Function at 0x1000a260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001692e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.LoadCursorA
push str.USER32.dll
mov dword [esp + 0x1c], esi
mov dword [esi + 0x88], 0x1001721c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x7f8a
mov dword [esp + 0x1c], 0x7f00
mov dword [esp + 0x20], 0x7f03
mov dword [esp + 0x24], 0x7f89
mov dword [esp + 0x28], 0x7f8b
mov dword [esp + 0x2c], 0x7f01
mov dword [esp + 0x30], 0x7f81
mov dword [esp + 0x34], 0x7f88
mov dword [esp + 0x38], 0x7f80
mov dword [esp + 0x3c], 0x7f86
mov dword [esp + 0x40], 0x7f83
mov dword [esp + 0x44], 0x7f85
mov dword [esp + 0x48], 0x7f82
mov dword [esp + 0x4c], 0x7f84
mov dword [esp + 0x50], 0x7f04
mov dword [esp + 0x54], 0x7f02
lea ebx, [esp + 0x18]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [esp + 0x18]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000a336
xor ebp, ebp
push str.GDI32.dll
mov dword [esp + 0x64], ebp
mov dword [esi], 0x10017220
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x68]
mov dword [0x1001d468], eax
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000a37d.2
xor edx, edx
mov dl, byte [eax + 0x1000a570]
jmp dword [edx*4 + 0x1000a568]
mov dword [esi + 0x70], ecx
jmp 0x1000a390
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000adc0
test al, al
jne 0x1000a3b1
call dword [0x1001d45c]
push eax
mov dword [esi + 0x10c], eax
call dword [0x1001d460]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x70]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [0x1001cbd4]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x70]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov dword [esi + 0x30], ebp
push str.CreateCompatibleDC
mov byte [esi + 0x24], al
mov ecx, dword [0x1001d468]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x44]
mov edi, eax
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x44]
push eax
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
lea ebx, [esi + 0x5c]
push 1
push ecx
push edx
mov dword [ebx], ebp
lea ebp, [esi + 0x60]
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [ebp], 0
call fcn.1000aa30
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1000aa30
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x28]
push 1
push eax
push ecx
mov ecx, esi
call fcn.1000aa30
mov dword [esi + 0x6c], eax
mov edx, dword [0x1001d468]
push str.CreateDIBSection
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
mov edi, eax
push 0
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call edi
mov edx, dword [esi + 0x68]
push 0
push 0
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x44]
push ebp
push 0
push edx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
lea ecx, [esi + 0x78]
push 0
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
push ecx
push 0
push edx
push eax
call edi
mov dword [esi + 0x84], eax
mov ecx, dword [0x1001d468]
push str.SelectObject
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x58]
mov edi, eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push 0
lea ecx, [esi + 0x34]
push 0
push ecx
call dword [0x1001d464]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x58]
div dword [esi + 0x2c]
mov dword [esi + 0x20], 0
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
jb 0x1001a6ab
inc ecx
add byte [eax], al
inc ebx
jb 0x1001a6d4
popal
je 0x1001a6d7
push esp
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
push 0x33706c65
xor dl, byte [ebx + 0x6e]
popal
jo str.IMM32.dll
push 0x746f
add byte [eax], al
push eax
jb 0x1001a6fa
arpl word [ebp + 0x73], sp
jae 0x1001a6c3
xor al, byte [esi + 0x69]
jb 0x1001a708
je 0x1001a697
add byte [eax + 0x72], dl
push eax
jb 0x1001a70a
arpl word [ebp + 0x73], sp
jae 0x1001a6d3
xor cl, byte [esi + 0x65]
js 0x1001a719
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001a703
push edi
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x1001a729
inc ecx
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x1001a729
push edi
imul ebp, dword [esi + 0x64], 0x73776f
dec ebp
jae 0x1001a73b
add byte [ebp + 0x65], cl
dec ebp
jae 0x1001a73b
popal
inc edx
outsd dx, dword [esi]
js 0x1001a710
add byte [ebp + 0x61], cl
dec ebp
popal
jo 0x1001a72a
push esi
imul esp, dword [ebp + 0x77], 0x6946664f
insb byte es:[edi], dx
add byte gs:[eax], al
add byte [ebx + 0x72], al
inc ebx
invalid
dec edi
inc si
imul ebp, dword [ebp], 0x72430000
inc ebx
invalid
popal
je 0x1001a74b
inc esi
imul ebp, dword [ebp + 0x4d], 0x69707061
outsb dx, byte [esi]
inc ecx
add byte [eax], al
dec ecx
dec ebp
dec ebp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [0x30255b0a], cl
or eax, 0x30255b0a
xor dh, byte [ebp + 0x2d]
and eax, 0x2d753230
and eax, 0x2d753230
and eax, 0x30252064
xor dh, byte [ebp + 0x3a]
and eax, 0x3a753230
and eax, 0x3a753230
and eax, 0x5d753230
cmp ah, byte [0x5d753230]
and byte [eax], ch
and eax, 0xa0d2973
add byte [eax], al
inc edi
je 0x1001a76d
je 0x1001a76d
arpl word [ecx + ebp*2 + 0x76], si
push edi
imul ebp, dword [esi + 0x64], 0x5d00776f
add byte [eax], al
add byte [0x4700000a], cl
inc edi
je 0x1001a78f
jns 0x1001a795
popal
insd dword es:[edi], dx
push esp
js 0x1001a7c2
inc ecx
add byte [ebx + 0x61], al
inc ebx
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
dec esi
js 0x1001a7cc
dec eax
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
jae 0x1001a7cf
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001a7d4
js 0x1001a7e5
add byte [eax], al
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001a7be
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001a7ee
jae 0x1001a7ea
je 0x1001a7ec
outsd dx, dword [esi]
outsb dx, byte [esi]
push ebx
je 0x1001a7fa
imul ebp, dword [esi + 0x67], 0x41
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001a7da
je 0x1001a7da
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001a800
js 0x1001a811
add byte [eax], al
add byte [ebp + 0x79], cl
dec ebp
jns 0x1001a7e6
jb 0x1001a80a
popal
je 0x1001a80d
dec ebp
popal
add byte [eax], al
inc esi
jb 0x1001a814
push ebx
imul esp, dword [eax + eax + 0x53], 0x65537465
push ebx
je 0x1001a80b
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x6144726f
jns str.AllocateAndInitializeSid
jae 0x1001a826
arpl word [edx + 0x69], si
jb 0x1001a82e
jo 0x1001a83b
outsd dx, dword [esi]
jb 0x1001a80e
popal
arpl word [eax + eax], bp
insb byte es:[edi], dx
add byte [eax], al
add byte [ecx + 0x64], al
inc ecx
inc ecx
arpl word [ebx + 0x65], sp
jae 0x1001a84c
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
ja 0x1001a844
inc ecx
arpl word [ebp], sp
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x6c6341
add byte [eax], al
inc edi
je 0x1001a844
jp 0x1001a853
inc ecx
arpl word [eax + eax], bp
add byte [edi + 0x65], al
inc edi
je 0x1001a844
outsb dx, byte gs:[esi]
je 0x1001a865
push ebx
imul esp, dword [eax + eax], 0x6c410000
inc ecx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
inc ecx
je 0x1001a871
inc ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
imul esp, dword [eax + eax], 0x6e490000
dec ecx
outsb dx, byte [esi]
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x646953
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x726f
add byte [eax], al
push ebx
je 0x1001a89b
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x75636553
jb 0x1001a899
je 0x1001a8ab
inc esp
jae 0x1001a899
jb 0x1001a8a1
jo 0x1001a8ae
outsd dx, dword [esi]
jb 0x1001a83d
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x1001a89b
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0x41
add byte [eax], al
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
push 0x576b6f6f
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
inc ebp
js str.Plugin
pop esp
push eax
insb byte es:[edi], dx
jne 0x1001a8d4
imul ebp, dword [esi], 0x65474853
push ebx
dec eax
inc edi
je 0x1001a8c9
dec eax
inc edi
je 0x1001a8c9
jo 0x1001a8dd
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x1001a8d3
popal
je 0x1001a8ee
inc ecx
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a8f3
imul ebp, dword [esi + 0x45], 0x646e
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a8ff
imul ebp, dword [esi + 0x53], 0x74726174
outsb dx, byte [esi]
push ebx
je 0x1001a8fe
jb 0x1001a913
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
insb byte es:[edi], dx
jne 0x1001a90b
imul ebp, dword [esi + 0x44], 0x74656c65
add byte gs:[eax], al
add byte [eax], al
and eax, 0x20202073
and eax, 0x20202073
and eax, 0x73
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a92b
imul ebp, dword [esi + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0xb4ce0000
mov esp, 0xd8d4d3
arpl word [edx + 0x69], si
jo 0x1001a942
add byte [eax], al
into
mov ah, 0xbc
rcl esp, cl
fadd dword [eax]
aam 0xd8
add byte [eax], al
rcl cl, cl
mov esi, 0xd4d3bcad
add dl, dl
sar dword [esi - 0x2b2c4353], 1
rcl esp, cl
fadd dword [eax]
add byte [eax], al
add byte [0x2e2a5c73], ah
and eax, 0x2e2a5c73
sub al, byte [eax]
add byte [edx + 0x6c], al
inc edx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x49], bp
outsb dx, byte [esi]
jo 0x1001a96a
je 0x1001a8f7
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001a962
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
push ebx
je 0x1001a94f
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
inc esp
inc esp
popal
je 0x1001a979
add byte [eax], al
add byte [eax], al
inc ebp
insd dword es:[edi], dx
jo 0x1001a994
jns 0x1001a965
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
dec edi
jo 0x1001a994
add byte [edi + 0x70], cl
dec edi
jo 0x1001a994
outsb dx, byte [esi]
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001a983
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
jo 0x1001a9a6
outsd dx, dword [esi]
popal
jb 0x1001a9ac
inc esp
popal
je 0x1001a9ad
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001a9a7
add byte [edi + 0x65], al
inc edi
je 0x1001a9a7
jns 0x1001a9c9
je 0x1001a9bd
insd dword es:[edi], dx
dec ebp
je 0x1001a9cf
imul esp, dword [ebx + 0x73], 0
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
dec esp
outsd dx, dword [esi]
popal
inc ebx
jne 0x1001a9e9
jae str.SetCursorPos
jb 0x1001a9bc
add byte [ebp + 0x73], al
inc esp
jae 0x1001a9f4
invalid
outsd dx, dword [esi]
jns 0x1001a9c7
inc ebx
jne str.keybd_event
jae 0x1001a9f7
jb 0x1001a98a
add byte [eax], al
push ebp
jae 0x1001a9f4
jb 0x1001a9c4
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001aa13
popal
inc ecx
add byte [eax], al
add byte [eax], al
push ebx
jns 0x1001aa1e
add byte [ebx + 0x79], dl
push ebx
jns 0x1001aa1e
invalid
je 0x1001aa12
insd dword es:[edi], dx
insd dword es:[edi], dx
push eax
popal
jb 0x1001aa13
insd dword es:[edi], dx
je 0x1001aa1b
jb 0x1001aa2b
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [ebp + 0x6f], ch
insd dword es:[edi], dx
outsd dx, dword [esi]
jne 0x1001aa37
pop edi
jbe 0x1001aa2e
jbe 0x1001aa2e
outsb dx, byte [esi]
je str.MapVirtualKeyA
dec ebp
popal
jo 0x1001aa26
push esi
imul esi, dword [edx + 0x74], 0x4b6c6175
jns 0x1001aa1b
add byte [eax], al
push ebx
je 0x1001aa23
popal
jo 0x1001aa57
jne 0x1001aa57
add byte gs:[eax], al
push ebx
je 0x1001aa2f
jne 0x1001aa60
jae 0x1001aa5f
jb 0x1001aa42
outsd dx, dword [esi]
jae 0x1001a9f5
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x65], ch
imul esp, dword [ebp + 0x79], 0x62
imul esp, dword [ebp + 0x79], 0x62
pop edi
jbe 0x1001aa66
outsb dx, byte [esi]
je str.WindowFromPoint
push edi
imul ebp, dword [esi + 0x64], 0x7246776f
outsd dx, dword [esi]
insd dword es:[edi], dx
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x74655300
push ebx
je 0x1001aa6a
je str.SetRect
add byte [ebx + 0x65], dl
push ebx
je 0x1001aa6a
push ebx
je 0x1001aa6a
arpl word gs:[eax + eax + 0x47], si
inc edi
je 0x1001aa64
add byte [edi + 0x65], al
inc edi
invalid
je 0x1001aa64
inc ebx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
invalid
je 0x1001aa6c
jae 0x1001aa96
je 0x1001aa9c
jo 0x1001aa86
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [eax], al
push edx
insb byte es:[edi], dx
add byte [edx + 0x65], dl
push edx
insb byte es:[edi], dx
popal
jae str.GetCursorInfo
inc esp
inc ebx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
insb byte es:[edi], dx
add byte [eax], al
push ebx
insb byte es:[edi], dx
arpl word gs:[edi + ecx*2 + 0x62], si
push 0x65
arpl word [eax + eax], si
add byte [eax], al
inc ebx
jb 0x1001aabc
popal
je 0x1001aabf
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
arpl word [ecx + ebp*2 + 0x6f], si
je 0x1001aacb
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001aad0
popal
popal
je 0x1001aad3
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001aad4
je 0x1001aade
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [eax], al
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001aaf3
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001ab03
je 0x1001ab03
inc esp
inc ebx
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001aaeb
jne 0x1001ab1c
jae 0x1001ab1b
jb 0x1001aaf7
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001aafb
jne str.TerminateProcess
jae 0x1001ab2b
jb 0x1001ab0e
outsd dx, dword [esi]
jae 0x1001aac1
add byte [eax], al
add byte [edx + 0x69], al
inc edx
invalid
je 0x1001ab0a
insb byte es:[edi], dx
je 0x1001aacb
add byte [edi + 0x65], al
inc edi
je 0x1001ab14
dec ecx
inc edx
imul esi, dword [ebx + esi*2], 0x72430000
inc ebx
invalid
je 0x1001ab48
jae 0x1001aad6
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
invalid
add byte [eax], al
inc ebx
jb str.TerminateThread
popal
popal
je 0x1001ab43
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ab44
je 0x1001ab4e
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0x5c000070
pop esp
arpl word [ebp + 0x64], bp
js 0x1001ab5d
insd dword es:[edi], dx
popal
jo 0x1001aaef
add byte [ebx + 0x6d], bl
pop esp
invalid
insd dword es:[edi], dx
js 0x1001ab5d
add byte gs:[eax], al
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001ab64
add byte [ebx + 0x72], al
inc ebx
jb 0x1001ab64
popal
popal
je 0x1001ab67
push eax
imul esi, dword [eax + 0x65], 0x654b0000
dec ebx
invalid
jb 0x1001ab7a
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc esp
imul esi, dword [ebx + 0x63], 0x656e6e6f
arpl word [esi + ecx*2 + 0x61], si
arpl word [edi + 0x6e], bp
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[esi + ecx*2 + 0x61], si
insd dword es:[edi], dx
push eax
imul esi, dword [eax + 0x65], 0x72655400
push esp
invalid
invalid
add byte [ebp + 0x72], dl
push esp
invalid
invalid
push esp
jb 0x1001ab9d
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x1001ab3d
add byte [eax], al
add byte [ebp + 0x72], dl
push esp
invalid
invalid
push esp
jb 0x1001abb1
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x68546574
jb 0x1001abb2
push esp
push 0x64616572
add byte [eax + 0x65], dl
push eax
invalid
popal
add byte fs:[eax + 0x65], dl
push eax
invalid
imul ecx, dword gs:[esi + 0x61], 0x6d
push eax
imul esi, dword [eax + 0x65], 0x45000000
inc ebp
js 0x1001abcc
add byte [eax], al
add byte [ebp + 0x78], al
inc ebp
js 0x1001abcc
je 0x1001abbc
imul ebp, dword [esi + 0x64], 0x4573776f
je 0x1001abbc
push edi
imul ebp, dword [esi + 0x64], 0x4573776f
outsd dx, dword fs:[esi]
ja 0x1001abde
inc ebp
js 0x1001ab6e
add byte [eax], al
inc edi
je 0x1001abcb
imul ebp, dword [esi + 0x64], 0x6854776f
jb 0x1001abe2
push 0x64616572
push eax
popal
push eax
jb 0x1001abf1
arpl word [ebp + 0x73], sp
jae 0x1001abd0
add byte fs:[eax], al
add byte [eax], al
dec ecx
jae 0x1001abe6
imul ebp, dword [esi + 0x64], 0x6956776f
jae 0x1001ac01
bound ebp, qword [ebp]
inc edi
je 0x1001abed
outsd dx, dword [esi]
jne 0x1001ac10
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
js 0x1001abf1
add byte [eax], al
add byte [eax], al
add byte [ebp + 0x6e], al
inc ebp
outsb dx, byte [esi]
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x1001ac25
push eax
jb 0x1001ac2a
arpl word [ebp + 0x73], sp
jae 0x1001ac0d
jae 0x1001ac32
dec ebp
outsd dx, dword [esi]
jne 0x1001ac30
jae 0x1001abc7
add byte [eax + 0x53], dl
push eax
push ebx
inc ecx
push eax
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
inc esp
bound esi, qword gs:[ebp + 0x67]
push eax
jb 0x1001ac47
jbe 0x1001ac49
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte gs:[bx + si], al
add byte [eax], al
push ebx
push ebx
push 0x6f647475
je 0x1001ac53
outsd dx, dword [esi]
ja str.SetThreadDesktop
outsb dx, byte [esi]
push eax
jb 0x1001ac5e
jbe str.SetThreadDesktop
insb byte es:[edi], dx
add byte gs:[bx + 0x65], al
inc edi
je 0x1001ac55
jae 0x1001ac67
jb 0x1001ac53
jb 0x1001ac53
bound ebp, qword [edx + 0x65]
arpl word [ecx + ecx*2 + 0x6e], si
outsw dx, word [esi]
jb 0x1001ac7c
popal
je 0x1001ac7b
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001ac70
push 0x64616572
inc esp
jae 0x1001ac90
je 0x1001ac96
jo 0x1001ac29
add byte [eax], al
add byte [edi + 0x70], cl
dec edi
jo 0x1001ac94
outsb dx, byte [esi]
add byte [eax], al
dec edi
jo 0x1001ac94
outsb dx, byte [esi]
inc esp
jae 0x1001ac9f
jae 0x1001ac9f
je 0x1001aca5
jo 0x1001ac79
add byte [eax], al
add byte [eax], al
dec edi
jo 0x1001aca4
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
jo 0x1001acb9
je 0x1001ac8a
jae str.CloseWindow
jae str.CloseWindow
je 0x1001acba
jo 0x1001ac4d
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001acba
inc esp
jae 0x1001acc4
je 0x1001acca
jo 0x1001ac5d
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x1001acb8
add byte [eax], al
push ebx
je 0x1001acb8
push 0x64616572
inc esp
popal
inc esp
jae 0x1001acd8
je 0x1001acde
jo 0x1001ac71
add byte [eax], al
add byte [eax], al
push eax
outsd dx, dword [esi]
add byte [eax], al
add byte [eax + 0x6f], dl
push eax
outsd dx, dword [esi]
jae 0x1001acec
dec ebp
jae 0x1001acef
jae 0x1001acde
popal
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x1001aced
jb 0x1001acf8
je 0x1001acdf
popal
inc esi
inc esi
imul ebp, dword [ebp], 0x4d000000
dec ebp
add byte [eax], al
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jp 0x1001ad05
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
arpl word [edi + 0x6d], bp
jo 0x1001ad0b
je 0x1001ad15
bound ebp, qword [ebp + 0x29]
add byte [eax], al
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ad1e
push edi
push edi
imul ebp, dword [esi + 0x64], 0x4300776f
inc ebx
push esi
imul esp, dword [ebp + 0x6f], 0x706143
outsd dx, dword gs:[esi]
inc ebx
popal
jo 0x1001acca
add byte [eax], al
arpl word [ecx + 0x70], sp
inc ebx
jb 0x1001ad37
popal
je 0x1001ad3a
inc ebx
popal
jo 0x1001ad4d
je 0x1001ad4f
jne 0x1001ad4d
jb 0x1001ad41
push edi
push edi
imul ebp, dword [esi + 0x64], 0x41776f
inc ecx
push esi
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x1001ad24
add byte [ecx + 0x56], al
inc ecx
push esi
dec ecx
inc ebx
inc ecx
push eax
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.ICOpen
popal
je 0x1001ad67
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsd dx, dword fs:[esi]
ja 0x1001ad4e
js 0x1001ad4c
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
je 0x1001ad57
jb 0x1001ad7e
jbe 0x1001ad7c
jb 0x1001ad5d
jae 0x1001ad7f
jb 0x1001ad87
jo str.ICSeqCompressFrameEnd
imul ebp, dword [edi + 0x6e], 0x41
add byte [ecx + 0x43], cl
dec ecx
inc ebx
add byte [eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ad71
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ada4
jae 0x1001ada8
inc esi
jb 0x1001ad99
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ad85
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001adb8
jae 0x1001adbc
inc esi
jb 0x1001adad
insd dword es:[edi], dx
push ebx
push ebx
je 0x1001adb2
jb 0x1001adc7
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001add1
jae 0x1001adc0
popal
add byte gs:[bx + si], al
add byte [ecx + 0x43], cl
dec ecx
inc ebx
dec edi
jo 0x1001adce
outsb dx, byte [esi]
add byte [eax], al
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ade4
add byte gs:[ecx + 0x43], cl
dec ecx
inc ebx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001adf9
jae 0x1001adfd
outsd dx, dword [esi]
jb 0x1001add3
jb 0x1001adf4
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001addd
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ae10
jae 0x1001ae14
inc esi
jb 0x1001ae05
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x78], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
jnp 0x1001ae32
jg 0x1001adf9
invalid
xor eax, 0x3a2d3237
cmp eax, 0x6d2f3235
cmp bh, byte [0x6d2f3235]
jbe 0x1001ae2c
add eax, 0x5040208
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [edx], eax
add al, 3
add eax, dword [ecx]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [eax], ecx
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [0x2010202]
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [ebx]
add dword [edx], eax
add eax, dword [0x4020602]
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add eax, dword [ebx]
add al, byte [ecx]
add dword [ebx], eax
push es
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [edx]
add dword [edx], eax
add dword [edx], eax
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
add al, 1
add al, byte [edx]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x5020302
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x6030402
add ch, byte [ebx + 0x77]
imul esi, dword [edi + 0x75], 0x72
cmp dword [edx], ebp
sub eax, 0x2f737571
popal
arpl word [eax + 0x66], bp
jae 0x1001af21
pushal
insb byte es:[edi], dx
outsd dx, dword [esi]
push 0x79762873
jbe 0x1001af04
add al, 3
add dword [edx], eax
add eax, dword [0x1030602]
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add bl, dl
add eax, 0x31550206
push ebp
xor dword [edx], esi
xor byte [eax], dh
xor al, 0x33
xor esi, dword [eax]
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]