Function at 0x43c420
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x88
mov esi, esp
push eax
sub esp, 0x1c
mov eax, esp
mov dword [esi], eax
push eax
mov edi, esp
mov eax, dword [0x452df0]
mov dword [esi + 0x18], 0xf301f12d
mov dword [esi + 0x1c], 0xef7ded65
mov dword [esi + 0x20], 0xeb77e964
mov dword [esi + 0x24], 0xe71ae571
mov dword [esi + 0x28], 0xe37be172
mov dword [esi + 0x2c], 0x9f039d12
mov dword [esi + 0x30], 0x9b9a9945
mov dword [esi + 0x34], 0
mov ecx, 0x2c
nop
nop
movzx edx, byte [esi + ecx - 0x14]
mov ebx, edx
and ebx, ecx
add bl, bl
sub dl, bl
movzx edx, dl
add edx, ecx
add dl, 0x24
mov byte [esi + ecx - 0x14], dl
inc ecx
cmp ecx, 0x4c
jne case.default.0x43c4b6
lea ecx, [esi + 0x5c]
lea ebx, [esi + 0x74]
lea edx, [esi + 0x18]
push ecx
push 8
push ebx
push 0xd
push edx
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503b8]
mov dword [esi + 0x74], 0x3a0043
mov dword [esi + 0x78], 0x5c
mov dword [esi + 0x68], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x14], 0
lea eax, [esi + 0x14]
push eax
push 0x449b20
push 1
push 0
push 0x449b30
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503c0]
mov dword [esi + 0x70], edi
mov dword [esi + 0x18], 0x33653162
mov dword [esi + 0x1c], 0x3f623d6b
mov dword [esi + 0x20], 0x3b79395c
mov dword [esi + 0x24], 0x4713450d
mov dword [esi + 0x28], 0x4370411e
mov word [esi + 0x2c], 0x4d4c
mov dword [esi + 0x2e], 0
mov byte [esi + 0x32], 0
mov ebx, 0x2f2bfb34
mov edi, 0xd0d404cb
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esi + ebx - 0x2f2bfb1c]
mov dword [esi + 4], eax
mov edx, ebx
and edx, eax
add edx, edx
sub edx, eax
add edx, edi
and edx, ebx
mov eax, edx
or al, 0xfd
inc al
mov ecx, edx
and cl, 0x7d
mul cl
mov ecx, eax
add cl, byte [esi + 4]
mov eax, edx
shr al, 1
and al, 1
or dl, 2
mul dl
add al, al
sub cl, al
movzx eax, cl
add eax, ebx
add al, 0xfc
mov byte [esi + ebx - 0x2f2bfb1c], al
inc ebx
dec edi
cmp ebx, 0x2f2bfb4f
jne 0x43c560
lea edi, [esi + 0x18]
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esi + 0x14]
mov ecx, dword [ebx]
lea edx, [esi + 0x10]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esi + 0x6c], eax
push eax
push ebx
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
lea ebx, [esi + 0x74]
jmp dword [eax*4 + 0x4503c8]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esi + 0x10]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4503e0]
mov dword [esi + 0x18], 0x19451b45
mov dword [esi + 0x1c], 0x6566674c
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xbb
xor cl, byte [esi + eax + 0x18]
add cl, 0x59
mov byte [esi + eax + 0x18], cl
inc eax
cmp eax, 8
jne 0x43c620
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi + 4], eax
mov dword [esi + 0x18], 0x49b14ba1
mov dword [esi + 0x1c], 0x45bd47bc
mov dword [esi + 0x20], 0x41ae43b9
mov dword [esi + 0x24], 0x7da87f60
mov dword [esi + 0x28], 0x79807b5c
mov dword [esi + 0x2c], 0x75877796
mov dword [esi + 0x30], 0x71527387
mov dword [esi + 0x34], 0x6df96f99
mov dword [esi + 0x38], 0x69a76bfe
mov dword [esi + 0x3c], 0x658767a6
mov dword [esi + 0x40], 0x6195639a
mov dword [esi + 0x44], 0x1df31f91
mov word [esi + 0x48], 0x1b1c
mov dword [esi + 0x4a], 0
mov word [esi + 0x4e], 0
mov eax, 0x2ae6e613
nop
nop
nop
nop
movzx edx, byte [esi + eax - 0x2ae6e5fb]
mov ecx, eax
xor ecx, edx
lea edi, [ecx + ecx]
not edi
add edi, ecx
and edi, eax
mov ebx, edi
and ebx, 0x2ae6e67d
mov ecx, edi
or ecx, 0xfffffffd
inc ecx
imul ecx, ebx
mov ebx, edi
and ebx, 2
or edi, 2
imul edi, ebx
add ecx, edx
sub ecx, edi
add ecx, eax
mov edx, ecx
not edx
and edx, 0x60
and ecx, 0x9f
sub ecx, edx
inc cl
mov byte [esi + eax - 0x2ae6e5fb], cl
inc eax
cmp eax, 0x2ae6e64b
jne 0x43c6b0
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
lea edx, [esi + 0x58]
push edx
push 0
push 0x30
push ebx
mov edi, dword [esi + 4]
push edi
push eax
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
mov dword [esi + 0x50], ebx
jmp dword [eax*4 + 0x4503e8]
lea ebx, [esi + 0x74]
jmp dword [0x450448]
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
lea edx, [esi + 0x54]
lea edi, [esi + 0xc]
push edx
push edi
lea edi, [esi + 0x18]
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esi + 0x54], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x4503f0]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [esi]
mov dword [eax], 0x51e94f19
mov dword [eax + 4], 0x55f953e2
mov dword [eax + 8], 0x59fa57f7
mov dword [eax + 0xc], 0x5ded5b16
mov dword [eax + 0x10], 0xa1fc5ff3
mov dword [eax + 0x14], 0xa510a307
mov word [eax + 0x18], 0xa7a4
mov dword [eax + 0x1a], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov edi, ecx
and edi, 0x1a
mov ebx, edx
xor ebx, 0xed
add ebx, edi
xor bl, byte [eax + edx]
add bl, 0x5f
mov byte [eax + edx], bl
inc edx
add ecx, 2
cmp edx, 0x1e
jne case.default.0x43c817
mov edx, dword [esi + 8]
mov ecx, dword [edx]
push 0
push 0
lea edi, [esi + 0x18]
push edi
push 0
push eax
push edx
call dword [ecx + 0x10]
test eax, eax
setns al
cmp word [esi + 0x18], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x4503f8]
mov eax, dword [esi + 0x20]
mov dword [esi], eax
movzx ecx, word [eax]
xor edi, edi
mov ebx, 0
test cx, cx
je 0x43c868
mov eax, dword [esi]
add eax, 2
xor ebx, ebx
jmp 0x43c847
inc ebx
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x43c868
cmp cx, 0x7f
jbe 0x43c83b
movzx edx, cx
cmp edx, 0x7ff
ja 0x43c85d
add ebx, 2
jmp 0x43c83c
cmp cx, 0xffff
je 0x43c83c
add ebx, 3
jmp 0x43c83c
mov dword [esi + 8], ebx
mov eax, dword [esi + 8]
lea ebx, [eax + 1]
push ebx
call fcn.0040c7f0
add esp, 4
push dword [esi]
push ebx
mov ebx, dword [esi + 8]
mov dword [esi], eax
push eax
call fcn.00432840
add esp, 0xc
add ebx, 0xfffffffc
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x450400]
mov eax, edi
and eax, 4
mov ecx, edi
or ecx, 4
imul ecx, eax
xor eax, 4
mov edx, edi
and edx, 0xfffffffb
imul edx, eax
add ecx, dword [esi]
mov eax, dword [edx + ecx]
mov dword [esi + edi*4 + 0x5c], eax
xor eax, eax
sub ebx, 4
setb al
jmp dword [eax*4 + 0x450408]
inc edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x450400]
lea edi, [esi + 0x18]
jmp dword [0x450410]
push dword [esi]
call fcn.0040c800
add esp, 4
jmp dword [0x450418]
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
nop
nop
nop
nop
nop
nop
nop
push edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp dword [0x450424]
mov edi, dword [esi + 0x58]
mov eax, dword [edi]
mov ebx, dword [eax + 8]
jmp dword [0x450438]
push edi
call ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push edi
call ebx
jmp dword [0x450440]
lea ebx, [esi + 0x74]
jmp dword [0x450448]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esi + 4]
call edi
push dword [esi + 0x50]
call edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esi + 4]
call edi
push dword [esi + 0x50]
call edi
jmp dword [0x450454]
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 0x6c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, dword [esi + 0x70]
mov dword [edi], 0
push 0xd2e7977e
push dword [0x452de8]
call fcn.004452a0
add esp, 8
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push ebx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x450458]
mov eax, dword [edi]
mov dword [esi + 0x5c], eax
xor edi, edi
xor eax, eax
cmp edi, 4
setb al
mov edx, dword [ebp + 8]
jmp dword [eax*4 + 0x450460]
xor ecx, ecx
test edi, edi
setne cl
mov eax, edi
jmp dword [ecx*4 + 0x450478]
xor ecx, ecx
cmp dword [esi + edi*4 + 0x5c], 0
sete cl
mov eax, edi
jmp dword [ecx*4 + 0x450480]
lea eax, [edi - 1]
imul eax, dword [esi + eax*4 + 0x5c], 0x1a5845
add eax, 0xebde8a13
mov dword [esi + edi*4 + 0x5c], eax
push 0x10
push 9
mov dword [esi + 4], edx
push edx
push eax
call fcn.00434640
add esp, 0x10
lea edx, [eax - 1]
mov ecx, eax
nop
nop
nop
inc edx
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne case.default.0x43ca74
mov ebx, edx
xor ebx, eax
mov ecx, eax
not ecx
and ecx, edx
add ecx, ecx
sub ecx, ebx
add ecx, 0xfffffff8
xor ebx, ebx
cmp ecx, 0
setne bl
xor edx, edx
jmp dword [ebx*4 + 0x450488]
mov byte [eax + edx - 1], 0x30
dec edx
xor ebx, ebx
cmp ecx, edx
setne bl
jmp dword [ebx*4 + 0x450488]
mov edx, dword [esi + 4]
add edx, 8
inc edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x450460]
mov eax, dword [case.0x43c817.23]
nop
jmp eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
mov eax, dword [case.0x43c4b6.56]
nop
nop
jmp eax
ret
int3
xor eax, eax
jmp 0x43cce5
mov edi, dword [esp + 0x3c]
push 0x400
call fcn.0043fba0
add esp, 4
mov ebp, eax
mov esi, dword [esp + 0x14]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x72
xor cl, byte [esp + eax]
add cl, 0xc6
mov byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x43cb30
mov eax, dword [esp]
mov edx, dword [0x452df4]
test edx, edx
je case.default.0x43cbaa
xor ebx, ebx
mov ecx, dword [0x452df8]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa70a987f
je 0x43cb70
inc ebx
cmp edx, ebx
jne 0x43cb60
jmp case.default.0x43cbaa
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je case.default.0x43cbaa
lea eax, [esp + 0x1c]
push 0x2f
push 0x400
push ebp
push eax
push esi
push 5
push dword [0x452dfc]
push edx
call fcn.00442cc0
add esp, 0x20
not eax
shr eax, 0x1f
xor ebx, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
jmp dword [eax*4 + 0x4504a8]
push ebp
call fcn.0043fc00
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp], 0x4c4d4a4b
mov word [esp + 4], 0
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x72
xor cl, byte [esp + ebx]
add cl, 0xc6
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 6
jne 0x43cbd0
mov ecx, dword [0x452df4]
test ecx, ecx
je 0x43ccdf
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x452df8]
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43ccc5
inc esi
cmp ecx, esi
jne 0x43cc00
jmp 0x43ccdf
xor eax, eax
cmp ebx, dword [ebp]
setb al
xor ecx, ecx
mov dword [esp + 0x10], 0
jmp dword [eax*4 + 0x4504c0]
mov edi, ebp
mov ecx, esp
call fcn.0043fff0
mov ecx, esi
inc ecx
xor eax, eax
mov ebp, dword [esp + 0x18]
cmp ecx, dword [ebp]
setb al
jmp dword [eax*4 + 0x4504c0]
mov esi, ecx
mov eax, dword [ebp + ecx*4 + 4]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, esp
push 0
push eax
call fcn.0043fe60
xor eax, eax
mov ecx, edi
neg ecx
mov ebp, edi
mov edi, dword [esp + 0x40]
sbb eax, edi
setl al
movzx eax, al
shl eax, 0x14
or eax, 1
mov ecx, esp
push eax
call fcn.0043fe80
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x4504c8]
mov ecx, esp
push edi
push ebp
push 0
call fcn.00440080
test eax, eax
setns al
mov dword [esp + 0x10], eax
jmp case.0x43cbaa.8
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je 0x43ccdf
push eax
push 1
push dword [0x452dfc]
push ecx
call fcn.00442cc0
add esp, 0x10
mov eax, dword [esp + 0x10]
and al, 1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov ax, word [ebp]
xor ecx, ecx
sub ax, 0x2e
sete cl
mov dword [esp + 0x354], ecx
mov eax, dword [esp + 0x358]
mov ecx, dword [esp + 0x354]
mov eax, dword [eax + ecx*4]
jmp eax
sub eax, 0x8b15721a
test byte [esp + ebx*4], ah
add byte [eax], al
add byte [ebx + 0xa0248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x2c4], ecx
mov eax, dword [esp + 0x2c8]
mov ecx, dword [esp + 0x2c4]
mov ecx, dword [eax + ecx*4]
xor eax, eax
jmp ecx
call fcn.0041d600
xor eax, eax
mov ecx, edi
sub ecx, 3
sete cl
mov dword [esp + 0x274], 1
mov edx, dword [esp + 0x278]
mov ebx, dword [esp + 0x274]
mov edx, dword [edx + ebx*4]
jmp edx
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x178]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 0x40]
jmp eax
mov word [esi], 0x5c
mov word [ecx + 6], 0
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx + eax*4]
jmp eax
xor eax, eax
mov ecx, esi
sub ecx, ebx
seta cl
mov edx, dword [esp + 0x32c]
mov esi, dword [esp + 0x330]
mov edx, dword [esi + edx*4]
jmp edx
mov al, cl
and eax, 1
mov dword [esp + 0x26c], eax
mov eax, dword [esp + 0x270]
mov ecx, dword [esp + 0x26c]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x3f4]
jmp eax
xor eax, eax
mov ecx, edi
sub ecx, 2
sete cl
mov edx, dword [esp + 0x364]
mov ebx, dword [esp + 0x368]
mov edx, dword [ebx + edx*4]
jmp edx
mov ecx, dword [esp + 0x254]
mov edx, dword [esp + 0x258]
mov ecx, dword [edx + ecx*4]
jmp ecx
movzx eax, al
and eax, 1
mov dword [esp + 0x1e4], eax
mov eax, dword [esp + 0x1e8]
mov ecx, dword [esp + 0x1e4]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x3f4]
mov edx, dword [esp + 0xc]
jmp eax
mov ax, word [ebx + 2]
xor ecx, ecx
sub ax, 0x3a
sete cl
mov dword [esp + 0x10c], ecx
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x10c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x264], 1
mov eax, dword [esp + 0x268]
mov ecx, dword [esp + 0x264]
mov eax, dword [eax + ecx*4]
jmp eax
mov cx, word [eax]
xor edx, edx
sub cx, 0x5c
sete dl
mov dword [esp + 0x1b4], edx
mov ecx, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1b4]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov al, byte [esp + 0x18]
mov byte [esp + 0x1c], al
mov byte [esp + 0x30], 0xca
mov byte [esp + 0x31], 0x8b
mov byte [esp + 0x32], 0x2e
mov byte [esp + 0x33], 0x89
mov byte [esp + 0x34], 0x88
mov byte [esp + 0x35], 0x87
mov eax, 6
mov byte [esp + eax + 0x30], 0
add eax, 1
cmp eax, 0xc
jne 0x43dac6
mov eax, dword [esp + 0x2f4]
mov ecx, dword [esp + 0x2f8]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x214], ecx
mov eax, dword [esp + 0x218]
mov ecx, dword [esp + 0x214]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x134], 0
mov eax, dword [esp + 0x138]
mov ecx, dword [esp + 0x134]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
movzx eax, di
mov dword [esp + 0xf4], 0
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xf4]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [esp + 0x28c]
mov ecx, dword [esp + 0x290]
mov eax, dword [ecx + eax*4]
jmp eax
sbb dh, byte [eax]
and bl, byte [eax + 0x65ef9d2]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
mov eax, dword [ecx + eax*4]
jmp eax
not al
movzx eax, al
and eax, 1
mov dword [esp + 0x2a4], eax
mov eax, dword [esp + 0x2a8]
mov ecx, dword [esp + 0x2a4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x1cc]
mov ecx, dword [esp + 0x1d0]
mov eax, dword [ecx + eax*4]
mov edx, dword [esp + 0xc]
jmp eax
add ebp, 4
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
mov eax, dword [ecx + eax*4]
mov edi, ebp
jmp eax
mov ax, word [ebp]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x38c], ecx
mov eax, dword [esp + 0x390]
mov ecx, dword [esp + 0x38c]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x204], ecx
mov eax, dword [esp + 0x208]
mov ecx, dword [esp + 0x204]
mov eax, dword [eax + ecx*4]
xor ebx, ebx
jmp eax
mov al, byte [esp + 0x13]
mov bl, al
and ebx, 1
mov dword [esp + 0xcc], ebx
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xcc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esp + 0x3f4]
jmp eax
mov ecx, dword [esp + 0x1ac]
mov edx, dword [esp + 0x1b0]
mov ecx, dword [edx + ecx*4]
mov esi, eax
jmp ecx
call fcn.0041d600
mov ax, word [ebp]
test ax, ax
sete al
mov dword [esp + 0x2b4], 0
mov ecx, dword [esp + 0x2b8]
mov edx, dword [esp + 0x2b4]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0041d600
xor eax, eax
test esi, esi
setne cl
mov dword [esp + 0x2dc], 0
mov edx, dword [esp + 0x2e0]
mov ebx, dword [esp + 0x2dc]
mov edx, dword [edx + ebx*4]
jmp edx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [esi]
test ax, ax
sete bl
mov eax, dword [esp + 0x1fc]
mov ecx, dword [esp + 0x200]
mov eax, dword [ecx + eax*4]
jmp eax
mov esi, ebx
add esi, 4
mov di, word [ebx + 4]
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x108]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0041d600
lea edx, [ebp + esi*2]
mov dword [esp + 0x14c], 0
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x14c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0xd4], 0
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xd4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + eax*4]
jmp eax
mov word [ebx], 0x5c
mov word [ebx + 2], 0
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebx]
mov ecx, dword [esp + 0x314]
mov edx, dword [esp + 0x318]
mov ecx, dword [edx + ecx*4]
jmp ecx
pop eax
call 0x44cef033
and al, 0x74
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + eax*4]
jmp eax
mov edx, ebp
add edx, 2
mov ax, word [ebp + 2]
xor ecx, ecx
sub ax, 0x2e
sete cl
mov dword [esp + 0x21c], ecx
mov eax, dword [esp + 0x220]
mov ecx, dword [esp + 0x21c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x18c], 0
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x18c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x1f4], 1
mov eax, dword [esp + 0x1f8]
mov ecx, dword [esp + 0x1f4]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov al, bl
inc al
mov dword [esp + 0x1ec], 1
mov ecx, dword [esp + 0x1f0]
mov edx, dword [esp + 0x1ec]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0041d600
mov dword [esp + 0xac], 1
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xac]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x124]
mov ecx, dword [esp + 0x128]
mov eax, dword [ecx + eax*4]
mov ebp, edi
jmp eax
add ebp, 4
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x288]
mov eax, dword [ecx + eax*4]
mov edi, ebp
jmp eax
mov eax, dword [esp + 0x194]
mov ecx, dword [esp + 0x198]
mov eax, dword [ecx + eax*4]
jmp eax
add eax, 0xfffffffe
mov ecx, dword [esp + 0x1a4]
mov edx, dword [esp + 0x1a8]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov word [ebx], 0
mov eax, dword [esp + 0x3c4]
mov ecx, dword [esp + 0x3c8]
mov eax, dword [ecx + eax*4]
mov esi, ebx
jmp eax
mov dword [esp + 0xc], esi
mov dword [esp], ebp
mov dword [esp + 4], 0x5c
call fcn.0043e670
mov esi, eax
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0x3b4], eax
mov eax, dword [esp + 0x3b8]
mov ecx, dword [esp + 0x3b4]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov ax, word [ebp]
mov dword [esp + 0x25c], 1
mov ecx, dword [esp + 0x260]
mov edx, dword [esp + 0x25c]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, dword [esp + 0x3cc]
mov ecx, dword [esp + 0x3d0]
mov eax, dword [ecx + eax*4]
xor ebx, ebx
jmp eax
fsubr dword [ebp + 0x634d78fd]
aas
xor al, 0x8b
inc esp
and al, 0x44
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0041d600
mov word [esi], 0
mov dword [esp + 0x12c], 1
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x12c]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x144]
mov ecx, dword [esp + 0x148]
mov eax, dword [ecx + eax*4]
jmp eax
sub esi, ebp
sar esi, 1
mov edi, esi
inc edi
xor eax, eax
mov ecx, edi
sub ecx, 1
sete al
mov dword [esp + 0x394], eax
mov eax, dword [esp + 0x398]
mov ecx, dword [esp + 0x394]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x1d4], 0
mov eax, dword [esp + 0x1d8]
mov ecx, dword [esp + 0x1d4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0041d600
mov dword [esp + 0x27c], 0
mov eax, dword [esp + 0x280]
mov ecx, dword [esp + 0x27c]
mov eax, dword [eax + ecx*4]
jmp eax
mov dword [esp + 0x40], edx
mov al, byte [esp + 0x14]
mov byte [esp + 0x20], al
mov byte [esp + 0x24], 0x46
mov byte [esp + 0x25], 9
mov byte [esp + 0x26], 0x62
mov byte [esp + 0x27], 0xf
mov byte [esp + 0x28], 0xc
mov byte [esp + 0x29], 0xd
mov eax, 6
mov byte [esp + eax + 0x24], 0
add eax, 1
cmp eax, 0xc
jne 0x43e2ed
xor eax, eax
cmp eax, 0xc
jae 0x43e337
movzx edx, byte [esp + eax + 0x24]
mov ecx, eax
add ecx, 0x32e0e002
mov esi, edx
add esi, 1
mov edi, edx
xor edi, 0xffffffff
mov ebx, ecx
or ebx, edi
add ebx, esi
shl ebx, 1
add ecx, edx
sub ecx, ebx
mov ebx, dword [esp + 0x3f4]
add cl, 0xf6
mov byte [esp + eax + 0x24], cl
add eax, 1
jmp 0x43e2fc
mov esi, ebx
add esi, 2
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0043e6b0
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x20c], ecx
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
mov eax, dword [eax + ecx*4]
jmp eax
cmp eax, 0xe44ad2c3
mov dword [0x848b4672], eax
and al, 0x8c
add byte [eax], al
add byte [ebx + 0x90248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x80]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x120]
mov ecx, dword [esp + 0x11c]
mov eax, dword [eax + ecx*4]
jmp eax
add edx, 0xfffffffe
mov eax, dword [esp + 0x1c4]
mov ecx, dword [esp + 0x1c8]
mov ecx, dword [ecx + eax*4]
mov eax, edx
jmp ecx
call fcn.0041d600
mov dword [esp + 0x1dc], 1
mov eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1dc]
mov eax, dword [eax + ecx*4]
jmp eax
adc dword [edi - 0x7663ba3d], esi
aaa
jge 0x43e48d
mov dword [esi], 0x448b0000
and al, 0x5c
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + eax*4]
jmp eax
mov edx, dword [esp + 0x2d4]
mov esi, dword [esp + 0x2d8]
mov edx, dword [esi + edx*4]
jmp edx
call fcn.0041d600
mov dword [esp + 0x2bc], 0
mov eax, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2bc]
mov eax, dword [eax + ecx*4]
jmp eax
inc edi
test byte [esp], ah
add al, byte [eax]
add byte [ecx], al
add byte [eax], al
add byte [ebx + 0x2e82484], cl
add byte [eax], al
mov ecx, dword [esp + 0x2e4]
mov eax, dword [eax + ecx*4]
jmp eax
aas
dec edi
invalid
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x98]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0041d600
mov cx, word [ebp + 4]
xor eax, eax
sub cx, 0x5c
sete cl
mov dword [esp + 0x184], 1
mov edx, dword [esp + 0x188]
mov esi, dword [esp + 0x184]
mov edx, dword [edx + esi*4]
jmp edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov edi, dword [esp + 0xc]
mov dword [esp], edi
call fcn.0041d350
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x168]
mov eax, dword [ecx + eax*4]
jmp eax
mov edx, dword [esp + 0x22c]
mov ebx, dword [esp + 0x230]
mov edx, dword [ebx + edx*4]
jmp edx
and bl, 1
movzx eax, bl
add esp, 0x3dc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0xec]
mov edx, dword [esp + 0xf0]
mov ecx, dword [edx + ecx*4]
jmp ecx
add esi, 0xfffffffe
mov eax, dword [esp + 0x294]
mov ecx, dword [esp + 0x298]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x17c], eax
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x17c]
mov eax, dword [eax + ecx*4]
mov esi, dword [esp + 0xc]
jmp eax
call fcn.0041d600
xor eax, eax
mov ecx, dword [esp + 0x3c]
sub ecx, 0x2e
sete cl
mov dword [esp + 0x234], 1
mov edx, dword [esp + 0x238]
mov ebx, dword [esp + 0x234]
mov edx, dword [edx + ebx*4]
jmp edx
mov ecx, dword [esp + 0x2ac]
mov edx, dword [esp + 0x2b0]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov edi, ebp
add edi, 2
mov eax, dword [esp + 0x34c]
mov ecx, dword [esp + 0x350]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx + eax*4]
mov bl, 1
jmp eax
mov esi, dword [esp + 0xc]
mov word [esi], 0x5c
mov eax, dword [esp + 0x384]
mov ecx, dword [esp + 0x388]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp], ebp
call fcn.0041d5e0
mov ecx, dword [esp + 0x3ac]
mov edx, dword [esp + 0x3b0]
mov ecx, dword [edx + ecx*4]
jmp ecx
int3
mov eax, dword [case.0x43cbaa.135]
nop
nop
nop
jmp eax
mov dword [esp], 0x313e3f0c
mov word [esp + 4], 0
mov esi, 0x35
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + esi - 0x35]
mov ebx, edx
and ebx, esi
mov eax, ebx
or al, 0xfd
inc al
mov ecx, ebx
and cl, 0x3d
mul cl
mov ecx, eax
add cl, dl
mov eax, ebx
shr al, 1
and al, 1
or bl, 2
mul bl
add al, al
sub cl, al
movzx eax, cl
add eax, esi
add al, 0xf7
mov byte [esp + esi - 0x35], al
inc esi
cmp esi, 0x3b
jne 0x43fc40
mov eax, dword [esp]
mov eax, dword fs:[eax]
push edi
push 0
push dword [eax + 0x18]
call dword [0x45ae18]
add esp, 8
pop esi
pop edi
pop ebx
ret
int3
les eax, [ebx]
mov ebp, 0xa40043c4
leave
inc ebx
add byte [edx], dl
lds eax, [ebx]
invalid
enter 0x43, 0x1e
enter 0x43, 0xffffffffffffffe0
enter 0x43, 0xffffffffffffffa0
enter 0x43, 0xffffffffffffffd0
enter 0x43, 0xffffffffffffffe0
enter 0x43, 0xffffffffffffffe9
enter 0x43, 0xfffffffffffffff3
enter 0x43, 0x10
leave
inc ebx
add cl, bh
enter 0x43, 0x10
leave
inc ebx
add byte [esi], ah
leave
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [esi], ah
leave
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax - 0x37], al
inc ebx
add byte [ecx + ecx*8], dh
inc ebx
add byte [ecx - 0x37], cl
inc ebx
add byte [eax - 0x37], al
inc ebx
add byte [eax - 0x37], dh
inc ebx
add byte [edx - 0x37], dl
inc ebx
add byte [eax - 0x37], dh
inc ebx
add byte [esi - 0x4dffbc37], al
retf 0x43
retf