Given esp = 0x13F3AC, eip = 0x513FC3 and the memory snippet below: \ (Each question is independent) \ 0013F3A0: 11 BA 5E BA 0D F0 AD 0B 0D F0 FE CA 01 F0 AD DE \ 0013F3B0: CA FE 40 00 6C 61 7A 79 20 64 6F 67 2E 00 13 00 \ 0013F3C0: 28 3F 51 00 E2 F2 13 00 CA FE 40 00 00 00 00 00

1. What is the new value of esp after a pop eax?

2.What is the value in eax after that same pop eax?

3. What will be in ax after executing "mov ax,[esp + 9]?"

4. Given that edx = 0xCAFEDEAD, what is in edx after doing a mov dh,[esp - 4]?

5. How many 4-byte values on this stack, when interpreted as an address, would be in close to esp?

6. What is the value in edi, after this instruction: \mov edi,[esp - 8]

7. What is the value in ebx after this instruction: \mov ebx,esp

8. What is the value at esp+8 after this instruction: \inc [esp + 8]

9. When interpreted as a string, what does it say at [esp + 8]