Function at 0x1000bbc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10016cce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x88], 0x10017474
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000bc7b
xor ebp, ebp
push str.GDI32.dll
mov dword [esp + 0x60], ebp
mov dword [esi], 0x10017478
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x64]
mov dword [0x1001e378], eax
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000bcc4.2
xor edx, edx
mov dl, byte [eax + 0x1000beb8]
jmp dword [edx*4 + 0x1000beb0]
mov dword [esi + 0x70], ecx
jmp 0x1000bcd7
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000c6e0
test al, al
jne 0x1000bcf8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esi + 0x10c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x6c]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x30], ebp
push str.CreateCompatibleDC
mov byte [esi + 0x24], al
mov ecx, dword [0x1001e378]
push ecx
call ebx
mov edx, dword [esi + 0x44]
mov edi, eax
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x44]
push eax
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
lea ebp, [esi + 0x5c]
push 1
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [ebp], 0
mov dword [esi + 0x60], 0
call fcn.1000c350
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1000c350
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x28]
push 1
push eax
push ecx
mov ecx, esi
call fcn.1000c350
mov dword [esi + 0x6c], eax
mov edx, dword [0x1001e378]
push str.CreateDIBSection
push edx
call ebx
push 0
push 0
push ebp
mov edi, eax
push 0
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call edi
mov edx, dword [esi + 0x68]
mov dword [esi + 0x54], eax
push 0
lea eax, [esi + 0x60]
push 0
push eax
mov eax, dword [esi + 0x44]
push 0
push edx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
lea ecx, [esi + 0x78]
push 0
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
push ecx
push 0
push edx
push eax
call edi
mov dword [esi + 0x84], eax
mov ecx, dword [0x1001e378]
push str.SelectObject
push ecx
call ebx
mov edx, dword [esi + 0x58]
mov edi, eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push 0
lea ecx, [esi + 0x34]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x54]
div dword [esi + 0x2c]
mov dword [esi + 0x20], 0
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc
or byte [ecx], al
add al, byte [ebx + eax]
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [edi + edx*2]
push edi
jb 0x1001c04d
je 0x1001c057
insb byte es:[edi], dx
jb 0x1001c00c
push esp
jbe 0x1001c05c
imul ebp, dword [ebp + 0x6d], 0x5521736e
jo 0x1001c071
insb byte es:[edi], dx
push 0x4c226c71
jno 0x1001c074
jne 0x1001c067
insb byte es:[edi], dx
push 0x6f462268
outsb dx, byte [esi]
add eax, dword [ecx + eax]
add al, byte [edx]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x5020302
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add eax, dword [edx]
add dword [edx], eax
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add dword [ebx], eax
push es
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add dword [edx], eax
add eax, dword [0x2050602]
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add esp, dword [eax]
and byte [edx + 0x71], dl
insd dword es:[edi], dx
bound edi, qword [edx + 0x64]
insb byte es:[edi], dx
inc esp
push 0x6e
pushal
jo 0x1001c13b
pop ebp
dec eax
imul esp, dword [edi + 0x74], 0x6f704654
jo 0x1001c1a1
jge 0x1001c190
das
bound esi, qword [ecx + 0x65]
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [edx], eax
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2030201
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x30001], al
add byte [esi + 0x4d], bh
jle 0x1001c263
dec eax
jp 0x1001c219
add byte [eax], al
add byte [eax + 0x41], cl
dec eax
inc ecx
push edx
inc esp
push edi
inc ecx
push edx
inc ebp
pop esp
inc esp
inc ebp
push ebx
inc ebx
push edx
dec ecx
push eax
push esp
dec ecx
dec edi
dec esi
pop esp
push ebx
jns 0x1001c2a7
je 0x1001c29b
insd dword es:[edi], dx
pop esp
inc ebx
outsb dx, byte gs:[esi]
je 0x1001c2af
popal
insb byte es:[edi], dx
push eax
jb 0x1001c2b1
arpl word [ebp + 0x73], sp
jae 0x1001c2b6
jb 0x1001c2a5
xor byte [eax], al
add byte [ebx + 0x78], ch
imul edi, dword [eax + 0x65], 0x73
popal
jo 0x1001c2c3
js 0x1001c2bc
add byte [edx + 0x61], dl
push edx
popal
jbe 0x1001c2a9
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
js 0x1001c2c8
add byte [ebx], dh
xor esi, dword [esi]
xor byte [edx + esi*2 + 0x61], dh
jns 0x1001c29a
js str.SeRestorePrivilege
add byte [ebx], dh
xor esi, dword [esi]
xor byte [ebx + 0x64], dh
js 0x1001c2de
add byte [eax], al
add byte [ecx + 0x56], al
inc ecx
push esi
push eax
js str.ServiceDll
add byte [edx], bh
add byte [eax], al
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
pop esp
dec esi
je 0x1001c2f2
and eax, 0x64
dec ebp
jns 0x1001c2bb
and byte [edi + 0x69], dl
outsb dx, byte [esi]
xor esi, dword [edx]
and byte [ecx + 0x70], al
push edi
imul ebp, dword [esi + 0x33], 0x70412032
jo 0x1001c311
popal
arpl word [ecx + ebp*2 + 0x6f], si
je 0x1001c312
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [edi + 0x49], dl
push edi
dec ecx
dec esi
xor esi, dword [edx]
and byte [ecx + 0x70], al
jo 0x1001c322
inc ecx
jo 0x1001c325
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
inc edx
popal
arpl word [ebx + 0x75], bp
jo 0x1001c319
push eax
jb 0x1001c334
jbe 0x1001c336
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte [ebx + 0x65], dl
push ebx
push edx
push ebx
push edx
jae 0x1001c34e
outsd dx, dword [esi]
jb 0x1001c342
push eax
jb 0x1001c349
jbe 0x1001c34b
insb byte es:[edi], dx
add byte gs:[bx + si], al
push ebx
jb 0x1001c362
imul esp, dword [ebx + 0x65], 0x6c6c44
add byte [0x61505c73], ah
and eax, 0x61505c73
add byte [eax], al
and eax, 0x61505c73
jb 0x1001c35c
insd dword es:[edi], dx
je 0x1001c364
jb 0x1001c374
add byte [eax], al
add byte [ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
and eax, 0x654e0064
dec esi
invalid
je 0x1001c341
je 0x1001c341
push esp
insd dword es:[edi], dx
jo 0x1001c347
imul ebp, dword [esi + 0x69], 0
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001c39c
jb 0x1001c391
outsb dx, byte [esi]
je 0x1001c372
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001c3a5
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001c395
push ebx
jb 0x1001c3b3
imul esp, dword [ebx + 0x65], 0x5c73
pop esp
add byte [eax], al
and eax, 0x69000073
invalid
add byte [ecx + 0x6d], ch
invalid
insd dword es:[edi], dx
insd dword es:[edi], dx
jae 0x1001c3c3
jae 0x1001c3c3
arpl word [eax], ax
add byte [ebx + 0x4f], dl
push ebx
dec edi
add byte [eax], al
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001c3bf
jb 0x1001c3cd
jae 0x1001c3cf
je 0x1001c3bf
pop esp
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x1001c3e3
jb 0x1001c3d8
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x1001c3cc
jb str.need_dictionary
imul ebp, dword [edi + 0x6e], 0x6376535c
dec eax
outsd dx, dword [esi]
jae 0x1001c3f8
add byte [eax], al
add byte [eax], al
pop esp
push eax
popal
jb 0x1001c3ee
insd dword es:[edi], dx
je 0x1001c3f6
jb 0x1001c406
add byte [edx], cl
add byte [eax], al
add byte [ebx + 0x3a], ah
arpl word [edx], di
pop esp
dec esi
push esp
pop edi
push eax
popal
je 0x1001c40a
push 0x70
add byte [bx + si], al
and eax, 0x74737953
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x1001c3d9
and eax, 0x7379535c
pop esp
push ebx
jns 0x1001c42b
je 0x1001c41f
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
jae 0x1001c436
jbe 0x1001c424
arpl word [eax + 0x6f], bp
push 0x2e74736f
js 0x1001c42e
jae 0x1001c439
js 0x1001c42e
and byte [0x6d69206b], ch
and byte [ecx + 0x6d], ch
imul ebp, dword [ebp + 0x67], 0x637673
jae 0x1001c448
arpl word [eax], ax
inc edi
insb byte es:[edi], dx
popal
bound ebp, qword [ebp + 0x5f]
insb byte es:[edi], dx
pop edi
pop edi
push edi
popal
imul esi, dword [eax + eax], 0x2e310000
xor dword [esi], ebp
xor dword [esi], ebp
add byte [ecx], dh
xor dword [esi], ebp
xor dword [esi], ebp
xor al, 0
add byte [eax], al
outsb dx, byte [esi]
and byte fs:[ecx + ebp*2 + 0x63], ah
and byte fs:[ecx + ebp*2 + 0x63], ah
je 0x1001c45f
outsd dx, dword [esi]
outsb dx, byte [esi]
popal
jb 0x1001c474
add byte [ecx + 0x6e], ch
imul ebp, dword [esi + 0x63], 0x6572726f
arpl word [eax + 0x64], si
popal
popal
je 0x1001c46b
and byte [ebx + 0x68], ah
arpl word gs:[ebx], bp
add byte [eax], al
add byte [ecx + 0x6e], ch
imul ebp, dword [esi + 0x63], 0x6572726f
arpl word [eax + 0x68], si
popal
jb 0x1001c445
and byte [ebx + 0x68], ah
arpl word gs:[ebx], bp
arpl word [eax + 0x65], bp
arpl word [ebx], bp
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001c491
insb byte es:[edi], dx
imul esp, dword [eax + 0x77], 0x6f646e69
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x1001c45b
jae 0x1001c4a6
jp 0x1001c4a4
add byte [ebp + 0x6e], dh
jne 0x1001c4b0
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
ja 0x1001c4b5
and byte [ebx + 0x6f], ah
insd dword es:[edi], dx
arpl word [edi + 0x6d], bp
jo 0x1001c4bf
jae 0x1001c4c3
imul ebp, dword [edi + 0x6e], 0x74656d20
push 0x646f
in al, 0xc3
add dword [eax], edx
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [edx + 0x69], ah
je 0x1001c48c
add ah, ah
ret
adc byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001c4c5
insb byte es:[edi], dx
imul esp, dword [eax + 0x62], 0x6c207469
bound ebp, qword [ecx + 0x74]
and byte [ebp + 0x6e], ch
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001c4da
and byte [edx + 0x65], dh
jo 0x1001c4dc
jo 0x1001c4dc
popal
je 0x1001c47a
add byte [eax], al
je 0x1001c4ed
outsd dx, dword [esi]
and byte [ebp + 0x61], ch
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
jns 0x1001c4a5
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001c4f3
and byte [edi + 0x72], ch
and byte [ecx + ebp*2 + 0x73], ah
je 0x1001c4f5
outsd dx, dword [esi]
jb 0x1001c4af
imul esi, dword fs:[ebx + 0x74], 0x65636e61
and byte [ebx + 0x79], dh
jae 0x1001c507
popal
outsb dx, byte [esi]
arpl word [ebp + 0x20], sp
jae 0x1001c513
insd dword es:[edi], dx
bound ebp, qword [edi + 0x6c]
jae str.invalid_stored_block_lengths
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [ebx + 0x74], dh
insb byte es:[edi], dx
imul esp, dword [eax + 0x73], 0x65726f74
and byte fs:[ebx + 0x74], dh
outsd dx, dword [esi]
jb 0x1001c512
and byte fs:[edx + 0x6c], ah
outsd dx, dword [esi]
arpl word [ebx + 0x20], bp
bound ebp, qword [edi + ebp*2 + 0x63]
imul esp, dword [eax], 0x6c
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001c523
jae 0x1001c4bd
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001c525
popal
insb byte es:[edi], dx
imul esp, dword [eax + 0x62], 0x6b636f6c
and byte [ecx + edi*2 + 0x70], dh
add byte gs:[eax], al
in al, dx
ret
add dword [eax], edx
pushal
fadd dword [ecx]
adc byte [ebp + eax*8 + 1], dl
adc byte [ebp + eax*8 + 1], al
adc byte [eax], bh
lds eax, [ecx]
adc byte [eax*8 - 0x3aebefff], ah
add dword [eax], edx
cld
lds eax, [ecx]
adc byte [eax*8 - 0x3b03efff], dl
add dword [eax], edx
pushal
fadd dword [ecx]
adc byte [ecx + 0x6e], ch
imul ebp, dword [esi + 0x63], 0x61706d6f
adc ah, bh
les eax, [ecx]
adc byte [eax - 0x28], ah
add dword [eax], edx
imul ebp, dword [esi + 0x63], 0x61706d6f
je 0x1001c56e
bound ebp, qword [ebp + 0x20]
jbe 0x1001c570
and byte gs:[esi + 0x65], dh
jb 0x1001c580
imul ebp, dword [edi + 0x6e], 0
add byte [eax], al
add byte [edx + 0x75], ah
bound esi, qword [ebp + 0x66]
jb 0x1001c53b
bound esi, qword [ebp + 0x66]
jb 0x1001c53b
jb 0x1001c590
outsd dx, dword [esi]
jb 0x1001c521
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
outsb dx, byte [esi]
jae 0x1001c59d
imul sp, word [ebx + 0x69], 0x6e65
je 0x1001c551
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jb 0x1001c5b0
add byte [ecx + 0x74], ah
popal
invalid
popal
and byte [ebp + 0x72], ah
jb 0x1001c5b0
jb 0x1001c543
add byte [ebx + 0x74], dh
jae 0x1001c5ba
jb 0x1001c5ad
popal
insd dword es:[edi], dx
and byte [ebp + 0x72], ah
jb 0x1001c5be
jb 0x1001c551
add byte [eax], al
add byte [esi + 0x69], ah
imul bp, word [ebp + 0x20], 0x7265
jb str.invalid_literal_length_code
jb 0x1001c55f
add byte [ebx + 0x74], dh
jae 0x1001c5d6
jb 0x1001c5c9
popal
insd dword es:[edi], dx
and byte [ebp + 0x6e], ah
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
clc
jbe 0x1001c574
adc byte [ebp + esi*2 + 0x1011001], ch
lodsb al, byte [esi]
jne 0x1001c578
adc byte [ecx], al
add dword [eax], eax
add byte [esi], bl
add dword [ecx], eax
add byte [eax], al
push ds
add dword [eax], eax
add byte [edi], cl
add byte [eax], al
sldt word [eax]
add byte [eax], al
add byte [eax], al
add byte [eax + 0x7b], bh
add dword [eax], edx
and byte [esi + 1], dh
adc byte [eax], al
add byte [eax], al
add byte [esi], bl
add byte [eax], al
add byte [eax], al
push ds
add byte [eax], al
add byte [edi], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x100176], bl
add byte [eax], al
add byte [ebx], dl
add byte [eax], al
add byte [edi], al
pop es
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001c619
insb byte es:[edi], dx
imul esp, dword [eax + 0x64], 0x61747369
jae 0x1001c634
popal
outsb dx, byte [esi]
arpl word [ebp + 0x20], sp
arpl word [edi + 0x64], bp
add byte gs:[eax], al
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001c631
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [ecx + ebp*2 + 0x74], ch
jb 0x1001c63b
insb byte es:[edi], dx
imul esp, dword [eax + 0x6c], 0x72657469
popal
insb byte es:[edi], dx
das
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001c64a
and byte [ebx + 0x6f], ah
add byte gs:[ecx], cl
add byte [eax], al
add byte [0x60000000], al
pop es
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push eax
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + ecx], dl
add byte [ebx], dh
add byte [eax], al
push edx
pop es
add byte [eax], al
pop ds
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
rol byte [eax], 0
add byte [eax + 7], dl
pop es
add byte [eax], al
or al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pushal
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax], ah
add byte [eax], ah
add byte [eax], al
add byte [eax], cl
add byte [eax], al
and byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
mov al, byte [pe_dos_header]
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
loopne 0x1001c66e
add byte [eax], al
push eax
pop es
add byte [eax], al
push es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], bl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sbb byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
nop
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
cmp eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
js 0x1001c69e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
rol byte [eax], 1
add byte [eax], al
push ecx
pop es
add byte [eax], al
adc dword [eax], eax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push 0
or byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax], dh
or byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], cl
or byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
lock add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push esp
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], dl
add byte [eax], al
push ebp
or byte [eax], al
add bl, ah
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
sub eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
je 0x1001c71e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
enter 0, 0
push ecx
pop es
add byte [eax], al
or eax, 0
or byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
test al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
test byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
inc esp
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add al, ch
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pop esp
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], bl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
cwde
add byte [eax], al
add byte [edi + eax], dl
add byte [ebx], dl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jl 0x1001c79e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp al, 0
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
fadd dword [eax]
add byte [eax], al
push edx
pop es
add byte [eax], al
pop ss
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
mov eax, 0
or byte [eax], al
add byte [eax + eax], cl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
mov word [eax], es
add byte [eax], al
add byte [eax], cl
add byte [eax], al
dec esp
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add al, bh
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push edx
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], dl
add byte [eax], al
add byte [ebp + 8], dl
add byte [eax], al
mov dword [0x53000000], eax
pop es
add byte [eax], al
and eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jb 0x1001c81e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
les eax, [eax]
add byte [eax], al
push ecx
pop es
add byte [eax], al
or eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
bound eax, qword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
and al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], al
or byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
in al, 0
add byte [eax], al
push eax
pop es
add byte [eax], al
pop es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], bl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sbb al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
xchg esp, eax
add byte [eax], al
add byte [edi + eax], dl
add byte [ebx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jp 0x1001c89e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
aam 0
add byte [eax], al
push edx
pop es
add byte [eax], al
adc eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sub al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
mov ah, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
or al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
mov al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
dec edx
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add ah, dh
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add eax, 0
or byte [eax], al
add byte [esi], dl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push ss
add byte [eax], al
add al, al
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
xor eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jbe 0x1001c91e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte ss:[eax], al
add byte [eax], al
or dword [eax], eax
add ah, cl
add byte [eax], al
add byte [ecx + 7], dl
add byte [eax], al
sldt word [eax]
add byte [eax], al
or byte [eax], al
add byte [esi], ah
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte es:[eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x8000000], ch
add byte [eax], al
push es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], al
or byte [eax], al
add byte [esi], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
in al, dx
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
or dword [eax], eax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pop esi
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], bl
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x7540000], bl
add byte [eax], al
arpl word [eax], ax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jle 0x1001c99e
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte ds:[eax], al
add byte [eax], al
or dword [eax], eax
add ah, bl
add byte [eax], al
add byte [edx + 7], dl
add byte [eax], al
sbb eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], ch
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x8000000], bh
add byte [eax], al
push cs
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], cl
or byte [eax], al
add byte [esi], cl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
cld
add byte [eax], al
add byte [eax + 7], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push ecx
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [ecx], dl
add byte [eax], al
add byte [ebp + 8], dl
add byte [eax], al
add dword [eax], 0
add byte [edx + 7], dl
add byte [eax], al
pop ds
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [ecx], dh
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor dword [eax], eax
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
ret 0