Function at 0x7c8185ec
Capabilities:
Access pe header
Create process on windows
Create thread
Get number of processors
Get system information on windows
Resume thread

Disassembly:
cmp dword [ebp - 0x68c], ebx
jne 0x7c842b94
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x690]
push eax
push dword [ebp - 0x7b8]
push dword [ebp - 0x6b8]
push dword [ebp - 0x678]
call fcn.7c817da1
mov dword [ebp - 0x998], eax
cmp eax, ebx
jl 0x7c842bba
jmp 0x7c817f6a
cmp byte [ebp - 0x74e], bl
jne 0x7c819137
test byte [ebp + 0x23], 2
jne 0x7c819137
lea eax, [ebp - 0x8b4]
push eax
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x924]
push eax
push dword [ebp - 0x678]
push dword [ebp - 0x798]
push dword [ebp - 0x8b0]
call sym.KERNEL32.dll_BasepCheckWinSaferRestrictions
mov dword [ebp - 0x97c], eax
cmp eax, 0xffffffff
je 0x7c842bf6
cmp eax, ebx
jl 0x7c842c0b
jmp 0x7c819137
cmp byte [eax + 1], bl
jne 0x7c818920
sub eax, ecx
inc eax
mov word [ebp - 0x92c], ax
mov eax, dword [ebp - 0x92c]
inc eax
mov word [ebp - 0x92a], ax
movzx eax, ax
shl eax, 1
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0x908], ebx
push 4
push esi
lea eax, [ebp - 0xa98]
push eax
push ebx
lea eax, [ebp - 0x908]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
cmp eax, ebx
jl 0x7c842a0b
mov ax, word [ebp - 0xa98]
mov word [ebp - 0x90a], ax
push ebx
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x90c]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
mov esi, eax
cmp esi, ebx
jl 0x7c842a16
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 0x85c], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x8e4], ebx
mov dword [ebp - 0x6a8], ebx
mov dword [ebp - 0x6c0], ebx
mov byte [ebp - 0x74f], bl
mov dword [ebp - 0x864], ebx
mov dword [ebp - 4], ebx
push 0x11
pop ecx
mov esi, dword [ebp - 0x94c]
lea edi, [ebp - 0x8a8]
rep movsd dword es:[edi], dword [esi]
test byte [ebp - 0x87b], 1
je 0x7c8183d9
test byte [ebp - 0x87b], 6
jne 0x7c842a34
cmp dword [ebp - 0x81c], ebx
jne 0x7c82af75
cmp dword [ebp - 0x85c], ebx
jne 0x7c828c8c
cmp dword [ebp - 0x678], ebx
jne 0x7c828cb6
mov dword [ebp - 0x8e0], ebx
mov byte [ebp - 0x815], 1
mov byte [ebp - 0x74d], bl
mov byte [ebp - 0x725], bl
cmp dword [ebp - 0x798], ebx
je 0x7c82e38a
mov eax, dword [ebp - 0x79c]
cmp eax, ebx
je 0x7c842adc
cmp word [eax], bx
je 0x7c842adc
lea eax, [ebp - 0x734]
push eax
push ebx
lea eax, [ebp - 0x6bc]
push eax
mov edi, dword [ebp - 0x798]
push edi
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
mov byte [ebp - 0x8d9], al
cmp al, bl
je 0x7c842af4
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x85c], eax
push edi
lea eax, [ebp - 0x6cc]
push eax
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
call esi
push edi
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov dword [ebp - 0xa84], eax
cmp eax, 2
jne 0x7c81d03a
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x734]
cmp ax, bx
jne 0x7c81d0b2
mov dword [ebp - 0x72c], ebx
mov dword [ebp - 0x7d0], 0x18
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c4], 0x40
lea eax, [ebp - 0x6bc]
mov dword [ebp - 0x7c8], eax
mov dword [ebp - 0x7c0], ebx
mov dword [ebp - 0x7bc], ebx
push 0x60
push 5
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x7d0]
push eax
push 0x1000a1
lea eax, [ebp - 0x678]
push eax
mov esi, dword [sym.imp.ntdll.dll_NtOpenFile]
call esi
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c81d0c9
cmp dword [ebp - 0x8a0], ebx
je 0x7c8189a8
push dword [ebp - 0x678]
push 0x1000000
push 0x10
push ebx
push ebx
push 0xf001f
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
mov dword [ebp - 0x754], edi
cmp edi, ebx
jl 0x7c81858c
push dword [ebp - 0x798]
call fcn.7c8185b6
mov edi, eax
mov dword [ebp - 0x754], edi
cmp edi, ebx
jl 0x7c842b0c
test byte [ebp + 0x21], 0x20
jne 0x7c842b23
cmp byte [ebp - 0x74e], bl
jne 0x7c82cfb3
cmp edi, ebx
jl 0x7c827ab2
cmp dword [ebp - 0x690], ebx
jne 0x7c842b68
jmp 0x7c82cfa8
push 0xa94
push 0x7c818990
call fcn.7c8024d6
mov eax, dword [0x7c8856cc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x94c], eax
mov esi, dword [ebp + 0x30]
mov dword [ebp - 0x8ec], esi
mov edx, dword [ebp + 0x34]
mov dword [ebp - 0x944], edx
xor ebx, ebx
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x7d4], ebx
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x91c], ebx
mov eax, dword [ebp + 0x20]
and eax, 0x8000000
mov dword [ebp - 0x954], eax
mov byte [ebp - 0x79d], bl
mov dword [ebp - 0x920], ebx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x69c], ebx
mov byte [ebp - 0x74e], bl
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x8d0], ebx
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x96c], eax
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x968], eax
lea eax, [ebp - 0x2b4]
mov dword [ebp - 0x964], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x960], eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x764], ebx
xor eax, eax
lea edi, [ebp - 0x760]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x784], ebx
xor eax, eax
lea edi, [ebp - 0x780]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x714], eax
lea eax, [ebp - 0x6f4]
mov dword [ebp - 0x710], eax
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x70c], eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x708], eax
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x71c], eax
lea eax, [ebp - 0x290]
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x794], ebx
xor eax, eax
lea edi, [ebp - 0x790]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x924], ebx
mov dword [ebp - 0x8b4], ebx
mov dword [ebp - 0x8c4], ebx
mov dword [ebp - 0x8d4], ebx
mov dword [ebp - 0x74c], ebx
xor eax, eax
lea edi, [ebp - 0x748]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x740], ebx
xor eax, eax
lea edi, [ebp - 0x73c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x7f1], bl
mov word [ebp - 0x6fc], 0x54
mov word [ebp - 0x6fa], 0x56
mov dword [ebp - 0x6f8], 0x7c818938
mov word [ebp - 0x704], 0xe
mov word [ebp - 0x702], 0x10
mov dword [ebp - 0x700], 0x7c818924
push 0x18
pop ecx
mov dword [ebp - 0x7ec], ecx
mov dword [ebp - 0x7e8], ebx
lea eax, [ebp - 0x6fc]
mov dword [ebp - 0x7e4], eax
mov dword [ebp - 0x7e0], 0x40
mov dword [ebp - 0x7dc], ebx
mov dword [ebp - 0x7d8], ebx
xor eax, eax
lea edi, [ebp - 0x348]
rep stosd dword es:[edi], eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp edx, ebx
jne 0x7c82d59f
mov eax, dword [ebp + 0x20]
and eax, 0xf7ffffff
mov dword [ebp + 0x20], eax
mov ecx, eax
and ecx, 0x18
cmp cl, 0x18
je 0x7c842993
mov dword [ebp - 0x6e0], ebx
mov dword [ebp - 0x6e8], ebx
test al, 0x40
jne 0x7c84299f
test ah, 0x40
jne 0x7c8429ab
test al, 0x20
jne 0x7c82b9f9
test ah, ah
js 0x7c8429b7
test al, al
js 0x7c8429c3
test ah, 1
jne 0x7c8429cf
mov byte [ebp - 0x667], bl
mov byte [ebp - 0x668], bl
and word [ebp + 0x20], 0x3e1f
mov edi, 0x800
mov esi, 0x1000
test dword [ebp + 0x20], edi
jne 0x7c8429e7
test dword [ebp + 0x20], esi
jne 0x7c8188d5
mov eax, dword [0x7c88503c]
cmp byte [eax + 0x19f4], bl
jne 0x7c8429f1
test dword [ebp + 0x20], edi
jne 0x7c8188f8
push ebx
push 4
lea eax, [ebp - 0x9a0]
push eax
push 4
push ebx
call dword [sym.imp.ntdll.dll_NtQueryInformationJobObject]
cmp eax, 0xc0000022
jne 0x7c8429f9
mov ecx, dword [ebp - 0x7b8]
cmp ecx, ebx
je 0x7c818357
test byte [ebp + 0x21], 4
jne 0x7c818357
mov eax, ecx
mov dword [ebp - 0x928], ecx
cmp byte [eax], bl
je 0x7c8182ca
inc eax
jmp 0x7c818918
mov eax, dword fs:[0x18]
mov dword [ebp - 0x980], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0x8a0], eax
jmp 0x7c81853a
or dword [ebp - 4], 0xffffffff
call fcn.7c82cfda
cmp dword [ebp - 0x7b8], ebx
jne 0x7c8329b8
movzx eax, byte [ebp - 0x7f2]
mov ecx, dword [ebp - 0x1c]
call fcn.7c8097aa
call fcn.7c802511
ret 0x30
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x68c]
cmp eax, ebx
jne 0x7c84350a
lea ecx, [ebp - 0x370]
add ecx, 0x28
mov dword [ebp - 0x958], ecx
push ecx
lea ecx, [ebp - 0x2b4]
push ecx
lea ecx, [ebp - 0x794]
push ecx
lea ecx, [ebp - 0x71c]
push ecx
lea ecx, [ebp - 0x764]
push ecx
lea ecx, [ebp - 0x714]
push ecx
lea ecx, [ebp - 0x784]
push ecx
lea ecx, [ebp - 0x70c]
push ecx
push ebx
neg eax
sbb eax, eax
lea ecx, [ebp - 0x774]
and eax, ecx
push eax
call fcn.7c819a3f
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c82cfc4
push ebx
push 0x18
lea eax, [ebp - 0x80c]
push eax
push ebx
push dword [ebp - 0x66c]
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c82cfc4
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8bc], ebx
je 0x7c818d51
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa10], eax
push 0x20a
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
mov dword [ebp - 0x8e4], edi
cmp edi, ebx
je 0x7c842a40
lea eax, [ebp - 0x6a8]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp - 0x8bc]
call sym.KERNEL32.dll_GetFullPathNameW
mov dword [ebp - 0x994], eax
cmp eax, esi
ja 0x7c843539
push edi
call sym.KERNEL32.dll_GetFileAttributesW
mov dword [ebp - 0xa6c], eax
cmp eax, 0xffffffff
je 0x7c843539
test al, 0x10
je 0x7c843539
cmp byte [ebp - 0x74d], bl
jne 0x7c843543
cmp byte [ebp - 0x725], bl
jne 0x7c843543
mov eax, dword [ebp - 0x958]
test byte [eax], 1
jne 0x7c82aa89
cmp byte [ebp - 0x74d], bl
jne 0x7c82cfca
cmp byte [ebp - 0x725], bl
mov ecx, dword [ebp - 0x79c]
jne 0x7c82cfca
push dword [ebp - 0x69c]
push dword [ebp - 0x93c]
mov al, byte [ebp - 0x79d]
neg al
sbb eax, eax
and eax, 2
push eax
push dword [ebp + 0x1c]
mov eax, dword [ebp - 0x954]
or eax, dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x8a8]
push eax
push dword [ebp - 0x7b8]
push ecx
push dword [ebp - 0x8e4]
push dword [ebp - 0x798]
push dword [ebp - 0x8c8]
push dword [ebp - 0x66c]
push dword [ebp - 0x8d4]
call fcn.7c819499
test eax, eax
je 0x7c81d09e
lea eax, [ebp - 0x6d4]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov dword [ebp - 0x6d0], ebx
cmp dword [ebp - 0x820], ebx
jne 0x7c818e1a
cmp dword [ebp + 0x1c], ebx
je 0x7c81ee5d
mov eax, 0x40000
cmp dword [ebp - 0x848], eax
jb 0x7c818e2d
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x7b4]
push ecx
push eax
push dword [ebp - 0x844]
push dword [ebp - 0x66c]
call fcn.7c8102ec
mov dword [ebp - 0xa7c], eax
cmp eax, ebx
jl 0x7c82cfbe
push ebx
push dword [ebp - 0x7ac]
push dword [ebp - 0x850]
push dword [ebp - 0x8c8]
lea eax, [ebp - 0x664]
push eax
call fcn.7c810473
push ebx
push dword [ebp - 0x8f4]
lea eax, [ebp - 0x7d0]
push eax
call fcn.7c809398
mov dword [ebp - 0x8ac], eax
cmp byte [ebp - 0x7f1], bl
je 0x7c818ea0
cmp dword [ebp - 0x8b0], ebx
jne 0x7c82d5e9
push 1
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x6dc]
push eax
push dword [ebp - 0x66c]
push dword [ebp - 0x8ac]
push 0x1f03ff
lea eax, [ebp - 0x67c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateThread]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c82cfbe
mov eax, dword [ebp - 0x8c8]
cdq
lea esi, [ebp - 0x370]
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], edx
mov eax, dword [ebp - 0x66c]
mov dword [esi], eax
mov eax, dword [ebp - 0x67c]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x6dc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x6d8]
mov dword [esi + 0xc], eax
movzx eax, word [ebp - 0x830]
cmp eax, 0x14c
jne 0x7c843646
mov word [esi + 0x90], bx
mov eax, dword [ebp + 0x20]
and eax, 0xfffffffc
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
cmp dword [ebp - 0x840], 2
je 0x7c81ee06
cmp byte [ebp - 0x79d], bl
jne 0x7c81ee06
test byte [ebp - 0x87c], 0x40
jne 0x7c84368a
test byte [ebp - 0x87c], 0x80
jne 0x7c82030d
mov eax, dword [ebp - 0x820]
mov dword [esi + 0x1c], eax
cmp eax, ebx
jne 0x7c843692
push 0x26
pop ecx
lea esi, [ebp - 0x370]
mov edi, esi
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x348], ebx
jne 0x7c82aa95
push 0x98
push 0x10000
push dword [ebp - 0x694]
lea eax, [ebp - 0x398]
push eax
call dword [sym.imp.ntdll.dll_CsrClientCallServer]
cmp dword [ebp - 0x694], ebx
jne 0x7c82aa72
cmp dword [ebp - 0x378], ebx
jl 0x7c8436c4
cmp dword [ebp - 0x8c4], ebx
jne 0x7c8436e6
cmp dword [ebp - 0x8b4], ebx
jne 0x7c84372c
test byte [ebp + 0x20], 4
jne 0x7c81900a
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0x67c]
call dword [sym.imp.ntdll.dll_NtResumeThread]
mov eax, dword [ebp - 0x674]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [ebp - 0x820]
mov byte [ebp - 0x7f2], 1
cmp dword [ebp - 0x7d4], ebx
jne 0x7c843762
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
cmp eax, ebx
jne 0x7c84376e
mov eax, dword [ebp - 0x66c]
mov edi, dword [ebp - 0x8ec]
mov dword [edi], eax
mov eax, dword [ebp - 0x67c]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x6dc]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x6d8]
mov dword [edi + 0xc], eax
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x67c], ebx
mov dword [ebp - 4], ebx
jmp 0x7c8189e9
cmp edi, ebx
jl 0x7c8279c2
cmp byte [ebp - 0x79d], bl
jne 0x7c819151
test byte [ebp + 0x21], 8
jne 0x7c842c36
push ebx
push 0x30
lea eax, [ebp - 0x850]
push eax
xor edi, edi
inc edi
push edi
push dword [ebp - 0x670]
call dword [sym.imp.ntdll.dll_NtQuerySection]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c82cfbe
test byte [ebp - 0x833], 0x20
jne 0x7c835907
mov word [ebp - 0x224], bx
test byte [ebp + 0x20], 3
jne 0x7c842fc0
push ebx
push 0x208
lea eax, [ebp - 0x224]
push eax
push edi
push 0x7c81908c
lea eax, [ebp - 0x6bc]
push eax
call sub.ntdll.dll_LdrQueryImageFileExecutionOptions
mov ax, word [ebp - 0x830]
cmp ax, word [0x7ffe002c]
jb 0x7c843814
cmp ax, word [0x7ffe002e]
ja 0x7c843814
cmp dword [ebp - 0x840], 2
je 0x7c8191ed
cmp dword [ebp - 0x840], 3
jne 0x7c842fdd
movzx eax, word [ebp - 0x83c]
push eax
movzx eax, word [ebp - 0x83a]
push eax
call fcn.7c8190a3
test eax, eax
je 0x7c835907
cmp word [ebp - 0x224], bx
jne 0x7c8432ce
push 0x7c81907c
call sym.KERNEL32.dll_LoadLibraryA
mov esi, eax
mov dword [ebp - 0xa4c], esi
cmp esi, ebx
je 0x7c819265
push 0x7c819394
push esi
call sym.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x7c81925f
push ebx
push 4
lea eax, [ebp - 0x6b0]
push eax
push 0x47
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jne 0x7c81925f
mov byte [ebp - 0x7f1], 1
push esi
call sym.KERNEL32.dll_FreeLibrary
push ebx
push dword [ebp - 0x8f0]
lea eax, [ebp - 0x7d0]
push eax
call fcn.7c809398
mov dword [ebp - 0x8ac], eax
cmp byte [ebp - 0x7f1], bl
je 0x7c819292
cmp dword [ebp - 0x8b0], ebx
jne 0x7c82d5a6
mov dword [ebp - 0x860], ebx
test byte [ebp + 0x23], 1
jne 0x7c8433f1
test byte [ebp + 0x20], 3
jne 0x7c8433fc
cmp dword [ebp + 0x1c], ebx
je 0x7c8192b8
or dword [ebp - 0x860], 4
mov ax, word [ebp - 0x830]
sub ax, 0x14c
neg ax
sbb eax, eax
not eax
and eax, dword [ebp - 0x690]
mov dword [ebp - 0x93c], eax
push dword [ebp - 0x924]
push ebx
push dword [ebp - 0x920]
push dword [ebp - 0x670]
push dword [ebp - 0x860]
or esi, 0xffffffff
push esi
push dword [ebp - 0x8ac]
push 0x1f0fff
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateProcessEx]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c82cfc4
cmp byte [ebp - 0x667], bl
jne 0x7c82b9ac
test byte [ebp + 0x23], 4
jne 0x7c81ef53
cmp dword [ebp - 0x820], ebx
jne 0x7c843464
mov eax, dword [ebp - 0x688]
cmp eax, ebx
jne 0x7c8434a1
movzx eax, word [ebp - 0x6cc]
lea ecx, [eax + 0x14]
mov dword [ebp - 0x2c4], ecx
lea ecx, [eax + 0x10]
mov dword [ebp - 0x258], ecx
add eax, 2
mov dword [ebp - 0x2a0], eax
movzx eax, word [ebp - 0x6f4]
lea ecx, [eax + 0x14]
mov dword [ebp - 0x234], ecx
add eax, 0x10
mov dword [ebp - 0x27c], eax
xor ecx, ecx
mov dword [ebp - 0x948], ecx
mov dword [ebp - 0x810], ebx
jmp 0x7c8193ae
cmp dword [ebp - 0x810], 5
je 0x7c8193d5
mov eax, dword [ebp - 0x810]
mov eax, dword [ebp + eax*4 - 0x96c]
add ecx, dword [eax + 0x14]
mov dword [ebp - 0x948], ecx
inc dword [ebp - 0x810]
jmp 0x7c8193ae
mov eax, dword fs:[0x18]
mov dword [ebp - 0x98c], eax
push ecx
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x8d0], eax
cmp eax, ebx
je 0x7c8434dc
mov dword [ebp - 0x810], ebx
cmp dword [ebp - 0x810], 5
je 0x7c818c0d
mov eax, dword [ebp - 0x810]
lea esi, [ebp + eax*4 - 0x96c]
mov edi, dword [esi]
mov ecx, dword [edi + 0x14]
mov dword [ebp - 0x900], ecx
cmp eax, ebx
je 0x7c81948c
mov eax, dword [esi - 4]
mov edx, dword [eax + 0x14]
add edx, dword [eax + 8]
mov dword [ebp - 0x950], edx
and ecx, 0xfffffffe
mov dword [ebp - 0x900], ecx
mov eax, 0xfffe
cmp ecx, eax
ja 0x7c8434e6
cmp ecx, 2
jb 0x7c8434f3
mov eax, dword [esi]
mov dword [eax + 8], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], edx
cmp edx, ebx
je 0x7c819475
mov eax, dword [edi + 4]
mov word [eax], bx
mov esi, dword [esi]
mov word [esi], bx
mov word [esi + 2], cx
inc dword [ebp - 0x810]
or esi, 0xffffffff
jmp 0x7c819403
mov edx, dword [ebp - 0x8d0]
jmp 0x7c819435
cmp eax, 1
je 0x7c818495
cmp dword [ebp - 0x858], ebx
jne 0x7c81d077
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa08], eax
push 0x20a
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x858], eax
cmp eax, ebx
je 0x7c842afb
push ebx
push dword [ebp - 0x858]
push 0x20a
push edi
call dword [sym.imp.ntdll.dll_RtlGetFullPathName_U]
push dword [ebp - 0x858]
lea eax, [ebp - 0x6cc]
push eax
call esi
jmp 0x7c818495
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.7c80df7f
pop ecx
pop ecx
xor eax, eax
jmp 0x7c818a05
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x6b8], eax
jmp 0x7c8184c2
push 0x60
push 5
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x7d0]
push eax
push 0x100020
lea eax, [ebp - 0x678]
push eax
call esi
mov dword [ebp - 0x754], eax
cmp eax, ebx
jge 0x7c81852e
push edi
call dword [sym.imp.ntdll.dll_RtlIsDosDeviceName_U]
test eax, eax
jne 0x7c842b02
push dword [ebp - 0x754]
call fcn.7c809419
jmp 0x7c81d09e
or dword [esi], 2
push ebx
call sym.KERNEL32.dll_GetModuleHandleA
push eax
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov dword [ebp - 0x9bc], eax
cmp eax, ebx
je 0x7c818f60
cmp word [eax + 0x5c], 2
jne 0x7c818f60
or dword [esi], 1
jmp 0x7c818f60
test byte [ebp - 0x87b], 1
jne 0x7c818e1a
test dword [ebp + 0x20], 0x8000018
jne 0x7c818e1a
push 3
pop edi
cmp dword [ebp - 0x840], edi
jne 0x7c818e1a
push ebx
push 4
lea eax, [ebp - 0x7f0]
push eax
mov eax, dword [ebp - 0x8c8]
add eax, 0x10
push eax
push dword [ebp - 0x66c]
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jl 0x7c818e1a
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa18], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x18]
mov esi, 0x10000003
and eax, esi
cmp eax, edi
jne 0x7c82cfeb
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa54], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x1c]
and eax, esi
cmp eax, edi
jne 0x7c82cf79
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa20], eax
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
and eax, esi
cmp eax, edi
je 0x7c818e1a
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9b4], eax
mov ecx, dword [ebp - 0x7f0]
add ecx, 0x20
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x20]
push dword [ebp - 0x66c]
call fcn.7c82d01f
jmp 0x7c818e1a
mov dword [ebp - 0x940], edi
push 4
lea eax, [ebp - 0x940]
push eax
push 0xc
push dword [ebp - 0x66c]
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
jmp 0x7c81932f
and dword [esi], 0xfffffffe
jmp 0x7c818f7a
mov eax, 0xc000011b
cmp edi, eax
je 0x7c8279e3
cmp edi, 0xc000012e
jle 0x7c835907
cmp edi, 0xc0000130
jg 0x7c842c13
mov dword [ebp - 0x904], 1
cmp edi, 0xc0000130
je 0x7c842ea6
cmp edi, eax
je 0x7c842ea6
push edi
lea eax, [ebp - 0x6bc]
push eax
call fcn.7c827aeb
mov dword [ebp - 0x904], eax
cmp eax, ebx
jne 0x7c842ea6
movzx eax, word [ebp - 0x6bc]
shr eax, 1
mov ecx, dword [ebp - 0x6b8]
lea eax, [ecx + eax*2 - 8]
mov dword [ebp - 0x910], eax
cmp word [ebp - 0x6bc], 8
jb 0x7c835907
push 4
push 0x7c827aa8
push eax
mov edi, dword [sym.imp.ntdll.dll__wcsnicmp]
call edi
add esp, 0xc
test eax, eax
je 0x7c827a74
push 4
push 0x7c827a9c
push dword [ebp - 0x910]
call edi
add esp, 0xc
test eax, eax
jne 0x7c835907
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9a8], eax
push 0x210
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x7c842d82
mov eax, 0xc000012f
cmp edi, eax
jne 0x7c82cfb3
push eax
lea eax, [ebp - 0x6bc]
push eax
call fcn.7c827aeb
test eax, eax
je 0x7c8185a0
jmp 0x7c82cfb3
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9f0], eax
push dword [ebp - 0x85c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x85c], ebx
jmp 0x7c8183f1
push dword [ebp - 0x678]
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [ebp - 0x678], ebx
jmp 0x7c8183fd
push dword [ebp - 0x694]
call dword [sym.imp.ntdll.dll_CsrFreeCaptureBuffer]
mov dword [ebp - 0x694], ebx
jmp 0x7c818fcd
or dword [ebp - 0x8d4], 1
jmp 0x7c818d78
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x978], eax
lea eax, [ebp - 0x314]
mov dword [ebp - 0x974], eax
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x970], eax
lea eax, [ebp - 0x978]
push eax
push 3
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.ntdll.dll_CsrCaptureMessageMultiUnicodeStringsInPlace]
mov dword [ebp - 0x754], eax
cmp eax, ebx
jge 0x7c818fa4
jmp 0x7c82cfbe
mov byte [ebp - 0x815], bl
lea edi, [eax + 2]
mov dword [ebp - 0x8cc], edi
mov dword [ebp - 0x798], edi
mov ax, word [edi]
cmp ax, bx
je 0x7c82e2cc
cmp ax, 0x22
je 0x7c82aed4
inc edi
inc edi
mov dword [ebp - 0x8cc], edi
mov dword [ebp - 0x814], edi
jmp 0x7c82aeb2
mov dword [ebp - 0x814], edi
mov byte [ebp - 0x74f], 1
jmp 0x7c82e2cc
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa3c], eax
push dword [ebp - 0x81c]
push ebx
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 0x81c], ebx
jmp 0x7c8183e5
mov dword [ebp - 0x8f8], ebx
cmp byte [ebp - 0x667], 4
je 0x7c84343b
push 2
lea eax, [ebp - 0x668]
push eax
push 0x12
push dword [ebp - 0x66c]
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x8f8], ebx
jne 0x7c84344c
cmp dword [ebp - 0x754], ebx
jge 0x7c819325
jmp 0x7c84345c
mov byte [ebp - 0x667], 2
jmp 0x7c8188a0
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9ac], eax
mov ecx, dword [ebp - 0x7f0]
add ecx, 0x1c
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x1c]
push dword [ebp - 0x66c]
call fcn.7c82d01f
jmp 0x7c81eef7
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7c817d4a
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7c817f6a
push eax
jmp 0x7c81d10c
push eax
jmp 0x7c843430
mov ecx, dword [ebp - 0x864]
jmp 0x7c818d96
mov eax, dword fs:[0x18]
mov dword [ebp - 0x9a4], eax
mov ecx, dword [ebp - 0x7f0]
add ecx, 0x18
push ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x10]
push dword [eax + 0x18]
push dword [ebp - 0x66c]
call fcn.7c82d01f
jmp 0x7c81eed8
push dword [ebp - 0x798]
call dword [sym.imp.ntdll.dll_RtlDetermineDosPathNameType_U]
mov dword [ebp - 0xa44], eax
cmp eax, 5
jne 0x7c842a64
push 0xc0000034
call fcn.7c809419
cmp dword [ebp - 0x8e0], ebx
jne 0x7c842a99
call fcn.7c8307de
mov dword [ebp - 0x8e0], eax
mov ax, word [ebp - 0x8c0]
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x798], eax
cmp word [edi], bx
je 0x7c81d09e
jmp 0x7c842aa9
mov dword [edx], ebx
jmp 0x7c818843
cmp dword [ebp - 0x8f0], ebx
je 0x7c819292
mov esi, dword [ebp - 0x8f0]
lea edi, [ebp - 0x74c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x748], ebx
push ebx
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x7d0]
push eax
call fcn.7c809398
mov dword [ebp - 0x8ac], eax
xor edi, edi
inc edi
jmp 0x7c819292
cmp dword [ebp - 0x8f4], ebx
je 0x7c818ea0
jmp 0x7c843612
mov eax, dword [ebp - 0x814]
mov cx, word [eax]
mov word [ebp - 0x8c0], cx
mov word [eax], bx
push ebx
push dword [ebp - 0x81c]
push 0x104
push 0x7c82e380
push dword [ebp - 0x798]
push ebx
call sym.KERNEL32.dll_SearchPathW
mov esi, eax
shl esi, 1
mov dword [ebp - 0x8d8], esi
je 0x7c82e33c
cmp esi, 0x208
jae 0x7c82e33c
push dword [ebp - 0x81c]
call sym.KERNEL32.dll_GetFileAttributesW
mov dword [ebp - 0x9f8], eax
cmp eax, 0xffffffff
je 0x7c82e32e
test al, 0x10
jne 0x7c842a4a
inc esi
mov dword [ebp - 0x8d8], esi
inc esi
mov dword [ebp - 0x8d8], esi
cmp esi, ebx
je 0x7c82d192
cmp esi, 0x208
jae 0x7c82d192
mov ax, word [ebp - 0x8c0]
mov ecx, dword [ebp - 0x814]
mov word [ecx], ax
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x798], eax
push eax
call fcn.7c82e3ec
test eax, eax
je 0x7c818439
jmp 0x7c842a51
mov eax, dword fs:[0x18]
mov dword [ebp - 0xa40], eax
push 0x208
push dword [0x7c8856d4]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x81c], eax
cmp eax, ebx
je 0x7c842a40
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x798], eax
mov dword [ebp - 0x814], eax
mov edi, eax
mov dword [ebp - 0x8cc], edi
cmp word [eax], 0x22
je 0x7c82ae9d
mov dword [ebp - 0x798], eax
jmp 0x7c82e41d
mov ax, word [edi]
cmp ax, bx
je 0x7c82e2cc
cmp ax, 0x20
je 0x7c82e445
cmp ax, 9
je 0x7c82e445
inc edi
inc edi
mov dword [ebp - 0x8cc], edi
mov dword [ebp - 0x814], edi
jmp 0x7c82e41d
mov dword [ebp - 0x814], edi
jmp 0x7c82e2cc
xor eax, 0x1dffaf9e
xchg edx, eax
into
jne 0x7c832921
mov ch, 0x93
loop 0x7c8328cf
jge 0x7c8328da
jge 0x7c8328ad
push esp
lodsd eax, dword [esi]
popal
mov dword [0x2b5f1a4e], eax
div byte [edx - 0x36]
sub esi, esi
jb 0x7c8328ef
mov fs, word [ebx - 0x68]
pop es
mov eax, ecx
sbb byte [edx - 0x57], ch
jl 0x7c8328bc
cwde
mov dl, 0x3a
call 0x68e722ec
push 0xf08c498e
adc esi, eax
fistp dword [ebx - 0x4b]
stc
rol dword [ebx + ebp*4 - 0x52], 1
mov dl, byte [esi]
push ds
jns 0x7c832930
xor byte [edi*8 - 0x691348ad], dl
jns fcn.7c83298c
sub al, 3
mov al, 0xd0
ret 0x454c
add esi, dword [eax + 0x454cc2d0]
dec esp
inc ebp
int 0xe3
mov word [ebp + 0x54], cs
ficom dword [ebx - 0x42]
dec edi
test eax, 0x8807308a
insb byte es:[edi], dx
sub ecx, edi
das
cmc
rcr dword [0x2229167d], cl
pop ebx
cmp bh, 0xa5
jp case.0x7c811b8a.88
loopne 0x7c83291b
in al, dx
dec esp
push ss
xlatb
fst st(1)
xor bh, ah
int3
and dh, byte [eax]
cmp esp, 0x342168ca
and byte [edx - 0x1f72d1d4], dl
xchg ecx, eax
and al, 0xc3
jns 0x7c83295b
in al, 0xca
ret
int1
aam 9
salc
mov edi, ecx
sbb edx, dword [esi - 0x23]
retf
sub eax, 0x882ae05d
dec byte [edx]
jns 0x7c8429f5
sub cl, byte [eax + 0x58790afe]
fmul dword [eax - 0x6355b20a]
test byte [ebp - 0x56], 0x9c
stosb byte es:[edi], al
pushfd
hlt
and dword [edi - 0x7b], esi
retf
cmp dh, byte [ebp + 0x5e]
ljmp 0xb937
inc edx
dec ebx
cmp byte [ebx], dl
mov ebx, 0x429ba23d
dec ecx
or eax, dword [ebx + 0x64]
invalid
mov byte [0xb49429b], al
inc ebx
invalid
ret
push esp
aad 0x3f
xor al, 0xbb
iretd
popal
pop esi
imul dl
jle 0x7c8429a1
inc esi
mov ch, 0x89
adc ah, al
rol byte [ecx + esi*8 + 0x5ec9853c], 1
mov dword [edx], edx
loopne 0x7c8429c9
test cl, dh
cmp al, 0x85
leave
pop esi
sub dword [ebx - 0x1d7b2353], eax
lodsd eax, dword [esi]
add byte [eax + 0xe], al
jp 0x7c842997
mov al, 0x6f
mov edx, 0x5ae19061
cdq
sub esi, esp
jecxz 0x7c8429ed
push esi
and byte [ebx - 0x1be918c2], dh
salc
mov byte [ecx], 0xa7
xchg ebx, eax
test al, 0x2d
hlt
add eax, 0x89b5cace
mov dword [0xa5b50784], eax
clc
push ds
xchg ecx, eax
loope 0x7c8429dc
rol dword [eax], 0x5b
dec esp
mov esi, 0x1de42cea
in al, 0x1d
inc ecx
mov dh, 0x26
in al, 0xd5
lcall 0x5c78, 0x5f39ad0f
aad 0x9a
shrd dword [ecx], edi, cl
pop edi
js 0x7c842ab5
retf
movsb byte es:[edi], byte [esi]
sub al, 0x1f
add dword [edx], edx
lodsd eax, dword [esi]
invalid
sub bh, byte [ebx]
add dword [ebp + 0x5a], ebx
jmp 0x7c842ac5
adc dword [ecx + 0x52], edx
lahf
sub al, 0x8f
daa
or edi, dword [ebx]
push es
push edi
enter 0x6296, 0x6d
jmp 0x7c842abf
adc eax, 0x2ee92c55
jb 0x7c842a71
push edi
add al, 0xcd
je 0x7c842b0a
adc al, byte [ebx - 0x59]
int3
in eax, 0xfc
adc dword [ebp + 0x66b375d1], esi
mov bl, 0x66
das
invalid
mov ebp, 0xefbb2089
pop ebx
xchg edx, eax
dec ebx
out 0x28, al
mov esi, 0x4cda2e4b
mov cl, byte [ebx]
add eax, 0x4859e924
sbb edx, dword [ebx + 0x3818a1e4]
in al, 0xa1
sbb byte [eax], bh
rol edx, 1
cmp eax, 0xfbf090d3
ret
rcl dword [eax - 0x503c0410], cl
jnp 0x7c842b58
push ebp
push ds
inc edi
mov cl, 0x5f
push esp
test al, 0x18
mov ebp, dword [edi]
jb 0x7c842b80
movsb byte es:[edi], byte fs:[esi]
jo 0x7c842b4b
xchg edx, eax
xor byte [ebx + 0x16d86147], cl
test dword [ecx + esi*4 - 0x7e0c3be8], eax
in eax, 0x38
sub esi, dword [edx + 0x6e]
jb 0x7c842b93
les edx, [edx]
pop ebp
jmp 0x4ab2a2de
xchg ecx, eax
cmp eax, 0x61c0026a
popal
inc edi
push ss
aaa
salc
pop ss
aaa
and byte [esi + 0x42], cl
out 0x1e, eax
or byte [esi], ch
call 0xa817afd1
mov ebx, 0x279c64cc
daa
scasd eax, dword es:[edi]
xor cl, bl
jae 0x7c842bd8
in eax, 0x5b
or esp, ecx
pop ax
and eax, 0x2eb17040
push esi
mov dword [0xa302e9ad], eax
push 0x17
invalid
out 0x37, al
aaa
xor al, 0xd3
out dx, al
xlatb
insb byte es:[edi], dx
dec ebp
movsb byte es:[edi], byte es:[esi]
pop eax
dec edx
xor ch, byte [ebp + ecx*8 + 3]
xchg esp, eax
iretd
enter 0x1026, 0xffffffffffffffe6
sub dl, byte gs:[eax]
out 0x65, al
sub dl, byte [eax]
dec esi
xchg ecx, eax
test eax, 0xaeb996be
loop 0x7c842b5d
or dl, bh
jns 0x7c842bb7
mov ss, word [ebx + 0x14]
cmc
dec eax
fcmovnb st(0), st(6)
xor eax, 0xcfb231d8
out dx, eax
lcall 0xbc6, 0xdab54761
jmp 0x7780224e
mov bh, 0xee
inc edi
mov esi, 0xbf7916c8
push 0x1a32a86e
mov ch, 0x37
jbe 0x7c842c38
mov ebp, 0x596f9613
pop ecx
xor dword [ebp - 0x2b447b5d], 0xecac8df9
push ds
push si
jmp 0x7c842bc9
stc
lea ebp, [esp + ebp*8 - 0x14a999e2]
lodsd eax, dword [esi]
pop ds
sub dword [edi + 0x42f34481], edi
arpl bx, cx
movsd dword es:[edi], dword [esi]
ror byte [eax + ebx*4], 0x48
jmp 0x7e627725
fmul dword [esi - 0x79]
pop ds
xchg dword [edi], ebx
popfd
dec eax
xchg edx, eax
mov dword [ecx - 0x4d51462a], 0x2a5fa148
mov bh, 0xb3
lea ebx, [ebp - 0x38]
wait
out 0x74, eax
pop edi
adc byte [eax + 0x740d0f5b], 0x6f
test dword [edi + 0x4d6d63ad], esp
daa
and eax, 0xa685afa7
outsd dx, dword [esi]
sahf
invalid
wait
popfd
mov bl, 0xd
ret 0xf093
push eax
rcr dword [ecx + 0x74], 1
xchg esp, eax
loopne 0x7c842c49
push esp
mov ebx, 0x357dde98
push esp
adc al, 0x64
not edx
invalid
xchg esi, eax
xchg ebp, eax
salc
sub esp, eax
or byte [edx], al
jb 0x7c842c79
add byte [ecx + 0x14], bl
jmp 0x7c842ce3
xchg edi, eax
cmp ah, byte [eax + 5]
ret 0x763e
jge 0x7c842c6e
and ah, cl
adc eax, 0x228c8ebb
or edi, dword [edx - 0x7e879c99]
cmp al, 0x84
in al, 0x63
and ah, 0x52
mov ch, 0xf
cmp al, 0xe
cli
pop ebp
sbb al, 0x92
ja 0x7c842cda
adc byte [edi + esi*2], ah
mov dword [0x6dadf9bb], eax
sal dword [ebx], 1
jns 0x7c842c91
cmp eax, 0x458a6058
arpl word [ecx - 0x6ba4232c], dx
fmul qword [ebx + 0x4d]
ficomp dword [eax]
outsb dx, byte [esi]
cmpsb byte [esi], byte es:[edi]
jns 0x7c842d38
sub ah, byte [eax - 0x56]
into
xchg ecx, eax
cmp eax, 0xf6d65ec5
xchg ebp, eax
sub dh, 0x50
or eax, 0x8794d6c4
push ds
pop edx
dec edx
out dx, al
and ch, byte [ebp - 0x47]
pop esp
adc ebp, dword [0xc7b1051f]
inc edi
push ss
out 0xae, eax
inc eax
and al, 0x1b
add al, 0xe6
into
lds ebx, [esi]
pop ecx
ror dword [edi + 0xa], 0x25
enter 0xfffffffffffffc37, 0x3c
imul edi, edx, 0xc
invalid
xor ecx, dword [edx + 0x78]
dec esp
wait
sal dl, 1
out dx, al
jge 0x7c842d04
push ds
or byte [edx + 0x39cae5fe], dh
add ecx, ecx
dec edi
imul ecx, ecx, 0xfffffff6
out dx, al
jg 0x7c842d9c
jno 0x7c842d4f
pop ecx
fisub dword [edi + 0x5a5bd92d]
push 0x7e
imul ebp
pop eax
cwde
jge 0x7c842db2
push esi
push edx
popal
lodsd eax, dword [esi]
push cs
call 0x899e84f2
cmp al, 0x24
sbb eax, 0xc47e4c
rcr dword [edi], cl
push edx
push edi
sbb cl, byte [0x4c1d243c]
jle 0x7c842d6a
add bl, dl
pop ds
dec esp
fucomi st(1)
imul ebp, edi, 0x4f
xchg cl, bl
lea edx, [ebx + 0x7431878]
sub eax, 0x42ba17f0
test al, 0x1b
ret 0x5217
pop ss
out 0x46, eax
cli
xchg esp, eax
pop ss
cmp dword [esi - 0x2a], ebx
or al, 0x27
das
mov ah, 0xbb
cwde
or edx, dword [ebx + 0x1ed17e7]
test ch, cl
mov esp, 0xf0520f4a
xor eax, 0xc8f634a2
ret
sal byte [ebp - 0x638b356a], 1
test byte [esi + 0x3c], ch
movsd dword es:[edi], dword [esi]
invalid
aam 0xb8
lodsb al, byte [esi]
sub eax, 0x73e3d273
cmpsb byte [esi], byte es:[edi]
rep lodsd eax, dword [esi]
lodsd eax, dword [esi]
jnp 0x7c842f92
cmpsb byte [esi], byte es:[edi]
push es
lodsb al, byte [esi]
jle 0x7c842f36
sub al, 0x91
lcall 0x4aa0, 0xf864e75b
cmp byte [edx], ch
cld
pop esi
jbe 0x7c842f74
add eax, 0xc291cab5
pop edx
retf 0xc291
lodsd eax, dword [esi]
retf 0xe333
loope 0x7c842f6a
stosb byte es:[edi], al
mov byte [0xa3814aab], al
xor byte [ebx + 0x47028c67], bh
or byte [esi + 5], al
add byte [esi - 0xe], al
jge 0x7c842f8e
mov byte [ebp + 0xe8b421d], al
dec ecx
invalid
retf 0x5eb9
xlatb
clc
add eax, 0xea93b7d5
fistp dword [ecx + 0x7f]
mov dword [eax + 0x6f0bab50], esi
xchg esp, eax
loop 0x7c8432a4
loope 0x7c8432ba
in eax, dx
lds esp, [ecx + 0x6c]
dec ebx
xor dword [ebx + 0x189338d], 0x81d54381
in al, 0x92
xchg edi, eax
fnstsw word [ebx]
mov al, byte [0xf01511ec]
push es
pop edi
pop ebp
mov byte [0x756b59fe], al
and dh, byte [esi]
nop
mov bl, 0xd2
and bl, byte [ebx - 0x156c1265]
push edx
pop ebp
or ch, byte [ebp + 0x47]
push ss
sahf
popfd
jbe 0x7c843265
pop esi
pop ds
cmpsd dword [esi], dword es:[edi]
lea esp, [eax + 0x1e]
mov ch, 0x6b
jno 0x7c843246
push es
or dword [eax], edi
stosb byte es:[edi], al
push ecx
rol byte [ecx], 0xdc
pushal
cmp edx, esi
xor byte [esi], bl
xor byte [esi], bl
add eax, 0x6fa1e571
inc eax
clc
mov al, byte [0xf812c0d7]
push esp
shl byte [edi + 0x5474154c], 0xa3
mov al, byte [0x2461f3e3]
call 0x27dcb5bb
je 0x7c843324
mov dword [0x61f3e3a0], eax
popal
and al, 0xe8
loopne 0x7c84325b
pop eax
stosd dword es:[edi], eax
js 0x7c8432d7
mov dword [edx + 0xe], esp
stc
push ss
push 0x18
push eax
insb byte es:[edi], dx
invalid
test dword [ebp + 0x4f], esp
add eax, 0xf5763f61
adc eax, 0xac9c0ca8
add esi, dword [ebx - 0x5c1dd5ba]
fsub st(3)
mov ebx, 0x29970a8c
push ecx
lahf
jo 0x7c8432d3
push ebp
sahf
pushfd
mov fs, word [edx + 0x67f42843]
pop edi
mov edi, 0xf5040845
ret 0x7990
lahf
inc esp
std
mov eax, dword [0xe0ce6fbd]
add eax, 0x52a995f1
invalid
into
loopne 0x7c8433f9
int1
xchg ebp, eax
test eax, 0xa4240f52
and al, 0xa4
push ds
lds ecx, [0x8d1a6b62]
and dword [ecx + esi + 0x5e], ecx
wait
xor byte [esi], bh
sbb eax, 0x6905b7b6
mov ch, 0x80
cmp dword [ecx + 0x2d819585], ecx
xrelease lock or dword [ebp + 0x76adf480], 0x4606135b
mov dword [ebp - 0xcd27e6b], eax
lock or dword [ebp + 0x76adf480], 0x4606135b
xlatb
fsub qword [esp + ecx*8 - 0x1c99ec46]
or ch, byte [ebp - 0x37a545b0]
lodsd eax, dword [esi]
adc al, 0xda
enter 0x14ad, 0xffffffffffffffda
lahf
int1
jae 0x7c8433eb
push ds
dec ecx
popfd
mov byte [ebp - 0x5f304023], ah
adc dl, al
and dword [esi - 1], esi
jmp 0x468a137f
pop ebx
mov byte [0x9075c259], al
mov ecx, 0xfdcd865b
or esi, dword [ebx]
jnp 0x7c8434be
push 0xffffffffffffff85
dec ebx
mov edx, 0xe70ad5cb
pushfd
test dword [ebx - 0x46], ecx
retf
dec esi
jae 0x7c843411
push esp
cmp bl, al
or dl, byte [0xd38563d6]
jle 0x7c84342b
ret 0xd496
sbb eax, 0x562b6150
fdivr dword [ebp + 0x2c]
inc ecx
or byte [0x75dc56be], 0xe0
test al, 0x94
lodsd eax, dword [esi]
push eax
insd dword es:[edi], dx
lea ecx, [edi + 0x73065ee5]
push ebx
invalid
sbb byte [0x4d69402a], bl
mov dl, 2
dec ebp
cmp byte [ecx - 0x46], bh
push esp
in eax, dx
add dword [0x5202e274], 0xd866b7af
lcall 0x6cda, 0x9a6f40e7
fisubr dword [edx + edx - 0x62]
in al, dx
outsd dx, dword [esi]
jne 0x7c843491
adc bl, byte [esi + 0x756fec64]
retf 0xb87a
jp 0x7c843481
mov al, byte [0xbec0ff2f]
nop
out dx, al
retf
das
inc eax
mov esi, 0x91cbee90
xor al, 0xdb
sub eax, 0x345e81ff
pop esp
cwde
imul sp, word [esi + 0x46], 0x2e
imul esp, dword [esi + 0x46], 0x2e
mov dword [0x6226f56c], eax
xchg dword [ebx + 0x6c], esi
insb byte es:[edi], dx
cmc
bound eax, qword es:[edi - 0x814938d]
jecxz 0x7c843515
jae 0x7c843554
jmp 0x7c8434e1
rcl dword [ecx - 0x44e58de9], 0x91
mov esi, 0x1e762b65
mov es, esp
or al, 0xc7
nop
push ebx
js 0x7c843554
pop ebx
pop ecx
mov ebx, 0x5f97b2ba
enter 0xfffffffffffff657, 0x38
idiv byte [eax]
invalid
cmpsd dword [esi], dword es:[edi]
out 0x14, al
neg byte [ebp - 0x5a931da8]
les ebx, [esi]
mov esp, 0x6a936248
xchg ebp, eax
xor bh, cl
sub al, 0xf3
retf 0xbd3e
and byte [ebx], bl
dec edi
jl 0x7c8434c0
jns 0x7c84357a
push ds
push 0x4f85e3f5
jecxz 0x7c8434ca
dec edi
mov ah, 0xc5
rcl byte [eax], 0xc8
ret 0x78f9
imul ebp, dword [ebp + esi*4 + 0x51634fa6], 0x3521b8f3
sbb esi, esi
cld
popal
and eax, dword ds:[ebp + 0x175426b6]
mov bh, 0x6d
wait
mov dh, byte [edx - 0x1e]
fsubr dword [ebx + 0x66]
mov esp, 0x36db8b5f
mov eax, dword [0x5422fc2]
push eax
lodsd eax, dword [esi]
push eax
or cl, byte [0x21fc6b70]
das
inc edx
add eax, 0xa50ad50
or eax, 0x21fc6b70
pushal
stosb byte es:[edi], al
sti
push ebp
ret
cli
sbb bl, al
and esp, esp
idiv byte [edx - 8]
fsub dword [ebx]
in al, 0xf6
jp 0x7c843610
ret
and dl, byte [edx - 0x59dc4e66]
call 0x8b0d0b99
scasd eax, dword es:[edi]
mov eax, dword [0x506e56e3]
ret 0x1127
xchg esi, eax
invalid
popfd
and dh, byte [0x5cd70ac6]
and eax, dword [esi + 0x51]
mov word [ebx], ds
arpl word [edi + 0x37c74196], bp
pop ebp
xchg ebx, eax
dec eax
and al, 0xb8
xchg byte [esi], al
mov edx, 0x2dc6ad5b
push cs
pop es
add byte [esi - 0x23f02749], dh
pop ebx
out 0xef, eax
adc eax, 0x10447693
imul eax, esi, 0xa
xchg ebp, eax
ficom dword [esi + edx]
popal
ja 0x7c843739
call 0x27dcd24d
sub eax, 0x34bee728
xor eax, 0x5b1226ed
and byte [ebx], ah
mov bh, 0x36
bound esp, qword [eax + 0x2f]
bound esp, qword ss:[eax + 0x2f]
dec ecx
test al, 0x8e
int 0xbf
imul ebp, dword [eax + 0x3dd82db1], 0xffffffc4
fsubr dword [edx - 0x1271588a]
sbb ch, 0xc4
or eax, 0x1802f857
push edi
clc
add bl, byte [eax]
push edx
in al, 0x67
jmp 0x7c8436f7
mov dl, 0x17
in al, 7
stc
loopne 0x7c843792
and byte [ebp + 0x2b], al
lodsb al, byte [esi]
dec edx
aas
loope 0x7c8436dc
leave
pushfd
invalid
dec edi
sub eax, 0xfc648c8d
cmp al, 0x99
ret 0x97cc
mov ch, 0x37
ror dword [edx - 0x20527205], 1
inc ebp
dec edx
mov ebx, 0x23752744
in eax, dx
dec ecx
xlatb
pop edx
ret 0xea23
in al, 0x21
pop ss
popal
cld
out 0x51, eax
and byte [esi], 0xa7
ret 0xd368
dec eax
pop edx
invalid