Function at 0x100177f0
Capabilities:
Copy file
Delete file
Encode data using base64
Encode data using xor
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10170c30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, 0x104
push esi
xor edi, edi
lea eax, [ebp - 0x108]
push edi
push eax
pushfd
test byte [0x100177f0], 0xa2
jne 0x100177f1
dec ecx
mov dh, 5
xor edx, dword [edi]
or dword [ebx + 0x254c6adf], ebx
cmp al, 0x40
jae 0xfdc80f72
imul ecx, dword [edi + 0x467428e3], 0xdcfefdc0
xor al, 0x43
lodsb al, byte ds:[esi]
sub dword [ecx - 0x2f183760], ecx
ror ebx, 0x4f
mov esi, dword [edi + 0x6187e858]
pop ss
fsub st(4), st(0)
pop esp
dec esi
and ah, byte [esi + 0x68]
dec ebp
test al, 0x6d
adc edx, dword [eax]
or eax, 0x222e7156
enter 0xffffffffffffd0e7, 0xffffffffffffffc1
retf
adc byte [0x222e7156], cl
xor dh, byte [esi + 0x56]
scasd eax, dword es:[edi]
imul ebx, dword [ebp + ebp*8 + 0x162e9b1e], 0xffffffe6
aas
cmp bh, ah
neg dword [edi + esi]
sahf
push 0x4429113e
and byte [ebx], bh
push edx
sub dword [ebx + 0x15a91453], ecx
mov dword [0x3c65dc7a], eax
loop 0x10017788
cmp al, 0xe2
mov ecx, 0x12bc34f6
sti
div byte [esp + edi*4]
adc ch, byte [esi]
sti
out dx, eax
inc ecx
lds ebp, [ebx]
pop eax
inc esi
or al, 0xef
sbb al, 0xf8
cwde
dec eax
mov dh, 0xa
mov esp, 0x38bf83ba
sub eax, esi
push edx
jle 0x100177a0
adc edx, dword [ecx]
dec esp
push edx
popfd
call fcn.1011df60
pushfd
test byte [0x10017828], 0x30
jne 0x10017929
jbe 0x1001784b
or dword [eax], 0xffffff9e
mov ebp, 0xe8b797a5
mov ah, 0x46
ror dword [ecx], 1
pop edi
inc ebx
pop edx
dec eax
lodsb al, byte [esi]
jo 0x100177cc
arpl word [eax - 9], si
cmp esi, dword [eax - 0x2fc3767a]
loop 0x100177f0
call [edx]
push edi
sbb eax, 0x7b031b10
imul eax, edi, 0x646e8837
aas
pop ebp
not dword [ebp + 0x2e]
push ss
test al, 0x90
adc esi, dword [ebx + 0x63ee1718]
mov al, byte [0xd8562da3]
cli
mov esi, 0xa519c16d
fmul qword [esi - 0x3c]
cmp eax, 0xd03ef015
dec ebp
sbb dword [ebp + 0x3dc44edc], esp
adc eax, 0x4dd03ef0
sub dl, byte [ebx]
xchg ecx, eax
nop
test dword [eax - 0x15], edi
dec edi
aad 0x56
stosd dword es:[edi], eax
mov esp, esi
inc eax
sti
xchg byte [ecx], ah
mov bl, 0xe7
push esp
jns 0x100178ec
or al, 0x1b
sbb byte [eax], cl
sbb ebx, dword [eax]
or al, 0x60
pop ecx
call 0x2dd9e975
or cl, byte [eax + esi*2]
adc esi, dword [edi]
mov al, 0x11
call [edi + edx*4 - 0x388661bc]
ja 0x100178a7
push ebp
mov dword [ecx - 0x6d000ee9], edx
mov cl, 0x5b
push 0x6612bd9b
pushal
inc esi
test byte [edi - 0x37], ch
mov ecx, 0xc9fcc356
fstp xword [ebp + 0x7b]
outsd dx, dword [esi]
lodsb al, byte [esi]
test eax, 0xde6c2782
popal
je 0x10017910
push esi
ret
daa
insb byte es:[edi], dx
fisub word [ecx + 0x74]
arpl word [eax], si
pop ecx
inc esp
xor byte [ecx + 0x44], bl
cli
ror byte [eax + 0x5a], 1
inc ebx
cli
xchg ebp, eax
push esi
leave
cmp al, 0xdd
push esi
and byte [edi + 0xe], ah
push cs
mov ch, byte [ebp + edx*2 - 0x3a]
cwde
dec esp
adc ecx, dword [edi + esi*8]
push ds
jecxz 0x1001786e
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
xchg esi, eax
pop ds
dec ebx
mov dword [0xcb056799], eax
lodsb al, byte [esi]
xor dh, byte [edx]
daa
arpl word [eax - 0x750ee032], dx
mov eax, dword [0x8cba1cb]
mov eax, dword [0xeee98d6d]
pop ecx
jl 0x100178bd
push esp
sub dword [ebx], edx
mov ebp, 0x28ae52bc
sbb eax, 0x620892d
add byte [esi], cl
add dl, byte [eax - 7]
mov edi, 0x32546e98
imul ebp, dword [esi + 0x53a6bb2b], 0x6832c1c
jns 0x1001789c
test al, 0xc2
jno 0x1001796c
ret 0x5971
popfd
and al, 0x3d
sub byte [ecx], cl
mov bl, 0xd8
call 0x63702e31
lodsd eax, dword [esi]
push ebx
ffreep st(1)
pop ss
aad 0x6e
pop ebx
xchg esi, eax
inc edx
popfd
push esi
lea eax, [ebp - 0x20c]
pushfd
test byte [0x10017a22], 0x31
jne 0x10017a23
mov ebp, dword [esi - 0x64]
sbb eax, 0x461244c9
aam 0x77
sub eax, 0xaf7efb19
mov dword [esp + edi*4], esp
bound eax, qword [ecx + 0x64]
in al, 0x89
inc byte [ebp + 0x185cf086]
div byte [0xbc2dabc9]
call [edx + 0x726916e7]
sub byte [ebx], 0xb9
jnp 0x1001791a
lodsd eax, dword [esi]
xchg edi, eax
cmp dl, byte [ebp + 0xb]
ja 0x1001797b
add al, 0x83
jle 0x100179f6
xchg edx, eax
rcr byte [ebx], 0xd8
mov al, byte [0xc6f8430e]
mov bl, 0xd6
dec edx
test eax, 0x17725e8d
and eax, 0x85bbc099
or dword [edx + 0x6c], eax
pop ebp
cmp dl, ch
mov ecx, dword [eax + 0x1a]
or dl, byte [esi + 0x4064a615]
popal
and edx, dword [edx + 0x4f6d6b26]
push cs
and dl, byte [ebx + 0x10]
fcmove st(0), st(3)
adc eax, 0x360244f0
mov edx, 0x48ae0d55
xchg esp, eax
xchg esi, eax
push esi
nop
sub ebx, dword [ebp + 0x37]
or al, 0xbb
or eax, 0xfd47cf42
cmp dword [edi - 0x78433d82], esi
pushal
dec edi
or ecx, dword [ecx]
ficomp dword [edi + eax*2 + 0x18401d2c]
salc
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
pop ds
jbe 0x1001796b
aam 0xd
mov cl, 0x58
mov ebx, 0xb3537892
ror byte [eax - 0x40], cl
pop ds
pop edx
push 0xffffffffffffffa3
dec ebp
js 0x10017a56
and al, 0xfd
pop ds
cwde
and byte [edx - 0x6a2d72b5], 0xa8
pop es
call 0x4827bc
sub byte [edx - 0x4b], cl
inc esi
lock sub byte [edx - 0x4b], cl
in al, dx
push es
pop esi
out dx, eax
jne 0x10017a08
sub dword [edi + 0x72], ebp
xchg esi, eax
aam 0xaf
aam 0x54
in al, 0xfa
push ebx
sbb eax, 0xda451a39
mov edi, 0xae1b41b1
inc esp
jb 0x100179fa
mov eax, dword [0xd5b9ea42]
cwde
popfd
push edi
push eax
pushfd
test byte [0x10017a45], 0x6f
jne 0x10017b46
clc
sbb eax, 0x1beb3e01
jecxz 0x10017a84
fidiv dword [eax]
pushal
enter 0xffffffffffffd1a4, 0x72
pop edi
arpl word [esi], bx
js 0x10017a1d
int1
mov eax, dword [0xd1dcacb5]
jnp 0x10017a7f
outsb dx, byte [esi]
xlatb
jge 0x10017a7b
sbb al, 0x7e
pushal
arpl word [esi + ebp*8 + 0x526ec3ce], bp
dec ebp
and dword [ecx], ecx
sbb dword [ebx - 0x2a], esi
push es
jae 0x10017a88
std
sbb dword [edi - 0x37], ecx
add cl, byte [ebx*8 - 0x28e954a3]
dec ebp
aaa
push esi
je 0x10017aa1
cmc
fisub dword [esi + 0x7f]
jmp [edi + 0x7d63add2]
arpl word [ebp - 0x21], di
or eax, 0x154d30a0
xor byte [ebp + 0x15], cl
jecxz 0x10017a65
fadd qword [esi - 0x4f]
sti
inc esi
mov cl, 0xfb
call 0xf7b5dc70
mov ah, 0xe7
push edi
cmp eax, 0xeb1d0a7
in al, 0xd8
add eax, 0x4dae643c
inc edi
movsd dword es:[edi], dword [esi]
in al, 0x17
pop ss
jle 0x10017b11
sbb bl, cl
loop 0x10017af0
xchg esp, eax
adc al, 0x69
cmp dword [edi + 0x171ff2b9], 0x58
adc eax, 0x3fa76354
sub eax, 0x4cb2f486
mov esi, 0x214884f6
and dl, dh
salc
test ebx, ecx
xor eax, dword [ebx]
fidiv word [ecx + 0x76]
inc ebx
pop esi
pushal
call dword [edx + 0x6b]
xor al, byte [ebx]
int 0xab
fistp word [ecx + 0x6fa042c3]
mov gs, word [edx + ecx*4]
mov al, byte [0x8a2c8e6f]
mov bh, 9
push esi
xlatb
jge 0x10017b0f
push ecx
ja 0x10017b1a
in eax, dx
jge 0x10017b32
ja 0x10017ad8
add eax, 0x2d0ab78d
fisubr word [ecx - 0x4a16ecf6]
insd dword es:[edi], dx
add esp, edi
mov eax, dword [0xaff762c3]
js 0x10017a8f
sahf
mov ebp, 0x9c9c854
jl 0x10017ac2
mov ecx, 0x6efee04f
xchg ebx, eax
dec ebx
movsb byte es:[edi], byte [esi]
sub byte [edx + 0x14], bh
jp 0x10017b27
imul esp, dword [esi], 0xcd505541
mov ecx, dword [esi]
push cs
push eax
or ecx, ebx
xchg byte [ecx], bl
add dword [ecx], ecx
cmp eax, 0x9e0c1463
or al, 0x9e
lodsb al, byte [esi]
salc
je 0x10017b29
cmp ah, ah
sar dword [edi - 0x4c], cl
out 0xf2, eax
add dword [edx], ebx
add dword [edx], ebx
sahf
aam 0x96
inc esp
mov eax, dword [0xc9261692]
mov ds, word [eax + 0xe]
or eax, 0x7803f91f
popfd
call fcn.1011df60
add esp, 0x18
push 0x103
pushfd
test byte [0x10017b80], 0xe8
jne 0x10017b81
outsb dx, byte [esi]
mov dl, cl
cmp byte [edx], bl
pop eax
jo 0x10017b71
loopne 0x10017ba2
xchg esi, eax
fucom st(3)
cmpsd dword [esi], dword es:[edi]
jbe 0x10017b25
in al, dx
mov word [edi + 0x74], es
sub eax, ecx
dec esi
lodsd eax, dword [esi]
out dx, al
je 0x10017b9e
ror dword [esi - 0x53], 0xee
mov esp, 0x9f3a8629
imul ecx, dword [eax], 0xfffffff4
xchg edx, eax
pop ds
popfd
lea eax, [ebp - 0x108]
push eax
push dword [0x10172dc8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
pushfd
test byte [0x10017c84], 0x42
je 0x10017c85
add byte [edx + 0x14], ah
adc byte [esi + esi*8 + 0x17c8405], bl
adc byte [edx + 0xf], al
test dl, ah
add byte [eax], al
add byte [edi + ebp*4], al
add al, 0xaf
cwde
in eax, 0xdd
sbb dword [esi - 0x39], ebx
xchg edx, eax
pop ebp
in eax, dx
pop ss
adc byte [eax], 0xe2
add dword [esi + 0x20], esp
mov bh, 0xf1
jae 0x10017bee
nop
xchg edi, eax
fsubr dword [ebx + 0x1c]
xchg edx, eax
inc esp
xor dh, byte [edx - 0x3c9a83f6]
mov edx, 0x860e2ad2
fisub word [esi]
dec ebp
add ebx, esi
imul eax, dword [esi], 0x7e93282e
add eax, ebp
clc
or edi, dword [ecx + ecx]
jo 0x10017b91
mov ebp, 0xe26edb04
jg 0x10017c59
xchg esp, eax
mov cl, 0xa5
adc eax, 0x4a377410
adc dword [edx + 0x481d4442], ebx
scasd eax, dword es:[edi]
push esp
lcall 0x54af, 0x481d4442
pop ebp
outsd dx, dword [esi]
leave
lodsd eax, dword [esi]
adc al, 0x3e
and al, 0x30
mov word [ecx + 0x7f], fs
test eax, 0x3dd24293
dec esp
dec esp
imul ecx, dword [edi + esi*4 + 0x4c], 0xf3d4f91b
pop esp
loop 0x10017c07
xchg dword [edx], ecx
mov ah, 0x9e
popfd
shl byte [esi + 0x79], cl
cmp bh, cl
movsb byte es:[edi], byte [esi]
pop ecx
inc esi
adc bl, byte [ecx + 0x5b]
lodsd eax, dword [esi]
rol byte [ebp - 0x62], 0x4c
adc byte [ebp + 0x67faf9cb], ch
dec edi
jno 0x10017c97
jg 0x10017c4a
or al, 0xe2
dec ecx
mov al, byte [0x87a5f978]
inc edx
cmp dh, byte [0x426391c9]
mov dword [edi + 0x36726f11], eax
mov esi, 0x11085ebe
pop esi
or byte [ecx], dl
cmp al, 0x54
pop ecx
imul edx, dword [edx + 0x7f], 0x21
mov esp, 0xb7f3293b
and dword [ebx + edi + 0x5bb7f329], edi
pop ebx
add byte [ebx + edi*4], ah
test al, 0x5f
add eax, 0x16a47c5f
loopne 0x10017c91
add al, 0x46
popal
fistp word [ebx]
out dx, al
dec esp
mov ecx, 0xe7aa0c21
add dl, al
inc esi
cmp eax, 0x66c92fb
xor esi, dword [edx + 0x65a03a7a]
adc eax, 0x3c66c1ed
popfd
test eax, eax
jne 0x10017fcf
add eax, dword [eax]
add byte [eax + 0xc], ch
push 0xf69c1014
add eax, 0x10017d93
push str.Cant_getmodulefilename_
adc al, 0x10
pushfd
test byte [0x10017d93], 0xc9
jge 0x10017c9a
adc cl, cl
leave
jne 0x10017d94
add eax, 0xed3c7909
cld
pop ds
pop ebp
sbb bl, byte [eax]
cmp eax, 0xe09a9b0a
fstp xword [edx + 0x73]
dec edi
js 0x10017c8b
adc dword [edi + 0x1c], esi
leave
mov ebx, 0x9a61798d
outsb dx, byte [esi]
mov ch, 0x89
adc dword [edx - 0x71], edi
dec esp
inc esi
jno 0x10017c53
shr edx, 1
inc esi
mov dword [0x2c6eafd1], eax
mov al, byte [ebp - 0x75]
mov dword [0xcc13dba0], eax
fisub dword [eax]
and bh, byte [ecx - 0x83f8b84]
out dx, al
rcl dword [ecx + 0x31]
xchg ebx, eax
in al, 0xe5
xlatb
and ecx, dword [ebx + 0x62d8d94f]
cmp ch, byte [ebx - 0x6d]
sub bh, byte [ebp - 0x57]
push ds
or dl, byte [ebp - 0x6a2878d0]
lodsb al, byte [esi]
outsd dx, dword [esi]
inc dword [ebx]
jae 0x10017d7d
imul byte [eax + 0x76]
mov ebp, 0x9f43dc0f
xchg ebx, eax
mov edx, 0x6772a203
mov bl, 0xb3
push 0xffffffffffffffd1
add dl, byte [edx + 0x5e66cc68]
cmc
mov bl, 0x6a
rol dword [edx], 1
xchg edx, eax
push 0xf55e66cc
jns 0x10017d6c
jecxz 0x10017d2d
scasb al, byte es:[edi]
inc ebx
leave
adc al, 0x18
cmp byte [ecx - 0x2a], dh
dec ecx
pop esi
xor eax, dword [edi - 0x62161c89]
aaa
std
adc edx, ebx
xchg dword [esi - 0x36], edi
imul esi, ebp, 0x3d
bound ebx, qword [ebp + ebp + 0xb]
je 0x10017d3c
jmp 0x21feb4cf
or esi, dword [ebp + edi*8 + 0x3c]
daa
cmp al, 0x27
enter 0xffffffffffff94da, 0xffffffffffffffc0
mov dh, 0xf9
jnp 0x10017d11
adc dword [eax], eax
or dword [ecx + 0x53], edx
sal byte [eax], cl
inc ecx
rcr edi, cl
or eax, 0x44982a13
mov cl, 0x70
and cl, byte [ecx - 0x1d8ec9cc]
out dx, al
test byte [edx + 0x21], dl
dec esi
out dx, eax
and al, 0xd0
pop ss
cli
and al, 0x87
dec ecx
or dword [esi - 0x68], ecx
jbe 0x10017daa
sar dword [ebx + ebp*8 - 0x1d], 1
mov ch, 0xc8
daa
fidivr dword [0xb80181b0]
jnp 0x10017dcd
add dword [eax - 0x77ddb385], edi
xor bl, byte [edi + esi*8 + 0x621ce0cf]
or byte [eax - 0x67], dl
dec esp
and cl, byte [eax - 0x300863ce]
loopne 0x10017da5
bound ecx, qword [eax]
push eax
cdq
int 0x73
adc esi, dword [edi]
into
and al, bl
popfd
push edi
pushfd
test byte [0x10017da6], 0xd1
jne 0x10017ea7
add bh, byte [edx]
rol esi, cl
cmp bh, byte [esi]
rol esi, cl
xchg ecx, eax
jge 0x10017d80
pop eax
inc esp
leave
push es
cmp byte [edx + ebx*8 + 0x18], al
sub esp, dword [esp + 0x40]
add edi, ecx
ror dh, 1
mov ebx, 0xb72466c0
sub dword [ebp + 0x1c3fb2ce], 0x19d13139
outsd dx, dword [esi]
test byte [edx - 0x55a68a08], 0xf4
inc esp
xor dword [edi], esi
fisubr dword [eax]
fiadd word [esi]
sub al, 0x94
mov ebp, edx
cmp dword [eax + edx], esp
pop edx
pop edi
fsubr qword [0x6152f961]
shl esi, cl
mov bh, al
jne 0x10017e2a
stosb byte es:[edi], al
hlt
shr dword [esi], cl
imul esp, dword [edx], 0x32
mov edi, 0xe53889f9
cmpsd dword [esi], dword es:[edi]
pop es
sbb al, 0x50
jbe 0x10017deb
mov esp, 0x843c1865
xchg ebx, eax
xchg dh, dl
pop esi
int3
shr byte [edi], cl
cmp byte [ecx + 0x5e], ah
sub eax, 0xaaeedcfc
movsb byte es:[edi], byte [esi]
out dx, al
enter 0xffffffffffff81e7, 0xffffffffffffff8c
mov al, byte [0x9da61f30]
out 0x81, eax
mov word [eax - 0x6259e0d0], fs
push cs
mov dword [0x2ee87349], eax
add al, 0x2d
inc ebx
ficomp dword [esi + 0x6876bdf5]
aaa
push es
sub esi, esp
push 0xf42b0637
sar dword [edi + 0xa], 0xdb
scasd eax, dword es:[edi]
sub dword [ebp + edx*4 - 0x3b49b5a0], ecx
fsubr dword [edi - 0x6a]
dec edi
sahf
and al, 0x11
je 0x10017ebc
xor edx, dword [esi]
pop es
inc esi
inc ecx
or cl, byte [0x7d609105]
cmovnp esi, dword [eax + 0x641ef1f]
movsd dword es:[di], dword [si]
popal
les ebp, [ecx - 0x2d]
fadd dword [ecx - 0x46]
frstor dword [ebp - 0x4f]
cmp byte [edi - 0x5f], al
in eax, 0x33
pop esp
ror byte [edx + ecx*8 - 0x7d], 1
adc ah, bh
adc dword [eax], 0xfffffffc
xor esi, 0xffffffe7
mul bh
jno 0x10017e14
pop edx
loopne 0x10017e6f
jbe 0x10017e07
adc ch, byte [ecx + 0x75]
call 0x12630a01
clc
dec ebx
sbb al, 0x72
push 7
or byte [eax], 0x2e
or byte [esi], ah
aad 0xc1
imul dword [ebp + 0x17]
inc ebx
dec eax
shl byte [edx + 0x12229d78], 0x3f
mov dword [0x957e2a10], eax
push ebx
sal byte [ebx], cl
adc cl, dh
popfd
push edi
call fcn.10049c0c
pushfd
test byte [0x10017ec3], 0x75
jne 0x10017fc4
pop esi
sbb eax, 0xf69c0003
add eax, 0x10017ec3
jne 0x10017ec6
test dword [eax], ecx
add dword [eax], eax
add byte [ebp + ebp*4 - 0x1b], dh
mov byte [edi + 0x76], ah
cmp bl, byte [ebp - 0x470266bd]
test eax, 0x6bfeaee2
ret 0x3b3
je 0x10017e6b
in eax, 0x88
jbe 0x10017efd
popfd
inc ebx
cdq
std
mov eax, 0xfeaee2a9
imul eax, edx, 0xffffffb3
add edx, dword [ebx]
inc ecx
in al, 0x90
cmp ah, bl
mov gs, word [esi - 0x64f9a11]
mov ebx, 0x6a06ee9e
mov ah, 0x1c
push eax
je 0x10017f22
add dword [edi], ecx
jecxz 0x10017f02
outsd dx, dword [esi]
xchg ebp, eax
inc ebp
inc esi
mov ebp, 0xcdb52130
xor byte [ecx], ah
mov ch, 0xcd
in eax, dx
fld dword [0x8a8dd70]
aas
scasb al, byte es:[edi]
insd dword es:[edi], dx
xchg ebp, eax
fsubr dword [eax - 0x14]
outsb dx, byte [esi]
mov esp, 0xe4b0d212
fdivrp st(5)
lodsb al, byte [esi]
or dword [ebx], ecx
jg 0x10017eaa
push edx
xchg edi, eax
daa
out 0x40, al
push eax
or dword [edi], 0xffffff87
dec ebx
add bl, byte [edx + esi*8]
enter 0x2014, 9
sub dword [edx - 0x1e], eax
pop ss
loop 0x10017f3b
jno 0x10017eef
pop edi
jns 0x10017eb5
cmp esp, dword [ebx]
jns 0x10017ed1
salc
sbb al, 0x59
and al, 0xe9
mov esp, 0x2428e10d
cld
jecxz 0x10017f7a
daa
dec edi
sbb dword [ebx - 0x41c5c1e2], ecx
pop esp
mov al, byte [0x252130c6]
add bl, byte [eax - 0x71]
lahf
in al, dx
out dx, al
dec edx
mov ecx, 0x79a35f7b
xor edx, dword [edi + 0x176916ba]
adc al, 0xf3
imul ebp, dword [edx + 0x7d4e4981], 0xb65ab8d8
cli
arpl ax, dx
and ch, byte [ebx - 0x5f]
dec esi
pushfd
sahf
sbb dh, byte [ebx + 0x29a4d0c6]
or edi, edx
cmpsb byte [esi], byte es:[edi]
fimul dword [edx + 0x25]
scasd eax, dword es:[edi]
dec ebp
clc
sbb dword ds:[0xf8bf4721], ecx
dec edx
and eax, 0x3ef84daf
sbb dword [0xf8bf4721], ecx
aam 0x82
aas
sub dword [eax - 0xf], ecx
sbb byte [ecx], dl
pushal
test eax, 0xea43e2d5
clc
sti
aad 0x46
push edi
pop ecx
xchg dword [eax - 0x67], edi
dec eax
cmp dword [edx + 0x2fb8eed8], ebx
jo 0x10017fd9
pop ebx
mov dl, 0xd1
push ebx
push edx
or dl, bh
push ebp
xchg esi, eax
add dword [edi - 0x447a038d], edi
nop
lodsb al, byte [esi]
mov al, byte [eax + 0x2d]
cli
inc esi
xchg dl, dh
xlatb
xchg dword [eax + esi*4 - 0x1d], edx
popfd
add esp, 0xc
xor eax, eax
jmp 0x10018924
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.1011ebdc
pop ecx
pop ecx
pushfd
test byte [0x10018087], 0x45
je 0x10018088
jmp [ebx + 0x10]
sub al, 0x66
pop edx
ffree st(6)
push es
enter 0x6d6c, 0xffffffffffffff94
salc
mov edx, 0x555797e7
jnp 0x10018030
pop esp
xor eax, 0x44a45f49
out 0xb4, al
mov edi, 0xbbfdbdcc
mov dword [esi], ebp
mov ebp, 0xbd5ee0c2
xchg esi, eax
mov edx, 0x3974dc96
mov ebx, 0x645a1e9f
push esp
pop ds
leave
inc esp
daa
dec edi
ficomp word [edi]
stosb byte es:[edi], al
jbe 0x10017fd7
add dh, byte [0xd416b161]
jl 0x10018094
arpl word [edi + esi*4], sp
and al, 0xb7
push ebx
xlatb
push ds
xor al, 0x94
arpl word [ecx + 0x43], bp
rcr al, 1
mov eax, 0xb2e58536
out 0x41, al
out dx, al
popal
cmp byte [esi], 9
shl dword [eax + edi*8], cl
and byte [ebx], dl
sahf
add eax, 0x6e2171ba
pop edx
enter 0x3591, 0xffffffffffffffe4
mov esi, dword [esi - 0x57782dda]
mov byte [0xbc385608], al
inc ebx
rcr dword [ebp - 0x5f], cl
mov edx, dword [ecx - 0x8c8c0fd]
cdq
movsb byte es:[edi], byte [esi]
mov ah, 0x81
cld
aam 0x9f
lds eax, [esi + 0x28e3b671]
adc byte [0x6e16d9f1], 0x7d
mov dh, 0x8c
mov dh, 0xa1
stosb byte es:[edi], al
invalid
popfd
cmp eax, edi
pushfd
test byte [0x1001817f], 0x6e
jne 0x10018180
test edi, esp
add byte [eax], al
add bh, dh
ja 0x100180e9
div dword [edi + 0x4d]
xchg byte [edi], ah
sbb ah, al
pop ds
sbb dword [edi + 0x5c], 0xfffffff9
clc
mov al, byte [0x5e31cd96]
sahf
dec ebp
jo 0x100180d9
in eax, dx
pop eax
mov dh, 0xb8
or dword [ebx + 0x156e656b], ecx
cmc
sbb al, 0x94
nop
adc eax, 0x34d89683
mov gs, ebx
pushal
clc
adc eax, 0xe46ca500
or al, cl
adc byte [edi + 0x7566caf1], 0x55
mov ebx, 0xe485c484
les eax, [ebp + 0x12ab88e4]
pop edi
mov byte [ebx + 0x62e35f12], ch
jecxz 0x10018141
cwde
out 0xb8, al
push ss
and dword [ebp + 0x51], esi
sti
int 0x48
or dh, al
mov dh, 0x39
cmpsb byte [esi], byte es:[edi]
pop esp
std
jle 0x100180d6
je 0x10018084
mov dword [ebp - 0x4b], eax
fimul dword [edx]
dec edx
test eax, 0x665f53d4
int1
sbb edi, dword [ecx + 0x3bf51afe]
movsb byte es:[edi], byte [esi]
cwde
cmc
movsb byte es:[edi], byte [esi]
pop eax
xchg edx, eax
dec esi
sbb esp, esi
mov al, byte [0xa1b0ad7]
xchg dword [eax + 0x61], esp
add dword [ebp - 0x339db788], ebp
mov ebp, 0xd958ddad
cld
mov dl, 0x52
push cs
fistp dword [ecx + 0x1d905df3]
bound ecx, qword [ebx]
loop 0x10018181
fsubr qword [esi - 7]
adc edx, 0xed8fe50e
pop esp
jge 0x100180dd
cmp bh, byte [edi + 0x60]
insd dword es:[edi], dx
and byte [esi + ecx*4], ch
and edx, dword [esi - 0x629b2572]
dec esi
and byte [edi - 0x453e488], dh
aad 0xf1
cmc
cmpsd dword fs:[esi], dword es:[edi]
fcmovne st(0), st(1)
rcl dword [esi], 0xb5
jle 0x10018174
adc al, 0x8a
rol byte [edi + 0x367bcaf4], cl
sub esp, dword [eax]
or dh, ch
les eax, [ebx - 0x5889e034]
sub ch, byte ss:[eax - 0x437bac79]
xchg byte [esi + 0x22], ch
in eax, dx
arpl word [edi], dx
mov dl, dl
xchg esp, esi
retf 0x367b
test byte [esi + eax*4 + 0x63ed226e], bh
pop ss
loopne 0x100181f5
cld
push es
popfd
je 0x1001825b
pushfd
test byte [0x10018256], 0x21
jne 0x10018257
push eax
push esp
and al, 0xe4
cmp byte [edi - 8], 0x14
xor dword [edx + 0x19bd1a7e], 0xd13a54b5
mov ecx, 0x74efc2bc
push ebp
in eax, 0x60
aad 0xbb
enter 0x1714, 0x22
call 0xdaad0439
or esi, dword [ebp + 0x6f604040]
pushal
outsd dx, dword [esi]
adc al, 0x7b
jne 0x100181a7
adc bh, byte [edi + 0x36]
add dword [edi], 0x34
cmp eax, 0x424fbb94
int 0x80
add cl, cl
cmc
aam 0xae
jg 0x1001815e
xor esi, eax
pop edx
faddp st(0)
pushal
loop 0x100181be
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
xchg ebp, eax
cld
mov ebx, dword [eax - 0x31]
dec esi
aas
xchg edx, eax
js 0x1001823a
notrack call ds:[ebp - 0x5aaa4662]
sbb eax, 0xc3c3ca6e
cmp byte [edx], ah
not byte [ecx + edi*4]
adc dword [ebx + 0x65], 0xffffffcd
cwde
test dword [edx], 0x77dbff1e
outsd dx, dword [esi]
mov ah, 0xc3
mov bh, 0xc6
rcl ebp, 0xe6
cmp al, 0x53
inc ebx
sub dword [edx - 1], ecx
cmp bl, ah
stosd dword es:[edi], eax
stc
or eax, dword [ebx - 0x68]
xor eax, 0xe598028e
ficom dword [esi + 0x770b2b31]
add dword [edi - 0x7a], esp
cdq
fnstcw word [ecx]
and eax, 0x8eea9baa
sti
jns 0x10018242
retf 0xc3c3
xor dword [edx - 0x69], esi
push ebx
dec dword [edx + 0x72a5aac6]
pop ecx
and byte [edx], 0xb5
and dl, byte [esi]
int3
and dh, byte [ebp + 0x66cc1622]
mov dword [0xef817159], ecx
pop ds
out 0xec, al
movsd dword es:[edi], dword [esi]
or esp, esi
lodsd eax, dword [esi]
rcl ebx, 1
popfd
inc eax
jmp 0x10018261
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
pushfd
test byte [0x100182ff], 0x5a
jne 0x10018300
adc cl, byte [ebp + 0x2e]
mov eax, 0x5b3dff99
mov cl, 0x25
rcr dword [edx + 0x30], 1
xor byte [ebp + 0x5ebf64d1], ch
mov eax, dword [0x982d7cfd]
pop ebx
pop es
arpl word [edx - 0x6f], dx
push ds
xchg esp, eax
jb 0x10018299
cdq
invalid
jecxz 0x100182c8
or eax, 0xc9c3fd62
or eax, 0xc9c3fd62
xor edi, edi
cmpsd dword [esi], dword es:[edi]
test al, 0x4c
mov bl, 0xe1
xchg ebp, eax
or dword [ebx - 0x7e51b3fe], 0xffffff81
sbb ebp, ecx
mov word [ecx], ss
mov dword [edx], ebp
add cl, byte [ecx + 0x54]
jl 0x1001827b
dec esi
in al, 0x6d
cwde
int1
or eax, ebx
cld
xor dword [esi], 0x35
mov al, byte [0x969e9a2e]
xchg esi, eax
fstp dword [0x7aaa91e6]
insb byte es:[edi], dx
out dx, eax
mov dl, 0x5d
into
int3
popfd
call fcn.1011f120
pop ecx
pop ecx
pushfd
test byte [0x10018343], 0x8c
jne 0x10018344
mov cl, 0xe9
sub eax, 0xae47a413
shr dword [ebp + esi*2 - 0x70], 0x55
jno 0x10018335
xchg ecx, eax
add esi, dword [ebp - 0x617f0f4]
xchg esi, eax
ficom dword [eax - 0x51]
xchg ebp, eax
in eax, dx
sbb eax, 0x8f76c101
dec edi
pop ss
xor eax, 0x943e8459
pop ecx
test byte [esi], bh
xchg esp, eax
cmp byte [ebx + 0x3d486488], ch
salc
enter 0xffffffffffff8c5b, 0x2e
popfd
lea eax, [ebp - 0x20c]
push str..bak
push eax
call fcn.1011f130
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
pushfd
test byte [0x10018461], 0xc1
jne 0x10018462
out dx, eax
je 0x100183e5
sub eax, dword [ebp + 0x734ecaf7]
out 0x10, eax
stc
inc eax
int 0x66
xchg byte [esp + ebx*2 + 0x6c], bh
aas
inc cl
xchg ebp, eax
or dword [edi], esi
sti
jns 0x100183bc
inc eax
cmp ebx, dword [ebx + 0x5c9bc721]
xlatb
pop eax
fistp dword [ecx]
mov eax, dword [0x55eadb5c]
pushfd
adc esi, dword [ecx - 0x66]
sbb edi, dword [edi - 0x10]
inc edi
leave
jle 0x1001837c
rol esp, 0xdc
jo 0x10018413
jle 0x100183e7
mov al, byte [0xefcc9e4d]
mov byte [ebp + 0x1b], cl
inc eax
and al, 0x23
push ebx
sub byte [esi], dl
outsb dx, byte [esi]
imul ebx, esi, 0xc2d4f7a1
or ecx, ebp
jne 0x1001836b
xor al, 0xa5
cmp bh, byte [ebp - 0x2c]
pop esp
cmp dword [esi], edi
in eax, dx
inc esp
and dword [eax], ebx
cmc
out dx, al
or cl, ah
sar byte [ecx - 0x7c8fb0e5], cl
clc
and ecx, ecx
dec esp
cmp esp, edi
insd dword es:[edi], dx
out 0x6d, eax
fstpnce st(2), st(0)
cdq
aas
scasb al, byte es:[edi]
and al, cl
mov ebp, 0xfe4a94a3
movsb byte es:[edi], byte [esi]
out 0xd7, al
outsb dx, byte [esi]
scasb al, byte es:[edi]
push ds
shl byte [eax], 1
or ebp, dword [esi + 6]
loop 0x10018452
push esp
dec esi
loopne 0x100183f4
mov al, byte [eax]
push eax
mov esp, 0x5cbaac1a
inc eax
and eax, 0xd96b660a
mov dl, 0x99
cdq
xor dword [ebx + 0x43], eax
outsd dx, dword [esi]
sub al, 0x7d
out 0xef, eax
and eax, 0x2fec4b1e
leave
stosb byte es:[edi], al
in eax, dx
loopne 0x10018444
or dword [edi + 0x7bfb6a50], ebx
pop ds
jae 0x10018474
setno dh
sub eax, 0xc4b438ca
mov ebp, 0x7ca7c694
fmul dword [edx + 0x3d2c0cbb]
call dword [edx + 0x7ab82c55]
sbb al, 0x57
push ebp
sub al, 0xb8
jp 0x10018465
push edi
insd dword es:[edi], dx
xchg ebp, eax
in eax, 0x81
imul ebx, dword [ebx - 1], 0x25bd48bb
fsub st(1), st(0)
sub dword [0x18b58108], ebp
sub byte [eax - 5], cl
invalid
popfd
push eax
call fcn.1011f4ee
add esp, 0x10
test eax, eax
test dword [eax + 0x10], esi
add byte [ebx - 0x3f7aef3c], al
je 0x100185c7
pushfd
test byte [0x100184a3], 0x26
jne 0x100185a4
xor ch, ah
mov bl, 0xef
push es
sbb bl, ah
mov ebp, ds
insb byte es:[edi], dx
jecxz 0x10018508
ror dl, 0x39
sahf
sub byte [ebp - 0x2e], bl
or al, 0x8c
sub dword [esi + esi*8 + 0x171035a8], ebx
cmpsd dword [esi], dword es:[edi]
cmp dword [esi + 0xcd25d28], ebx
mov word [ecx], gs
pushfd
imul byte [eax - 0x58e8efcb]
jno 0x100184d0
fldenv [ebx + 0x13]
jbe 0x100184ff
xor esi, dword [edi]
fisttp dword [eax]
adc dh, dl
sahf
jo 0x10018529
bound eax, qword [ecx + edi*4]
or byte [ebp - 0xc2934ef], dh
shl dl, 0x41
jge 0x10018491
cwde
inc ebx
rcr dl, cl
dec edi
aaa
push ds
xor eax, 0x7b58141c
aas
sub dword [ebx - 5], ebx
je 0x10018474
adc eax, 0x5bccf227
sub byte [eax + edi*8 + 0x7a], dl
cli
sbb bl, byte [ebx - 0x5f99316]
sub ecx, dword [edx + 0x3b]
push 0x9c839a27
cmp al, 0x95
sub dword [eax - 0x5a01d265], esp
mov ecx, 0x713da924
sub dword [edi], 0x3b
imul ecx, esi, 0x3351113d
xchg byte [edx + 0x69], ah
bound ebp, qword [ecx + 3]
jp 0x10018564
add edi, dword [edx + 0x60]
or al, 0x56
jg 0x100184bc
lahf
inc ebx
mov ch, 7
lahf
and esp, 8
clc
std
fnstsw word [edi - 0x78]
lea ebx, [edx + 0x156225fb]
inc edi
xor byte [eax], cl
xor byte [ebp - 0x73], dl
mov word [edx], cs
in eax, 0x1e
jge 0x10018568
lcall 0x3047, 0x156225fb
or byte [eax], dh
push ebp
lea ecx, [edx + ecx + 0x407d1ee5]
aaa
cmp al, 0x89
leave
sbb eax, 0x53dc5490
jle 0x1001857f
xchg ebp, eax
inc ecx
xchg ebx, eax
rcl dword [esi + 0x50f0dd06], cl
push 0xb0ecd10
xor dword [edx + 0x1e], eax
popfd
xchg esp, eax
inc edx
mov ebp, 0x45dcab01
xchg edi, eax
jbe 0x10018567
mov dh, 0x17
cwde
dec ebx
pop eax
outsd dx, dword [esi]
mov ebx, gs
je 0x10018517
or cl, bh
scasb al, byte es:[edi]
scasb al, byte es:[edi]
or al, dh
jno 0x10018501
push eax
sti
movsb byte es:[edi], byte [esi]
pop ebx
mov cl, 0xc4
xchg edi, eax
les esp, [esi]
xchg edi, eax
sub eax, 0xbd3a8855
imul edx, ecx, 0xdbe31997
adc dword [eax - 0x68d12bbf], ebx
rcl dword [edi + 0x11dbe319]
cwde
inc ecx
aam 0x2e
xchg edi, eax
dec ecx
push 0x4c23dfdf
sar ebp, cl
dec ebp
sbb dword [esi], eax
out 0x85, al
fbstp tbyte [edi]
scasb al, byte es:[edi]
pushfd
sti
jae 0x1001855e
invalid
je 0x10018533
cli
call 0x8a693b61
enter 0x35c6, 0xffffffffffffffdc
lea ecx, [eax + ecx]
pop ebp
cmp byte [edi + edx*2], ch
popfd
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push str.Cant_rename__s_to__s
push edi
push edi
call fcn.10049c0c
add esp, 0x14
jmp 0x10017fc8
push edi
lea eax, [ebp - 0x108]
push eax
push ebx
pushfd
test byte [0x1001861c], 0xff
jne 0x1001861d
jo 0x10018571
sti
xchg dword [edi], ecx
adc byte [eax + 0x7d9681b7], cl
and dword [eax - 0x79], ebp
das
and eax, 6
adc byte [ebx], al
js 0x1001865e
bound eax, qword [esi + eax*2 - 0x11aaf10b]
fsub qword [esi - 0x5b6af81]
int3
popfd
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
pushfd
test byte [0x1001867b], 0xbd
jne 0x1001867c
mov eax, 0xa992f77a
add eax, dword [ecx - 0x2a1e23e]
mov bh, 0x9d
or dword [edi + 0x145eabda], esp
pushfd
dec dword [edi + 0x71]
add dword [ecx], 0x44
xor cx, word [edi + 0x7e95c71c]
and bl, byte [esi]
jle 0x10018674
push ds
or ah, byte [eax]
jnp 0x10018658
dec edi
push cs
jns 0x10018650
int1
mov es, esp
clc
xor al, 0x3c
push ds
fcmove st(0), st(3)
mov bl, ch
mov ebp, 0xb77b2701
add ecx, edx
outsb dx, byte [esi]
popal
popfd
lahf
test al, 0xc9
adc cl, byte [0xc4d6a8b0]
or eax, 0xc4d6a8b0
mov ds, word [ecx]
inc ebp
popfd
jne 0x100188d3
lea eax, [ebp - 0x108]
push eax
push ebx
push str.Cant_copy__s_to__s
pushfd
test byte [0x100186ae], 0x63
jne 0x100186af
or esi, dword [edi]
mov esi, 0x631f750
xchg byte [ebx - 0x2e], al
dec edx
xchg byte [esi - 0x18045adc], bh
neg esp
xchg edx, eax
int3
fcom qword [edx + 0x57579dcc]
popfd
push edi
push edi
call fcn.10049c0c
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
pushfd
test byte [0x100186e4], 0xc1
je 0x100187e5
cmp byte [edi], bh
pop ebx
xchg edx, eax
shl byte [edx + 0x72], cl
xchg dword [esi + 0xf21466f], ecx
jne 0x1001873a
jo 0x10018762
push cs
test eax, 0x551737d7
or ecx, edx
cmpsb byte [esi], byte es:[edi]
push 0xffffffffffffffd2
scasb al, byte es:[edi]
in eax, dx
mov edi, 0x82ed536c
lds ebp, [ecx]
cld
nop
xor edi, edi
sub ebp, dword [ebp + 0x40]
or dh, al
fmulp st(2)
xchg ebp, eax
mov al, 0x67
mov esp, 0x42cc651e
push 0x38
sub ch, byte [esp + ecx*8 + 0x16cff8ec]
std
xchg edi, eax
jnp 0x100186ac
salc
push ecx
push ds
dec ebx
cwde
bound esi, qword [ecx - 0x3d]
loop 0x10018791
adc byte [edi + 0x78], dh
call 0xe3259d9c
sal dword [ebx], cl
out dx, al
stosd dword es:[edi], eax
ficomp word [edx - 0x51366b85]
mov ebx, 0x4087f10f
int3
xchg ebx, eax
or dword [ebx], 0x697eaa32
inc ecx
and al, cl
add byte [edx - 0x5190e10], ah
mov bh, 0x17
salc
outsb dx, byte [esi]
fdivr dword [edi - 0x15]
test byte [eax + 0x21d2b331], ah
outsb dx, byte [esi]
pushfd
xor dword [ebx + 0x646e21d2], esi
pushfd
xchg edx, eax
cmp dh, byte [edi + ecx*4]
mov eax, 0x48bca4c1
cmp ecx, esi
push 0xd028dcb
lodsd eax, dword [esi]
inc esi
adc dword [esi + edi - 0x24], edx
mov esp, 0x68ce3b48
retf
mov al, 0x7a
or al, 0xfa
pop ss
stosb byte es:[edi], al
push eax
cli
cld
cdq
or esp, dword [esi - 0x76034259]
int1
or ch, bl
jno 0x100187af
scasd eax, dword es:[edi]
or byte ds:[ebp + 0x7e], bl
sub dl, byte [edx + 0x53]
cwde
sbb ebx, ecx
sbb al, 0x34
sbb dword [ecx - 0x1c], edx
add byte [ebx], bl
fadd qword [edi - 0x65]
mov byte [ebx + 0x38], dl
and esp, edi
scasb al, byte es:[edi]
stosd dword es:[edi], eax
test bh, ch
je 0x100187c7
pop ebx
ja 0x1001880d
js 0x100187bf
ja 0x10018744
sub eax, 0xf0e90af4
bound edi, qword [edi + 0x8e7c04a]
cwde
outsb dx, byte [esi]
or al, 0x44
sbb byte [edx + edi*2 - 0x6d], ah
hlt
jp 0x10018754
mov bh, 0x14
cmp bh, al
sbb al, 0x83
jbe 0x10018771
xor dword [esi - 0x59], 0x35
fmul dword [eax]
retf 0x4629
xor eax, 0x29ca08d8
inc esi
outsd dx, dword [esi]
dec ebp
xchg esp, eax
jl 0x10018804
or dword [ebp - 0x12c4a15b], 0xa709927d
mov ch, 0xa
or eax, eax
and dl, bl
popfd
call fcn.1011f4ee
add esp, 0x1c
pushfd
test byte [0x1001881f], 0xf3
jne 0x10018820
int1
leave
cmp eax, 0xd7e09039
test eax, ebp
push ecx
sub edi, dword [esp + eax*4]
inc ebp
fisubr word [edi - 0x4b]
sbb dl, byte [edi - 0x17]
xchg ecx, eax
test byte [ebp - 0x22], al
outsd dx, dword [esi]
mov ch, 0x1a
push edi
jmp 0x6d2beba1
arpl word [edx], bp
pop ebp
push esi
add cl, ch
cmp al, byte [edi - 0x7d]
and dword [ebx], esp
jo 0x10018858
ficomp word [edi + 0x5e2b49e0]
popfd
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10017fc8
add eax, 0x84c86d99
pop es
shl dword [edi + 0x5c], 0x9f
push esp
add ch, al
xlatb
cwde
pop es
xchg edi, eax
xchg byte [edx - 0x3d3a58ce], ch
push ebp
xchg esp, eax
sti
int1
mov bh, 0x9e
pop ecx
adc eax, 0xe49ff136
mov ah, 0x57
mov dh, 0x75
inc ebp
adc byte [esi], 0x20
and al, 0x50
shl byte [ebp + 0x4d6155dd], 1
push es
xchg ebx, eax
fadd qword [ebx - 0x10e6816]
int 0x4c
int1
push edi
or dword [eax + 0x2f94bbf6], ecx
in al, 0x46
dec eax
movsb byte es:[edi], byte [esi]
and cl, byte [eax]
test eax, 0x65b0f93a
out dx, eax
salc
mov eax, dword ds:[0xb28dac2a]
jl 0x1001883f
or ch, bl
lodsd eax, dword [esi]
cdq
dec edi
cmpsb byte [esi], byte es:[edi]
and eax, 0x93cd5eab
and dword [edi + 0x14], esp
test ch, 0xe7
sbb ecx, dword [esi + 0x19]
out 0x14, al
pop esi
xchg edx, eax
push 0xffffffffffffffae
mov dword [ebx + 0x4b], ebx
mov fs, edx
pcmpgtw mm3, qword [eax]
fcmovb st(0), st(3)
stc
dec eax
mov byte [eax], dh
fild qword [ecx - 0x1bfbde84]
bound edi, qword [edi + 0xb212dc4]
cmp al, 0x14
popfd
push ebx
pushfd
test byte [0x10018909], 0xda
jne 0x1001890a
push ebx
push ss
arpl bx, si
adc dword [edx - 0x759fb38f], ebp
add ebp, eax
in al, 0xc8
xchg esi, eax
je 0x10018915
dec esi
sbb ah, byte [ebx + 0x4ed945d2]
pop esi
out dx, eax
cmc
mov bh, 0xe3
sub eax, 0x6e2954cb
mov ch, 0x89
cli
inc eax
pop edi
cmp eax, 0x931ba4ac
popfd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 5
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
xor eax, eax
inc eax
test esp, esi
std
invalid
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011e48a
pop ecx
pop ebx
adc byte [eax], al
leave
pushfd
test byte [0x100189d6], 0x2d
jne 0x100189d7
pop eax
or al, 0xf0
bound ebp, qword [edi + 0x4973a1b6]
mov dh, 0xa1
jae 0x10018992
push edi
movsd dword es:[edi], dword [esi]
mov ch, 0x73
jo 0x10018945
mov word [eax + 8], ds
push ecx
push ss
scasb al, byte es:[edi]
push es
sub eax, 0xb0b28b43
sti
jge 0x1001892d
xor dword [eax], eax
cpuid
add al, 0xb7
inc edx
and al, 0xb0
fist dword [edx + 0x5ccbaba]
cmp edi, dword [0x17ad1474]
lodsb al, byte [esi]
aas
add eax, 0x87b11e7
mov al, ah
push cs
xchg esp, eax
or esi, dword [esi]
sub ah, ch
outsb dx, byte [esi]
mov dh, byte [ebp + 0x39ec8b73]
outsb dx, byte [esi]
push ebp
outsd dx, dword [esi]
sub eax, 0x914a50fa
push eax
dec edx
xchg ecx, eax
shl dword [ebx - 0x3e1c0fec], cl
adc al, 0x2b
int3
popfd
ret 4