Function at 0x5d2270
Capabilities:
Access the windows event log

Disassembly:
mov edx, 0x4bd2715a
add edx, 0x1fd66dd6
insd dword es:[edi], dx
salc
pop ds
add edx, 0xd750445c
sub ecx, edx
jmp 0x5cd7a1
sub ebx, edi
jmp 0x5d2a30
pop edx
push edx
mov edx, 0x60196edc
add edx, 0x2b329b30
add edx, 0xcef5e728
xor edx, 0xf82d3df4
add ecx, edx
pop edx
push edx
mov edx, 0xf8cd5364
add edx, 0xcb239355
sub edx, 0x1b3a8e7f
xor edx, 0xc66ebce
push eax
mov eax, 0xb914d229
xor eax, 0x159c92c5
sub eax, 0x8348b6e1
xor eax, 0xed45e94
add edx, eax
pop eax
push edi
mov edi, 0x87a36020
add edi, 0x7d1eb7ef
sub edi, 0x88dea567
sub edx, edi
pop edi
sub ecx, edx
jmp 0x5cd82e
pop edx
push ebx
mov ebx, 0x52107b04
add ebx, 0x8da76d1f
sub ebx, 0x1b248b91
add ebx, 0x5c2d03d9
push esi
mov esi, 0x2e04abd3
sub esi, 0x4ea0b4fd
add esi, 0x9b08024
add esi, 0x6674da0d
xor esi, 0x7d64e9f
xor ebx, esi
jmp 0x5d0f3f
sub edi, 0xe4ba28f7
add edi, 0xe648ad81
push eax
mov eax, 0x7248c04
sub eax, 0x1ee98970
xor eax, 0x73205d8a
xor edi, eax
pop eax
push ebx
mov ebx, 0x33234e1c
xor ebx, 0x27c3dfa3
add ebx, 0x76ec343e
xor ebx, 0x4abd63c2
xor ebx, 0xb328d239
add edi, ebx
jmp 0x5cda77
sub eax, 0x110dfbb1
xor eax, 0xd985cb33
xor edi, eax
pop eax
push esi
mov esi, 0xe59f52fd
sub esi, 0x635938e8
xor esi, 0x6060c5ee
xor edi, esi
pop esi
push esi
mov esi, 0x8ba3e934
add esi, 0x31d5d0f8
sub esi, 0x6740de4a
jmp 0x5d0e07
pop ebx
push ebx
mov ebx, 0xac22e313
add ebx, 0xc6d22074
xor ebx, 0x92bf9351
xor ebx, 0xdfa7d443
add ebx, 0xd1527bb
add edi, ebx
pop ebx
jmp 0x5d099e
xor edx, esi
pop esi
push esi
mov esi, 0x9f17f82e
sub esi, 0xc4be7a6b
add esi, 0x4115f38f
add edx, esi
pop esi
add ebx, edx
pop edx
push eax
mov eax, 0x53485c18
add eax, 0x5694f90
xor eax, 0x7e2a451b
sub eax, 0x8cb59145
push esi
mov esi, 0xfdd7bada
xor esi, 0xdb3af875
jmp 0x5d398b
xor ebx, 0x25bbcd29
add ebx, 0x6c088ffb
add ebx, 0xdbfac78
add esi, ebx
pop ebx
push ebx
mov ebx, 0xd6b742aa
add ebx, 0x949b7a4a
xor ebx, 0x84d8239d
xor ebx, 0x218eb5a5
add ebx, 0x34dbaf8f
sub esi, ebx
pop ebx
jmp 0x5d3e77
xor edi, 0xa495e62d
jmp 0x5cddce
sub edi, 0x381cbc59
xor ecx, edi
pop edi
push edi
mov edi, 0x89971acd
sub edi, 0x6ce4aeb2
sub edi, 0x4a58a48
add edi, 0x376b0d79
xor edi, 0xcaf20afa
push ecx
mov ecx, 0xa74595f9
xor ecx, 0xf23bc95f
add ecx, 0xfcfd21d
add edi, ecx
jmp 0x5d1abb
sub edi, edx
jmp 0x5ce025
xor esi, 0x1466003a
xor esi, 0x101be953
sub esi, 0xd6307c0e
push eax
mov eax, 0xb3616b9
add eax, 0x1f8eb39e
xor eax, 0xad367a7b
sub eax, 0x3ea020db
add eax, 0xf9fb90b5
sub esi, eax
pop eax
push ebx
mov ebx, 0xd2b4d74
add ebx, 0x2c34b29f
sub ebx, 0xed969604
add ebx, 0x22fa8d2d
sub esi, ebx
pop ebx
push edx
mov edx, 0x531d209d
sub edx, 0xd27fc0f4
sub edx, 0x14d4315c
xor edx, 0x1347e4d0
xor esi, edx
jmp 0x5ce104
pop esi
push ecx
mov ecx, 0x8036ec37
xor ecx, 0x278dcd29
add ecx, 0x5b6e7412
xor ecx, 0xee9cecae
add edx, ecx
pop ecx
sub ecx, edx
pop edx
mov dword [ecx + ebp], esi
pop ecx
mov dword [0x61b464], esi
push edi
mov edi, 0xea61829b
xor edi, 0x88e648d9
xor edi, 0x5fa7500d
jmp 0x5cd882
mov eax, 0x20a126c9
sub eax, 0x3ce5e101
jmp 0x5d4b50
pop edx
push esi
mov esi, 0x75b33db2
sub esi, 0xc04d3bb9
add esi, 0x47af0d0a
add esi, 0x8ad837fc
sub esi, 0xbfa09150
xor edi, esi
jmp 0x5d3100
xor esi, ebx
pop ebx
sub ecx, esi
pop esi
cmp word [eax], cx
pop ecx
jne 0x5d282a
mov edx, dword [0x61b460]
inc edx
mov dword [0x61b460], edx
push ebx
mov ebx, 0xc50d36c0
sub ebx, 0x52caa64c
sub ebx, 0xbd20d5be
push eax
mov eax, 0xfb193a82
xor eax, 0x69c56816
add eax, 0xfebbe5d8
xor ebx, eax
pop eax
push edx
mov edx, 0xa8ef475a
add edx, 0xf50bf62
xor edx, 0x375381a2
add edx, 0x1fc6e06f
jmp 0x5cf3e8
sub esi, 0xe7fafb25
add esi, 0x192db627
xor esi, 0x6c021855
add esi, 0x9f779b28
sub eax, esi
pop esi
push ebx
jmp 0x5ce326
pop edx
xor edi, esi
pop esi
push eax
mov eax, 0x6a183098
sub eax, 0xb57d0e11
xor eax, 0xcca1da67
push ecx
mov ecx, 0x245ea68b
add ecx, 0x82fe272a
add ecx, 0xce49905f
xor ecx, 0xc1855652
sub eax, ecx
pop ecx
push edx
mov edx, 0x2da0d05d
sub edx, 0xe84fbfc5
xor edx, 0x913032b2
sub edx, 0x8fe446c9
xor eax, edx
pop edx
jmp 0x5ce196
xor edi, eax
pop eax
push edx
mov edx, 0xbe1230a1
sub edx, 0x35ad5a49
xor edx, 0x69168e0b
sub edx, 0x8a8319bb
add edx, 0xb445a6ad
push eax
mov eax, 0xf16047b4
xor eax, 0x704c571c
sub eax, 0xfb95f376
sub eax, 0x86b93de
sub eax, 0xebf9e38b
xor edx, eax
pop eax
mov edx, 0x4de51969
add edx, 0xd9376745
add edx, 0xa542f7c9
sub edx, 0x34623898
sub edx, 0x1312937a
jmp 0x5cf453
mov ebx, 0x60e6ce
xor ebx, 0x92565c2c
sub ebx, 0x685c2158
add eax, ebx
pop ebx
add ebx, eax
pop eax
mov dword [ebx + ebp], eax
pop ebx
je 0x5ce355
cmp eax, 0x5d81f1e3
je 0x5ce355
cmp eax, 0x5d91be30
jne 0x5d41d2
push ebx
mov ebx, 0xf3cdc76
add ebx, 0xe60ed3f8
add ebx, 0x8ca72a95
push eax
mov eax, 0xd3861607
add eax, 0xfee352d7
add eax, 0xcb1912a0
add eax, 0x5d0d2987
xor eax, 0x61f777c9
jmp 0x5d2a7b
add ebx, 0xd2239e06
xor ebx, 0x72fd4b52
xor ebx, 0xf9175dfb
sub edx, ebx
pop ebx
push ecx
mov ecx, 0xc91aed3
sub ecx, 0x3419f739
sub ecx, 0x23cf5a54
xor ecx, 0x910694fb
add edx, ecx
pop ecx
push esi
mov esi, 0xa172c2ae
add esi, 0xa2aec598
add esi, 0x1fadbf87
add edx, esi
jmp 0x5cdf25
add ebx, 0xd088552e
sub ebx, 0x820f19cf
xor ebx, 0xd6cec2a7
add ecx, ebx
pop ebx
push eax
mov eax, 0x3daec422
sub eax, 0x300478e6
add eax, 0xdecf80d4
xor ecx, eax
pop eax
push edi
mov edi, 0x650b2e52
xor edi, 0x11be1024
xor edi, 0xc2f34c9d
add edi, 0x7a28f48d
xor edi, 0xb76048e5
sub ecx, edi
pop edi
push eax
mov eax, 0x919b6128
sub eax, 0x1dba9bd3
sub eax, 0x2a482c7c
xor eax, 0xf872ad10
sub ecx, eax
pop eax
lea ecx, [ecx]
mov dword [esp + ecx], edi
pop ecx
pop edi
jmp 0x5d42fb
add ecx, 0x835984c2
xor ecx, 0x36b3dbc2
sub ecx, 0x41785313
push esi
mov esi, 0xc8bd3f60
add esi, 0xce8ecaa8
sub esi, 0xec7459b6
add esi, 0xd7253c09
add ecx, esi
pop esi
push eax
mov eax, 0x91f21e50
add eax, 0x3ae79321
sub eax, 0xa0709ff
sub ecx, eax
pop eax
push edx
jmp 0x5cd785
add ecx, 0x90b9d43f
sub esi, ecx
jmp 0x5d4069
xor eax, ecx
pop ecx
jmp 0x5d3549
add ebx, 0xecf01de4
add edx, ebx
pop ebx
push ecx
mov ecx, 0x9df87acc
sub ecx, 0x2139250b
sub ecx, 0x70c4c99a
add edx, ecx
pop ecx
jmp 0x5d3a9f
je 0x5d282a
push ecx
mov ecx, 0xbe03fa35
jmp 0x5ce84a
add ecx, 0xf54684cf
add ecx, 0x884ec7fd
sub ecx, 0x626ea294
push eax
mov eax, 0xfd8d82fc
add eax, 0x87545a6b
add eax, 0xb8a1b97
add eax, 0xa92b8e56
sub ecx, eax
pop eax
push ebx
mov ebx, 0x5fa3e724
add ebx, 0x9ef8285b
add ebx, 0x972a72f3
sub ecx, ebx
pop ebx
push esi
mov esi, 0x1a7bd5b6
add esi, 0x2b31bd72
add esi, 0xe5750dca
push ebx
mov ebx, 0xf6286f6a
sub ebx, 0x2c07b4fc
xor ebx, 0xa63245b7
xor ebx, 0x23300878
sub esi, ebx
pop ebx
push edx
mov edx, 0xba8847cf
sub edx, 0xa44c70e8
jmp 0x5ce8d1
sub edx, 0x87d7a945
sub edx, 0xdc33e14f
xor esi, edx
jmp 0x5d3b01
xor ebx, 0x6f48c76a
xor ebx, 0x12446c0a
add edx, ebx
pop ebx
add edi, edx
pop edx
push eax
mov eax, 0xecf91c4c
xor eax, 0x6693dad0
sub eax, 0x23db1780
xor eax, 0xebe8e3e2
push ecx
mov ecx, 0x6ed0bfe
xor ecx, 0x96aa4564
add ecx, 0xd3724a9a
sub eax, ecx
pop ecx
push edx
mov edx, 0xf450c626
sub edx, 0xc1465355
add edx, 0xf2d30c1
sub edx, 0x44781fc5
xor edx, 0x23845266
sub eax, edx
pop edx
jmp 0x5d067b
sub edi, 0xf6696339
sub edi, 0x5f5d8ead
sub edi, 0x471739a1
add edi, 0x5520b180
sub ebx, edi
pop edi
push edi
mov edi, 0xacebeae3
sub edi, 0xe72e184c
add edi, 0x43092aaa
sub edi, 0xe77baa03
add edi, 0xd8821c5
xor ebx, edi
pop edi
add edx, ebx
pop ebx
push edi
jmp 0x5ceade
mov edi, 0xeb93116e
add edi, 0x2f9dce2b
xor edi, 0x86473869
xor edi, 0x5d3c7982
push esi
mov esi, 0x3a3f61c5
xor esi, 0x8d7440a7
xor esi, 0xbfff788f
sub esi, 0xfa07679f
sub esi, 0x87dec718
add edi, esi
pop esi
push ecx
mov ecx, 0xf7a7cb59
sub ecx, 0xa820f91f
add ecx, 0x53d27b51
sub edi, ecx
jmp 0x5cebea
pop ecx
push eax
mov eax, 0x9d6f20a0
sub eax, 0x12d8e28e
xor eax, 0x5c8314ff
sub eax, 0x8fea0a3a
add eax, 0xeefe1ec6
add edi, eax
pop eax
push esi
mov esi, 0x57a6dd3f
xor esi, 0x853e6001
xor esi, 0xf30093ce
sub esi, 0x8f1f835
sub esi, 0x7e19a4f5
xor edi, esi
pop esi
xor edx, edi
pop edi
push edi
mov edi, 0x1aed087f
xor edi, 0xfd2f73e5
xor edi, 0x4cb66cc3
xor edi, 0xc77b347b
sub edi, 0x6c8f34c
push eax
mov eax, 0x59e0a762
xor eax, 0x6eab7b58
jmp 0x5cd9f5
mov esi, 0xa1180c15
xor esi, 0x88fba657
add esi, 0x226ff496
jmp 0x5cec7d
xor esi, 0xc1901e34
push eax
mov eax, 0x408f8867
add eax, 0x36a9c155
xor eax, 0x633c2bf0
xor eax, 0x4f17c339
add eax, 0x4d9dbc95
xor esi, eax
pop eax
push eax
mov eax, 0xc967e73f
add eax, 0xe970ba3c
sub eax, 0xc0aa76eb
xor eax, 0xecb40888
xor esi, eax
pop eax
push ebx
mov ebx, 0x4ccf4bbc
xor ebx, 0x2aecf596
xor ebx, 0x44252357
xor ebx, 0xa4b1085d
add ebx, 0x7c7e0785
add esi, ebx
pop ebx
jmp 0x5cece6
sub ecx, esi
pop esi
cmp word [esi], cx
pop ecx
jne 0x5d282a
mov eax, dword [0x61b464]
push edx
mov edx, 0xdc27edc3
xor edx, 0xa367c644
add edx, 0x858bc9af
push eax
mov eax, 0xe93b7df9
sub eax, 0xc4efb1c5
xor eax, 0x8dad7428
jmp 0x5cfd48
mov edx, 0xf6fe105a
sub edx, 0xfd06f475
xor edx, 0xa3fbc8a7
xor edx, 0xa7cdf508
sub edx, 0x58440dc4
push ebx
mov ebx, 0xe6da5c0d
add ebx, 0xa14f4d43
add ebx, 0xf26eb984
sub ebx, 0x5e44ca8
jmp 0x5ceea3
mov edi, 0x9f38ca32
sub edi, 0xc107fc2
sub edi, 0x72851388
sub edi, 0xd4b05fd9
sub edi, 0x9acae94f
sub ecx, edi
pop edi
push edx
mov edx, 0x836bdbc1
add edx, 0xb2a3c3f4
sub edx, 0x99caf010
add ecx, edx
jmp 0x5cfc64
xor ebx, 0x7bb68b8
sub edx, ebx
pop ebx
push esi
mov esi, 0x1b839724
sub esi, 0x1538fa4f
sub esi, 0xb2563510
add esi, 0xf0a5618f
add esi, 0x9e2775c9
sub edx, esi
pop esi
push ecx
mov ecx, 0xaca66dfd
sub ecx, 0x1ddf099c
add ecx, 0x62a9d80c
sub ecx, 0x241f4b91
jmp 0x5cf029
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, ecx
pop ecx
jmp 0x5cf299
sub ecx, 0x1ed9967b
add ecx, 0x7befbca4
xor edx, ecx
pop ecx
push edi
mov edi, 0x690d2985
xor edi, 0x4b85f705
xor edi, 0xded28335
sub edi, 0x36995bae
xor edx, edi
pop edi
push ebx
mov ebx, 0xa4a3eec5
sub ebx, 0x3e7acbf1
sub ebx, 0x51adcdf3
add ebx, 0xabb0be
push eax
mov eax, 0x6b1fcc41
xor eax, 0xe3c0438d
add eax, 0x5d676c07
xor eax, 0xb12616e3
add eax, 0x55aa6534
xor ebx, eax
jmp 0x5cf162
add ebx, 0xd669acbd
xor ebx, 0x96f40de3
sub ebx, 0xdc1ed710
sub edi, ebx
pop ebx
push ebx
mov ebx, 0xe1de5a79
sub ebx, 0xdbc5a815
xor ebx, 0xddf44303
sub edi, ebx
pop ebx
push ebx
mov ebx, 0x4b93fde9
xor ebx, 0xe229b30e
sub ebx, 0xb17a5878
add ebx, 0x60f84cd3
add ebx, 0x13eed032
add edi, ebx
pop ebx
lea edi, [edi]
mov dword [esp + edi], edx
pop edi
pop edx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push esi
mov esi, 0x9c9df9f5
sub esi, 0xa5716805
add esi, 0xf52289fa
xor esi, 0x6d056f0e
sub esi, 0xb4d13648
push edi
mov edi, 0xeee5fd2
add edi, 0x6973c034
xor edi, 0x1938013b
xor edi, 0x97418e83
add esi, edi
pop edi
push ecx
mov ecx, 0x5ae67cc6
sub ecx, 0x8812d5be
sub ecx, 0xc5651b5a
add ecx, 0x59c948a5
xor esi, ecx
pop ecx
push ecx
mov ecx, 0x26919d
add ecx, 0xe7dba06e
xor ecx, 0x125fdbc3
sub ecx, 0xb6a0be11
jmp 0x5ce677
pop eax
push edx
mov edx, 0xa7e180b7
add edx, 0x347725fd
xor edx, 0x654188dd
xor edx, 0xc6dc86d0
xor edx, 0x1980ed3f
xor ebx, edx
jmp 0x5cf28d
add edx, 0x4ae04fd6
xor edx, 0xd179d2ab
xor ecx, edx
pop edx
push edi
mov edi, 0x97de8213
sub edi, 0x350be717
jmp 0x5cdda1
pop edx
push edi
mov edi, 0xf38b5a0c
jmp 0x5cea96
push eax
mov eax, 0x6f7a9af7
xor eax, 0xa1df9cb7
add eax, 0x4f2c22a3
xor eax, 0x988cea97
xor edx, eax
pop eax
jmp 0x5d1d69
add ebx, edx
jmp 0x5cf426
pop edx
push eax
mov eax, 0xf9ca217b
add eax, 0x8e215bf
add eax, 0x66381543
push ecx
mov ecx, 0x8e44a8f8
xor ecx, 0x29cb7741
xor ecx, 0x4cbef51b
sub ecx, 0xae50ecd
jmp 0x5cf46e
xor ebx, edx
pop edx
push esi
mov esi, 0x60280571
xor esi, 0xec2240e2
add esi, 0x51e42bff
push edi
jmp 0x5d014a
jmp 0x5ce73f
add esi, ecx
pop ecx
xor ecx, esi
pop esi
push ebx
mov ebx, 0xc4407840
add ebx, 0x5752aed
add ebx, 0xf178e692
push esi
mov esi, 0x5bc8b3a4
add esi, 0x90f05f92
xor esi, 0x4815a7a7
add esi, 0xb5c79b59
jmp 0x5cf5f6
sub edx, 0xa9609ed5
xor edx, 0x6ec1ab01
sub edx, 0x3c86e2e2
add edx, 0x92da2863
push eax
mov eax, 0xea2fde0f
add eax, 0x86bc5224
xor eax, 0x6cee10ba
sub eax, 0x9cd71d49
add eax, 0xb8060d74
add edx, eax
pop eax
push eax
mov eax, 0x10cac0ee
jmp 0x5cff68
sub ebx, esi
pop esi
push eax
jmp 0x5cf613
push esi
mov esi, 0xc867bdb1
sub esi, 0x3c758e9d
add esi, 0x538c4da7
jmp 0x5d4b8d
mov eax, 0x4ca7c042
sub eax, 0xb86c4490
add eax, 0xd59de4d3
add eax, 0x593c4e9d
xor eax, 0xca1d7258
sub ebx, eax
pop eax
push eax
mov eax, 0x92eb3a1
sub eax, 0x1bb1ded4
sub eax, 0xb51babd5
add ebx, eax
pop eax
jmp 0x5d46c0
pop eax
push esi
mov esi, 0xeb0636b5
add esi, 0xe08af50
sub esi, 0x807aad8e
add esi, 0xc9fb535b
push eax
mov eax, 0x5834ec04
xor eax, 0x9adcfd6c
sub eax, 0x6b29384f
jmp 0x5cf82a
add edx, ecx
pop ecx
push ebx
mov ebx, 0x3c41cb6e
sub ebx, 0x6d60ada5
xor ebx, 0x1802474d
sub ebx, 0xc947158e
xor ebx, 0x68665f7d
sub edx, ebx
pop ebx
push ecx
mov ecx, 0xd527262e
add ecx, 0x95ff3d89
add ecx, 0x9c283727
jmp 0x5cf031
xor eax, 0x75c85560
xor eax, 0xda499d53
add esi, eax
pop eax
push eax
jmp 0x5cf90b
mov eax, 0x8f3c27c5
sub eax, 0x84f8e90c
sub eax, 0xfa3fb02c
xor eax, 0x9cad9686
add esi, eax
invalid
pop eax
xor ebx, esi
pop esi
mov eax, dword [eax + ebx]
pop ebx
cmp eax, 0x5bec64eb
push ebx
mov ebx, 0xfc1c67fa
sub ebx, 0x9e03641b
sub ebx, 0xf517fc7a
push ecx
mov ecx, 0x8c4fe8ee
add ecx, 0x770c7952
sub ecx, 0xa2ed5ac8
xor ecx, 0x857065f0
xor ecx, 0x90c3972a
xor ebx, ecx
pop ecx
push edi
mov edi, 0xd8aa52f2
sub edi, 0x8d429f46
xor edi, 0x4eeba53c
xor edi, 0x3787fc01
jmp 0x5cd79a
pop edx
push esi
mov esi, 0xa5a7e29b
sub esi, 0x67c8ff77
add esi, 0x8b8b3a7e
push edx
mov edx, 0x1a5f4af
add edx, 0xfb16a4d8
add edx, 0x7f73184d
xor esi, edx
pop edx
push edx
mov edx, 0xf26f63c3
xor edx, 0xb5c8d6f7
sub edx, 0x435b0c8f
xor edx, 0xe2c26996
sub edx, 0xbdb87774
add esi, edx
pop edx
push ebx
mov ebx, 0xca872365
xor ebx, 0xdd51d68d
sub ebx, 0x9545d0b1
add ebx, 0xa0436582
sub esi, ebx
pop ebx
sub ecx, esi
pop esi
push edi
mov edi, 0x1db2a181
add edi, 0x2047aa63
add edi, 0x568c756c
push edx
mov edx, 0x8453deb3
add edx, 0x6f30e74e
sub edx, 0x942aa194
sub edx, 0xd830c59a
jmp 0x5cde0e
sub eax, 0x11183eb
xor edx, eax
pop eax
push ebx
mov ebx, 0x59e73366
sub ebx, 0xb63e3726
xor ebx, 0x9a3ba2a5
add ebx, 0xa0f33483
sub edx, ebx
pop ebx
push edi
mov edi, 0xf12087d0
xor edi, 0x782a45ec
add edi, 0x2c3f24f8
sub edi, 0x47a9d123
sub edi, 0x65b87045
push edx
mov edx, 0xcc25c5a0
xor edx, 0x84611d5b
xor edx, 0x453ecd49
xor edi, edx
pop edx
push esi
mov esi, 0x324f7d0d
xor esi, 0x78881edf
sub esi, 0x3c2f52c4
add esi, 0x3813c7dc
add esi, 0x9a5b4892
sub edi, esi
pop esi
push ebx
mov ebx, 0x56d3ef7c
add ebx, 0x4cdd0e95
add ebx, 0xd6a03787
sub ebx, 0x8bb97760
xor ebx, 0x34305e8a
sub edi, ebx
pop ebx
push ebx
mov ebx, 0x34e9ec52
add ebx, 0x86f38d6d
add ebx, 0x8127b090
sub edi, ebx
pop ebx
xor edx, edi
jmp 0x5cff66
jmp 0x5cffa3
sub eax, 0x614b5d3c
sub eax, 0x83d4fec4
xor edx, eax
pop eax
push ebx
mov ebx, 0x64cb3332
add ebx, 0x980db802
xor ebx, 0x19ca4044
sub edx, ebx
pop ebx
push ecx
mov ecx, 0x8f0fdc72
sub ecx, 0x78dbe48e
sub ecx, 0x19abb6d8
jmp 0x5d429d
pop edi
push ebx
mov ebx, 0xfa20d6d0
add ebx, 0x81d74616
jmp 0x5d0a31
xor ebx, edx
pop edx
push ecx
mov ecx, 0xc5862266
xor ecx, 0x9a21fc0e
add ecx, 0xd7de8f2a
add ecx, 0x89ff6372
xor ecx, 0xcc683b33
sub ebx, ecx
pop ecx
sub eax, ebx
pop ebx
jmp 0x5d0095
push esi
mov esi, 0x9de72492
sub esi, 0x3412e044
xor esi, 0x688957de
push edx
mov edx, 0x6ec3a73f
add edx, 0x7826448
sub edx, 0x796e56ac
xor esi, edx
pop edx
push edi
jmp 0x5d00fa
pop esi
push esi
mov esi, 0x4c5c80bb
pop esp
dec esp
xor esi, 0xe439ca6a
sub esi, 0x6eb521cc
sub esi, 0xbf751a83
xor esi, 0x4567a969
sub ebx, esi
pop esi
push esi
mov esi, 0xd87b21f4
add esi, 0x99bdc6d0
xor esi, 0x65bd1d60
add ebx, esi
jmp 0x5d485b
mov edi, 0x7ceac016
sub edi, 0x49b343b9
add edi, 0xf14a89dc
add esi, edi
pop edi
push edi
mov edi, 0xa721e011
add edi, 0x13c17dad
jmp 0x5d0339
push edx
mov edx, 0x4118cfd9
add edx, 0x38f12104
sub edx, 0xd1be3287
sub ecx, edx
pop edx
sub edi, ecx
pop ecx
mov eax, dword [edi + ebp]
pop edi
push eax
push ecx
mov ecx, 0xba6e6f8
sub ecx, 0xa926df52
jmp 0x5d0170
mov edi, 0x4316e767
xor edi, 0x3d0dcf0
sub edi, 0xcf61946a
xor edi, 0xbbe6f130
add edi, 0xa5036cd2
sub esi, edi
pop edi
push edi
jmp 0x5d2165
sub ecx, 0x40aa7fc
add ecx, 0x1225f194
int1
and eax, 0x4bbf5712
xor byte [ecx + 0x2f7814f], bl
cli
mov edi, 0x90ef81ce
and al, 0x98
loop 0x5d0110
out dx, eax
sbb al, 0x21
add eax, 0x82c78113
jmp 0x5d01b7
in eax, dx
sub ecx, edi
pop edi
push edi
mov edi, 0xeeac002f
add edi, 0x6312deee
jmp 0x5d031e
add edi, 0x1e22730
add edi, 0xedb8e6fa
sub edi, 0x88764542
add ecx, edi
pop edi
push edi
jmp 0x5cee6a
add edi, 0xe4573988
xor esi, edi
pop edi
add eax, esi
pop esi
add esi, eax
jmp 0x5d0350
pop eax
push ecx
mov ecx, 0x400f071a
sub ecx, 0xb5da1eed
sub ecx, 0x5bdf93c5
add ecx, 0xd4334e72
push edx
mov edx, 0xff63568d
xor edx, 0xbbb5d3a
xor edx, 0x6a6317b7
xor edx, 0xdfb0a6c3
jmp 0x5d2ece
sub ecx, 0x7c6aee1c
add ecx, 0x86fcdb72
sub ecx, 0x5f0e737f
add ecx, 0xc76d2b6c
push ebx
mov ebx, 0x59981815
add ebx, 0xf19704a8
add ebx, 0x3ab3696
add ebx, 0x12a831a9
add ebx, 0xed0cbd1
xor ecx, ebx
pop ebx
push esi
mov esi, 0xfb1fae5b
add esi, 0x8d744cbf
xor esi, 0xdf94c487
xor esi, 0xe8403e11
add esi, 0xcfab87c7
add ecx, esi
pop esi
jmp 0x5d011f
sub edi, eax
pop eax
push edx
mov edx, 0x4c01a201
sub edx, 0xae28e6b0
sub edx, 0x3f15453d
push esi
mov esi, 0xfd2024ee
xor esi, 0x1ab5ce5b
jmp 0x5d313e
push edx
jmp 0x5cee33
xor ebx, 0x15b038fa
push esi
mov esi, 0x9ee08142
add esi, 0xd173291d
sub esi, 0xc83b9a1f
sub esi, 0xfbf5dcea
add esi, 0x7a1f0e07
add ebx, esi
jmp 0x5d00bf
add ecx, 0x33b6c46c
sub eax, ecx
pop ecx
jmp 0x5d0cb6
push edi
mov edi, 0xb663f299
sub edi, 0x96bd5491
sub edi, 0xd442e81e
add edi, 0xcb0c4ccf
add edi, 0x3867a53
push ebx
mov ebx, 0x7e88e150
add ebx, 0x2fe5e9f
sub ebx, 0x110c2f42
add ebx, 0x1f2baba4
add ebx, 0x505c2969
add edi, ebx
pop ebx
jmp 0x5d0c4c
push ecx
mov ecx, 0x725a5bdd
add ecx, 0xca2571b1
sub ecx, 0xe4b63922
xor edi, ecx
jmp 0x5d1051
sub esi, eax
pop eax
push ecx
mov ecx, 0xa94aafd9
xor ecx, 0xde8129e2
xor ecx, 0x5e53fddc
xor ecx, 0x622daa2b
push edx
mov edx, 0x6118589d
add edx, 0x7f300c13
sub edx, 0xc8056576
jmp 0x5d0cff
add edx, 0x2af12f9
sub ecx, edx
pop edx
push esi
mov esi, 0x8359a9dc
add esi, 0x7ce50fe7
add esi, 0x971911e
xor esi, 0xce256be0
jmp 0x5d0db5
sub edx, 0xbff64386
sub edx, 0x8bc1601c
xor edx, 0x24f3a571
xor edx, 0xd33edbb9
push ebx
mov ebx, 0x50a77723
sub ebx, 0x7f152361
add ebx, 0x628409a9
add edx, ebx
pop ebx
push esi
mov esi, 0x5098a49
xor esi, 0x5a0a1313
sub esi, 0x35bcc16
add edx, esi
pop esi
push ecx
mov ecx, 0x4f762901
add ecx, 0xb3ff8617
add ecx, 0xc0b04fe
add ecx, 0x49b82e71
add ecx, 0x945a4b05
sub edx, ecx
pop ecx
push edi
mov edi, 0xf0c148c6
add edi, 0xfbd38448
sub edi, 0x9b3b193d
add edi, 0xe95a808e
sub edx, edi
pop edi
add esi, edx
pop edx
cmp eax, esi
pop esi
je 0x5d32ae
push esi
jmp 0x5ce8c7
xor ecx, esi
pop esi
push eax
mov eax, 0x9c414bdc
xor eax, 0x4411cbad
xor eax, 0x1a7a4db8
xor ecx, eax
pop eax
push esi
mov esi, 0x4b3ddf0a
add esi, 0x50895ed0
xor esi, 0x98d64987
add ecx, esi
pop esi
sub esi, ecx
pop ecx
mov dword [esi + ebp], eax
pop esi
push ecx
mov ecx, 0xb5e11ac0
sub ecx, 0x30542b7b
jmp 0x5ce5b9
add esi, 0xb3f5bff9
add edi, esi
pop esi
xor edx, edi
pop edi
push ecx
mov ecx, 0xf9e6f1f0
xor ecx, 0x9aa9afd6
add ecx, 0x6000715
jmp 0x5d1794
pop esi
push edx
mov edx, 0xfd36b90e
add edx, 0xfca1300
xor edx, 0xf92a538e
add edx, 0x74ef193b
xor ebx, edx
pop edx
push esi
mov esi, 0xa6f56684
xor esi, 0xef27b50
xor esi, 0xdf1d4351
sub esi, 0x28434951
sub ebx, esi
pop esi
push eax
mov eax, 0x9ea7e419
add eax, 0x975a8816
sub eax, 0xf096c697
xor eax, 0xad66d8a0
sub ebx, eax
pop eax
sub ecx, ebx
pop ebx
mov eax, dword [ecx + ebp]
pop ecx
test eax, eax
jmp 0x5ce80e
pop ecx
push edx
mov edx, 0xa9866752
add edx, 0xd4178751
sub edx, 0xd6ccee03
add edx, 0xb69eba58
sub edi, edx
pop edx
push edx
mov edx, 0xa7face52
xor edx, 0x4b01f4be
sub edx, 0x3c2165d1
sub edx, 0x18a317a2
xor edx, 0x5fed7caf
push edi
mov edi, 0x5a4fd40a
xor edi, 0x7bf05fec
sub edi, 0x341c2185
sub edi, 0x29c44968
add edx, edi
pop edi
push eax
mov eax, 0x3ed6e9e6
sub eax, 0x6fd855df
add eax, 0x5b5ad0c9
xor edx, eax
pop eax
push ebx
mov ebx, 0x1175960e
sub ebx, 0xf01ac834
jmp 0x5d1128
push edi
mov edi, 0x7d6afce3
add edi, 0xc4282c95
add edi, 0x103f8882
xor ebx, edi
pop edi
push esi
mov esi, 0x562e4cb1
sub esi, 0x9751e5e6
xor esi, 0x8949af7c
add esi, 0xa9405191
xor ebx, esi
pop esi
push ecx
mov ecx, 0x20b1f830
add ecx, 0x5107bcb1
sub ecx, 0x54447760
sub ecx, 0x391d54a
xor ecx, 0xfd83b188
add ebx, ecx
pop ecx
add ecx, ebx
pop ebx
push edx
mov edx, 0x1470e750
jmp 0x5cf5b2
sub ebx, 0x757c73be
sub ebx, 0x7092041d
jmp 0x5d1147
add edx, ebx
pop ebx
push ebx
mov ebx, 0x73fd74ee
sub ebx, 0x876aedd6
jmp 0x5ce971
add ecx, 0x3cc4e175
sub ecx, 0x3c36d9f9
add ecx, 0xdd21f985
xor ecx, 0xc9dfc897
add eax, ecx
pop ecx
push edx
mov edx, 0xe86d60ea
add edx, 0xc869ad7f
add edx, 0x75dc5b31
xor edx, 0x3df74a0e
xor edx, 0xab87b6a6
add eax, edx
pop edx
push edx
mov edx, 0x4d8bd7de
add edx, 0xead9bbe6
sub edx, 0x47f2e33e
sub edx, 0xa57c739a
add edx, 0xe174fd0a
sub eax, edx
pop edx
push ebx
mov ebx, 0x3ec53f4f
sub ebx, 0x8ea0379d
sub ebx, 0x10ccac36
xor ebx, 0x26485668
push edx
mov edx, 0x574f846f
sub edx, 0x451e0e8
xor edx, 0x87377749
add edx, 0xff3ddaea
add edx, 0xba34c921
add ebx, edx
pop edx
push eax
mov eax, 0xe25f93f0
sub eax, 0x159df691
add eax, 0x80e9d7a8
sub eax, 0x9bdef3ad
sub eax, 0x717257fa
jmp 0x5d15cf
push ebp
push edx
mov edx, 0x6d50fd02
add edx, 0x27887c75
add edx, 0xc9b401d1
xor edx, 0xabec3ec3
push ecx
mov ecx, 0x83622ff5
xor ecx, 0x76ba3847
sub ecx, 0x3c46a09b
sub ecx, 0x63a5298
sub ecx, 0x3d9ff880
jmp 0x5cf754
sub ebx, eax
pop eax
push ecx
mov ecx, 0xf88e206d
xor ecx, 0x1677e476
xor ecx, 0xefe948fa
sub ecx, 0xf334b2f6
add ecx, 0xa6567b88
xor ebx, ecx
pop ecx
add eax, ebx
pop ebx
push ebx
jmp 0x5d3e4a
push edx
mov edx, 0x1ef46697
sub edx, 0x168ca38d
sub edx, 0xad978d67
sub edx, 0x72a555f6
sub edx, 0x7ef75420
add eax, edx
pop edx
push ecx
mov ecx, 0x641adef1
jmp 0x5d4489
push eax
mov eax, 0x4523360a
sub eax, 0x6998ad72
xor eax, 0xb68daab6
sub eax, 0x6595efff
push esi
mov esi, 0xa455fe29
add esi, 0xe2c2ce44
sub esi, 0x892390cc
add esi, 0xbbc8d519
jmp 0x5d199b
xor eax, esi
pop esi
push ecx
mov ecx, 0xe4701aff
xor ecx, 0xac42167
jmp 0x5d1a25
add ecx, 0x7770cc9e
add ecx, 0x5f63145b
jmp 0x5d0b16
pop ecx
push eax
mov eax, 0xc110f8fd
add eax, 0xf7d0383f
sub eax, 0xb474cf86
add edi, eax
pop eax
push eax
mov eax, 0xf11aef0f
sub eax, 0x194fd2d0
add eax, 0x5c3e2c65
sub edi, eax
pop eax
sub ecx, edi
pop edi
push ebx
mov ebx, 0x2083fe3e
sub ebx, 0x7e427023
add ebx, 0x9961b965
push edi
mov edi, 0xf052e6d3
xor edi, 0xcf38e552
xor edi, 0xd0d25547
xor edi, 0xed77bca3
add ebx, edi
pop edi
push esi
mov esi, 0xc2661b8
add esi, 0x7ae8cfc3
xor esi, 0xe742d5ab
add esi, 0xe22b46df
xor ebx, esi
pop esi
sub ecx, ebx
pop ebx
push ebx
mov ebx, 0xc96f2ff5
add ebx, 0x3cfa3e84
sub ebx, 0x585cf997
add ebx, 0xfc0e70d5
sub ebx, 0x7087e812
jmp 0x5d10c9
xor ecx, esi
pop esi
push edi
mov edi, 0xb36c9391
xor edi, 0x7055243c
sub edi, 0xd705e1c5
sub ecx, edi
pop edi
push edi
mov edi, 0x4c517b85
add edi, 0xaface0c
sub edi, 0x6b93cd4a
jmp 0x5d3f61
sub edi, edx
pop edx
push ecx
mov ecx, 0x93ab1927
jmp 0x5d05df
pop edx
push edx
mov edx, 0x8d0a2db2
xor edx, 0xbbd44554
add edx, 0xc32a5c2d
push ebx
jmp 0x5d1f07
sub edi, edx
pop edx
push edx
mov edx, 0x5532118
sub edx, 0xa608e10a
add edx, 0x7144dd81
push eax
mov eax, 0x35a71b28
xor eax, 0xce262670
sub eax, 0x3a020a2
sub edx, eax
pop eax
push edi
mov edi, 0x93e71350
add edi, 0x89e507d8
xor edi, 0x75fae5fc
add edx, edi
pop edi
add edi, edx
pop edx
push ecx
mov ecx, 0xfc9ad04c
sub ecx, 0x6735c3e8
add ecx, 0xb4c23c0
xor ecx, 0x3abe9c3c
push ebx
mov ebx, 0xa71bf445
add ebx, 0xf729101d
jmp 0x5ce48b
mov ebx, 0xf68f83bf
jmp 0x5ce430
mov edi, 0xf3cad90b
xor edi, 0x4ef9dfe9
add edi, 0xaded69de
sub edi, 0x647475e
xor edi, 0xae6554bc
add esi, edi
pop edi
push ecx
mov ecx, 0xc2861733
pop ss
xchg dl, al
add ecx, 0x282784f8
add ecx, 0x191dc8cd
add esi, ecx
pop ecx
sub ebx, esi
pop esi
push ecx
mov ecx, 0x33f6837d
add ecx, 0x2aab8975
sub ecx, 0xc453261b
push ebx
mov ebx, 0xc14f08ca
sub ebx, 0xe957cedf
add ebx, 0x29a3c830
xor ecx, ebx
pop ebx
push esi
mov esi, 0x51c0b49b
sub esi, 0x4e6400ae
jmp 0x5d370a
add esi, 0x1a9ceba5
sub esi, 0x15f28373
push eax
mov eax, 0xffe7294d
add eax, 0x64ac1827
add eax, 0xfc27958
sub eax, 0xdcf7487f
xor esi, eax
pop eax
push ebx
mov ebx, 0x8ea4d7df
xor ebx, 0x4e3fcd6f
xor ebx, 0x282778a
xor ebx, 0xdc435f07
jmp 0x5ce05f
add edi, 0x5eb842ca
sub edi, 0x8a666ad9
xor edi, 0x8cbcc8fb
sub edx, edi
pop edi
push ecx
mov ecx, 0x8c666ecc
sub ecx, 0x3638dc
cmp byte [esi], dh
add byte [ecx - 0x1d554a17], al
insd dword es:[edi], dx
xor edx, ecx
pop ecx
xor ecx, edx
jmp 0x5d1e86
mov eax, dword [0x61b350]
test eax, eax
je 0x5ce7cd
jmp 0x5d1593
pop edi
push esi
mov esi, 0x3e204b11
sub esi, 0x1b9ca373
xor esi, 0x4c1bbed0
push ebx
mov ebx, 0xafb72dde
add ebx, 0x335739e9
sub ebx, 0x3529ff79
xor esi, ebx
pop ebx
push ecx
mov ecx, 0xfdd75c48
xor ecx, 0x27d72e33
xor ecx, 0xf56b163
add ecx, 0x25e31b68
sub esi, ecx
pop ecx
push edx
mov edx, 0x6b55eb7d
jmp 0x5d2a82
sub ebx, eax
jmp 0x5d3706
sub edx, 0xfc9f2770
xor edx, 0x5700277c
xor esi, edx
pop edx
push ebx
mov ebx, 0x4958fcf8
jmp 0x5d2aa4
xor ebx, 0xf3cf1623
add ebx, 0xb1fd69d4
xor esi, ebx
pop ebx
add ebx, esi
pop esi
push esi
jmp 0x5d2c05
add edi, esi
pop esi
push esi
mov esi, 0x2895bd9e
add esi, 0xd5e8e377
jmp 0x5cdea2
mov esi, 0xd6744637
add esi, 0x87b16011
add esi, 0xedde4875
add esi, 0xef806fd5
push edx
mov edx, 0x77cf7d11
xor edx, 0xeb0d7aa6
sub edx, 0x5f15f719
add esi, edx
jmp 0x5d2c9b
pop edx
push edi
mov edi, 0xe55f1fe7
add edi, 0xd85378a3
add edi, 0x26d430bd
add edi, 0x3ee89bd3
sub edi, 0x4e24a35d
add esi, edi
pop edi
push eax
mov eax, 0x91d56133
xor eax, 0xb7c0d8ae
add eax, 0xaffacd28
xor eax, 0xbd60301a
xor esi, eax
pop eax
push ebx
mov ebx, 0xa2cb05d4
sub ebx, 0xb0e703a
xor ebx, 0x69cec89d
sub esi, ebx
pop ebx
add ebx, esi
pop esi
jmp 0x5d2d8e
push edx
mov edx, 0xb575e0cf
sub edx, 0xcbde4cf2
sub edx, 0x25e3cd09
xor edx, 0xc87fce22
push esi
mov esi, 0xa11d3989
add esi, 0x63b66af6
jmp 0x5d2e16
add esi, 0x8c4d83fe
jmp 0x5cdb65
add ecx, edx
pop edx
push edx
mov edx, 0x2240a2ed
sub edx, 0xc5c44a27
add edx, 0x608ccd26
xor edx, 0x21a2206d
xor edx, 0x7c5915ed
jmp 0x5d48cc
pop esi
push esi
mov esi, 0x758239e9
sub esi, 0x65830e37
sub esi, 0x6a41744b
sub edi, esi
pop esi
add ecx, edi
pop edi
mov eax, dword [ecx + ebp]
pop ecx
call eax
add esp, 4
push esi
mov esi, 0x8a655f4
jmp 0x5d33df
add esi, 0x250cfd1a
add esi, 0xdd832da
sub edx, esi
pop esi
push esi
mov esi, 0x4daf61f2
add esi, 0xf6b56575
sub esi, 0x16db08bf
sub edx, esi
pop esi
push ecx
mov ecx, 0x9db6726b
add ecx, 0x489ce4b0
sub ecx, 0x4f729ba7
xor ecx, 0x33597f7b
jmp 0x5d338d
mov eax, 0x526017a
sub eax, 0x568e1f17
sub eax, 0x8a8edeef
push edi
mov edi, 0x78c6b7f0
add edi, 0xa9146fa9
xor edi, 0xbd3fc89c
xor edi, 0xf482bb37
sub edi, 0x25bd0a44
add eax, edi
pop edi
push esi
mov esi, 0x4bf39360
sub esi, 0xcd553d85
xor esi, 0xdc4f862c
add esi, 0xcc573371
sub esi, 0x2f2f4fd8
sub eax, esi
pop esi
push edx
mov edx, 0x3399d272
add edx, 0x205bc6c4
add edx, 0x36adca5c
xor edx, 0x4a04ba32
sub eax, edx
pop edx
push ecx
mov ecx, 0xd1a70bfe
add ecx, 0x7a4e909c
add ecx, 0x7f81179a
xor ecx, 0x7e291cf9
push esi
mov esi, 0xff4361cc
add esi, 0xc1534410
xor esi, 0xfc433d5b
add esi, 0x6014a375
xor ecx, esi
pop esi
push eax
mov eax, 0x56a42034
add eax, 0xe7ab43bc
sub eax, 0xd3ac8aff
mov ch, byte [ebx + edx*8 - 0x66910f7f]
mov byte [esi + 0x5058c129], bh
mov eax, 0x9bab0092
xor eax, 0xb5942e7d
mov ch, 0x81
sar ch, 0xa8
add dword [edx - 0x7f], ebx
lock xor dword [edx - 0x75], eax
jnp 0x5d3304
sar byte [ebx], 0xd9
or bh, byte [0xa15e9]
invalid
add ecx, 0x89cc8385
add edx, ecx
pop ecx
push edi
mov edi, 0xc7e6282f
add edi, 0x4f43f615
xor edi, 0xce49308d
add edi, 0xbb363c5a
add edi, 0x5e4acfba
xor edx, edi
pop edi
jmp 0x5d1e9c
sub esi, 0x8c87f427
sub esi, 0x55875eb3
push ebx
mov ebx, 0xb8932d79
jmp 0x5cdd30
push ebx
mov ebx, 0x6282c66c
sub ebx, 0xa22cca6f
xor ebx, 0x433b264d
add eax, ebx
pop ebx
sub ebx, eax
jmp 0x5cf688
xor eax, 0xe5d7c51e
sub eax, 0xa1a36d2
xor eax, 0x881678ae
add edx, eax
pop eax
push edi
mov edi, 0x8ec743df
xor edi, 0x47412875
sub edi, 0x210cc60c
sub edi, 0x59f90bdf
sub edx, edi
pop edi
xor ecx, edx
pop edx
push edx
mov edx, 0xf4acee97
add edx, 0xba8341f6
sub edx, 0xbdc86478
sub edx, 0x76e2db5d
xor edx, 0xbf629b89
push esi
mov esi, 0x99b19cfa
add esi, 0x6fe72859
xor esi, 0xb035ff40
xor edx, esi
jmp fcn.005d36ee
pop esi
push eax
mov eax, 0x8dbb2f71
xor eax, 0x432b29af
add eax, 0xdd88ca9
jmp 0x5d37a4
pop eax
push edx
jmp 0x5d371f
add esi, 0xd8f6f4a
add esi, 0x4d14ed18
xor ecx, esi
pop esi
push eax
jmp 0x5d49aa
mov edx, 0x19a1c81a
xor edx, 0x57b46c16
xor edx, 0x33541c5b
add ebx, edx
pop edx
push edx
mov edx, 0x21928d73
add edx, 0xc71b4c74
add edx, 0xcf38bb16
add edx, 0x1d100a8
push esi
mov esi, 0x896b22b
xor esi, 0x3070f39e
xor esi, 0x37441846
sub esi, 0x43154d95
xor esi, 0xcc406c9c
add edx, esi
pop esi
push esi
mov esi, 0x7b10d7c6
add esi, 0x64613896
xor esi, 0xe4b915b5