 0x3f8], 0x40955759
mov dword [ebp - 0x3f4], 0x5e2b7706
mov eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x400], 0x5b2b7410
mov dword [ebp - 0x3fc], 0xe6872a8b
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x408], 0xb313a086
mov dword [ebp - 0x404], 0x28a4ae1c
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 0x404]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x410], 0xe88a522b
mov dword [ebp - 0x40c], 0x23fbcc18
mov eax, dword [ebp - 0x410]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp - 0x418], 0x645acc6c
mov dword [ebp - 0x414], 0xf93f33d1
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x8c], ecx
mov ecx, dword [ebp - 0x414]
mov dword [ebp - 0x420], 0x8ca51f9d
mov dword [ebp - 0x41c], 0x250e748a
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp - 0x41c]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x3b8], 0xcdfec7f6
mov dword [ebp - 0x3b4], 0xa2d9783b
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp - 0x428], 0x854fcf4f
mov dword [ebp - 0x424], 0x801d6864
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x430], 0x70dd1e30
mov dword [ebp - 0x42c], 0x6706475d
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x438], 0x1a515971
mov dword [ebp - 0x434], 0xc8db70a6
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x440], 0xee4c8dda
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x43c], 0x28a48737
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0x43c]
movaps xmm1, xmmword [ebp - 0x4d0]
pxor xmm1, xmmword [ebp - 0x90]
movaps xmmword [ebp - 0x4d0], xmm1
movaps xmm1, xmmword [ebp - 0x4c0]
pxor xmm1, xmmword [ebp - 0x80]
movaps xmmword [ebp - 0x4c0], xmm1
movaps xmm1, xmmword [ebp - 0x4b0]
pxor xmm1, xmmword [ebp - 0x70]
movaps xmmword [ebp - 0x4b0], xmm1
movaps xmm1, xmmword [ebp - 0x4a0]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x54], ecx
pxor xmm1, xmmword [ebp - 0x60]
push 1
movaps xmmword [ebp - 0x4a0], xmm1
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x39c], eax
call fcn.0049dcbb
add esp, 4
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 5
lea eax, [ebp - 0x9c]
push eax
call fcn.0044a950
add esp, 4
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00447b10
add esp, 4
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4d0]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d2e0
sub ecx, edx
lea eax, [ebp - 0x4d0]
push ecx
add eax, ecx
lea ecx, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00449800
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xec]
cmp dword [ebp - 0xd8], 0x10
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 0xdc]
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0xec]
add edx, ecx
movq qword [ebp - 0xcc], xmm0
cmp dword [ebp - 0xd8], 0x10
mov dword [ebp - 0xc4], 0
cmovae eax, dword [ebp - 0xec]
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x3a4], esp
call fcn.00444200
mov byte [ebp - 4], 9
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0x3ac], esp
lea eax, [ebp - 0xa8]
push ecx
push eax
push edx
push dword [ebp - 0x394]
call fcn.00444110
mov byte [ebp - 4], 0xa
push ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcc]
call fcn.00448b30
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xcc]
cmp ecx, dword [ebp - 0xc8]
jne 0x43d4b3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcc]
call fcn.004462c0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x43d3f9
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x43d3f9
mov esi, dword [ebp - 0xa8]
test esi, esi
je 0x43d3f9
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x43d3e2
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x43d434
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x43d434
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.00446fc0
mov edi, dword [ebp - 0x37c]
jmp 0x43d460
mov eax, dword [ebp - 0x94]
test eax, eax
cmove eax, dword [ebp - 0x350]
mov dword [ebp - 0x94], eax
add edi, dword [ebp - 0x94]
push 0x1c
lea eax, [ebp - 0x35c]
push eax
push edi
mov edi, dword [ebp - 0x36c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
jne 0x43cc80
mov esi, dword [ebp - 0x360]
mov dword [ebp - 0x364], 0
mov byte [ebp - 4], 2
test edi, edi
je 0x43d4a4
push edi
call dword [0x4bd7a0]
mov byte [ebp - 4], 1
push dword [ebp - 0x384]
jmp 0x43d5c5
push 0
lea eax, [ebp - 0x53c]
push eax
call fcn.00443ff0
mov edi, eax
mov byte [ebp - 4], 0xc
mov esi, dword [ebp - 0x360]
cmp esi, edi
je 0x43d4f9
mov ecx, esi
call fcn.00446fc0
movups xmm0, xmmword [edi]
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x53c]
call fcn.00446fc0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xcc]
call fcn.004462c0
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0xa8]
test ecx, ecx
je 0x43d55d
or eax, 0xffffffff
lock xadd dword [ecx + 0x20], eax
jne 0x43d55d
mov esi, dword [ebp - 0xa8]
test esi, esi
je 0x43d557
nop dword [eax]
mov ecx, esi
lea eax, [esi + 0xc]
mov esi, dword [eax]
mov dword [eax], 0
push 1
mov eax, dword [ecx]
call dword [eax]
test esi, esi
jne 0x43d540
mov esi, dword [ebp - 0x360]
mov dword [ebp - 0xa8], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x38c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x43d598
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
mov ecx, eax
test ecx, ecx
je 0x43d598
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.00446fc0
mov edi, dword [ebp - 0x36c]
jmp 0x43d48b
mov dword [ebp - 0x364], 0
mov byte [ebp - 4], 1
test edi, edi
je 0x43d5cb
push edi
call dword [0x4bd7a0]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.00446fc0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497d9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret