Function at 0x4014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov byte [esp + 0x68], al
mov byte [esp + 0x69], al
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov byte [esp + 0x5c], al
mov byte [esp + 0x5d], al
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov byte [esp + 0x50], al
mov byte [esp + 0x51], al
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov byte [esp + 0x80], al
mov byte [esp + 0x81], al
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
mov byte [esp + 0x45], al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov byte [esp + 0x74], al
mov byte [esp + 0x75], al
mov dword [esp + 0x14], eax
cmp ebp, dword [0x4a8e90]
jg 0x401764
test ebp, ebp
jle 0x401764
mov ebx, ebp
shl ebx, 4
add ebx, dword [0x4a8ec4]
test ebx, ebx
je 0x4017c3
inc ebp
lea eax, [ebp - 1]
mov dword [0x4a8014], eax
mov edx, dword [ebx + 4]
mov eax, dword [edx]
movzx esi, word [eax + 8]
xor ecx, ecx
mov dword [esp + 0x34], 0
cmp si, 0x7f
je 0x4015e3
mov eax, edx
nop
mov edi, dword [eax + 4]
add eax, 4
inc ecx
cmp word [edi + 8], 0x7f
jne 0x4015d0
test ecx, ecx
jbe 0x4015e3
dec ecx
test si, si
jne case.0x40161f.8
mov esi, dword [edx]
mov eax, dword [esi]
cmp eax, 4
je 0x401670
cmp eax, 0xd
je 0x401741
cmp eax, 0xe
je 0x4016ec
cmp eax, 8
je 0x40176b
sub eax, 5
cmp eax, 0x1c
ja case.0x40161f.8
movzx ecx, byte [eax + 0x401994]
jmp dword [ecx*4 + 0x401954]
mov ecx, dword [edx + 4]
cmp word [ecx + 8], 0x7f
jne 0x42b049
sub dword [esp + 0x30], 1
jne 0x42b0fd
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
call fcn.0040e940
test eax, eax
je case.0x40161f.8
jmp 0x42b069
mov edi, dword [esp + 0x34]
xor eax, eax
test ax, ax
je 0x401693
mov esi, dword [edx + edi*4 + 4]
movzx eax, word [esi + 8]
inc edi
mov dword [esp + 0x34], edi
cmp ax, 0x7f
jne 0x401676
jmp 0x42b133
cmp dword [esi], 5
jne 0x40167b
mov ecx, dword [edx + ecx*4]
cmp word [ecx + 8], 0
jne 0x4016c5
cmp dword [ecx], 5
jne 0x4016c5
mov eax, dword [esp + 0x14]
inc dword [esp + 0x18]
mov dword [esp + 0x38], eax
inc eax
lea edi, [esp + 0x38]
lea esi, [esp + 0x54]
mov dword [esp + 0x14], eax
call fcn.00401090
mov ecx, dword [esp + 0x34]
mov eax, dword [ebx + 4]
mov eax, dword [eax + ecx*4 + 4]
inc ecx
cmp word [eax + 8], 0
jne case.0x40161f.8
mov eax, dword [eax]
cmp eax, 0x23
je case.0x40161f.8
jmp 0x42aff0
mov ecx, dword [edx + 4]
cmp word [ecx + 8], 0x7f
jne 0x42b049
dec dword [esp + 0x20]
dec dword [esp + 0x14]
cmp dword [esp + 0x3c], 0
je 0x42afda
cmp byte [esp + 0x45], 0
jne 0x42afe4
mov eax, dword [esp + 0x40]
mov edi, dword [eax]
lea esi, [esp + 0x3c]
call fcn.0040c250
cmp dword [esp + 0x20], 0
jl 0x42b127
cmp dword [esp + 0x14], edi
je case.0x40161f.8
jmp 0x42b127
mov eax, dword [esp + 0x14]
inc dword [esp + 0x20]
mov dword [esp + 0x34], eax
inc eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x3c]
mov dword [esp + 0x14], eax
call fcn.00401090
jmp case.0x40161f.8
xor ebx, ebx
jmp 0x4015a3
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x7f
jne 0x42b037
mov ebx, dword [esp + 0x14]
dec dword [esp + 0x18]
dec ebx
cmp dword [esp + 0x54], 0
mov dword [esp + 0x14], ebx
je 0x42afca
cmp byte [esp + 0x5d], 0
mov eax, dword [esp + 0x58]
jne 0x42afd2
mov edi, dword [eax]
lea esi, [esp + 0x54]
call fcn.0040c250
cmp dword [esp + 0x18], 0
jl 0x42b11e
cmp ebx, edi
je case.0x40161f.8
jmp 0x42b11e
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push eax
push ecx
push 0
call fcn.0040e940
test eax, eax
jne 0x42b069
cmp dword [esp + 0x30], eax
jne 0x42b0fd
lea eax, [esp + 0x6c]
call fcn.004014e0
lea eax, [esp + 0x3c]
call fcn.004014e0
lea eax, [esp + 0x78]
call fcn.004014e0
lea eax, [esp + 0x48]
call fcn.004014e0
lea eax, [esp + 0x54]
call fcn.004014e0
lea eax, [esp + 0x60]
call fcn.004014e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
mov eax, dword [esp + 0x30]
inc eax
cmp eax, 1
jg 0x42b0fd
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
push edx
push eax
jmp 0x40164e
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x7f
jne 0x42b037
mov eax, dword [esp + 0x14]
inc dword [esp + 0x1c]
mov dword [esp + 0x34], eax
inc eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x6c]
mov dword [esp + 0x14], eax
call fcn.00401090
jmp case.0x40161f.8
mov eax, dword [esp + 0x14]
inc dword [esp + 0x24]
mov dword [esp + 0x34], eax
inc eax
lea edi, [esp + 0x34]
lea esi, [esp + 0x78]
mov dword [esp + 0x14], eax
call fcn.00401090
jmp case.0x40161f.8
mov ebx, dword [esp + 0x14]
dec dword [esp + 0x1c]
dec ebx
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], ebx
call fcn.00410a70
test al, al
jne 0x42ae70
lea eax, [esp + 0x6c]
call fcn.00410a60
mov edi, dword [eax]
lea esi, [esp + 0x6c]
call fcn.0040c250
cmp dword [esp + 0x1c], 0
jl 0x42b109
cmp ebx, edi
je case.0x40161f.8
jmp 0x42b109
mov ecx, dword [edx + 4]
cmp word [ecx + 8], 0x7f
jne 0x42b049
mov ebx, dword [esp + 0x14]
dec dword [esp + 0x24]
dec ebx
lea eax, [esp + 0x78]
mov dword [esp + 0x14], ebx
call fcn.00410a70
test al, al
jne 0x42ae78
lea eax, [esp + 0x78]
call fcn.00410a60
mov edi, dword [eax]
lea esi, [esp + 0x78]
call fcn.0040c250
cmp dword [esp + 0x24], 0
jl 0x42b115
cmp ebx, edi
je case.0x40161f.8
jmp 0x42b115
mov eax, dword [esp + 0x14]
mov edx, dword [esi]
mov dword [esi + 4], edi
add edi, edi
push edi
lea ecx, [ebp + eax*2]
push ecx
push edx
call fcn.00410f70
mov eax, dword [esi]
add esp, 0xc
xor ecx, ecx
mov word [edi + eax], cx
pop edi
pop esi
pop ebp
ret 8
cmp byte [edi + 0x144], 0
jne 0x4097c7
cmp byte [0x49728b], 0
jne 0x40960a
cmp byte [0x4a8410], 0
jne 0x4310b9
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
lea eax, [esp + 0x6c]
push eax
call esi
test eax, eax
jne 0x4098c0
cmp byte [0x49728e], 1
je 0x4310e1
cmp dword [edi + 0xf8], 1
je 0x4097af
cmp dword [0x4a83cc], 0
jne 0x4310fe
cmp byte [0x497294], 1
je 0x4311ae
cmp dword [edi + 0x460], 0
jne 0x4311c8
cmp byte [0x4a83e4], 0
jne 0x431311
push edi
call fcn.00409540
cmp al, 1
je case.0x409800.127
cmp byte [0x4a8558], 0
jne 0x43153a
mov eax, dword [edi + 0xf8]
cmp eax, 7
je 0x4315b8
cmp eax, 8
je 0x431623
cmp eax, 9
je 0x431623
cmp eax, 2
je 0x40986e
cmp eax, 3
je 0x40986e
cmp eax, 4
je 0x40986e
cmp eax, 5
je 0x40986e
cmp eax, 6
je 0x40986e
mov ecx, dword [ebp + 8]
mov dword [edi + 0xf4], ecx
mov eax, ecx
inc ecx
cmp eax, dword [0x4a8e90]
mov dword [ebp + 8], ecx
jg 0x4318f3
test eax, eax
jle 0x4318f3
shl eax, 4
add eax, dword [0x4a8ec4]
test eax, eax
je 0x4318f3
mov esi, eax
mov edx, dword [esi + 4]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edx, dword [edx]
movsx eax, word [edx + 8]
cmp eax, ebx
jne 0x40970d
lea eax, [ebp + 8]
push eax
push esi
push edi
call fcn.0040b380
cmp byte [edi + 0xfc], 0
je 0x4095b0
jmp 0x4097c7
cmp eax, 0x34
jne 0x4097ef
lea eax, [esp + 0x1f]
push eax
lea ecx, [esp + 0x3c]
push ecx
push esi
push edi
lea eax, [esp + 0x20]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], ebx
call fcn.00409a40
test eax, eax
jne 0x409754
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [edx + eax*4]
cmp word [eax + 8], 0x7f
jne 0x431986
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x409779
mov eax, dword [esi + 0xc]
dec dword [eax]
mov edx, dword [esi + 0xc]
cmp dword [edx], ebx
je 0x4319a1
push esi
call fcn.004112ef
add esp, 4
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x40]
cmp eax, 8
je 0x4319bd
cmp eax, 0xa
je 0x4319de
cmp eax, 5
je 0x4319f5
cmp eax, 0xb
je 0x431a03
cmp eax, 0xc
jne case.0x409800.127
jmp 0x431a21
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
add eax, edi
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0
call fcn.0040d590
mov eax, dword [edi + 0xec]
mov byte [edi + 0x144], 0
cmp eax, 1
je 0x40994b
dec eax
mov dword [edi + 0xec], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
dec eax
cmp eax, 0x7e
ja case.0x409800.2
movzx eax, byte [eax + 0x4099b4]
jmp dword [eax*4 + 0x4099a0]
push edi
mov eax, esi
call fcn.00409340
jmp case.0x409800.127
xor eax, eax
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], eax
mov dword [esp + 0xc4], eax
push ecx
lea eax, [esp + 0x14]
and al, 0x14
mov edx, esi
mov ebx, edi
mov dword [esp + 0xc4], 1
call fcn.00409030
test eax, eax
jne 0x40985d
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [edx + eax*4]
cmp word [eax + 8], 0x7f
jne 0x431902
lea esi, [esp + 0xb8]
call fcn.004092c0
jmp case.0x409800.127
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [edi + 0x2f0], esi
je 0x4098a2
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [edi + 0x2f8]
cmp eax, ecx
jb 0x43179c
sub eax, ecx
cmp eax, dword [edi + 0x2f0]
jae 0x40992c
mov eax, dword [edi + 0xf8]
cmp eax, 3
jl case.0x409800.127
jmp 0x4317bd
cmp dword [esp + 0x60], 0x12
je 0x4310cb
lea ecx, [esp + 0x5c]
push ecx
mov ecx, 0x4a83d8
call fcn.0040d280
test eax, eax
jne 0x409907
lea edx, [esp + 0x5c]
push edx
mov ebx, 0x4a83d8
call fcn.0040d2a0
test eax, eax
jne 0x409907
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 1
push 0
push 0
push 0
lea edx, [esp + 0x6c]
push edx
call esi
test eax, eax
je 0x4095f0
jmp 0x4098c0
cmp dword [edi + 0xf8], 2
jne 0x4317a4
mov byte [edi + 0x144], 1
mov dword [edi + 0xf8], esi
jmp case.0x409800.127
mov esi, edi
call fcn.0040f060
cmp byte [edi + 0xfc], 1
je 0x4097e4
push edi
call fcn.00401aa0
push 0
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov edx, dword [0x4972c0]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x148]
push eax
call esi
test eax, eax
jle 0x4097e4
jmp 0x431a38
out dx, eax
dec dword [eax]
call fcn.004013e0
lea eax, [edi + 1]
push eax
call 0x4446547
xor ecx, ecx
mov dword [esi + 8], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
mov dword [esi], eax
jmp 0x403fd9
mov eax, dword [edx + 4]
cmp word [eax + 8], 0x7b
jne 0x42c0a9
mov eax, dword [esp + 0x14]
mov ecx, 1
or dword [esp + 0x2c], 0x34241489
pop es
ror dword [ebp - 0x728bdb84], 0x74
and al, 0x48
mov dword [esp + 0x14], eax
call fcn.00401090
jmp 0x3fd584
mov eax, dword [esp + 0x14]
mov ecx, 1
add dword [esp + 0x28], ecx
mov dword [esp], eax
xor al, 3
ror dword [ebp - 0x72cbdb84], 0x74
and al, 0x60
mov dword [esp + 0x14], eax
ljmp 0x14e9
lea edi, [ebx + 1]
jmp 0x4018e2
mov dword [ebx + 1], edi
jmp 0x40193a
mov edx, dword [edx + 4]
cmp word [edx + 8], 0x7f
jne 0x42b037
invalid
mov eax, dword [edx + 4]
cmp word [eax + 8], 0x7f
jne 0x42b049
mov ebx, dword [esp + 0x14]
dec dword [esp + 0x28]
dec ebx
lea eax, [esp + 0x60]
mov dword [ebp + 0x24], edi
adc al, 0xe8
pop ebx
invalid
lea eax, [esp + 0x48]
call fcn.00410a70
test al, al
jne 0x42af75
lea eax, [esp + 0x48]
call fcn.00410a60
mov ecx, dword [esp + 0x14]
dec ecx
cmp eax, dword [eax]
je case.0x40161f.8
lea eax, [esp + 0x60]
call fcn.004101f0
test al, al
jne 0x42af9c
lea eax, [esp + 0x60]
call fcn.00410a60
mov edx, dword [esp + 0x14]
dec edx
cmp edx, dword [eax]
invalid
push 0xffffffffffffffff
push 0x98
jmp 0x42b05f
mov eax, dword [edx + 4]
xor word [eax + 8], 0x7f
jne 0x42b049
xchg ebx, eax
add byte [eax], al
add byte [ebx + 0x18247c], al
cmp dword [esp + 0x18], 0
cmp dword [esp + 0x18], 0
jne case.0x40161f.8
push 0xffffffffffffffff
push 0x74
jmp 0x42b05f
lea edi, [ebx + 1]
jmp 0x4017ab
mov eax, dword [eax + 0x14]
jmp 0x4017a0
mov bh, byte [esi + 0x24]
adc al, 0x47
jmp 0x401727
mov eax, dword [esp + 0x40]
mov eax, dword [edx + 4]
jmp 0x40171c
sub eax, 0x12
cmp eax, 0x10
ja 0x42b53f
dec edi
mov dh, 0x90
jo 0x42afb2
inc edx
add bh, bh
and al, 0x95
push esp
mov cl, 0x42
add byte [ebx + 0x1c247c], al
cmp dword [esp + 0x1c], 0
cmp dword [esp + 0x1c], 0
jne 0xf8409584
cmp dword [esp + 0x24], 0
jne 0x7c401584
cmp dword [esp - 0x60], 0
jne 0x301584
push 0xffffffffffffffff
push 0x8000096
jmp 0x43305f
mov eax, dword [ebx + 4]
mov ecx, dword [eax - 0x74]
movsx edx, word [ecx + 0xa]
push edx
push 0x72
jmp 0x42b05f
mov ecx, dword [edx + 4]
movsx edx, word [ecx + 0xa]
push edx
push 0x72
jmp 0x42b05f
push 0xffffffffffffffff
push 0x81
push 0x204a7f20
call 0x55e62e
lea eax, [esp + 0x6c]
call fcn.00401ce0
mov dword [esp + 0x3c], eax
call fcn.004014e0
lea eax, [esp + 0x78]
call 0x3f14e0
lea eax, [ebp + 0x24]
dec eax
call fcn.004014e0
lea eax, [esp + 0x54]
call fcn.004014e0
lea eax, [esp + 0x60]
call fcn.004024e0
mov eax, 0x20003
jmp 0x40982e
push 0xffffffffffffffff
push 0x83
in eax, dx
push esi
invalid
push 0xffffffffffffffff
push 0x93
jmp 0x42b05f
push 0xffffffffffffffff
push 0x78
jmp 0x42b05f
push 0xffffffffffffffff
push 0x75
jmp 0x42ac5f
push 0xffffffffffffffff
push 0x400095
jmp 0x42b05f
push 0x7f
push 0x80000a1
jmp 0x42b05f
add byte [eax], al
add al, ch
mov ecx, 0x45fffd75
jmp 0x33c2
mov eax, dword [esi]
push ebp
mov ebp, dword [eax - 0x75]
inc eax
or byte [ebx], dh
leave
mov edx, 4
loop 0x42c0ca
nop
sal edi, 0xd9
or ecx, eax
push ecx
call fcn.0041171a
mov ecx, dword [esi]
push 4
mov dword [ecx], eax
call fcn.0041171a
add dword [eax + ecx + 0x874c085], 0xffffffc7
add byte [ecx], al
add byte [eax], al
add bl, ch
add dh, byte [ebx]
ror byte [ebx + 0x4428916], 0x8b
push es
cmp dword [eax + 8], 0
jle 0x42c13b
add al, 0x89
add eax, ebp
dec eax
push esi
invalid
push ebx
push edi
xor edi, edi
cmp dword [ebp + edi*4], 0
je 0x42c128
sub dl, byte [eax]
call fcn.0041170a
add esp, 4
test eax, eax
je 0x42c11d
mov ebx, eax
mov eax, dword [ebp + edi*8]
call fcn.0040bd50
retf
mov ecx, dword [esi]
mov esi, dword [ecx]
xor eax, eax
mov dword [edx + edi*4], eax
jmp 0x42c131
mov eax, dword [eax]
mov dword [eax + edi*4], 0x4000
mov eax, dword [esi]
pop es
cmp edi, dword [eax + 8]
jl 0x42c0f4
pop edi
pop ebx
pop ebp
ret
bound esp, qword [edx + edx*8 - 0x46]
inc ebx
inc esp
in eax, 0xfe
mov eax, esi
pushal
mov word [eax + 0x13faa484], fs
dec eax
sbb dword [esi], 0x6562710f
mov ecx, 0xfdc526c1
lodsb al, byte [esi]
jp 0x43114e
les ebp, [edi - 0x54]
mov dh, 6
bound ebp, qword [edi + 0x5e]
inc ecx
push esp
xchg dword [edx], edx
sti
inc edi
fsubr qword [ebx + 0x1f]
sbb dword [ecx - 0x6b], ebp
dec edx
aas
sub eax, 0x5cbac85d
push es
pop ds
or al, 0xcc
out dx, eax
retf 0xe83a
salc
sub dword [ecx + 0x5e], eax
pushal
xchg edx, eax
mov dword [0xb0223c33], eax
invalid
pop esi
pop ss
push ss
wait
invalid
lodsb al, byte [esi]
shr cl, 0xb
aam 3
or ebp, dword [ebx - 0x1fa66a0]
and al, 0xff
aad 0xb5
or bh, bh
hlt
in eax, 0xf4
insb byte es:[edi], dx
inc esi
adc cl, dh
dec edi
rcr dword [ecx + 0x3438bc53], cl
rcr dword [ecx + ebx*2 - 0x372aeace], 0x69
insd dword es:[edi], dx
pop edx
in eax, dx
mov ecx, 0xf991712
sbb dword [ebp + ecx*4 - 0x3da2a569], esp
pop ebp
fadd qword [edx*2 + 0x63d29be3]
xchg ebp, eax
cwde
or dword gs:[edx - 0x1eff197], edi
or byte [edx - 0x65], 0x9b
arpl word [edx - 0x20], dx
or dword ss:[ebx + 0x12], eax
cmpsd dword [esi], dword es:[edi]
loop 0x43124b
ror byte [ecx - 0x21], cl
insd dword es:[edi], dx
add dh, byte gs:[esi]
xchg edx, eax
sbb ebx, edx
or dword [0xf0908185], ecx
retf 0x74c
je 0x43122d
mov eax, dword [0xbc771987]
retf
inc ecx
lodsb al, byte [esi]
xchg edi, eax
shr byte [eax + edi*2 - 0x6a], 0x3a
stosb byte es:[edi], al
pop esp
retf
xchg edi, eax
xchg edi, eax
inc ebp
pop ds
cmp byte [edi + 0x55f75d9b], ch
rol dword [esi + 0x73ca4611], cl
call 0x41be0196
cmpsd dword [esi], dword es:[edi]
sbb edi, dword [ebx]
jnp 0x431220
popal
aas
inc si
rcl byte [eax + ebp*2 + reloc.ADVAPI32.dll_CreateProcessWithLogonW], 0x9a
mov dl, 0x94
or ecx, dword [esi]
mov esi, 0xb0164eac
clc
popal
or eax, dword [0xd5595732]
inc edi
std
lodsd eax, dword [esi]
adc dword [esi], ecx
mov eax, dword [reloc.ADVAPI32.dll_GetTokenInformation]
ror ebx, 1
mov ebp, 0x8a25664d
xchg dword [ecx + 0x1c], edx
and dword [edi + reloc.ADVAPI32.dll_GetSecurityDescriptorDacl], edx
xchg ebp, eax
pop ss
int1
leave
int1
mov dl, byte [esi]
in al, dx
pop ebp
std
mov dl, 0x53
hlt
in eax, dx
ficomp dword [eax + 4]
mov al, byte [0xe1a69557]
std
pop edi
out 0x5c, al
inc esp
xchg ebx, eax
adc edx, esp
jg 0x431361
invalid
dec esi
sbb al, 0x57
js 0x431379
dec ecx
ljmp 0x4837
int1
sahf
fsubr st(5)
mov eax, 0x8efc6c79
add esi, esi
jl 0x4313a2
mov es, word [ecx]
idiv byte [esp - 2]
invalid
mov esi, reloc.KERNEL32.dll_GetVersionExW
into
outsd dx, dword [esi]
jle 0x431370
and ebp, esi
pop ebx
cwde
jmp 0x431380
rcl eax, cl
push ebx
pop edx
add dword [edi - 0x3f], esp
and bl, byte gs:[ebx + reloc.KERNEL32.dll_CreateFileW]
sub dword [ebx + ebp*8 - 0x764c7a38], ebp
lahf
add al, byte [esi - 0x1be7a917]
xlatb
jl 0x43137f
iretd
adc dword [ecx + 0x25], edi
cld
push 0xdd7ca538
test dword [edi], edx
cmp al, 0xd1
sub al, 0xef
add ebx, dword gs:[ebp - 0x17]
jl 0x4315a1
adc edi, edx
ja 0x431585
xor al, 0x13
invalid
je 0x4315fe
test eax, reloc.KERNEL32.dll_GetModuleFileNameA
arpl word [edx - 0x36], si
dec ebp
insb byte es:[edi], dx
ret 0xf50a
out 0x1f, al
mov dword [reloc.KERNEL32.dll_GetConsoleCP], eax
xchg ebx, eax
sbb byte [edi + 0x3e], 0xe1
jecxz 0x431625
retf
add byte [ebx], 0x9b
jge 0x431617
and byte [ecx - 0x1f158d31], ah
sbb dword [eax - 0x264069bd], esi
sbb al, 0xf2
cmpsb byte [esi], byte es:[edi]
add al, byte es:[edx]
int1
insd dword es:[edi], dx
inc esp
les edi, [eax]
test ecx, edx
test al, 0xf7
pop esi
pop edi
jge 0x4315e2
lea edi, [0xe42c2476]
jmp 0x8b6d60df
mov dword [0x90a06313], eax
push 0xffffffffffffffdb
push esi
int3
inc eax
and eax, 0xb3c9ad80
push es
or eax, edx
int 0xa
dec esi
in al, 0x47
stosb byte es:[edi], al
test byte [esi - 0x60], dh
xor al, 0xdf
invalid
out dx, al
cmp esi, dword [eax + 0x37]
lcall 0x7258, 0xc5b1a528
lds ebx, [eax + 0x72]
dec edi
sub al, 0xfb
stosd dword es:[edi], eax
add bh, byte [eax + 0x6bfda26d]
test dword [eax], ebp
rcr dword [esi - 0x54], cl
loope 0x4317e8
add eax, 0x5570cbc1
push ebp
mov ebx, 0x5168f940
or bh, ch
xchg esi, eax
lahf
je 0x431832
sub bh, 0x45
scasb al, byte es:[edi]
sub byte [ebx - 0x242cecb], bl
sbb eax, reloc.USER32.dll_GetKeyboardState
wait
xor eax, reloc.USER32.dll_SetKeyboardState
push 0x41
push 3
out 0x1e, al
enter 0x3f8e, 0x72
mov cl, al
jno 0x4317ce
lcall 0xfe53, 0xc544ef02
mov ah, 0x29
out dx, eax
or al, 0xae
into
mov byte [reloc.USER32.dll_SendDlgItemMessageW], al
mov ah, 0x98
invalid
invalid
dec ebx
xchg dword [esp + edx + 0x2e], esp
push ebp
out 0x8e, al
push ds
mov ah, 0x86
salc
mov ecx, 0x36d96497
mov eax, 0x8e092653
or bh, byte [edx - 0x79]
xor edi, dword [0x64a3cb49]
cmp eax, 0x64a3cb49
out 0xb2, eax
dec esp
mov dh, 0xa9
pop ebx
fisub dword [edi - 0x15]
das
xlatb
wait
in al, dx
out 0x61, eax
jge 0x43184e
pop ebx
out dx, al
add al, 0x9f
mov eax, 0xb7ef261a
pop ecx
jp 0x4318ee
dec eax
xchg esp, eax
mov ebx, 0xa367f175
inc esp
dec edx
invalid
lea ebx, ss:[ebx + 0x29]
sti
ret 0x2baf
dec eax
enter 0xffffffffffffe91e, 0x48
xor dword [ebp + 0x40], esp
mov edx, reloc.USER32.dll_CloseClipboard
jns 0x4318eb
xor ch, byte [ecx - 0x23]
and dword [edx + 0x6345ff72], esp
xor byte [esi + 0x50], al
inc edx
push edx
std
or dword [eax + eax*2 - 0x4ec77871], esp
mov dl, 0xdc
pushal
xchg ebx, eax
loop 0x431954
push esi
mov ebp, reloc.USER32.dll_TranslateMessage
pop ebx
add esi, dword [ecx - 0x55df50c9]
inc ebx
mov ebp, edi
and ebp, esi
mov ch, 0x8f
invalid
mov ah, 0x4a
movsd dword es:[edi], dword [esi]
pop ds
xchg edi, eax
xchg esi, eax
pop ebp
pop ebp
or dword cs:[edi], 6
out 0x77, al
sbb eax, reloc.USER32.dll_RegisterClassExW
and byte [edi], ch
jmp 0x431894
xor cl, cl
les eax, [edx + 0x58111e19]
jecxz 0x4318fe
jg 0x4318fe
fiadd word [edx - 0x5514a3fa]
movsb byte es:[edi], byte [esi]
fcmovnbe st(0), st(5)
inc esi
xchg esi, eax
salc
je 0x4318ab
mov ecx, 0x535745bc
xor al, bh
invalid
outsb dx, byte [esi]
scasd eax, dword es:[edi]
or ecx, dword [ebx - 0x48881333]
inc edi
mov bh, 0x47
push ebx
invalid
adc ch, byte [edx - 6]
popfd
mov bh, 0x3a
xor byte [ebp + 0x71], ch
int3
imul edx, dword [esi + 0x19], 0xffffff8f
lodsb al, byte [esi]
sbb dword [edi], edi
xlatb
push esi
hlt
sub ebx, dword [esp + reloc.WSOCK32.dll___WSAFDIsSet]
aam 0x97
jno 0x431a28
dec esp
cmp byte [esi - 0x20], dl
hlt
jg 0x43194d
invalid
pop edx
test dword [edi - 6], edi
cmp dword [edx], eax
je 0x4319e3
add al, 0xfd
cdq
jb 0x431a44
and ecx, dword ss:[ecx]
out 0xa7, eax
jmp 0x1ca143a0
lodsd eax, dword [esi]
neg byte [ecx + ecx*4 - 0x75]
int3
int3
push eax
lahf
movsb byte es:[edi], byte [esi]
and dword [ecx - 0x16df8ead], ecx
movsb byte es:[edi], byte [esi]
out dx, eax
mov dh, 0x32
add dword [ebx], ebx
leave
mov ecx, gs
test byte [edx - 0x3d], al
jns 0x431a65
js 0x431a81
cmpsb byte [esi], byte es:[edi]
sbb esp, 0x37
mov edx, 0x8cc3d085
cmp ebx, esi
push esp
test eax, edx
ret
push esp
je 0x4319b9
rol bh, cl
xor dh, dl
dec ebx
pushal
cmp al, 0x4b
sbb eax, 0x83e5ae55
call 0x1d55e892
jle 0x4319cf
sub eax, 0x54
into
adc bl, byte [0x17ef8f7e]
out dx, eax
pop ss
invalid
hlt
mov al, 0x1f
xor ebp, ecx
ja 0x431ab5
xor al, 0xa2
salc
dec edx
or ecx, dword [ebp + 0x59]
retf 0x705
ljmp 0x5087:0x8d6fea3
test dword [ebx + 0x34], ebp
cmp bh, ah
invalid
mov edx, 0x8c90e963
ret 0xcca5
std
cmp al, 0xac
dec edi
jge 0x433030
popfd
out 0x41, al
push edi
ret