Function at 0x10012ce5
Capabilities:
Authenticate hmac
Check os version
Get common file path
Get hostname
Get system information on windows

Disassembly:
add cl, ch
inc ebp
pop es
add byte [eax], al
inc dword [ebp - 0x8c]
lea eax, [ebp - 0x88]
push str..DEFAULT
push eax
call fcn.1011f079
pushfd
test byte [0x100123fd], 0xcc
jne 0x100123fe
stc
loop 0x10012404
popfd
pop ecx
pop ecx
test eax, eax
pushfd
test byte [0x100124c3], 0x75
jne 0x100124c4
test dword [ebx + 0x31000000], esi
cmpsb byte [esi], byte es:[edi]
cmp dword [ebx - 6], esp
xor dword [esi + 0x41fa6339], esp
cli
inc ecx
fsubr dword [ecx - 0x31]
sub dword [ebx], esp
ror ah, 1
stc
je 0x10012415
dec edi
xchg esi, eax
sub edx, dword [edi + edx*4]
or esp, dword [esi - 0x7d49dcc1]
dec ebx
sbb eax, dword [ebx - 0x2c]
xor al, 0x86
xor byte [ebp + 0x1dd96a2f], bh
lodsd eax, dword [esi]
mov al, byte [0x893032c1]
push edi
imul ebp, dword [edx], 0x34
lahf
lodsb al, byte [esi]
aas
dec ebp
jb 0x100123d4
adc al, 0x98
scasb al, byte es:[edi]
bound eax, qword [ecx - 0x65548144]
add dword [eax], ecx
scasd eax, dword es:[edi]
pop dword [0x431c2556]
mov ah, 0x8c
mov al, 0xa
mov al, 0x17
int1
adc esi, dword [esi + 0x1c]
jne 0x1001247d
imul esp, dword [edx + 0x55c2cc32], 0xac358acd
loopne 0x1001240c
jno 0x100124a6
cmp dword [ebx - 0x19], edi
popal
xchg dword [ecx - 0x6004bfe4], edx
sti
lahf
call 0x5934b8eb
cmp dh, byte [ecx + 0x25]
sub dword [edi - 0x65], esi
jge 0x1001241a
pushal
jbe 0x10012502
inc ecx
or al, 0xd
xchg ebx, eax
inc ebp
inc esi
dec edi
push esp
jbe 0x10012461
xchg byte [esi + 0x16244ec5], dl
jl 0x100124bf
add dword [edx - 0x36], 0xffffffae
mov cl, 0xad
mov ecx, gs
or cl, ch
retf 0xb1ae
adc ebx, dword [esi - 0x3afcabb0]
test eax, 0xf28f49ce
int 0x65
in al, dx
aam 0x82
lds edx, [ebx]
or al, ch
push ds
adc ecx, dword [edx]
lds ebx, [esi]
pop ebp
popfd
je 0x10012908
lea eax, [ebp - 0x88]
push str.Classes
pushfd
test byte [0x10012588], 0xa1
je 0x10012589
dec eax
leave
sub bl, byte [ecx - 0x7828b0a]
div byte [ebp + edi*2 - 8]
aaa
push ebp
pop esp
cdq
adc al, 0x58
sbb byte fs:[ecx], cl
fsubrp st(4)
outsd dx, dword [esi]
push eax
mov cl, 9
call 0xd18f2a39
sub ecx, 0xffffffb1
jns 0x10012581
mov cl, 0x79
jl 0x100124e8
loop 0x100124ae
cmpsd dword [esi], dword es:[edi]
push es
daa
mov esp, dword [esi]
push edx
xlatb
sbb bl, byte [esi + eax*8]
mov ecx, dword [edi]
popal
push ebp
mov esi, 0x2b93587d
dec edi
ror dword [ecx], 1
mov ch, 0x15
je 0x10012567
pop edi
pushfd
lds edx, [edx - 0x35]
salc
pop ebp
mov ebp, 0x541a726c
dec esp
push ss
cmp byte [esi - 0x54], al
lahf
test al, 0x3f
mov bh, 0xcf
cmpsd dword [esi], dword es:[edi]
fisub word [esi - 0xc]
push cs
sub cl, 0xd9
inc edi
sal dword [edx - 0x37432824], cl
out dx, eax
arpl word [ebx - 0x50039c6b], si
xchg ebp, eax
arpl sp, di
scasd eax, dword es:[edi]
mov al, 0xf3
shr dword [ebp - 0x58], cl
xor al, 0x4b
fbld tbyte [edx]
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
cmc
and ebx, esp
test byte [ebx - 0x5d], ah
leave
or al, 0x4b
pop esp
xchg esi, eax
and dh, byte [edx]
adc byte [esi + 0x5f], ah
pop di
dec edx
mov esi, 0x41ec7634
push edx
jae 0x100125ef
scasb al, byte es:[edi]
out dx, eax
and al, 0xf7
shr byte [0x133a166e], 0xa7
jl 0x10012549
mov eax, dword [0xcb80e821]
push ebp
add al, 0x1b
scasd eax, dword es:[edi]
push es
call 0x1456f106
sbb ebp, dword [edi - 0x17af62fa]
invalid
popfd
push eax
call fcn.1011ed1d
pop ecx
pop ecx
test eax, eax
jne 0x10012908
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x88]
push eax
call sub.ADVAPI32.dll_ConvertStringSidToSidA
test eax, eax
je 0x10012908
call dword [eax - 0x18]
insd dword es:[edi], dx
fimul word [ebx]
add byte [ebp + 0x53840fc0], al
add eax, dword [eax]
add byte [edx + 0x20], ch
push 0x20
lea eax, [ebp - 0x24]
push 0
pushfd
test byte [0x10012644], 0x18
jne 0x10012645
pop esp
dec ecx
xlatb
pop eax
jb 0x100125e6
int3
or ebp, dword [esi + 0x21]
mov ecx, 0xcb413bae
clc
inc ecx
aas
mov ebx, 0x784f5987
not dh
rol byte [ecx + 0x2c], 0x29
jle 0x100125a6
xor esp, ebp
mov al, byte [0xdd27bec]
mov dword [esi], ebx
push edi
mov al, 0x35
sub ebp, dword [edx]
xor byte [esi], ah
cmpsd dword [esi], dword es:[edi]
cmp dword [ebp + 0x20], ecx
jae 0x10012621
jne 0x1001266e
mov al, byte [0x22e83284]
loopne 0x10012601
je 0x100125ca
inc ecx
sbb al, 0xa7
cmovns edx, edx
push es
stosb byte es:[edi], al
xlatb
salc
or al, 0x51
xor dword [ecx], esp
pop esp
aam 0xd1
aad 2
mov dl, 0x46
dec eax
pushal
stosd dword es:[edi], eax
jnp 0x10012684
mov bh, 0xc6
rol dword [ecx], 0x29
adc al, 0x5c
popfd
push eax
call fcn.1011df60
add esp, 0xc
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x98]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x94]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
test eax, eax
je 0x10012908
invalid
pushfd
test byte [0x100126a7], 0x53
cmpsd dword [esi], dword es:[edi]
add dword es:[eax], edx
push ebx
jne 0x100126a8
inc edx
xor eax, 0x80782427
add ebp, dword [esi + 0x1e]
add byte [ebx], 0x6e
push ds
and dword [edi + 0x3c], esi
std
inc esp
test al, 0xd3
xor bh, dh
sbb dword [0x890b9e7b], esi
in al, 0x10
or ebx, edx
xchg ecx, eax
popfd
push esi
call fcn.1011d740
pop ecx
mov ecx, dword [ebp - 0x90]
pushfd
test byte [0x100126ca], 0xcb
jne 0x100126cb
add dword [ecx - 0x2d], esp
arpl word [esi], sp
jge 0x100126fb
mov ah, 0xb8
aam 0x21
popfd
lea eax, [ecx + eax + 2]
cmp eax, dword [ebp + 0x14]
jae 0x10012b27
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.1011f130
push 0x101465b4
push esi
pushfd
test byte [0x1001270c], 0xd2
jne 0x1001280d
push eax
dec dword [edi]
xor bl, byte [ecx]
xlatb
sbb edi, edx
xchg ebx, eax
sbb esp, ebx
jns 0x10012690
push ecx
pop ebp
and dl, ah
add byte [ecx + 0x5dc75876], ch
outsb dx, byte [esi]
test al, 0x12
or ebx, 0xef966125
insd dword es:[edi], dx
bound esp, qword [edi - 0x1aa8f843]
push edx
adc edi, dword [ebx + 0x49]
push es
or dword [eax], edi
lea esi, [ebp - 0x66]
jle 0x10012743
fsub dword [edx + 0x5a]
or al, 7
push cs
and ecx, dword [edi + 0x39dec5eb]
inc esp
pop esi
cld
mov edi, 0x1cbb1968
mov ch, 0x1c
push es
jmp [ecx - 0x5e]
pushfd
push 0x74ca4556
jns 0x10012778
stosb byte es:[edi], al
inc esi
jo 0x10012727
arpl word [edx], ax
arpl word [edx + edi*4 - 0x5d], di
inc esp
loop 0x100127d1
mov dword [0xd779e244], eax
xlatb
out dx, al
push ss
mov bh, 0xd5
push 0xd3edeff4
cmp edx, ebx
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
and eax, esi
push edi
mov edi, 0xe58db790
test byte [ebx - 0x30], al
jb 0x10012754
hlt
dec edi
imul ebp, dword [0x825848d4], 0x4e
cli
popfd
pop eax
or byte [esi - 6], 0x9d
push edx
not byte [ebx + 0x49]
xor byte [ecx], ah
cmp ah, byte [edx + 0x4c4189c2]
and eax, 0x77b04e4f
mov cl, 0x4a
cmpsd dword [esi], dword es:[edi]
arpl word [eax + esi*8 + 0x759d0034], ax
dec eax
xchg esi, eax
add al, 0x1d
pop ss
cmp byte [ebx - 0x2d01e8bf], ah
xchg ecx, eax
mov dword fs:[0x7b56283d], eax
pop edi
leave
out 0xc8, al
jg 0x1001275e
cmp ebp, dword [eax + 0xe]
cmp eax, 0x4a8b296f
lea eax, [eax]
not dword [ebp + edx*8 - 0x1e]
or byte [ecx + 0x38], ch
xor ecx, ebp
leave
enter 0x3c03, 0x2b
and al, 0x86
stosb byte es:[edi], al
imul esp, dword [ebx + ecx + 0x392d8a14], 0x1223d560
cmp dword [eax - 0x2b], esp
and edx, dword [edx]
pop ebx
int3
popfd
call fcn.1011f130
add esp, 0x10
pushfd
test byte [0x10012906], 0x67
jne 0x10012907
inc edx
or esp, eax
mov ebp, 0xe0750f88
sub al, 0x8c
sub ebx, edx
inc edi
int3
invalid
and ecx, dword [ecx]
clc
or eax, edi
movsd dword es:[edi], dword [esi]
jge 0x100128d1
sbb eax, 0x6ad43a39
pop es
or ah, 0xbc
pop edx
aas
push eax
adc eax, 0x31773dba
xchg ebx, eax
pop es
sbb byte [ebx + 0x7b6b1e90], dh
add bh, 0xd3
lahf
or byte [edx - 8], bh
mov ch, 0x48
xor eax, 0x2ae670a8
push ds
xchg dword [ebx + eax*2 - 0x29865e6c], edi
popfd
push 0x64
lea eax, [ebp - 0x88]
pushfd
test byte [0x1001292e], 0xd2
jne 0x10012a2f
je 0x100128d2
add eax, dword [edi + 0x27]
lahf
rcl byte [eax + 0x65], 0x3c
xor al, 0x4e
mov al, 0xf6
sub byte [ebp + 0x2f], bh
call 0x5fe13466
mov ah, 0x5c
insb byte es:[edi], dx
popal
add ah, ch
scasb al, byte es:[edi]
pop esi
xchg ebp, eax
nop
mov ah, 0x38
loopne 0x100128d3
adc byte [edx - 0x3dc49b27], cl
arpl word [ebp + 0x52], bp
inc eax
pop ss
push cs
dec esi
xor esp, dword [ecx + ebp*4]
mov bl, 0x3c
pop ecx
dec ebp
cmpsd dword [esi], dword es:[edi]
jl 0x100129ce
xor al, byte [ecx - 0x56]
rcr dword [eax - 0x1a], 0x6f
inc ecx
add byte [edi], ah
inc esp
or ebx, ecx
popfd
les ecx, [ecx + 0x24]
mov edx, 0x493c7f6b
cmp al, 0x49
pop es
mov edx, 0xbb8d5516
rcr bh, 1
xchg esp, eax
xlatb
inc edx
and eax, 0x7f3d9fe
jl 0x100129ec
fsub qword [esp + esi]
fsub st(3), st(0)
mov ebx, 0x8f5f044f
test al, 0x25
jb 0x10012928
sahf
out dx, al
xchg ebx, eax
mov edx, dword [eax]
sub al, 0x92
xchg edi, eax
sahf
add al, 0xb6
adc ebp, edi
push edi
aaa
jecxz 0x100129c4
cmc
scasd eax, dword es:[edi]
xchg esp, eax
jle 0x10012a16
jnp 0x10012a02
push es
mov esp, dword [eax]
mov ebp, 0x5969cb37
jbe 0x100129b9
jo 0x1001296d
mov bh, 0x6e
outsb dx, byte [esi]
fistp word [esi + 0x40]
inc eax
out dx, al
adc ecx, ecx
cmp eax, 0x69540209
das
mov dl, 0x97
xchg edi, eax
pushfd
cld
mov eax, dword [0xb714ae13]
xor eax, 0x15dfd56b
or dword [eax - 0x72], ecx
mov esp, 0x609adcc6
jbe 0x100129b4
aad 0xdf
adc eax, 0xbc8e4809
invalid
sar ecx, 1
movsb byte es:[edi], byte [esi]
enter 0x4702, 0x6c
cmpsb byte [esi], byte es:[edi]
push 0x4b
mov eax, edi
arpl word [esi + 0x9a6bd1a], dx
add dword [ecx + 0x2c4cb579], 0x8e38deaf
pop ecx
test byte [0xcd261cad], al
or dword [ecx + 0x4cb57981], eax
sub al, 0xaf
fidivr word [eax]
mov ds, word [ecx - 0x7c]
add eax, 0xcd261cad
sub eax, 0x2b9abe28
add edi, dword [ecx - 0x51]
sub eax, dword [ebx]
jns 0x100129b5
int1
push 0x7b
jl 0x10012a0f
sub eax, 0x8ac2b1e4
sub al, bh
enter 0xfffffffffffff888, 0xffffffffffffffc5
aam 0xd0
pop ss
rcl byte [0x3abb6efb], 0x54
jl 0x10012a0b
mov ch, byte [edx]
invalid
invalid
jae 0x10012a4b
sub al, 0xa0
stosb byte es:[edi], al
and byte [esi - 0x10923c2], bh
popfd
push eax
push dword [ebp - 0x8c]
push reloc.WS2_32.dll_closesocket
call edi
pushfd
test byte [0x10012b1d], 0x79
jne 0x10012b1e
add byte [esi - 0x7c], bl
xchg esp, edi
jae 0x10012a58
pop esi
test byte [edi - 0x4df98c04], al
xor edi, dword [edx + 0x4a672aab]
mov dl, 0x33
mov edx, 0x4a672aab
dec edx
dec ebx
out 0xdc, al
fistp qword [edi]
mov eax, 0x8c2adbc1
adc edi, dword [edi + 0x24]
outsb dx, byte [esi]
push 0xffffffffffffff82
shr dword [edx - 0x79], 0xc4
xchg dword [esi + 0x6eaa1a44], ebx
xchg esi, eax
rol dword [ebx + 0x2cb9980c], 0x9a
pushal
cwde
mov edi, edi
out 0x6b, al
or esp, edi
xchg dword [esi - 0x489abe2a], ebp
rol byte [esp + ecx - 0x4123fe12], 0x63
sti
insb byte es:[edi], dx
adc eax, 0xc5b9687b
dec eax
aad 0x68
add dword [esi + ebx*8 + 0x312c036e], ebp
dec edx
pop esi
cld
pop edi
rcl byte [edx], 0x66
cmpsb byte [esi], byte es:[edi]
sahf
in eax, 0x3b
adc al, 0xc9
call 0xa7b7c837
mov esp, 0x6c10e8ba
sar byte [ecx - 0x60], 1
shl byte [eax - 0x7a], cl
mov esp, fs
jnp 0x10012b0f
jo 0x10012b3c
add eax, 0x16a4f5a2
or eax, 0xe9839cb2
outsd dx, dword [esi]
out dx, eax
and cl, dl
cmp dword [eax - 0x2f9647c0], ebp
mov ecx, 0xd1d8a286
out dx, eax
xchg esp, eax
and eax, 0xb4d7cb19
insd dword es:[edi], dx
cmp ecx, dword [edi + 0x61]
cmp esp, dword [esi - 0x72470ab8]
mov dword [esi + ebx + 0x4160833], ebx
jno 0x10012b11
push ss
add al, 0x71
sbb byte [edx - 0xa], dl
xor dword [edi - 0x5b], esp
push edx
div byte [ecx]
movsd dword es:[di], dword [si]
je 0x10012ab0
clc
ja 0x10012ad0
ror dword [esp + ebx*8 - 0x4416b29d], cl
push edi
add ebx, esi
xor edi, ebp
je 0x10012b6d
mov edx, dword [edx + ebx*4 - 0x6457d53c]
mov al, byte [0x6e3882]
pop ss
popfd
cmp eax, ebx
jne 0x100123da
mov ecx, dword [ebp - 4]
pop edi
pushfd
test byte [0x10012bf0], 0x3a
jne 0x10012bf1
pushfd
lds ebx, [eax]
mov bh, 0xd5
and al, 0x16
loopne 0x10012af5
aad 0x24
push ss
insb byte es:[edi], dx
std
push ebp
mov word [esi + 0x7f], gs
sbb dword [edx], esi
sub dh, dh
fnstcw word [ecx + ebp*4 - 0x5d]
xchg dword [ecx + 0x9ce1205], eax
in eax, 0xd0
mov byte [esi], dh
pop ecx
sub eax, 0x1dd682c2
outsd dx, dword [esi]
dec eax
pop ebx
xor byte [esi - 1], 0x2e
xor eax, 0xf602d981
push 0xffffffffffffffa7
mov esp, 0x4fb021bb
cdq
int3
popfd
xor eax, eax
pop esi
xor ecx, ebp
pushfd
test byte [0x10012c3e], 0x7a
jne 0x10012c3f
mov ebx, 0xaa727a5f
adc eax, 0xb00acb0b
mov edx, 0x62d11534
or edx, dword [esi - 0x7ff52152]
nop
adc dword [edx], edx
add eax, 0xa8edece
bound ecx, qword [ebx]
xchg esi, eax
scasb al, byte es:[edi]
fimul word [edx]
adc byte [eax - 0x31faedef], 0xde
mov cs, word [edx]
jno 0x10012c7b
add cl, cl
cmpsd dword [esi], dword es:[edi]
out dx, eax
das
sub al, 0xbb
cdq
sti
cli
in eax, 0x60
stosb byte es:[edi], al
inc ecx
pop esp
sub edi, dword [ebx + 0x6cd36683]
loop 0x10012c39
jle 0x10012c41
pop es
je 0x10012c0f
push esp
fsubr st(5), st(0)
popfd
inc eax
pop ebx
call fcn.1011e48a
leave
ret 0x10
inc edx
insd dword es:[edi], dx
mov edx, 0x9e458d9c
and word [ecx], 0x26e4
sbb al, 0x92
adc dl, byte [edi + ebp]
or al, 0x3e
lea eax, [esi + 0x7d]
pop ds
scasd eax, dword es:[edi]
and dword [esi], 0xdb6a14cf
cmp ch, ch
cmpsd dword [esi], dword es:[edi]
out dx, eax
sbb eax, 0xc8472090
xor byte [0x5e326d6c], dh
fbld tbyte [ebp + 0x6fcacebb]
pop eax
lodsb al, byte [esi]
mov byte [ebp - 0x4fcfb20b], bh
pop eax
out 0xda, al
mov cl, 0x46
push eax
bound edi, qword [edi]
das
pushfd
or ebp, edi
xor dword [edx + 0x21], edi
imul edi, dword [ebx], 0x938cf8ae
mov dword [0xa1a93a5b], eax
int1
cld
pop ebx
aas
push edx
pop ss
pushfd
movsb byte es:[edi], byte [esi]
sub ebp, dword [ebp + 0x38]
inc ebx
cld
jecxz 0x10012c9b
xchg edi, eax
lea eax, [ecx + 0x3b]
mov bl, 0xd0
popfd
push ebp
mov ebp, esp
pushfd
test byte [0x10012de3], 0xe
jne 0x10012de4
or byte [esi], 0x45
pop esp
sub eax, dword [ecx - 0x7ad84f1a]
int3
popfd
sub esp, 0x2fc
mov eax, dword [0x10170c30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
pushfd
test byte [0x10012efe], 0xa9
jne 0x10012eff
add byte [0x2c59549d], ah
and eax, 0x2c59549d
loop 0x10012e06
push ecx
aad 0x24
or al, 0x5b
stosb byte es:[edi], al
cmp al, 0xda
sub byte [ecx], ch
insb byte es:[edi], dx
lodsb al, byte [esi]
add eax, 0x9e372091
xchg esp, eax
push edi
jne 0x10012e05
aaa
dec ecx
pop ebp
or eax, edx
out 0xc0, al
aas
test eax, 0x89a2621b
leave
xchg esp, eax
add eax, 0x6ba43e7
push ds
in eax, 0x89
fisub word [eax + ebp*4]
dec esi
push ebp
dec ebp
pop edx
mov edi, 0x6b19b02
lodsd eax, dword [esi]
popal
mov al, byte [0x1ab00a8b]
dec esp
cmpsb byte [esi], byte es:[edi]
mov ebp, 0x37e3daed
and ecx, ebp
push eax
push edi
mov es, word [edx + 0x23d26728]
and dh, byte [edx]
xchg byte [ebp + 4], dl
sbb byte [ebx + 0x4f], 0x8e
push edi
jb 0x10012e69
inc dword [eax - 0x23d141d7]
inc edx
ljmp 0x592c
sub byte [ecx], 0xbe
fadd qword cs:[edx - 0x16]
stc
aad 3
lodsd eax, dword [esi]
sub al, 0x59
push esp
xor edx, ebp
cmpsd dword [esi], dword es:[edi]
mov esp, 0x76f6cf0c
push cs
xchg esp, eax
mov word [esi - 0x65], ds
fidivr dword [edi]
pop esp
or al, 0xd5
push eax
xchg esi, eax
aaa
add dword [edx - 0x2f], ecx
push ecx
mov cl, 0x45
and edx, dword [ebp + 0x10]
lahf
and byte [ecx - 0x5c], ah
aad 0xe4
mov edx, 0x48e60f21
out 0x48, al
fdivr qword [esi + ebp*4 + 0x2e]
push ecx
insd dword es:[edi], dx
sbb ch, ch
pop ds
adc dh, ah
in eax, 0x4e
aad 0xf2
lodsb al, byte [esi]
adc eax, 0x6f4390b1
mov word [ecx], fs
test al, 0xf2
movsd dword es:[edi], dword [esi]
or ch, byte [eax + 0x41e2e202]
outsb dx, byte [esi]
cmp byte [eax + 0x3b5961e4], al
outsd dx, dword [esi]
jge 0x10012e9f
sbb byte [esi + esi*4], 0x4f
cli
mov bh, 0x65
in al, 0xd2
cmc
and ah, dl
xchg dword [esi], eax
cmpsb byte [esi], byte es:[edi]
mov ecx, 0x5372436b
rcr dword [edi - 0x5d0d60b], 0xaa
xchg ebx, eax
dec eax
ja 0x10012f16
cmc
jo 0xbbc97f44
les ecx, [esi - 0x17]
std
jle 0x10012f3a
inc esi
xchg byte [esi + ebp*4], bh
scasb al, byte es:[edi]
push edi
popfd
lea eax, [ebp - 0x2fc]
push eax
mov ebx, ecx
mov dword [ebp - 0x2d8], 0x200
pushfd
test byte [0x10012fc6], 0x9d
jne 0x10012fc7
invalid
aaa
push esp
sbb byte [ebx + 0x4208e77f], dl
mov ch, 0x69
or eax, 0x1dd1dcbf
out 0x12, al
jae 0x10012f44
mov dword [ebx + esi*4 - 0x5678bff7], 0xcdfd8dcc
test eax, 0xcdfd8dcc
dec ecx
pop ebx
cmpsd dword [esi], dword es:[edi]
sbb al, 0x19
xchg esp, eax
pop ss
mov ah, 0xab
jecxz 0x10012f91
pop dword [edi - 0x6033686a]
mov ah, 0x3c
sub al, 0x61
mov al, byte [0x92e7f492]
cld
xor eax, 0xd4c5d557
mov dl, 0xfb
mov al, byte [0xaeb4a13e]
insd dword es:[edi], dx
and bl, byte [edx - 0x78]
pop es
in al, dx
bound ebp, qword [eax]
popal
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
aad 0xf2
pushfd
dec edx
scasb al, byte es:[edi]
test byte [edi - 0x6087bfef], bh
mov ecx, 0x243ec064
lodsb al, byte [esi]
mov edx, dword [ecx + ecx*4]
jae 0x10012fba
pop ebx
mov esi, 0xdb581446
pushfd
inc esi
jbe 0xa2c1013b
popfd
arpl word [edx], sp
scasd eax, dword es:[edi]
cld
mov cl, bl
stc
in al, 0x15
imul ecx, dword [esi + 0x6311a76c], 0x603d85a8
or dword [0x66ef3bfa], ecx
mov ch, 0xad
adc dword [ebx - 0x58], esp
test dword [0xfa0d0960], edi
cmp ebp, edi
mov ch, 0xad
aad 0xe
add edi, 0x46
les ebx, [eax + 0x747f1d56]
stosd dword es:[edi], eax
xor eax, 0x2c15a407
stc
inc ebx
daa
push esi
sbb eax, 0x35ab747f
pop es
movsb byte es:[edi], byte [esi]
adc eax, 0x2743f92c
popfd
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x2e8]
pushfd
test byte [0x10013059], 0xd8
jne 0x1001305a
in al, 5
add bh, cl
pushfd
xchg ebx, eax
mov bh, 0x96
mov ebx, 0xeda693ff
mov cl, 0x81
sbb ebx, dword [edx + 0x759aad42]
mov eax, ebp
xchg edi, eax
dec ecx
shr dword [ecx - 0xacc34dd], 0xab
retf
stosd dword es:[edi], eax
aad 0xe2
mov al, byte [0x5d844cc8]
add eax, 0x995eed84
xor dh, 0x5d
std
push esp
js 0x10012ffd
movsb byte es:[edi], byte [esi]
lodsd eax, dword [esi]
jns 0x10012fa5
dec edx
xor ch, bh
add bh, ch
sbb eax, edx
rcr byte [eax + 0x15896fd2], 1
cdq
inc ebp
ror byte [esi + ebx*4 + 0x47], 1
fistp dword [esp + edi + 0xc]
push esi
test esp, esp
xchg cl, bh
pop ss
clc
dec ebp
mov dword [ecx - 0x4af1ea73], eax
xchg byte [ebx - 0x10], cl
insd dword es:[edi], dx
pop ds
mov ah, 0x25
adc al, 0x28
xor byte [ebp - 0x212471a0], 0x56
xor al, 0x55
push ebp
inc ebp
xchg edx, eax
lea ebx, [ebx + 0x34]
sal dword gs:[eax + 0x3e], 0x36
inc esp
sahf
xor bh, byte [edx]
popfd
lea eax, [ebp - 0x238]
push 0x10146728
push eax
pushfd
test byte [0x1001307c], 0x41
je 0x1001307d
enter 0xffffffffffffe178, 0xffffffffffffffe6
test al, 0xc8
jnp 0x10012ffa
pop esp
sal dword [eax - 0x68], cl
popfd
call fcn.1011f090
lea eax, [ebp - 0x238]
push eax
lea esi, [ebx + 0x5a0]
push esi
call fcn.1011f120
add esp, 0x14
cmp word [ebp - 0x2dc], 5
mov edi, 0x10146718
ja 0x1001330a
pushfd
test byte [0x100130ce], 0xc6
jne 0x100131cf
jbe 0x1001304b
scasd eax, dword es:[edi]
xchg esp, eax
je 0x100130e8
xchg edi, eax
dec edi
dec esp
adc eax, 0xc62f5718
or al, 0xa5
insd dword es:[edi], dx
in eax, 0x9a
mov ecx, 0x58755897
pop ss
add al, 0xad
mov eax, 0x87448790
lahf
nop
xchg dword [edi + eax*4 - 0x61], eax
mov bl, 0xf1
bound edx, qword [esi + 0x50]
arpl word [eax + 0x16f6c1a8], sp
jb 0x100130d6
lds edx, [ecx]
out dx, eax
lea eax, [ebx + 0x64913d38]
push 0x3f
mov ch, 0xbd
sbb al, 0x62
fdivr dword [eax]
imul byte gs:[eax - 0x47]
mov edx, 0xbbea4ce7
fcom dword [eax + 0x5716ac06]
stosd dword es:[edi], eax
enter 0xffffffffffff96f5, 0x5c
sub byte [edx - 0x73], bh
in eax, dx
not byte [esi + 0x61]
movsd dword es:[edi], dword [esi]
mov al, byte [0x604d88b]
xchg dword [ecx - 0x5a579e63], ebx
mov ebp, 0x3f2982f
mov al, 0xde
push es
mov ebp, 0x3bed67bf
bound edi, qword [eax - 0x7f]
mov fs, ecx
pushfd
pop edi
mov ebx, dword [eax - 0x7199e082]
push eax
push ebp
movsb byte es:[edi], byte [esi]
idiv dword [eax - 0x64]
daa
xchg esp, eax
adc eax, 0x85592ec1
dec ebx
jne 0x10013144
xchg byte [esi + 0x74], ch
inc ebx
cmpsd dword [esi], dword es:[edi]
popal
xor eax, 0x527506f5
cmp byte [esi + 0x14], bl
salc
xchg ebp, eax
test dword [eax], edx
inc ebp
rdmsr
mov es, edi
push ebp
adc ch, bh
inc al
rol dword [edi + 0x2f], cl
xor dl, al
inc ecx
int3
jp 0x10013234
test eax, 0x936c86fd
in al, dx
pop eax
xlatb
movsd dword es:[edi], dword [esi]
pushfd
sbb eax, 0x50e922e3
push ds
jns 0x100131fd
push ecx
sub ecx, eax
popfd
push str.Intel_Pentium_or_Intel_Pentium_low
lea eax, [ebp - 0x238]
push edi
push eax
call fcn.1011f090
add esp, 0xc
pushfd
test byte [0x10013208], 0x8f
jne 0x10013309
add dword [eax], edx
invalid
pop ds
js 0x100131ea
push 0xf0e491ef
mov dh, 0x8e
mov ebp, 0x62a30407
mov word [eax + 0x71], ds
movsb byte es:[edi], byte [esi]
mov ch, 0xe7
stosd dword es:[edi], eax
add dword [ebx - 0x17f81f48], edi
lodsb al, byte [esi]
jae 0x100131b8
jnp 0x10013208
mov ebx, 0xa7cec8af
pop esi
inc esp
lahf
cmpsd dword [esi], dword es:[edi]
out dx, al
or esi, esp
in eax, dx
jge 0x100131db
fsubr dword [eax]
out dx, al
fistp qword [edi + 0x5ec961af]
insd dword es:[edi], dx
mov bl, 0x6b
out 0x43, al
nop
add byte [edx - 0x7d], bl
call fcn.1001262c
dec ebx
pop edx
and dword [esi - 0xd], 0xffffffe8
int1
dec ebx
push ds
add dword [ecx - 0x48], ebp
sbb al, ch
aam 0xce
cmc
mov dword [0x5c61e041], eax
cli
sahf
push ds
in al, 0xe7
inc eax
mov ecx, ecx
daa
dec edi
outsb dx, byte [esi]
push edx
mov word [esi - 0x4a], cs
stosb byte es:[edi], al
shl dword [edi], cl
scasb al, byte es:[edi]
test al, 0x6e
pop ecx
or byte [edx], dl
push ss
or ah, byte [ebp - 0x6c]
adc byte [eax], dh
in eax, dx
cmpsb byte [esi], byte es:[edi]
not byte [ecx - 0x465f8ee6]
sbb dword [edx + 0x503e9c8b], 0xdabd8229
out 0x59, eax
adc dword [ecx - 0x6a], ebp
inc ecx
jno 0x100132cf
or dword [ebp + 0x65], edx
xor eax, 0x5e50b76a
out 0xf8, eax
push ds
jnp 0x10013233
or eax, 0x918dbccb
or al, 0x23
fistp word [edi + 0x30]
add eax, 0x40985df4
xor al, ch
adc ch, ah
push esp
fisttp word [eax]
inc ecx
sub ebp, esi
adc edi, dword [edi - 0x69]
insb byte es:[edi], dx
sar dword [edi - 0x2d2805c9], 1
cwde
inc ecx
loop 0x100132a1
fdiv dword [esi]
pop ebp
outsb dx, byte [esi]
stc
xor dword [ecx + eax*2 - 0x17034557], 0xffffffa4
inc ebp
mov dh, 0x39
int1
pop edx
jns 0x100132d6
push ebp
in al, dx
and dword [eax - 0x7016008a], ebp
ja 0x1001330e
test al, 0x76
invalid
scasd eax, dword es:[edi]
sbb eax, 0x452acfa1
or byte [edx + 0x7c54475e], al
dec ebx
xor byte [eax - 0x46e0cdcf], bh
xor ebx, dword [eax]
outsb dx, byte [esi]
mov al, byte [0x57c1]
fisttp word [edx]
xchg ebx, eax
aas
test al, 0x44
pop esp
inc ebp
pop esp
scasb al, byte es:[edi]
sbb byte [ecx - 0x4091b6c7], 0x4c
mov esi, 0x18dc63aa
sub al, 0x81
pop ecx
popfd
cmp word [ebp - 0x2dc], 6
jne 0x10013331
std
invalid
push str.Intel__Pentium_III
lea eax, [ebp - 0x238]
push edi
push eax
call fcn.1011f090
add esp, 0xc
cmp word [ebp - 0x2dc], 6
jbe 0x1001343a
push str.Intel__Pentium_III
lea eax, [ebp - 0x238]
push edi
push eax
pushfd
test byte [0x10013430], 0x35
jne 0x10013431
sbb eax, 0xa86cb6c8
add eax, 0xde0ee796
mov bh, 0xbd
insd dword es:[edi], dx
sub byte [esi], bl
push esp
add eax, 0xa71d1069
int3
or byte cs:[ebx], dh
sub esi, dword [0xbd1b2fab]
outsb dx, byte [esi]
popfd
call fcn.1011f090
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
pushfd
test byte [0x10013493], 0xa9
jne 0x10013494
mov dl, 0x58
mov ch, dh
xchg byte [eax - 0x44], ch
and eax, 0x7ea4dc02
cmpsd dword [esi], dword es:[edi]
pushfd
dec eax
les esi, [edx]
fadd st(3)
jbe 0x10013427
mov esi, 0x391d6278
cmpsd dword ss:[esi], dword es:[edi]
adc eax, 0x9d9025bb
xchg ebx, eax
cmp byte [edx - 0x7a250fe1], bh
or ecx, edx
sub bl, byte [ecx + 0x5beb2206]
mov ebp, dword [eax]
mov al, byte [0x58fe2991]
push ecx
xchg ebp, eax
mov ebx, 0x21768559
imul ecx, dword [esi], 0x28
popfd
pop ecx
pop ecx
pushfd
test byte [0x100134a7], 0xb8
jne 0x100135a8
sbb dword [edi + 0x52eff819], eax
sbb eax, edi
out dx, eax
push edx
rsqrtps xmm1, xmm6
sbb bh, byte [ebp - 0x55fb5]
rol dl, cl
xchg edi, eax
dec edx
cmp edi, dword [ecx + 0x46895632]
out 0xc6, al
ja 0x100134c7
xchg ebp, eax
xchg ebx, eax
in eax, 0xb6
mov esp, 0x7d1a78ab
mov ebp, 0xd1ab0361
dec edx
jae 0x100134b7
stosd dword es:[edi], eax
js 0x100134e4
jge 0x10013489
popal
add ebp, dword [ebx - 0x1b8cb52f]
aas
xchg ecx, eax
in al, dx
test al, 0xf4
test byte [eax + edx*4 + 0xe], ah
shr dl, cl
adc dl, byte [ecx - 0x4a]
outsd dx, dword [esi]
lodsd eax, dword [esi]
mov dh, 0x19
adc eax, 0x841d5266
sbb dword [0x841d5266], edx
add al, 0xc9
xlatb
sub al, 0x91
pop ds
mov esi, edi
push esi
inc esi
stc
inc ebp
mov bl, 0x25
inc esp
lodsd eax, dword [esi]
sti
add dh, bh
loop 0x100134a7
adc al, 0x3c
stosd dword es:[edi], eax
push dword [ecx + 0x485f5930]
sar ebp, cl
and dword [0xb10c3a65], ecx
and dl, byte [ebx]
insd dword es:[edi], dx
lahf
cwde
or eax, 0x342ddef
xchg edi, eax
fnsave dword [edx]
dec edx
out 0xc7, eax
mov edi, 0x8fae3543
or ecx, edx
sbb ch, al
dec ebp
cld
daa
and esi, dword [edi + 0x3db7c0b]
sbb edx, ebp
jne 0x10013524
scasb al, byte es:[edi]
invalid
je 0x1001357a
xor edx, dword [esi - 0x2d]
or ebp, dword [ecx]
fcmovne st(0), st(1)
sub cl, byte [esi]
dec eax
je 0x10013550
or byte [edx - 0x4b], ch
push 0xffffffffffffffb5
mov eax, dword [0xcadd281b]
jle 0x100134de
sub ch, bl
retf 0x7ef3
jle 0x100134de
fcom dword [edx]
inc esp
cdq
xchg esi, eax
lds esp, [ebx]
je 0x1001354c
test al, 0xf9
push cs
insb byte es:[edi], dx
into
inc esp
dec edi
out 0x4d, al
xor eax, 0xae451db8
scasd eax, dword es:[edi]
mov eax, 0xafae451d
sub eax, 0xd7d91689
mov dl, 0xfd
inc eax
cmpsb byte [esi], byte es:[edi]
arpl bx, cx
mov esp, 0xbab9a42
fsub qword [edi + 0x74]
enter 0x3aaf, 0xffffffffffffff9c
pushfd
in al, 0xe0
je 0x10013565
or ebx, esp
je 0x10013547
scasd eax, dword es:[edi]
cmp bl, byte [esp + ebx*4 - 0x218b1f1c]
inc esp
xchg ebp, eax
enter 0xffffffffffff88ee, 0x4f
mov esi, 0x8679f1d1
inc esp
adc edi, dword [edi + esi]
xor ecx, dword [0x17495a12]
insd dword es:[edi], dx
in eax, dx
cmp esi, eax
shl byte [esi - 0x59334813], 0xdf
inc edx
popfd
lea eax, [ebp - 0x2d4]
push eax
mov dword [ebp - 0x2d4], 0x9c
add byte [eax], al
add byte [esi + esi*8 + 0x135e205], bl
adc byte [ebx], ch
pushfd
test byte [0x100135e2], 0x2b
jne 0x100136e3
daa
mov ch, 0x73
cmpsb byte [esi], byte es:[edi]
rcl byte [ecx], cl
dec ebp
out 0x69, al
pop edi
dec esi
ja 0x100135ce
jne 0x100135b9
xchg edx, eax
fisttp qword [eax - 0x69cb5c8]
pop edx
salc
xchg ebp, eax
pop edx
cmp byte [eax - 0x25], dl
test esi, 0x7af16735
add byte [edi], bh
enter 0x77b1, 0x72
das
push eax
jns 0x100135b8
outsd dx, dword [esi]
call 0xf6782ef3
and dword [ecx], esp
into
adc eax, 0xec899f5
sti
int3
xchg ebx, eax
or ebx, ebp
mov dl, 0xbc
ror dword [edi + edx], 1
sub al, 0xfd
and byte [edx], ch
push cs
pop ebp
jbe 0x100136de
rcl dword [eax - 0x7c37a6ac], cl
push cs
push cs
mov ch, 0x20
jns 0x10013713
popfd
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push dword [ebp - 0x2c8]
lea eax, [ebp - 0x238]
push dword [ebp - 0x2cc]
push dword [ebp - 0x2d0]
push 0x101466ac
push eax
call fcn.1011f090
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
pushfd
test byte [0x10013751], 0xca
jne 0x10013752
cmpsb byte [esi], byte es:[edi]
jns 0x100136c7
jo 0x10013724
cmp eax, 0x67471346
dec ecx
jns 0x100137a3
add bl, byte [edx]
xchg byte [esi - 0xe], dl
inc ecx
adc al, byte [ecx + 0x33]
stosb byte es:[edi], al
test ah, al
std
in eax, dx
adc al, 0x1c
inc eax
xchg esi, eax
lodsb al, byte [esi]
dec esi
imul eax, dword [eax - 0x28], 0x7625b607
enter 0x3d5, 0xffffffffffffff86
scasd eax, dword es:[edi]
popfd
movzx eax, word [ebp - 0x23e]
push eax
movzx eax, word [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push 0x10146690
push eax
call fcn.1011f090
lea eax, [ebp - 0x238]
push eax
push esi
pushfd
test byte [0x100137de], 0x95
jne 0x100137df
lea ecx, [ebx - 0x1a4b90ba]
sbb al, 0xe
sub ebx, dword [esi]
inc esp
inc eax
xchg esp, eax
adc dl, byte [ebx + 4]
sbb dword [esi - 0x4ab724ae], 0xcd86bdc5
xor eax, 0xe1eb94ec
sub dword [ecx - 0x44], edx
mov byte fs:[ebp - 0x64c68f23], ch
imul edx, dword [eax + ebp], 0x4c
test dword [edi + 0x3f2e9751], 0x95d9ecfa
inc ebp
jecxz 0x10013829
jmp 0x10013786
fist word [ecx - 0x2c]
pushal
mov bh, byte [edx - 0x78]
xchg ebp, ecx
fdivr st(0)
frstor dword [edi]
out dx, al
sbb ebx, dword [ebp - 0x80]
mov eax, dword [eax + 0x6a]
or ebp, dword [eax]
mov byte [eax], 0xa2
or al, 0x3b
fisttp word [ecx]
push eax
dec esp
popfd
call fcn.1011f130
add esp, 0x34
cmp byte [ebp - 0x23a], 1
jne 0x100137f8
add dword [ebp + 7], esi
push str.Windows_2000_xp_2003_Professional
jmp 0x1001381d
cmp byte [ebp - 0x23a], 2
jne 0x10013808
push str._Windows_2000_xp_2003_domain_controller
jmp 0x1001381d
cmp byte [ebp - 0x23a], 3
jne 0x10013818
push str.Windows_2000_xp_2003_Server
jmp 0x1001381d
push 0x1014661c
lea eax, [ebp - 0x238]
push 0x1014660c
push eax
call fcn.1011f090
add esp, 0xc
pushfd
test byte [0x1001386a], 0x1c
jne 0x1001386b
sbb eax, 0x8e0297df
push eax
aas
inc esp
cmc
sub ebp, edi
add al, 0x38
jno 0x100137ee
or dword [ebp + 0x77], eax
push es
xchg ecx, eax
scasd eax, dword es:[edi]
fld xword [ecx + 0x5dcd4f64]
aas
salc
jl 0x10013873
mov edx, 0x947bb05f
ja 0x1001384d
cmp al, byte [eax]
dec esp
mul dword [eax]
sub bh, byte [ebx]
into
cmpsd dword [esi], dword es:[edi]
pop ebx
popfd
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
push 0x10146604
push esi
call fcn.1011f130
add esp, 0x10
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x238]
pushfd
test byte [0x100138e8], 0x31
je 0x100138e9
push 0xb2707d7b
or eax, 0x2aa26745
mov bh, 0x1d
les esi, [edx - 0x71f7075e]
shl dword [edx + 0x29], 1
or al, 0xbd
popfd
out 0x40, eax
pop ss
sub al, 0xcd
in al, dx
les esp, [esi + ebp*8]
movsd dword es:[edi], dword [esi]
push ebp
mov ecx, 0x2bc21d9d
push ebp
pop ebp
mov edx, 0x548a8b96
in al, 7
cmp bh, byte [esi - 0x23]
cmp eax, 0xa59f068a
push esi
push es
pop ecx
dec ebp
sub al, 0x5a
int 0x48
inc esi
and ch, ch
mov eax, 0x82abb68b
popfd
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
mov edi, 0x101465b4
pushfd
test byte [0x10013955], 0x42
jne 0x10013956
test eax, ecx
std
invalid
sti
dec ebp
jg 0x1001396d
jns 0x100138f2
mov esi, 0x4db62f0b
mov dh, 0x4d
push es
jnp 0x1001395f
sbb byte [esi + edx*4 - 0xd600f8b], bh
fnstsw word [ecx - 0x68]
inc ebp
lodsd eax, dword [si]
clc
stosd dword es:[edi], eax
sbb al, 0x9b
das
push 0x35
sbb ebx, dword [eax - 0x76]
push esi
aas
out 0xc, eax
cmp eax, 0x3664f15c
in eax, 0xa0
cmp eax, 0x4fb7deb7
sahf
or cl, byte [esp]
test byte [ebx - 0x29d2944e], bl
into
lahf
xor eax, 0x87ac145f
jns 0x10013916
push edx
popfd
push edi
pushfd
test byte [0x10013a4d], 0x8b
jne 0x10013a4e
mov ecx, dword [edi]
test eax, ebp
add byte [eax], al
add byte [eax], bl
sti
sbb bl, bh
sub dword [esi - 0x65c9baf], 0xcf42476e
nop
stc
push esi
push 0x9260c308
pop edx
insb byte es:[edi], dx
adc dword [edx], 0x9517ebad
xchg edx, eax
scasd eax, dword es:[edi]
push es
test dword [edx], ecx
jle 0x10013a06
stc
outsb dx, byte [esi]
inc edi
inc edx
iretd
pop es
xchg ebp, eax
inc edx
sub ecx, dword [edx]
dec ecx
adc eax, 0xf0b20e67
lds edi, [ebx + 0x50c92d9e]
push ebx
or esi, edx
insb byte es:[edi], dx
in eax, dx
dec eax
dec ebx
lds eax, [ecx + 0x60338d6d]
fadd st(6), st(0)
int3
insb byte es:[edi], dx
pushal
jg 0x10013a35
lodsb al, byte [esi]
add bh, al
fsub st(5)
rcr dword [esi + 0x3c], cl
adc al, 0x17
into
fadd qword [edi + 0x49]
jmp edi
call 0x19f993e4
dec eax
inc eax
xor byte [0xc1f582a9], bh
salc
dec edi
in eax, dx
mov esi, 0x81198037
adc eax, dword [ecx - 0x677f9022]
cmp ah, dl
pop ds
push esp
ja 0x100139dd
sbb dword [ecx + 0x6fde8113], eax
sbb byte [eax + 0x541fd438], 0x77
leave
or ebx, dword [edx]
out 0xa9, al
les esi, [esi - 0x49]
push ebx
les edx, [ebx - 0x30]
inc eax
insb byte es:[edi], dx
je 0x10013a84
or eax, 0x2aa7be01
mov edx, 0x555fe1ed
inc edi
sbb al, 0xfe
pop ds
cld
sbb eax, 0x120e7e4d
or al, 0x38
push cs
adc cl, byte [eax + edi]
in eax, 0x22
mov edi, dword [esi + ebx + 0xa]
arpl word [ebx + 0x5a], cx
mov esi, 0x912e1770
mov ebx, dword [ecx - 0x69]
pushfd
jb 0x100139f3
popfd
push esi
call fcn.1011f130
push str.:
push esi
call fcn.1011f130
add esp, 0x18
push 0x105
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
push edi
push esi
call fcn.1011f130
add esp, 0x10
push 0x100
push 0x32
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x38]
push eax
mov ecx, ebx
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x238], 0
call fcn.100120af
cmp byte [ebp - 0x238], 0
je 0x10013caf
push 0x101465f4
push esi
call fcn.1011f130
lea eax, [ebp - 0x38]
push eax
push esi
pushfd
test byte [0x10013b04], 0x64
jne 0x10013b05
out 0xa2, al
cmp byte [0x2db15f0c], 0xc8
inc eax
popfd
out dx, al
mov bh, 0x6a
ror dword [esi - 0x379c0d2], cl
bound esi, qword [edi - 0x24]
xchg ebp, eax
xor eax, 0xb84c80eb
jb 0x10013b01
push cs
outsd dx, dword [esi]
push ebp
movsd dword es:[edi], dword [esi]
jnp 0x10013b78
cmp al, 0x75
pop ebx
arpl word [edx], bx
sub ch, ah
sbb ch, byte [edx]
in al, dx
clc
popfd
call fcn.1011f130
pushfd
test byte [0x10013c0e], 0x46
jne 0x10013c0f
aas
mov dl, dh
scasb al, byte es:[edi]
push ds
push ss
lodsb al, byte [esi]
adc eax, ebx
xor eax, 0x160ad1a8
xchg ebp, eax
mov edi, edx
mov cl, byte [edi - 0x40cf8a20]
cmpsb byte [esi], byte es:[edi]
or eax, 0x5497ed2e
mov bh, 0x36
loop 0x10013b5a
mov al, 0xa4
sbb dl, al
jbe 0x10013bb8
movsb byte es:[edi], byte [esi]
push ecx
salc
add eax, dword [esi - 0x202f85af]
imul edx, dword [esi + 0x19], 0x10
call 0xd0fbf952
push 0x1a
xchg byte [ebp + 0x7c], dl
lodsd eax, dword [esi]
mov byte [edi - 0x5928c94a], 7
xchg dword [esi + 0x7a6d736], esi
out 0x89, al
pop ecx
push ecx
jne 0x10013bcc
dec dword [edx + 0x7c]
xchg edx, eax
sub al, 0x1b
or esi, ecx
inc edx
xor edi, ebp
add edx, eax
sub dl, byte [edi]
mov al, byte [0x8f9b362e]
xchg ebx, eax
sbb eax, 0x2808c823
mov ah, 0x68
cmpsb byte [esi], byte es:[edi]
mov ebx, dword [eax - 0x58]
and dl, byte [ecx + esi*4 + 9]
arpl word [edi], ax
sbb ah, cl
pop esp
mov word [esi - 0x62], es
int 0xda
xchg ebx, eax
cld
fucom st(1)
and al, 0x5a
mov eax, 0x19dfecc1
adc eax, 0x1ab9adb2
xor ah, ch
adc al, 0x61
xor byte [esi + edx*8], dh
mov ah, 0x72
cmpsd dword [esi], dword es:[edi]
adc byte [eax], bl
sbb byte [eax - 0x34a3a45], ch
wait
invalid
cld
jne 0x10013c08
xchg ebp, eax
jo 0x10013bbc
inc edx
enter 0xffffffffffff9c2c, 0xffffffffffffffa9
lodsd eax, dword [esi]
in al, dx
pop esp
into
les esp, [ebp + 0x65]
cmp cl, 0xf2
imul ebp, dword [edx + 0x75f93aa5], 0x41
imul ebp, dword [edx + 0x75f93aa5], 0x41
add al, 0xda
pop ebx
mov dl, 0x34
sahf
stosd dword es:[edi], eax
pop es
fidiv dword [edx + ebx*4]
ficom word [esi + 0x3bba721]
add al, 0x84
xchg ebp, eax
mov esp, 0x43684c99
fnstcw word [ebx]
xor cl, byte [esi - 0x58]
and dword [edx], 0xf
dec esi
jno 0x10013bf6
dec eax
out 0xf5, eax
scasd eax, dword es:[edi]
push es
pop ss
sbb byte [ebp - 0x23], dh
sub eax, 0x7dcd0831
pop ebx
aaa
sti
movsd dword es:[edi], dword [esi]
xor bh, byte [edi]
xchg esi, eax
aas
popfd
push edi
push esi
call fcn.1011f130
push 0x101465e4
push esi
call fcn.1011f130
pushfd
test byte [0x10013c98], 0x1e
jne 0x10013c99
test eax, 0x2c90920e
sbb ecx, dword [ebp - 0x2e]
in eax, 0x3f
push esp
mov edx, 0x42890930
adc byte [ebx + esi + 0x4e], 0x35
pop eax
xlatb
cmp dword [edi - 0x332cee26], ebx
aad 0x49
mov cl, 0xd
in al, dx
aaa
jmp edx
popfd
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
add esp, 0x28
jmp 0x10013de2
sub cl, ch
xor eax, dword [ecx]
add byte [eax], al
lea eax, [ebp - 0x238]
push 0x101465cc
push eax
call fcn.1011f120
lea eax, [ebp - 0x238]
push eax
push esi
call fcn.1011f130
pushfd
test byte [0x10013cdd], 0x8e
jne 0x10013dde
add byte [esi + esi*8 + 0x13cdd05], bl
adc byte [esi + 0x103850f], cl
add byte [eax], al
xchg edi, eax
outsd dx, dword [esi]
salc
inc ebp
dec esi
inc esp
mov bh, 0xef
or ch, ch
xor byte [ebx - 0x1ddd1ed3], dh
push bx
loop 0x10013d4e
sub byte [ebx + edi + 0x40f9c73], 0x73
dec dword [ebp + 0x25]
bound ecx, qword [edi - 0x52ca5484]
inc esp
ja 0x10013d2b
jl 0x10013ca9
xor eax, 0x287744ad
cmp ch, ch
mov ebx, 0x85ae1f8b
mov esp, 0x2b4be6a8
int3
sub ecx, esi
jge 0x10013ccc
sub al, 0xc9
mov al, 0x97
dec ebx
das
or dl, byte [eax + 0x7c87b595]
fild word [ebx - 0x45f7e2de]
rcl ch, cl
jno 0x10013d4e
or byte [edx + 0x1d71d5d2], bh
js 0x10013d6c
mov ch, 0x83
adc byte [edi - 0x4e], ch
and eax, 0x915a65c
popfd
salc
pop edx
jns 0x10013d7c
jecxz 0x10013d33
sub ch, byte [ebx - 0x34]
sbb eax, 0x7654dd6e
pop ss
scasd eax, dword es:[edi]
in eax, 0xfb
jb 0x10013cfc
xchg ebx, eax
mov ch, 0x55
dec ecx
inc eax
push ds
adc bl, bh
sti
test eax, 0x7381af35
mov dword [eax + 9], edi
inc eax
insd dword es:[edi], dx
jb 0x10013da6
insb byte es:[edi], dx
xchg edi, eax
sti
aam 0x9c
cmpsd dword [esi], dword es:[edi]
push 0x72a98b3b
push ebx
aam 0x22
or al, 0x7b
enter 0x4cbd, 0xffffffffffffffce
inc eax
dec ecx
jle 0x10013d17
into
in eax, 0x57
add byte [ebx + ecx*8 - 0x44bea2e0], dh
add ebx, eax
test byte [eax + edx*8 - 0x22a2f521], 0xc7
or eax, 0xf180efd5
sub dword [ecx - 0x1d], esp
add byte [eax + 0x6e118c69], dl
push 0xffffffffffffff92
in al, dx
sahf
sbb byte [esp + eax*8 + 0x19], 0xed
pop esp
les ebx, [ecx]
in eax, dx
daa
fist word [ebx + edx*8 - 0x1946bc9b]
jbe 0x10013de8
inc ebx
mov ecx, 0x703376e6
pop edx
jo 0x10013e11
sub eax, 0x608fb090
adc eax, 0x7293fbde
push edx
sbb bh, bh
jb 0x10013e06
jb 0x10013da7
daa
jg 0x10013d59
pop es
inc edi
fnstsw word [esi + 0x69]
sti
rol byte [esi + edi*2 + 0x41], 1
imul edi, ebx, 0x417e44d0
inc ecx
sbb byte [ebp + 0x643aa910], cl
mov bh, 0xf9
popfd
add esp, 0x10
push esi
call fcn.1011d740
inc eax
pushfd
test byte [0x10013e11], 0x5d
jne 0x10013e12
dec esp
push 0x52
push dword [ebx - 0x65a868c1]
movsb byte es:[edi], byte [esi]
loopne 0x10013dd0
jns 0x10013dd5
add eax, 0xa5f38f74
pop esi
sub ecx, dword [esi + 6]
push ebp
mov ecx, 0x1e401abe
shl ecx, 1
loope 0x10013db0
popfd
push eax
pushfd
test byte [0x10013f0a], 0x21
je 0x10013f0b
or byte [edi + esi*2 - 0xe], ah
pushal
shr dword [esi + 0x73], 0x28
pop eax
das
mov dword [ecx - 0x7c647e88], esp
sbb dword [eax - 0x72259c7a], esi
sbb byte [ebx - 0x6bc5865e], dl
push cs
push edx
push ds
push 0x626c2a4b
cmp al, 0xc7
cmp ebx, dword [0xe1d4c98f]
inc edi
and dword [edi - 0x4c], eax
or byte [eax + 0x4d], bl
xchg esi, eax
jb 0x10013e58
jb 0x10013ed1
sbb dh, byte [eax + 0x23]
jne 0x10013ed7
sbb esp, dword [0x48a94d76]
lds esp, [edi + ebp*4 - 0x3497c2ac]
aas
stc
dec ebp
test eax, 0xafa4c548
push esp
cmp eax, 0xf93fcb68
xchg edx, eax
dec esp
imul esp, dword [edi + 0x17bd2842], 0xf8e3859b
jo 0x10013e66
adc byte [edx], 0xb
adc dh, byte [esp + edi*2 + 0x77]
pushal
lahf
mov cl, 0x50
int1
cmp edi, dword [ebx - 0x10b3ab2a]
xor eax, 0xe02e04c
dec esi
rol byte [ebx - 0x7c], cl
std
fidiv dword [ebx - 0x1c]
jno 0x10013edd
dec edi
mov ch, 0xbb
sub eax, 0xc233c374
mov cx, 0x491f
aas
fistp qword [esi + edi*2 - 0x1d]
into
mov eax, eax
jae 0x10013e5d
imul edi, dword [ecx + 0x1c7c7f44], 0x5a54728a
sub edi, dword [edi + 0x58]
cld
push cs
scasb al, byte es:[edi]
add dword [esi + esi*4], 0x3598caf4
inc edi
adc bl, byte [ebx + 0x5f1d97cf]
push ecx
cmc
iretd
cmp ch, bl
inc ebx
add bl, 0x59
pop ecx
sub bh, dh
cmp dword [ebp + 0xb], 0xffffffc5
movsd dword es:[edi], dword [esi]
inc esp
sub al, 0xc9
shr byte [edx + 0x6cf0d465], 1
lds ebp, [esi + 0x31]
xchg dword [edi], esp
in al, dx
les eax, [ebx + eax - 0x60]
push 0x9a3d6eb2
into
mov bh, 0x44
cli
js 0x10013edc
sbb byte [ebx + eax*4 + 0x44], cl
test dword [ebp + 1], ebp
int1
push es
popfd
lea eax, [ebx + 0x9d3]
push esi
push eax
call fcn.1011d7d0
push esi
call fcn.1011d740
mov ecx, dword [ebp - 4]
add esp, 0x14
inc eax
add dword [ebx + 0x9c2], eax
pushfd
test byte [0x10013f72], 5
je 0x10014073
pop ebx
cli
sbb ch, byte [ebp + ebp*8 + 0x7d5c8784]
cmpsd dword [esi], dword es:[edi]
dec edi
jl 0x10013f81
inc ebx
inc ebp
in eax, 0xc5
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
mov edx, 0x1a86a57e
xchg dword [ebx + 0x41], ebx
sbb byte [edx], 0x72
and dword [eax + edi*2], esp
push esp
cdq
and bl, ah
call 0x98bd78c9
xor esi, ebp
jb 0x10013f44
or cl, al
pushfd
mov byte [0x1ff7c948], bl
ficomp dword [eax]
pop esp
outsd dx, dword [esi]
inc edi
xlatb
sbb al, byte [ecx]
cmp dword [eax - 0x5040eaf8], 0xffffffb4
stosb byte es:[edi], al
or byte [edi - 0x76], bh
int3
popfd
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.1011e48a
pushfd
test byte [0x100140cf], 0x88
jne 0x100140d0
sub ah, byte [ecx - 0x76f3dc2c]
stosd dword es:[edi], eax
leave
mov cl, 9
xchg edi, eax
jo 0x10014081
mov dh, 0x95
fidiv word [ebx]
push cs
sub dword [ebp + 0x67a307a0], edx
in al, dx
mov bl, 0xb1
call 0x8cddb314
arpl word [ebx + 0x3e], bx
je 0x10014091
add al, 0xba
sar dword [edx - 0x3878b478], 1
inc eax
mov dl, 0xc6
dec eax
sbb al, 0xa9
push 0xffffffffffffffd7
sbb dword [ebx + 0x862d7ea], eax
or byte [0xdef4451], 0x44
mov dl, 0xeb
out dx, al
popfd
leave
ret