Function at 0x1000dc60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019f5e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0x88], 0x1001b34c
mov dword [ebp - 0x50], 0x7f8a
mov dword [ebp - 0x4c], 0x7f00
mov dword [ebp - 0x48], 0x7f03
mov dword [ebp - 0x44], 0x7f89
mov dword [ebp - 0x40], 0x7f8b
mov dword [ebp - 0x3c], 0x7f01
mov dword [ebp - 0x38], 0x7f81
mov dword [ebp - 0x34], 0x7f88
mov dword [ebp - 0x30], 0x7f80
mov dword [ebp - 0x2c], 0x7f86
mov dword [ebp - 0x28], 0x7f83
mov dword [ebp - 0x24], 0x7f85
mov dword [ebp - 0x20], 0x7f82
mov dword [ebp - 0x1c], 0x7f84
mov dword [ebp - 0x18], 0x7f04
mov dword [ebp - 0x14], 0x7f02
lea edi, [ebp - 0x50]
lea esi, [ecx + 0xcc]
mov ebx, 0x10
mov eax, dword [edi]
push eax
push 0
mov dword [esi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esi], eax
add edi, 4
add esi, 4
dec ebx
jne 0x1000dd09
mov eax, dword [ebp - 0x10]
push str.GDI32.dll
mov dword [ebp - 4], 0
mov dword [eax], 0x1001b350
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1002181c], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [ebp + 8]
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000dd5f.2
xor edx, edx
mov dl, byte [eax + 0x1000dfe4]
jmp dword [edx*4 + 0x1000dfdc]
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x70], ecx
jmp 0x1000dd7a
mov eax, dword [ebp - 0x10]
mov esi, eax
mov dword [eax + 0x70], 8
mov ecx, esi
call fcn.1000ea70
test al, al
jne 0x1000ddae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi + 0x10c], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov ecx, dword [esi + 0x10c]
push ecx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
push str.GetTickCount
push str.KERNEL32.dll
mov dword [esi + 0x10], 0xcc0020
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [esi + 4], 1
call eax
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov dl, byte [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esi + 8], ecx
mov byte [esi + 0xc], dl
mov dword [esi + 0x18], eax
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov dword [esi + 0x30], 0
mov byte [esi + 0x24], al
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov eax, dword [0x1002181c]
push str.CreateCompatibleDC
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0xc], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x44]
push ecx
call edi
mov edx, dword [esi + 0x44]
mov dword [esi + 0x4c], eax
push edx
call edi
push 0
mov dword [esi + 0x80], eax
call edi
push 0
mov dword [esi + 0x48], eax
call edi
mov dword [esi + 0x50], eax
lea eax, [esi + 0x5c]
mov ecx, dword [esi + 0x70]
mov dword [ebp + 0xc], eax
mov dword [eax], 0
lea eax, [esi + 0x60]
mov dword [ebp + 0x10], eax
push 1
mov dword [eax], 0
mov eax, dword [esi + 0x28]
push eax
push ecx
mov ecx, esi
call fcn.1000e5d0
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x28]
push edx
push eax
push ecx
mov ecx, esi
call fcn.1000e5d0
mov edx, dword [esi + 0x28]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
push 1
push edx
push eax
mov ecx, esi
call fcn.1000e5d0
mov dword [esi + 0x6c], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [0x1002181c]
push str.CreateDIBSection
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 0
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x44]
push 0
push edx
push 0
push eax
push ecx
call edi
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 0x44]
push 0
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x68]
push 0
push edx
push 0
push eax
push ecx
call edi
mov ecx, dword [esi + 0x44]
push 0
lea edx, [esi + 0x78]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x68]
push 0
push edx
push 0
push eax
push ecx
call edi
mov dword [esi + 0x84], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [0x1002181c]
push str.SelectObject
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0xc], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x4c]
push eax
push ecx
call edi
mov edx, dword [esi + 0x54]
mov eax, dword [esi + 0x48]
push edx
push eax
call edi
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x80]
push ecx
push edx
call edi
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
push eax
push ecx
push 0
lea edx, [esi + 0x34]
push 0
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0x14]
shl ecx, 1
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0x14]
xor edx, edx
div dword [esi + 0x2c]
mov dword [esi + 0x20], 0
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add byte [eax], al
add byte [eax], al
inc esi
jb 0x1001e148
add byte [eax], al
add byte [esi + 0x72], al
inc esi
jb 0x1001e148
dec esp
dec esp
imul esp, dword [edx + 0x72], 0x797261
push ebx
je 0x1001e135
jbe 0x1001e157
outsb dx, byte [esi]
je 0x1001e0f5
add byte [eax], al
add byte [edi + 0x61], dl
push edi
popal
imul esi, dword [esi + eax*2 + 0x6f], 0x6e695372
insb byte es:[di], dx
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax + 0x77], si
ja 0x1001e16f
jbe 0x1001e175
dec edi
jne 0x1001e187
push edi
jb 0x1001e17f
je 0x1001e17d
add byte [eax], al
add byte [eax], al
ja 0x1001e17f
jbe 0x1001e185
dec ecx
outsb dx, byte [esi]
push ebx
je 0x1001e186
jb 0x1001e19b
add byte [edi + 0x61], dh
ja 0x1001e18b
jbe 0x1001e191
dec ecx
outsb dx, byte [esi]
inc ecx
inc edx
jne 0x1001e19a
jb str.waveInPrepareHeader
jb str.waveInPrepareHeader
ja 0x1001e19b
jbe 0x1001e1a1
dec ecx
outsb dx, byte [esi]
push eax
jb 0x1001e1a6
jo str.waveOutOpen
jb 0x1001e1aa
dec eax
popal
jb str.waveInOpen
ja 0x1001e1af
jbe 0x1001e1b5
dec ecx
outsb dx, byte [esi]
dec edi
jo 0x1001e1ba
outsb dx, byte [esi]
add byte [eax], al
ja 0x1001e1bb
add byte [edi + 0x61], dh
ja 0x1001e1bb
jbe 0x1001e1c1
dec ecx
outsb dx, byte [esi]
inc edi
je str.waveOutGetNumDevs
jne 0x1001e1d1
inc esp
jbe 0x1001e1db
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001e1d4
popal
je 0x1001e1d7
push esp
push 0x64616572
add byte [eax], al
popal
add byte fs:[eax], al
add byte [eax], al
push edx
jae 0x1001e1f5
jne 0x1001e1ee
insd dword es:[edi], dx
push esp
push 0x64616572
add byte [eax], al
popal
popal
add byte fs:[eax], al
add byte [eax], al
ja 0x1001e1ef
jbe 0x1001e1f5
dec edi
jne 0x1001e207
push eax
jb 0x1001e1fb
jo 0x1001e1f9
jb 0x1001e1ff
dec eax
popal
jb 0x1001e1a1
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x1001e207
ja 0x1001e207
jbe 0x1001e20d
dec edi
jne 0x1001e21f
je 0x1001e1fb
dec edi
jo 0x1001e213
outsb dx, byte [esi]
add byte [edi + 0x61], dh
ja 0x1001e213
ja 0x1001e213
jbe 0x1001e219
dec edi
jne 0x1001e22b
inc edi
je 0x1001e209
dec esi
jne 0x1001e22a
inc esp
jbe str.VirtualAlloc
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
inc ebx
jb 0x1001e23a
je 0x1001e23c
arpl word [ecx + 0x6c], sp
popal
insb byte es:[edi], dx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [esi + 0x69], dl
push esi
invalid
jb str.ResetEvent
jne 0x1001e247
insb byte es:[edi], dx
inc esi
jb 0x1001e24f
add byte gs:[ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
je 0x1001e257
inc ebx
jb 0x1001e25e
je 0x1001e260
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebp + 0x6e], al
inc ebp
outsb dx, byte [esi]
je 0x1001e26d
jb 0x1001e24d
jb 0x1001e24d
inc ebx
jb 0x1001e275
je 0x1001e277
imul esp, dword [ebx + 0x61], 0x6365536c
je 0x1001e27f
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
arpl word [ecx + ebp*2 + 0x6f], si
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
dec esp
popal
add byte [eax], al
add byte [ebp + 0x61], cl
dec esp
popal
jbe 0x1001e286
inc ebx
jb 0x1001e28d
je 0x1001e28f
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
push esi
imul esi, dword [edx + 0x74], 0x416c6175
insb byte es:[edi], dx
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [eax], al
add byte [edi + 0x53], dl
push edi
push ebx
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
inc esp
pop edi
xor esi, dword [edx]
inc esp
dec esp
dec esp
add byte [eax], al
arpl word [edi + 0x6e], bp
add byte [ebx + 0x6f], ah
arpl word [edi + 0x6e], bp
outsb dx, byte [esi]
arpl word gs:[eax + eax + 0x52], si
push edx
add byte [edx + 0x65], dl
push edx
jae 0x1001e2c1
push edx
jae 0x1001e2c1
je 0x1001e2a3
jbe 0x1001e2c5
outsb dx, byte [esi]
je 0x1001e263
add byte [edi + 0x65], al
inc edi
je str.InterlockedExchange
popal
jae 0x1001e2df
inc ebp
jb 0x1001e2e0
jb 0x1001e2de
outsd dx, dword [esi]
jb 0x1001e271
add byte [eax], al
add byte [eax], al
add byte [eax], al
add al, dl
rol byte [ecx], 0x10
add byte [eax], al
add byte [eax], al
push eax
add byte [esi], ch
push eax
inc ecx
pop eax
add byte [eax], al
add byte [eax], al
rol al, 1
add dword [eax], edx
add byte [eax], al
add byte [eax], al
push eax
add byte [eax], al
add byte [esi], ch
push eax
inc ecx
inc esp
add byte [eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte [ecx + 0x6c], al
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
add byte gs:[eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte [edx + 0x75], ah
jb 0x1001e2b3
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
je 0x1001e31d
jb 0x1001e326
outsd dx, dword [esi]
arpl word [ebx + 0x65], bp
inc ebp
js 0x1001e325
arpl word [eax + 0x61], bp
outsb dx, byte [esi]
push 0x65676e61
add byte [ebx + 0x61], al
inc ebx
popal
add byte gs:[bp + di + 0x61], al
inc ebx
popal
outsb dx, byte [esi]
arpl word [ebp + 0x6c], sp
dec ecx
outsd dx, dword [esi]
add byte [eax], al
add byte [eax], al
push ebx
insb byte es:[edi], dx
jo 0x1001e2da
add byte [eax], al
inc edi
je 0x1001e32c
je 0x1001e32c
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
push esp
imul ebp, dword [ebp + 0x65], 0
inc edi
je 0x1001e344
imul esp, dword [ebx + 0x6b], 0x6e756f43
je 0x1001e2f9
add byte [eax], al
add byte [edx], dh
xor dh, byte [eax]
xor byte [eax], bh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [ebx], dh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
push eax
jb 0x1001e386
jne 0x1001e37d
je 0x1001e36a
popal
insd dword es:[edi], dx
add byte gs:[ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001e38f
jb 0x1001e39d
jae 0x1001e39f
je 0x1001e38f
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x1001e3b3
jb 0x1001e3a8
outsb dx, byte [esi]
je 0x1001e39c
jb 0x1001e3bc
imul ebp, dword [edi + 0x6e], 0
and eax, 0x25642573
jae 0x1001e357
add byte [0x55000064], ah
push ebp
jae 0x1001e3c4
jb 0x1001e38e
inc ecx
outsb dx, byte gs:[si]
je 0x1001e3a1
and byte [ebp + 0x6f], cl
jp 0x1001e3d5
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x1001e3db
je 0x1001e3e5
bound ebp, qword [ebp + 0x3b]
and byte [ebp + 0x53], cl
insb byte es:[edi], dx
cmp esp, dword gs:[eax]
dec ebp
push ebx
dec ecx
inc ebp
and byte [esi], dh
xor byte cs:[ebx], bh
and byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x1001e405
and byte [esi + 0x54], cl
and byte [0x203b312e], dh
push ebx
push esi
xor dword [ebx], edi
and byte [esi], ch
dec esi
inc ebp
push esp
xor al, 0x2e
xor byte [ebx + 0x3b], al
and byte [esi], ch
dec esi
cmp esp, dword [eax]
dec esi
inc ebp
push esp
xor al, 0x2e
xor byte [ebp + 0x29], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x1001e41d
jb str._d._d._d._d
je str.HeapAlloc
dec edi
jo 0x1001e424
outsb dx, byte [esi]
push ebp
jb 0x1001e42f
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x1001e431
jb 0x1001e43c
je 0x1001e420
jo str.lstrlenA
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x1001e441
jb str.MicrosoftNetworkConnectionspbk_rasphone.pbk
jb str.MicrosoftNetworkConnectionspbk_rasphone.pbk
je 0x1001e424
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001e44a
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edi + 0x49], dl
push edi
dec ecx
dec esi
dec ecx
dec esi
inc ebp
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x65], al
inc edi
je 0x1001e43f
jne 0x1001e470
jb 0x1001e465
outsb dx, byte [esi]
je 0x1001e453
jb 0x1001e474
arpl word [ebp + 0x73], sp
jae 0x1001e453
add byte fs:[eax + 0x65], cl
dec eax
popal
dec eax
popal
jo 0x1001e452
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [eax], al
inc edi
je 0x1001e46c
jb 0x1001e48d
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x1001e46b
jae 0x1001e495
dec eax
popal
popal
jo 0x1001e427
add byte [0x64252e64], ah
and eax, 0x64252e64
and eax, 0x64252e64
and eax, 0x64252e64
and byte [eax], al
add byte [eax], al
add byte [ebx + esi*2 + 0x74], ch
insb byte es:[edi], dx
jae 0x1001e4af
and eax, 0x2064
and eax, 0x2064
add byte [eax], al
insb byte es:[edi], dx
jae 0x1001e4af
jb 0x1001e4a9
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
inc ecx
add byte [eax], al
add byte [eax], al
and eax, 0x73255c73
add byte [eax], al
add byte [0x73255c73], ah
and eax, 0x73255c73
add byte [eax], al
add byte [ebp + 0x69], cl
dec ebp
invalid
arpl word [edx + 0x6f], si
jae 0x1001e4c2
add byte [eax], al
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001e4b2
outsd dx, dword [esi]
je 0x1001e4b2
dec esi
je 0x1001e4d1
outsd dx, dword [esi]
jb 0x1001e4c8
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
jae 0x1001e4c6
imul ebp, dword [edi + 0x6e], 0x62705c73
jo 0x1001e4ce
bound ebp, qword [ebx + 0x5c]
jb 0x1001e4d1
imul ebx, dword [edx + esi*2 + 0x61], 0x73
jo 0x1001e4db
jae 0x1001e4e2
push 0x2e656e6f
jo 0x1001e4db
outsd dx, dword [esi]
outsb dx, byte [esi]
jo 0x1001e4db
imul eax, dword [eax], 0
pop esp
inc ecx
jo str.lstrcpyA
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
and byte [ecx + 0x74], al
popal
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001e4f4
je 0x1001e4f4
dec esi
je 0x1001e513
outsd dx, dword [esi]
jb 0x1001e50a
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
jae str.GetPrivateProfileSectionNamesA
jo 0x1001e510
imul ebx, dword [edx + esi*2 + 0x61], 0x73
jo 0x1001e51d
pop esp
jb 0x1001e513
jae 0x1001e524
push 0x2e656e6f
jo 0x1001e51d
outsd dx, dword [esi]
outsb dx, byte [esi]
jo 0x1001e51d
imul eax, dword [eax], 0
add byte [eax], al
inc esp
outsd dx, dword [esi]
arpl word [ebp + 0x6d], si
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x1001e53c
jae 0x1001e4ea
and byte [ecx + 0x6e], ah
popal
outsb dx, byte [esi]
and byte fs:[ebx + 0x65], dl
je 0x1001e546
push ebx
je 0x1001e546
je 0x1001e53c
imul ebp, dword [esi + 0x67], 0x47005c73
inc edi
je 0x1001e533
outsb dx, byte [esi]
jae 0x1001e533
add byte [edi + 0x65], al
inc edi
je 0x1001e533
push edi
imul ebp, dword [esi + 0x64], 0x4473776f
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x1001e52d
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
jae 0x1001e567
jb 0x1001e558
arpl word [eax + 0x79], si
jo 0x1001e570
inc ecx
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
jae 0x1001e573
jb str.WideCharToMultiByte
popal
je 0x1001e545
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001e55c
je 0x1001e55c
jb 0x1001e577
jbe 0x1001e571
je 0x1001e577
push eax
jb 0x1001e584
imul bp, word [ebp + 0x53], 0x6365
je 0x1001e587
imul ebp, dword [edi + 0x6e], 0x656d614e
outsd dx, dword [esi]
outsb dx, byte [esi]
dec esi
popal
insd dword es:[edi], dx
jae 0x1001e567
jae 0x1001e567
add byte [eax], al
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
jbe 0x1001e592
jb 0x1001e5a3
push ebx
imul esp, dword [esp + edx*2 + 0x6f], 0x69727453
outsb dx, byte [esi]
push ebx
imul esp, dword [ecx + eax*2], 0x76646100
popal
jbe 0x1001e5a5
outsd dx, dword [esi]
push ebx
je 0x1001e5a9
imul ebp, dword [esi + 0x67], 0x41646953
inc ecx
add byte [eax], al
popal
jbe 0x1001e5a5
jo 0x1001e5af
imul esi, dword [ebx], 0x6c642e32
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
dec ebp
jne 0x1001e5bf
je 0x1001e5be
inc edx
jns str.GetVersionExA
push esp
outsd dx, dword [esi]
push edi
imul esp, dword [ebp + 0x43], 0x726168
push edi
imul esp, dword [ebp + 0x43], 0x54726168
outsd dx, dword [esi]
inc ebx
push 0x6f547261
dec ebp
jne 0x1001e5dd
insb byte es:[edi], dx
je str.GetPrivateProfileStringA
inc edx
jns 0x1001e5ea
add byte gs:[esp + 0x5f], cl
dec esp
and al, 0x5f
add byte [esp + 0x5f], cl
dec esp
and al, 0x5f
push edx
popal
jae 0x1001e5c3
popaw
jne 0x1001e5f0
je 0x1001e5c9
jb 0x1001e5ed
outsb dx, byte gs:[esi]
outsb dx, byte gs:[esi]
je 0x1001e5f6
popal
insb byte es:[edi], dx
jae 0x1001e5b4
xor byte [eax], al
add byte [edx + 0x61], dl
push edx
popal
add byte [eax], al
push edx
popal
jae str.GetPrivateProfileStringA
imul esp, dword [ecx + 0x6c], 0x61726150
insd dword es:[edi], dx
jae 0x1001e5c3
and eax, 0x302373
jae 0x1001e5c8
xor byte [eax], al
add byte [ebp + 0x76], al
inc esp
jbe 0x1001e615
arpl word [ebp], sp
add byte [eax + 0x68], dl
push eax
invalid
jbe 0x1001e615
arpl word [ebp], sp
add byte [eax + 0x68], dl
push eax
invalid
outsd dx, dword [esi]
outsb dx, byte [esi]
dec esi
jne 0x1001e625
bound esp, qword [ebp + 0x72]
add byte [ecx + ebp*2 + 0x61], al
inc esp
invalid
popal
popal
insb byte es:[edi], dx
push eax
popal
jb 0x1001e625
popal
insd dword es:[edi], dx
jae 0x1001e61c
dec ecx
inc esp
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001e626
inc edi
je 0x1001e626
jb 0x1001e646
imul ebp, dword [edi + 0x6e], 0x417845
add byte [eax], al
inc edi
je 0x1001e630
jb 0x1001e64b
jbe 0x1001e645
je 0x1001e64b
push eax
jb 0x1001e658
imul bp, word [ebp + 0x53], 0x7274
imul ebp, dword [ebp + 0x53], 0x6e697274
inc ecx
add byte [eax], al
push ebx
je 0x1001e662
imul ebp, dword [esi + 0x67], 0x41
add byte [ebx + esi*2 + 0x74], ch
insb byte es:[edi], dx
jae 0x1001e66f
add byte [eax], al
insb byte es:[edi], dx
jae 0x1001e66f
jb 0x1001e660
insd dword es:[edi], dx
jo 0x1001e641
add byte [eax], al
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001e66f
inc esi
imul ebp, dword [ebp + 0x41], 0x74654700
inc edi
je 0x1001e65a
imul ebp, dword [ebp + 0x41], 0x69727474
insb byte es:[edi], dx
inc ecx
je 0x1001e68e
jb 0x1001e685
bound esi, qword [ebp + 0x74]
jae 0x1001e663
add byte [eax], al
inc ebx
jb 0x1001e68c
popal
popal
je 0x1001e68f
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x1001e675
outsd dx, dword [esi]
jb 0x1001e6ac
inc ecx
add byte [eax], al
add byte [eax], al
push ebx
push 0x456c6c65
js 0x1001e6a5
arpl word [ebp + 0x74], si
jne 0x1001e6b7
inc ecx
add byte [eax], al
add byte [ebx + 0x68], dl
push ebx
invalid
insb byte es:[edi], dx
add byte [eax], al
push ebx
push 0x336c6c65
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x48], dl
push ebx
dec eax
inc edi
je 0x1001e6a0
je 0x1001e6a0
imul ebp, dword [ebp + 0x49], 0x416f666e
outsd dx, dword [esi]
inc ecx
add byte [eax], al
inc edi
je 0x1001e6b4
add byte [edi + 0x65], al
inc edi
je 0x1001e6b4
outsd dx, dword [esi]
imul esp, dword [bp + di + 0x61], 0x6972446c
jb 0x1001e6da
jbe 0x1001e6d8
push ebx
je 0x1001e6e8
jb 0x1001e6e0
imul ebp, dword [esi + 0x67], 0x47004173
inc edi
je 0x1001e6d6
outsb dx, byte [esi]
jae 0x1001e6bc
add byte [edi + 0x65], al
inc edi
je 0x1001e6d6
outsd dx, dword [esi]
insb byte es:[edi], dx
jne 0x1001e6f1
dec ecx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
jb 0x1001e6f8
popal
je 0x1001e6f7
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je str.LocalReAlloc
imul esi, dword [ebx + 0x6b], 0x65657246
push ebx
jo 0x1001e703
arpl word [ebp + 0x45], sp
js 0x1001e6e8
add byte [edi + 0x65], al
inc edi
je 0x1001e6f0
jb 0x1001e717
jbe 0x1001e715
push esp
jns 0x1001e723
inc ecx
inc ecx
add byte [eax], al
add byte [esi], ch
add byte cs:[eax], al
add byte cs:[eax], al
add byte [edi + ebp*2 + 0x63], cl
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [esi + 0x69], al
inc esi
imul ebp, dword [esi + 0x64], 0x73726946
je 0x1001e71c
invalid
insb byte es:[edi], dx
imul ebp, dword [ebp + 0x41], 0x6f4c0000
dec esp
outsd dx, dword [esi]
inc ecx
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
push edx
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [eax], al
add byte [esi + 0x69], al
inc esi
invalid
outsb dx, byte [esi]
dec esi
add byte [eax], al
add byte [eax], al
inc esi
imul ebp, dword [esi + 0x64], 0x7478654e
dec esi
js 0x1001e768
inc esi
imul ebp, dword [ebp + 0x41], 0x4c000000
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
inc ecx
add byte [eax], al
add byte [edi + ebp*2 + 0x63], cl
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc esi
jb 0x1001e769
add byte gs:[eax], al
add byte gs:[eax], al
add byte [esi + 0x69], al
inc esi
imul ebp, dword [esi + 0x64], 0x736f6c43
invalid
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001e75e
je 0x1001e75e
inc esi
imul ebp, dword [ebp + 0x53], 0x657a69
push edx
popal
inc esi
imul ebp, dword [ebp], 0x53000000
push ebx
je 0x1001e776
imul ebp, dword [ebp + 0x50], 0x746e696f
jb 0x1001e73b
add byte [0x25732573], ah
and eax, 0x25732573
jae 0x1001e743
add byte [0x2a732573], ah
and eax, 0x2a732573
sub al, byte cs:[eax]
pop esp
add byte [eax], al
add byte [ebp + 0x6f], cl
dec ebp
outsd dx, dword [esi]
jbe 0x1001e7b9
inc esi
imul ebp, dword [ebp + 0x41], 0x48000000
dec eax
je 0x1001e7d3
je 0x1001e7d0
jo str.HTTP_1.0_200_OK_r_n_r_n
das
xor dword [esi], ebp
xor dword [eax], esp
xor al, 0x30
xor esp, dword [eax]
and byte [esi + 0x6f], al
inc esi
outsd dx, dword [esi]
jb 0x1001e7cf
imul esp, dword [esp + 0x65], 0xd0a0d6e
or bh, byte [eax + ecx*2]
cmp al, 0x48
xor dword [esi], edi
xor al, 0x30
xor esp, dword [eax]
inc esi
outsd dx, dword [esi]
jb 0x1001e7e4
imul esp, dword [esp + 0x65], 0x482f3c6e
xor dword [esi], edi
add byte [eax], al
add byte [eax], al
dec eax
push esp
push esp
push eax
das
xor dword [esi], ebp
xor byte [eax], ah
xor dh, byte [eax]
xor byte [eax], ah
dec edi
dec ebx
or eax, 0xa0d0a
push eax
add byte [eax], al
add byte [ebx + esi*2 + 0x79], bl
pop esp
jae str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
jae 0x1001e819
outsd dx, dword [esi]
popal
je str..DEFAULTKeyboard_LayoutToggle
inc esp
inc ebp
inc esi
inc ecx
push ebp
dec esp
push esp
pop esp
dec ebx
jns 0x1001e823
outsd dx, dword [esi]
popal
jb 0x1001e829
and byte [ecx + 0x79], cl
outsd dx, dword [esi]
jne 0x1001e840
pop esp
push esp
outsd dx, dword [esi]
insb byte es:[di], dx
insb byte es:[di], dx
add byte gs:[eax + 0x6f], cl
dec eax
outsd dx, dword [esi]
add byte [eax + 0x6f], cl
dec eax
outsd dx, dword [esi]
je 0x1001e843
jns 0x1001e7db
add byte [edx], dh
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e85c
jb 0x1001e851
outsb dx, byte [esi]
je 0x1001e832
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e865
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e855
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e870
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x1001e872
imul ebp, dword [esi + 0x61], 0x6553206c
jb 0x1001e884
jb 0x1001e86d
push edi
jae 0x1001e871
jb 0x1001e87b
jo 0x1001e890
pop esp
push esp
jae 0x1001e87b
je 0x1001e884
jo 0x1001e823
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e8a0
jb 0x1001e895
outsb dx, byte [esi]
je 0x1001e876
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e8a9
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e899
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e8b4
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x1001e8b6
imul ebp, dword [esi + 0x61], 0x6553206c
jb 0x1001e8c8
jbe 0x1001e8b8
jb 0x1001e8b1
jb 0x1001e8b1
push edi
imul ebp, dword [esi + 0x53], 0x69746174
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x1001e8bd
imul ebp, dword [edi + 0x6e], 0x44525c73
push edx
inc esp
push eax
sub eax, 0x706354
push esp
arpl word [eax], si
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e8e8
jb 0x1001e8dd
outsb dx, byte [esi]
je 0x1001e8be
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e8f1
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e8e1
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e8fc
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x1001e8fe
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x6553206c
and byte [ebx + 0x65], dl
jb 0x1001e910
jbe 0x1001e900
jb 0x1001e8f9
jb 0x1001e8f9
push edx
inc esp
push eax
push esp
arpl word [eax], si
push eax
outsd dx, dword [esi]
jb 0x1001e91c
dec esi
jne 0x1001e918
bound esp, qword [ebp + 0x72]
add byte [eax], al
inc sp
inc esp
outsb dx, byte gs:[esi]
jns 0x1001e90a
push ebx
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
je str.SYSTEMCurrentControlSetControlTerminal_Server
imul ebp, dword [edi + 0x6e], 0x53000073
push ebx
pop ecx
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x1001e8c3
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e940
jb 0x1001e935
outsb dx, byte [esi]
je 0x1001e916
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e949
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e939
push ebx
jb 0x1001e957
imul esp, dword [ebx + 0x65], 0x65545c73
jb 0x1001e957
push ebx
jb 0x1001e964
imul esp, dword [ebx + 0x65], 0x53000000
push ebx
pop ecx
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e970
jb 0x1001e965
outsb dx, byte [esi]
je 0x1001e946
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e979
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e969
push ebx
jb 0x1001e987
jbe 0x1001e97b
imul esp, dword [ebx + 0x65], 0x65545c73
arpl word [ebp + 0x73], sp
pop esp
push esp
jb 0x1001e987
jb 0x1001e987
inc esp
inc esp
add byte [eax], al
add byte [eax], al
push ebx
je 0x1001e984
jb 0x1001e999
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001e9a4
jb 0x1001e999
outsb dx, byte [esi]
je 0x1001e97a
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001e9ad
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001e99d
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je str.SOFTWAREPoliciesMicrosoftWindowsInstaller
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x1001e9ba
imul ebp, dword [esi + 0x61], 0x6553206c
jb 0x1001e9cc
jb 0x1001e959
jb 0x1001e959
add byte [eax], al
add byte [ebx + edx*2 + 0x45], dl
push esp
push ebx
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x4f], dl
push ebx
dec edi
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001e9d7
pop esp
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x1001e9fb
jb 0x1001e9f0
outsb dx, byte [esi]
je 0x1001e9e4
jb 0x1001ea04
imul ebp, dword [edi + 0x6e], 0x6e69575c
insb byte es:[edi], dx
outsd dx, dword [esi]
outsd dx, dword [si]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x68], dl
push ebx
invalid
jne 0x1001ea18
outsd dx, dword fs:[esi]
ja 0x1001ea16
push edi
imul esi, dword [eax + ebp*2 + 0x6f], 0x6f4c7475
jne 0x1001ea23
dec esp
outsd dx, dword [esi]
outsd dx, dword [si]
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
push eax
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x69], 0x4d5c7365
imul esp, dword [ebx + 0x72], 0x666f736f
je str.Enabled
arpl word [edx + 0x6f], si
jae 0x1001ea40
je str.Enabled
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
outsd dx, dword fs:[esi]
ja 0x1001ea4e
pop esp
dec ecx
outsb dx, byte [esi]
jae 0x1001ea54
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
jb 0x1001e9e6
jb 0x1001e9e6
add byte [eax], al
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x41]
insd dword es:[edi], dx
insd dword es:[edi], dx
imul ebp, dword [esi + 0x54], 0x6d655253
outsd dx, dword [esi]
je str.Security
add byte [ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001ea6b
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
pop esp
inc ebx
jne str.HEAD
jb 0x1001ea81
outsb dx, byte [esi]
je 0x1001ea75
jb 0x1001ea95
imul ebp, dword [edi + 0x6e], 0x74656e5c
arpl word [ecx + 0x63], sp
push 0x45000065
inc ebp
outsd dx, dword [esi]
outsb dx, byte [esi]
pop esp
outsb dx, byte [esi]
je 0x1001ea8d
popal
arpl word [eax + 0x65], bp
add byte [eax], al
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
add byte [edi + 0x69], dl
push edi
invalid
outsb dx, byte [esi]
push ebx
je 0x1001ea9f
xor byte [esp + eax*2 + 0x65], bl
popaw
inc esp
popaw
jne 0x1001eab2
je str.CreateProcessA
inc ebx
jb 0x1001eab0
popal
je 0x1001eab3
push eax
jb 0x1001eac0
arpl word [ebp + 0x73], sp
jae 0x1001ea97
add byte [eax], al
push ebx
jns 0x1001eace
je 0x1001eac2
insd dword es:[edi], dx
add byte [eax], al
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2], 0x41000000
inc ecx
jo 0x1001eadf
add byte [ecx + 0x70], al
inc ecx
jo 0x1001eadf
insb byte es:[edi], dx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [ebx + 0x4f], al
inc ebx
dec edi
dec esi
dec esi
inc ebp
inc ebx
push esp
and byte [eax], al
add byte [eax], al
add byte [eax + 0x4f], dl
push eax
dec edi
push ebx
push esp
and byte [eax], al
add byte [eax], al
dec eax
inc ebp
inc ecx
inc esp
and byte [eax], al
add byte [eax], al
inc edi
inc ebp
push esp
and byte [eax], al
add byte [eax], al
add byte [eax + 0x74], ch
invalid
je 0x1001eb13
invalid
jo 0x1001eadb
cmp ch, byte [edi]
das
das
add al, dl
invalid
jne 0x1001eb14
dec ebx
jns 0x1001eab6
add byte [eax], al
insb byte es:[edi], dx
jae 0x1001eb2f
jb 0x1001eb20
insd dword es:[edi], dx
jo 0x1001eb29
inc ecx
add byte [eax], al
add byte [eax + 0x72], dl
push eax
jb 0x1001eb36
add byte [eax], al
push eax
jb 0x1001eb36
arpl word [ebp + 0x73], sp
jae 0x1001eaff
xor cl, byte [esi + 0x65]
js 0x1001eb45
js 0x1001eb45
add byte [eax], al
add byte [eax + 0x72], dl
push eax
jb 0x1001eb46
arpl word [ebp + 0x73], sp
jae 0x1001eb0f
xor esi, dword [edx]
inc esi
imul esi, dword [edx + 0x73], 0x43000074
inc ebx
jb str.GetWindowTextA
xor al, byte [esi + 0x69]
jb 0x1001eb54
je 0x1001eae3
add byte [ebx + 0x72], al
inc ebx
jb str.GetWindowTextA
popal
popal
je 0x1001eb4f
push esp
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
push 0x33706c65
xor dl, byte [ebx + 0x6e]
popal
jo 0x1001eb6c
push 0x746f
add byte [eax], al
inc ebp
outsb dx, byte [esi]
add byte [ebp + 0x6e], al
inc ebp
outsb dx, byte [esi]
jne 0x1001eb71
push edi
imul ebp, dword [esi + 0x64], 0x73776f
jne 0x1001eb81
jb 0x1001eb44
jb 0x1001eb44
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
dec ecx
dec ebp
dec ebp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [0x30255b0a], cl
or eax, 0x30255b0a
xor dh, byte [ebp + 0x2d]
and eax, 0x2d753230
jne 0x1001eb5e
and eax, 0x30252064
xor dh, byte [ebp + 0x3a]
and eax, 0x3a753230
and eax, 0x5d753230
and byte [eax], ch
sub byte [0xa0d2973], ah
and eax, 0xa0d2973
add byte [eax], al
inc edi
je 0x1001eba7
push edi
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x1001ebcd
ja 0x1001ebaa
js 0x1001ebcd
inc ecx
add byte [eax], al
inc edi
je 0x1001eba1
je 0x1001eba1
arpl word [ecx + ebp*2 + 0x76], si
push edi
imul ebp, dword [esi + 0x64], 0x5d00776f
pop ebp
add byte [eax], al
add byte [0x4900000a], cl
dec ecx
insd dword es:[edi], dx
or al, byte [eax]
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001ebbe
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ebee
jae 0x1001ebea
je 0x1001ebec
outsd dx, dword [esi]
outsb dx, byte [esi]
push ebx
je 0x1001ebfa
imul ebp, dword [esi + 0x67], 0x41
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001ebda
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001ec00
js 0x1001ec11
add byte [eax], al
add byte [eax + 0x65], cl
dec eax
popal
popal
jo 0x1001ebeb
jb 0x1001ec0c
add byte gs:[eax], al
add byte [eax], al
dec ebp
jns 0x1001ebf2
jb 0x1001ec16
popal
je 0x1001ec19
dec ebp
popal
add byte [eax], al
dec ebp
popal
jo 0x1001ec12
imul esp, dword [ebp + 0x77], 0x6946664f
insb byte es:[edi], dx
add byte gs:[eax], al
add byte [ebx + 0x72], al
inc ebx
invalid
ja 0x1001ec0f
inc si
imul ebp, dword [ebp], 0x72430000
inc ebx
invalid
popal
je 0x1001ec33
inc esi
inc esi
imul ebp, dword [ebp + 0x4d], 0x69707061
outsb dx, byte [esi]
inc ecx
add byte [eax], al
push ebx
je 0x1001ec37
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0x41
inc ebp
js 0x1001ec2e
inc ecx
add byte [eax], al
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x576b6f6f
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
ja 0x1001ec70
dec eax
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
push ebp
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
jo str.GlobalFree
imul esp, dword [ebp + 0x77], 0x6946664f
ja 0x1001ec5d
inc si
inc esi
imul ebp, dword [ebp], 0x61636f4c
dec esp
outsd dx, dword [esi]
invalid
popal
insb byte es:[edi], dx
add byte gs:[edi + ebp*2 + 0x63], cl
dec esp
outsd dx, dword [esi]
invalid
popal
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
push ebx
imul edi, dword [edx + 0x65], 0x44000000
inc esp
jae 0x1001ec98
jb 0x1001ec95
jns 0x1001ec6b
jne 0x1001ec9c
jae 0x1001ec9b
jb 0x1001ec2e
add byte [eax], al
push ebp
jae 0x1001ec98
jb 0x1001ec68
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebx
jns 0x1001ecb2
je 0x1001eca6
insd dword es:[edi], dx
push eax
popal
jb 0x1001eca7
insd dword es:[edi], dx
je 0x1001ecaf
jb 0x1001ecbf
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [ebp + 0x53], dl
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc esi
jb 0x1001ecce
add byte gs:[eax], al
add byte gs:[eax], al
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
popal
insb byte es:[edi], dx
push ebp
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx], bp
add byte [eax], al
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
dec esp
outsd dx, dword [esi]
arpl word [ebx], bp
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
popal
insb byte es:[edi], dx
push ebx
imul edi, dword [edx + 0x65], 0x65530000
push ebx
insb byte es:[edi], dx
jp 0x1001ed03
add byte [eax], al
push ebx
insb byte es:[edi], dx
arpl word gs:[edi + ecx*2 + 0x62], si
push 0x65
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
add byte [eax], al
inc ebx
jb 0x1001ed18
add byte [ebx + 0x72], al
inc ebx
invalid
popal
popal
je 0x1001ed1b
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
inc ebx
jb str.cmd.exe
popal
je 0x1001ed2f
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ed30
popal
je 0x1001ed3a
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [eax], al
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
je 0x1001ed4f
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001ed5f
inc esp
inc ebx
add byte [eax], al
add byte [eax], al
inc edx
imul esi, dword [edx + eax*2 + 0x6c], 0x47000074
inc edi
je 0x1001ed50
inc edx
insb byte es:[edi], dx
je 0x1001ed07
add byte [edi + 0x65], al
inc edi
je 0x1001ed50
dec ecx
inc edx
imul esi, dword [ebx + esi*2], 0x72430000
inc ebx
jb 0x1001ed7c
popal
je 0x1001ed7f
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ed80
je 0x1001ed8a
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0x5c000070
pop esp
pop esp
arpl word [ebp + 0x64], bp
js 0x1001ed99
js 0x1001ed99
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001eda0
popal
popal
je 0x1001eda3
push eax
imul esi, dword [eax + 0x65], 0x654b0000
dec ebx
jb 0x1001edb6
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001edab
je 0x1001edbb
jb 0x1001edd0
jne 0x1001edce
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [ecx + ebp*2 + 0x73], al
inc esp
imul esi, dword [ebx + 0x63], 0x656e6e6f
arpl word [esi + ecx*2 + 0x61], si
insd dword es:[edi], dx
push eax
imul esi, dword [eax + 0x65], 0x72655400
push esp
jb 0x1001ede9
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
je 0x1001ede6
push eax
push eax
jb 0x1001edf3
arpl word [ebp + 0x73], sp
jae 0x1001ed89
add byte [eax], al
add byte [eax + 0x65], dl
push eax
imul ecx, dword gs:[esi + 0x61], 0x6d
add byte [eax], al
push eax
imul ecx, dword gs:[esi + 0x61], 0x6d
push eax
imul esi, dword [eax + 0x65], 0x57000000
push edi
popal
add byte [eax], al
add byte [edi + 0x61], dl
push edi
popal
imul esi, dword [esi + eax*2 + 0x6f], 0x6c754d72
inc esi
outsd dx, dword [esi]
jb 0x1001edf1
dec ebp
jne 0x1001ee12
je 0x1001ee11
jo 0x1001ee16
dec edi
dec edi
bound ebp, qword [edx + 0x65]
arpl word [ebx + esi*2], si
add byte [edi + 0x70], cl
dec edi
invalid
outsb dx, byte gs:[esi]
push eax
jb 0x1001ee2a
arpl word [ebp + 0x73], sp
jae str.GetModuleFileNameExA
inc edi
je 0x1001ee11
outsd dx, dword [esi]
jne 0x1001ee34
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
popal
insd dword es:[edi], dx
inc ebp
js 0x1001ee15
add byte [eax], al
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x1001ee49
push eax
jb 0x1001ee4e
arpl word [ebp + 0x73], sp
jae 0x1001ee31
outsd dx, dword [esi]
jne 0x1001ee54
jne 0x1001ee54
jae 0x1001edeb
add byte [eax + 0x53], dl
push eax
push ebx
inc ecx
push eax
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
inc esp
bound esi, qword gs:[ebp + 0x67]
push eax
jb 0x1001ee6b
jbe 0x1001ee6d
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte [eax], al
push ebx
push ebx
push 0x6f647475
je 0x1001ee77
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x1001ee84
outsb dx, byte [esi]
push eax
jb 0x1001ee82
jbe 0x1001ee84
insb byte es:[edi], dx
add byte gs:[di + 0x78], ah
js 0x1001ee93
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x1001ee8c
jb 0x1001ee57
js 0x1001ee91
js 0x1001ee91
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001ee77
jne str.32770
jb 0x1001ee9d
outsb dx, byte [esi]
je 0x1001ee8f
push 0x64616572
dec ecx
add byte fs:[eax], al
dec ecx
outsb dx, byte [esi]
je 0x1001eead
jb 0x1001eeb8
outsb dx, byte [esi]
je 0x1001ee9f
popal
popal
inc esi
imul ebp, dword [ebp], 0x4d000000
dec ebp
add byte [eax], al
add byte [eax], al
dec ebp
add byte [ebp + 0x6f], cl
dec ebp
outsd dx, dword [esi]
outsd dx, dword [esi]
jp 0x1001eec5
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x1001eecb
je 0x1001eed5
imul esp, dword [edx + 0x6c], 0x2965
bound ebp, qword [ebp + 0x29]
add byte [eax], al
insb byte es:[edi], dx
sub dword gs:[eax], eax
add byte [eax], al
add byte [ebx + 0x56], al
inc ebx
push esi
add byte [eax], al
inc ebx
push esi
imul esp, dword [ebp + 0x6f], 0x706143
outsd dx, dword gs:[esi]
inc ebx
popal
jo 0x1001ee7e
add byte [eax], al
arpl word [ecx + 0x70], sp
inc ebx
jo 0x1001eec7
jb 0x1001eeeb
popal
je 0x1001eeee
inc ebx
popal
jo 0x1001ef01
je 0x1001ef03
jne 0x1001ef01
jb 0x1001eef5
push edi
push edi
imul ebp, dword [esi + 0x64], 0x41776f
inc ecx
push esi
dec ecx
inc ebx
inc ecx
push eax
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.ICOpen
popal
je 0x1001ef1b
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x1001ef02
js 0x1001ef00
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
je 0x1001ef0b
je 0x1001ef0b
jb 0x1001ef32
jbe 0x1001ef30
jb 0x1001ef11
jae 0x1001ef33
jb 0x1001ef3b
jo str.ICSeqCompressFrameEnd
imul ebp, dword [edi + 0x6e], 0x41
add byte [ecx + 0x43], cl
dec ecx
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ef25
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ef58
jae 0x1001ef5c
inc esi
jb 0x1001ef4d
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ef39
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ef6c
jae 0x1001ef70
inc esi
jb 0x1001ef61
insd dword es:[edi], dx
push ebx
push ebx
je 0x1001ef66
jb 0x1001ef7b
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001ef85
jae 0x1001ef74
popal
add byte gs:[bx + si], al
add byte [ecx + 0x43], cl
dec ecx
inc ebx
dec edi
jo 0x1001ef82
outsb dx, byte [esi]
add byte [eax], al
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ef98
add byte gs:[ecx + 0x43], cl
dec ecx
inc ebx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001efad
jae 0x1001efb1
outsd dx, dword [esi]
jb 0x1001ef87
jb 0x1001efa8
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ef91
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001efc4
jae 0x1001efc8
inc esi
jb 0x1001efb9
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp + ebp*2 + 0x64], dh
je 0x1001efd7
popal
add byte [eax], al
je 0x1001efd7
popal
imul ebp, dword [eax + 0x33], 0x36
xor dh, byte [0x31323734]
xor dh, byte [ecx]
sub edi, dword ss:[ebx]
xor dword [esi], esi
aaa
aaa
outsb dx, byte es:[esi]
jo 0x1001efe4
add eax, dword [ecx]
add dword [eax], ecx
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add eax, dword [0x2010202]
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add eax, dword [ebx]
add dword [edx], eax
add eax, dword [0x4020602]
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add dword [ebx], eax
push es
add al, byte [ecx]
add al, byte [esp + eax]
add dword [edx], eax
add al, 4
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [edx]
add dword [edx], eax
add dword [edx], eax
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
add eax, 0x5020302
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x3020103
add dword [ebx + 0x77], ebp
imul esi, dword [edi + 0x75], 0x72
cmp dword [edx], ebp
sub eax, 0x2f737571
popal
arpl word [eax + 0x66], bp
jae 0x1001f0d1
pushal
insb byte es:[edi], dx
outsd dx, dword [esi]
push 0x79762873
jbe 0x1001f0b4
add al, 3
add dword [edx], eax
add eax, dword [0x1030602]
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add dl, byte [ecx + 0x4702061d]
inc edi
bound esi, qword [eax + 0x6a]
and dword [esp + ebp*2 + 0x65], eax
outsb dx, byte fs:[esi]
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]