Function at 0x1000fe00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001d01f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x88
call fcn.1000fc80
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x1001e304
nop
nop
nop
nop
nop
add ebx, 0
add ebx, 0
add esp, 0xa
sub esp, 0xa
add ebx, 0
add ebx, 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x1f
ja case.0x1000fe76.1
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov al, byte [ecx + 0x10010141]
jmp dword [eax*4 + 0x10010139]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov dword [edx + 0x70], eax
jmp 0x1000fe92
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x70], 8
mov ecx, dword [ebp - 0x14]
call fcn.10010b64
and eax, 0xff
test eax, eax
jne 0x1000fec8
call dword [0x10025df4]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x10c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x10c]
push ecx
call dword [0x10025df8]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x10], 0xcc0020
mov ecx, dword [ebp - 0x14]
mov byte [ecx + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov eax, 0x3e8
xor edx, edx
div dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 0x14]
mov cl, byte [ebp + 0xc]
mov byte [eax + 0xc], cl
push 0
call dword [0x10025e00]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x28], eax
push 1
call dword [0x10025e00]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x2c], eax
mov ecx, dword [ebp - 0x14]
mov eax, 0x20
cdq
idiv dword [ecx + 0x70]
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x24], al
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x44]
push edx
call dword [0x10025d84]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x4c], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
push eax
call dword [0x10025d84]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x80], eax
push 0
call dword [0x10025d84]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x48], eax
push 0
call dword [0x10025d84]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x50], eax
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x5c], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x60], 0
push 1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x70]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.10010728
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x64], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x70]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.10010728
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x68], eax
push 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x70]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.10010728
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x6c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 0x5c
push edx
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x64]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
push eax
call dword [0x10025d80]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x54], eax
push 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 0x60
push edx
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
push eax
call dword [0x10025d80]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x58], eax
push 0
push 0
mov edx, dword [ebp - 0x14]
add edx, 0x78
push edx
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x44]
push eax
call dword [0x10025d80]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x84], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x58]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x4c]
push edx
call dword [0x10025d7c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x48]
push eax
call dword [0x10025d7c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x84]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x80]
push ecx
call dword [0x10025d7c]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
push edx
push 0
push 0
mov eax, dword [ebp - 0x14]
add eax, 0x34
push eax
call dword [0x10025dfc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x68]
mov esi, dword [ebp - 0x14]
mov eax, dword [ecx + 0x14]
xor edx, edx
div dword [esi + 0x2c]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x74], eax
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
ja 0x1002023b
add byte [eax + eax], dh
push edx
insb byte es:[edi], dx
je 0x1002023d
add byte [edx + 0x65], dl
push edx
insb byte es:[edi], dx
popal
jae 0x100202aa
inc esp
inc ebx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x10020291
jne 0x100202c2
jae 0x100202c1
jb 0x100202a4
outsd dx, dword [esi]
jae 0x10020257
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x100202a1
jne 0x100202d2
jae 0x100202d1
jb 0x100202ad
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x100202be
jb 0x100202df
arpl word [ebp + 0x73], sp
jae 0x100202cc
imul ebp, dword [esi + 0x64], 0x7453776f
popal
je 0x100202e8
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x70], cl
dec edi
jo 0x100202ec
outsb dx, byte [esi]
push edi
imul ebp, dword [esi + 0x64], 0x7453776f
popal
je 0x100202fc
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax + eax], dh
inc edi
je 0x100202ee
jb 0x1002030f
arpl word [ebp + 0x73], sp
jae 0x100202fc
jae 0x10020317
push edi
imul ebp, dword [esi + 0x64], 0x7453776f
popal
push ebx
je 0x1002030e
je 0x10020318
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1002030f
imul ebp, dword [esi + 0x64], 0x6854776f
jb 0x10020326
push 0x64616572
push eax
popal
push eax
jb 0x10020335
arpl word [ebp + 0x73], sp
jae 0x10020314
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
dec ecx
jae 0x1002032a
push edi
imul ebp, dword [esi + 0x64], 0x6956776f
jae 0x10020345
bound ebp, qword [ebp]
add byte [eax], al
inc ebx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1002034c
inc esp
jae 0x10020356
je 0x1002035c
jo 0x100202ef
add byte [eax + eax], dh
push ebx
je str.OpenDesktopA
je 0x100202f1
add byte [ebx + 0x65], dl
push ebx
je str.OpenDesktopA
push 0x64616572
inc esp
jae str.CreateWindowExA
je 0x10020370
jo 0x10020303
jb 0x10020305
add byte [edi + 0x70], cl
dec edi
jo 0x1002036e
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
jo 0x10020383
je 0x10020354
inc esp
jae 0x1002037e
je 0x10020384
outsd dx, dword [esi]
jo 0x10020317
jb 0x10020319
add byte [eax], al
inc edi
je 0x10020373
add byte [edi + 0x65], al
inc edi
je 0x10020373
jae 0x10020385
jb 0x10020371
bound ebp, qword [edx + 0x65]
arpl word [ecx + ecx*2 + 0x6e], si
je 0x10020371
outsb dx, byte [esi]
outsw dx, word [esi]
outsd dx, dword [esi]
jb 0x1002039a
popal
je 0x10020399
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1002038e
push 0x64616572
inc esp
jae 0x100203ae
je 0x100203b4
jo 0x10020347
arpl word [eax], ax
add byte [edi + 0x70], cl
dec edi
invalid
dec edi
jo 0x100203b2
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
inc esp
jae 0x100203bd
je 0x100203c3
jo 0x10020397
add byte [eax], bh
add byte [eax + 0x6f], dl
push eax
outsd dx, dword [esi]
jae 0x100203d2
dec ebp
jae 0x100203d5
popal
inc ecx
add byte [eax], bh
add byte [ebx + 0x72], al
inc ebx
jb 0x100203d2
popal
inc ebx
jb 0x100203d2
popal
je 0x100203d5
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsd dx, dword fs:[esi]
ja 0x100203bc
js str.CreateCompatibleDC
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x100203e6
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [ecx + 0x73], cl
dec ecx
jae 0x100203e4
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x10020388
add byte [eax], al
dec ecx
jae 0x100203e4
imul ebp, dword [esi + 0x64], 0x6e00776f
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x10020393
outsb dx, byte [esi]
add byte [eax], al
push ebx
insb byte es:[edi], dx
arpl word gs:[edi + ecx*2 + 0x62], si
arpl word [edi + ecx*2 + 0x62], si
push 0x65
arpl word [eax + eax + 0x10], si
add byte [eax], al
inc ebx
jb 0x1002040e
popal
je 0x10020411
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
je 0x1002041d
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ebx], al
add byte [ebx + 0x72], al
inc ebx
invalid
inc ebx
jb 0x10020422
popal
popal
je 0x10020425
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x10020426
je str.IsValidSid
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [ebp], ch
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
je 0x1002043b
dec edi
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 0x62], si
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1002044b
je 0x1002044b
inc esp
inc ebx
add bh, bh
add byte [eax], al
inc edx
imul esi, dword [edx + eax*2 + 0x6c], 0xff0074
add byte [edi + 0x65], al
inc edi
je str.LookupAccountNameA
dec ecx
inc edx
imul esi, dword [ebx + esi*2], 0x72430000
inc ebx
jb 0x1002046a
popal
je 0x1002046d
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1002046e
je 0x10020478
imul esp, dword [edx + 0x6c], 0x74694265
insd dword es:[edi], dx
popal
jo 0x10020419
bound ebp, qword [ebp + 0x42]
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0xa0070
or al, byte [eax]
add byte [edi + 0x70], cl
dec edi
jo 0x10020484
outsb dx, byte [esi]
jo 0x10020484
outsb dx, byte [esi]
push eax
jb 0x10020492
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x1002049a
jae 0x1002047c
push esp
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0
adc byte [eax], al
add byte [ecx + 0x73], cl
dec ecx
jae 0x10020489
dec ecx
jae 0x10020489
popal
insb byte es:[edi], dx
imul esp, dword [ebx + edx*2 + 0x69], 0x6e0064
add byte [edi + ebp*2 + 0x6f], cl
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
imul esi, dword [ebp + 0x70], 0x41
arpl word [ebx + 0x6f], sp
jne 0x100204b8
je 0x1002049a
dec esi
popal
insd dword es:[edi], dx
inc ecx
add byte [edi], ch
add byte [ebx + esi*2 + 0x61], cl
dec esp
jae 0x100204b8
dec edi
jo 0x100204bf
outsb dx, byte [esi]
push eax
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x79], 0x4c000000
dec esp
jae 0x100204c8
inc esi
jb 0x100204cf
dec ebp
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x100204ea
add byte [eax], al
add byte [edx + 0x65], dl
push edx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x100204e1
dec ebx
jns 0x10020480
add byte [eax], al
push edx
push ecx
push ecx
jne 0x100204ed
jb 0x10020503
jns 0x100204e1
push esi
popal
insb byte es:[edi], dx
jne 0x100204f4
inc ecx
add byte [eax + eax], ah
add byte [eax], al
push edx
dec edi
jo 0x100204ff
outsb dx, byte [esi]
dec ebx
jns 0x100204e4
js 0x100204e2
add byte [eax], al
add byte [ebx + 0x6c], al
outsd dx, dword [esi]
jae 0x1002050e
push ebx
jb 0x10020523
imul esp, dword [ebx + 0x65], 0x646e6148
insb byte es:[edi], dx
add byte gs:[edi], ch
add byte [ebp + 0x6c], al
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x10020525
push ebx
push ebx
jb 0x1002053a
imul esp, dword [ebx + 0x65], 0x43000000
add byte [eax], al
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020541
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
jb 0x1002054b
imul esp, dword [ebx + 0x65], 0x7400
push ecx
jne 0x10020544
jb 0x1002055a
push ebx
jb 0x1002055b
jbe 0x1002054f
imul esp, dword [ebx + 0x65], 0x74617453
jne 0x10020561
arpl word [ebp + 0x53], sp
je str.GetNamedSecurityInfoA
popal
je 0x10020562
jae 0x100204ef
add byte [edi], ch
add byte [edi + 0x70], cl
outsd dx, dword [esi]
add byte [eax], al
dec edi
jo 0x1002055a
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
push ebx
jb 0x10020570
imul esp, dword [ebx + 0x65], 0x410041
add byte [edi + 0x70], cl
outsb dx, byte gs:[esi]
inc ecx
add byte [eax], al
dec edi
jo 0x1002056a
outsb dx, byte [esi]
push ebx
inc ebx
dec ebp
popal
outsb dx, byte [esi]
popal
jb 0x10020551
jb 0x10020551
add byte [ecx], bh
add byte [ebx + 0x65], dl
push ebx
je 0x10020566
popal
insd dword es:[edi], dx
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x49], 0x416f666e
jns 0x1002056e
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [edx + 0x75], al
inc edx
jne 0x10020598
insb byte es:[edi], dx
inc ebp
js 0x100205a4
insb byte es:[edi], dx
invalid
arpl word [ecx + 0x74], bp
inc ecx
arpl word [ebx + 0x65], sp
jae 0x100205b2
push edi
imul esi, dword [eax + ebp*2 + 0x4e], 0x41656d61
je 0x100205ab
dec esi
popal
insd dword es:[edi], dx
inc ecx
add byte [eax], al
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1002059e
inc edi
je 0x1002059e
dec esi
popal
insd dword es:[edi], dx
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x49], 0x416f666e
je 0x100205d5
jns 0x100205a6
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
invalid
add byte [eax], al
push ebx
je 0x100205ad
je 0x100205ad
outsb dx, byte [esi]
je 0x100205dd
jb 0x100205d5
imul esp, dword [ebp + 0x73], 0x63416e49
insb byte es:[edi], dx
inc ecx
add byte [ebp], ah
add byte [edx + 0x65], dl
push edx
push ecx
jae 0x100205b8
dec ecx
outsb dx, byte [esi]
inc ecx
arpl word [ecx + eax*2], bp
add byte gs:[eax], al
push edx
push ecx
jne 0x100205e3
jb 0x100205f9
push esi
popal
insb byte es:[edi], dx
jne 0x100205ea
inc ebp
js 0x100205c9
add byte [ebp], ah
add byte [edx + 0x65], dl
push edx
dec edi
jo 0x100205f7
outsb dx, byte [esi]
dec ebx
jns 0x100205d8
add byte [eax], al
add byte [edx + 0x65], dl
push edx
push ebx
je 0x100205f7
popal
insb byte es:[edi], dx
jne 0x1002060a
inc ebp
js 0x100205e9
add byte [eax], al
add byte [eax], al
push edx
add byte [edx + 0x65], dl
push edx
inc ebx
inc ebx
jb 0x10020617
popal
je 0x1002061a
dec ebx
jns 0x100205fe
inc ebp
js 0x100205fc
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x10020628
inc ebp
jbe 0x1002062b
outsb dx, byte [esi]
je 0x10020615
outsd dx, dword [esi]
add byte [bx + si], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
popal
jb 0x10020619
jbe 0x1002063b
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x10020625
dec esp
outsd dx, dword [esi]
inc ecx
add byte [ecx], ch
add byte [edi + 0x70], cl
dec edi
jo 0x10020648
outsb dx, byte [esi]
imul eax, dword [eax], 0x65704f00
dec edi
jo 0x10020648
outsb dx, byte [esi]
inc ebp
jbe 0x1002064c
outsb dx, byte [esi]
je 0x10020636
dec esp
outsd dx, dword [esi]
inc ecx
add byte [eax], al
add byte [ecx + 0x64], al
inc ecx
push 0x75
jae 0x1002066a
push esp
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0x50
outsb dx, byte gs:[esi]
push eax
jb 0x10020667
jbe 0x10020669
insb byte es:[edi], dx
jae 0x10020606
add byte [eax], al
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
imul esi, dword [ebp + 0x70], 0x50
jb str.AddAccessAllowedAce
jbe 0x1002067c
insb byte es:[edi], dx
push esi
push esi
push esi
popal
insb byte es:[edi], dx
jne 0x10020681
inc ecx
add byte [eax], al
add byte [esi + 0x72], al
inc esi
jb 0x10020688
push ebx
imul esp, dword [eax + eax], 0x67655200
push edx
push ebx
add byte [eax], al
push edx
push ebx
je 0x1002067c
jns 0x10020687
arpl word gs:[ebp + 0x72], si
jne 0x100206aa
imul esi, dword [ecx + edi*2], 0x65530000
push ebx
invalid
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
invalid
je 0x10020695
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x6144726f
arpl word [edx + 0x69], si
jo 0x100206c5
outsd dx, dword [esi]
jb 0x10020698
popal
arpl word [eax + eax], bp
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
arpl word gs:[ebp + 0x72], si
jne 0x100206db
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x726f
add byte [eax], al
je 0x100206e5
inc esp
jae 0x100206d3
jb 0x100206db
jo 0x100206e8
outsd dx, dword [esi]
jb 0x10020677
add byte [eax], al
add byte [ecx + 0x64], al
inc ecx
invalid
inc ecx
inc ecx
inc ecx
arpl word [ebx + 0x65], sp
jae 0x100206f6
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
ja 0x100206ee
inc ecx
arpl word [ebp], sp
add byte [eax], al
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x6c6341
add byte [eax], al
inc edi
je 0x100206f0
jp 0x100206ff
inc ecx
arpl word [eax + eax], bp
add byte [edi + 0x65], al
inc edi
je 0x100206f0
outsb dx, byte gs:[esi]
je 0x10020711
push ebx
imul esp, dword [eax + eax + 0x69], 0x6c410000
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
inc ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
imul esp, dword [eax + eax + 0x72], 0x65520000
push edx
inc ebp
outsb dx, byte [esi]
jne 0x10020740
push esi
popal
insb byte es:[edi], dx
jne 0x1002073d
inc ecx
add byte [eax], al
add byte [edx + 0x65], dl
push edx
inc ebp
outsb dx, byte [esi]
jne str.RegisterServiceCtrlHandlerA
dec ebx
jns 0x1002072c
jns 0x1002072c
js 0x1002072a
inc ecx
add byte [eax], al
add byte [edx + 0x65], dl
push edx
invalid
inc esp
insb byte es:[edi], dx
je 0x1002075a
push esi
popal
insb byte es:[edi], dx
jne 0x1002075f
inc ecx
add byte [eax], al
add byte [edx + 0x65], dl
push edx
inc esp
inc esp
insb byte es:[edi], dx
je 0x1002076c
dec ebx
jns 0x1002074c
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb 0x10020776
popal
popal
je 0x10020779
push eax
jb 0x10020786
arpl word [ebp + 0x73], sp
jae 0x1002075d
jae 0x10020773
jae 0x10020785
jb 0x10020763
add byte [esi], ch
add byte [ebx + 0x65], dl
push ebx
je 0x1002077e
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0x49
outsb dx, byte gs:[esi]
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x100207a1
popal
je 0x100207a0
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebp + esi*2 + 0x70], al
inc esp
jne 0x100207af
jne 0x100207af
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6f546574
imul esp, dword [ebp + 0x6e], 0x45
js 0x1002074d
add byte [edx], dh
jb 0x1002074f
add byte [edx + 0x65], dl
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
jb 0x100207d2
imul esp, dword [ebx + 0x65], 0x6c727443
arpl word [ebp + 0x43], sp
inc ebx
je 0x100207d4
insb byte es:[edi], dx
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
jb str.SHGetSpecialFolderPathA
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x100207c5
add byte [eax], al
push ebx
je 0x100207c5
jb 0x100207eb
jb 0x100207eb
imul esp, dword [ebx + 0x65], 0x74617453
jne 0x100207f1
je 0x100207dc
je 0x100207f2
jae 0x1002077f
add byte [eax], al
add byte [eax], al
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
add byte [eax], al
add byte [edi + ebp*2 + 0x6f], cl
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
imul esi, dword [ebp + 0x70], 0x41
jne 0x100207f8
inc ecx
arpl word [ebx + 0x6f], sp
jne 0x100207fc
je 0x100207e3
imul esp, dword [ecx + eax*2], 0x65470000
inc edi
je 0x100207ee
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0x49
outsb dx, byte [esi]
outsw dx, word [esi]
outsd dx, dword [esi]
jb 0x10020811
popal
je 0x10020810
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x48], dl
push ebx
dec eax
push ebx
dec eax
inc edi
je 0x10020805
jo 0x10020819
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x1002080f
popal
je 0x1002082a
inc ecx
add byte [eax], al
add byte [ebx + 0x48], dl
push ebx
dec eax
inc edi
je 0x10020812
imul ebp, dword [ebp + 0x49], 0x416f666e
outsd dx, dword [esi]
inc ecx
add byte [esi], ch
add byte [ebx + 0x48], dl
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
je 0x10020845
dec ebx
jns 0x10020825
inc ecx
add byte [eax], dl
add byte [eax], al
ja 0x1002084b
jbe 0x10020851
dec ecx
dec ecx
outsb dx, byte [esi]
push ebx
je 0x10020852
jb 0x10020867
je 0x100207f4
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x10020859
add byte [eax], al
ja 0x10020859
jbe 0x1002085f
dec ecx
outsb dx, byte [esi]
inc ecx
inc edx
jne 0x10020868
jb 0x10020806
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x1002086b
add byte [eax], al
ja 0x1002086b
jbe 0x10020871
dec ecx
outsb dx, byte [esi]
push eax
jb 0x10020876
jo 0x10020874
jo 0x10020874
popal
jb 0x1002087a
dec eax
popal
jb 0x1002081c
jb 0x1002081c
add byte [eax], al
ja 0x10020881
jbe 0x10020887
dec edi
jne 0x10020899
push eax
jb 0x1002088d
jo 0x1002088b
jb 0x10020891
dec eax
popal
jb 0x10020833
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x10020899
jbe 0x1002089f
dec edi
jne 0x100208b1
dec edi
jo 0x100208a5
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x61], dh
popal
jbe 0x100208ad
dec ecx
outsb dx, byte [esi]
inc edi
je 0x1002089c
jne 0x100208bd
inc esp
jbe 0x100208c7
jbe 0x100208c7
add byte [eax], al
add byte [eax], al
push edi
push ebx
inc ecx
dec ecx
outsd dx, dword [esi]
arpl word [esp + ebp*2], si
inc dword [eax]
add byte [edi + 0x65], al
inc edi
je 0x100208bd
insb byte es:[edi], dx
add bh, bh
add byte [eax], al
inc edi
je 0x100208bd
push ebp
jae 0x100208cf
jb 0x100208bc
push eax
jb 0x100208dd
imul bp, word [ebp + 0x44], 0x7269
arpl word gs:[edi + ebp*2 + 0x72], si
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jb 0x100208db
arpl word [edi + ebp*2 + 0x72], si
jns 0x100208bd
add byte [eax], dl
add byte [eax], al
inc edi
je 0x100208d4
jb 0x100208f5
imul bp, word [ebp + 0x73], 0x6944
imul ebp, dword [ebp + 0x73], 0x65726944
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jb 0x100208f4
arpl word [edi + ebp*2 + 0x72], si
outsd dx, dword [esi]
jb 0x1002090d
jns str.InternetOpenA
inc ecx
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
outsb dx, byte [esi]
je 0x10020901
jb 0x1002090c
je 0x100208e4
je 0x100208e4
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1002090a
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x10020917
jb 0x10020922
jb 0x10020922
je 0x10020909
popal
inc esi
imul ebp, dword [ebp], 0x49000072
dec ecx
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edx], dh
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x1002092b
jb 0x10020936
outsb dx, byte [esi]
je 0x1002091a
jo 0x10020932
outsb dx, byte [esi]
push ebp
jb 0x1002093d
inc ecx
add byte [edx], dh
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x1002093f
jb 0x1002094a
outsb dx, byte [esi]
je 0x1002092e
je 0x1002092e
jo 0x10020946
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
add byte [eax], al
arpl word [ecx + 0x70], sp
inc edi
je 0x10020931
jb 0x10020958
jbe 0x10020956
jb 0x10020937
jae 0x10020959
jae 0x10020959
arpl word [edx + 0x69], si
jb 0x10020961
jo 0x1002096e
imul ebp, dword [edi + 0x6e], 0x100041
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc ebx
jb 0x1002096d
popal
je 0x10020970
inc ebx
inc ebx
popal
jo 0x10020983
jne 0x10020983
push edi
imul ebp, dword [esi + 0x64], 0x41776f
ja 0x1002095a
add byte [eax], al
add byte [edi + 0x54], dl
push edi
push esp
add byte [eax], al
push edi
push esp
push ebx
push ecx
jne 0x10020987
jb 0x1002099d
push ebp
jae 0x1002098c
jb 0x1002097d
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0
outsb dx, byte gs:[esi]
add byte [eax], al
add byte [edi + 0x54], dl
push edi
push esp
add byte [eax], al
push edi
push esp
push ebx
inc esi
jb 0x1002099b
dec ebp
dec ebp
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x100209b6
add byte [eax], al
add byte [edi + 0x54], dl
push edi
push esp
push ebx
push ecx
jne 0x100209ab
jb 0x100209c1
push ebx
jae 0x100209bf
jae 0x100209bf
imul ebp, dword [edi + 0x6e], 0x6f666e49
jb 0x100209c2
popal
je 0x100209c1
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x100209b2
push eax
jb 0x100209d3
arpl word [ebp + 0x73], sp
jae 0x100209b6
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x100209e7
jns 0x100209b8
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [eax], al
inc edi
je 0x100209c7
outsd dx, dword [esi]
jne 0x100209ea
insb byte es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
dec esi
popal
insd dword es:[edi], dx
inc ebp
inc ebp
js 0x100209cb
add byte [eax], al
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x100209ff
push eax
jb 0x10020a04
arpl word [ebp + 0x73], sp
jae 0x100209e7
outsd dx, dword [esi]
jne 0x10020a0a
insb byte es:[edi], dx
jae 0x100209a1
add byte [eax], al
add dh, ah
push 0x675e1001
add dword [eax], edx
nop
add dword [bx + si], edx
mov byte [0xb4100167], al
add dword [bx + si], edx
adc byte [eax - 0x5deffe99], dl
add dword [bx + si], edx
add dword [eax], edx
mov ah, 0x67
add dword [eax], edx
invalid
adc byte [edx + ebp*2 + 0x6a721001], al
push 1
adc byte [edx + 0x6a], dh
add dword [eax], edx
jb 0x10020a30
add dword [eax], edx
pushal
push 1
adc byte [eax + 0x6a], ah
add dword [eax], edx
dec esi
push 1
adc byte [edx + ebp*2], bh
adc byte [esi + 0x6a], cl
add dword [eax], edx
cmp al, 0x6a
add dword [eax], edx
sub ch, byte [edx + 1]
adc byte [edx], ch
push 1
adc byte [eax], bl
push 1
adc byte [esi], al
push 1
adc ah, dh
imul eax, dword [ecx], 0x169e210
adc al, dl
imul eax, dword [ecx], 0x169be10
adc byte [ecx + ebp*2 + 0x699a1001], ch
add dword [eax], edx
mov byte [ecx + 1], ch
adc byte [esi + 0x69], dh
add dword [eax], edx
imul eax, dword fs:[ecx], 0x1695210
adc byte [eax + 0x69], al
add dword [eax], edx
mov esi, 0xac100169
imul eax, dword [ecx], 0x1699a10
adc byte [eax + 0x76100169], cl
imul eax, dword [ecx], 0x1696410
adc byte [ecx + ebp*2 + 1], ah
adc byte [edx + 0x69], dl
add dword [eax], edx
inc eax
imul eax, dword [ecx], 0x1692e10
adc byte [ecx + ebp*2], bl
add dword [eax], edx
or ch, byte [ecx + 1]
adc al, bh
push 0x677e1001
push edx
imul eax, dword [ecx], 0x1694010
adc byte [esi], ch
imul eax, dword [ecx], 0x1691c10
add dword [eax], edx
imul eax, dword cs:[ecx], 0x1691c10
adc byte [edx], cl
imul eax, dword [ecx], 0x168f810
adc byte [esi + 0x67], bh
add dword [eax], edx
aam 0x68
add dword [eax], edx
ret 0x168
mov word [eax + 1], gs
adc byte [edx + 0x68], bh
add dword [eax], edx
push 0x56100168
push 0x68441001
add dword [eax], edx
xor ch, byte [eax + 1]
adc byte [eax], ah
push 0x680e1001
add dword [eax], edx
cld
add dword [bx + si], edx
ljmp 0x167