Function at 0x1000b310
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10016e3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x88], 0x100185a4
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000b3cb
mov ecx, dword [esp + 0x64]
xor ebp, ebp
mov dword [esp + 0x5c], ebp
mov dword [esi], 0x100185a8
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000b404.2
xor edx, edx
mov dl, byte [eax + 0x1000b5b8]
jmp dword [edx*4 + 0x1000b5b0]
mov dword [esi + 0x70], ecx
jmp 0x1000b417
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000bca0
test al, al
jne 0x1000b438
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esi + 0x10c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x6c]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov ecx, dword [esi + 0x44]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ecx
mov dword [esi + 0x30], ebp
mov byte [esi + 0x24], al
call edi
mov edx, dword [esi + 0x44]
mov dword [esi + 0x4c], eax
push edx
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x28]
push 1
lea edi, [esi + 0x5c]
lea ebx, [esi + 0x60]
push eax
push ecx
mov ecx, esi
mov dword [edi], ebp
mov dword [ebx], ebp
call fcn.1000b9c0
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x28]
push edx
push eax
push ecx
mov ecx, esi
call fcn.1000b9c0
mov edx, dword [esi + 0x28]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
push 1
push edx
push eax
mov ecx, esi
call fcn.1000b9c0
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x44]
push ebp
push ebp
push edi
mov edi, dword [sym.imp.GDI32.dll_CreateDIBSection]
push ebp
push ecx
push edx
mov dword [esi + 0x6c], eax
call edi
push ebp
mov dword [esi + 0x54], eax
push ebp
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x44]
push ebx
push ebp
push eax
push ecx
call edi
mov ecx, dword [esi + 0x44]
push ebp
lea edx, [esi + 0x78]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x68]
push ebp
push edx
push ebp
push eax
push ecx
call edi
mov edx, dword [esi + 0x58]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x84], eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push ebp
lea ecx, [esi + 0x34]
push ebp
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x54]
div dword [esi + 0x2c]
mov dword [esi + 0x20], ebp
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc
jbe 0x1001b71b
imul esp, dword [ebx + 0x65], 0x2010041
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
arpl word [ebp + 0x41], sp
add byte [ecx], al
add dl, byte [edx + 0x65]
imul esi, dword [bp + di + 0x74], 0x65537265
jb 0x1001b73a
imul esp, dword [ebx + 0x65], 0x6c727443
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
jb 0x1001b714
add byte [ecx], bh
add dl, byte [ebx + 0x65]
je 0x1001b72d
jb 0x1001b753
imul esp, dword [ebx + 0x65], 0x74617453
jne 0x1001b759
add byte [eax], al
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
lodsb al, byte [esi]
add byte [ebx + 0x48], dl
push ebx
dec eax
inc edi
je 0x1001b744
imul ebp, dword [ebp + 0x49], 0x416f666e
add byte [eax], al
pop es
add dword [ebx + 0x68], edx
push ebx
push 0x456c6c65
js 0x1001b777
arpl word [ebp + 0x74], si
inc ecx
je 0x1001b77b
inc ecx
add byte [ebx + 0x48], dl
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx], bh
add byte [ebx + 0x6f], al
inc ebx
outsd dx, dword [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
add byte [eax], al
push 0x556f4300
inc ebx
outsd dx, dword [esi]
push ebp
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x680000
inc ebx
outsd dx, dword [esi]
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x69], 0x6c616974
imul edi, dword [edx + 0x65], 0x100000
add byte [eax], al
adc byte [eax], al
inc ebx
outsd dx, dword [esi]
inc ebx
jb 0x1001b7b2
popal
je 0x1001b7b5
dec ecx
outsb dx, byte [esi]
jae 0x1001b7c8
je 0x1001b7b6
popal
outsb dx, byte [esi]
arpl word [ebp], sp
add byte [eax + eax + 0x43], ah
inc ebx
outsd dx, dword [esi]
push esp
popal
jae 0x1001b7cd
dec ebp
insd dword es:[edi], dx
inc esi
jb 0x1001b7cd
add byte gs:[edi + 0x6c], ch
outsd dx, dword [esi]
insb byte es:[edi], dx
xor esi, dword gs:[edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x4c], cl
dec edi
dec esp
inc ebp
inc ecx
push ebp
push esp
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
adc byte [eax], al
aas
aas
xor eax, dword [eax + 0x59]
inc ecx
pop eax
push eax
inc ecx
pop eax
inc eax
pop edx
add byte [eax], al
invalid
insb byte es:[edi], dx
jb 0x1001b7b6
add byte [eax + 0x6d656d02], bl
insd dword es:[edi], dx
insd dword es:[edi], dx
cwde
add ch, byte [ebp + 0x65]
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe str.strrchr
add byte [ecx + 2], al
arpl word [ebp + 0x69], sp
insb byte es:[edi], dx
add byte [eax], al
int1
add byte [edi + 0x66], bl
pop edi
je 0x1001b83d
outsd dx, dword [esi]
insb byte es:[edi], dx
add ch, al
add dh, byte [ebx + 0x74]
jae 0x1001b848
jb 0x1001b849
je 0x1001b84a
add byte [eax], al
int1
add dh, byte [edi + 0x63]
ja 0x1001b841
jae 0x1001b854
outsd dx, dword [esi]
insd dword es:[edi], dx
bound esi, qword [ebx]
add byte [ecx], al
pop edi
inc ebx
js 0x1001b864
push esp
push 0x45776f72
js 0x1001b857
jo 0x1001b86b
imul ebp, dword [edi + 0x6e], 0x25e0000
jb 0x1001b866
add byte gs:[eax], al
xchg ecx, eax
add ch, byte [ebp + 0x61]
insd dword es:[edi], dx
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add dl, cl
add byte [edi + 0x65], bl
pop edi
js 0x1001b877
jo 0x1001b88b
pop edi
push 0x6c646e61
jb 0x1001b853
add byte [eax], al
ret
jae 0x1001b89a
jb 0x1001b89a
arpl word [eax + 0x72], bp
add cl, al
add dh, byte [ebx + 0x74]
jae 0x1001b8a4
jb 0x1001b8a0
arpl word [eax + 0x79], si
add al, al
add dh, byte [ebx + 0x74]
jae 0x1001b8ae
jb str.MSVCRT.dll
arpl word [ebp + 0x70], bp
add cl, cl
insd dword es:[edi], dx
jo 0x1001b840
leave
add dh, byte [ebx + 0x74]
jae str.__dllonexit
jb 0x1001b8ba
outsd dx, dword [esi]
jne 0x1001b8b5
add byte [ebx + 2], dh
jae 0x1001b84e
imul esi, dword [ebx + 0x64], 0x74696769
imul esp, dword fs:[edi + 0x69], 0x2a90074
jb 0x1001b8bd
add byte [ecx + 0x6e657202], ch
jb 0x1001b8bd
outsb dx, byte [esi]
test eax, 0x6e657202
jb 0x1001b8bd
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
popal
insd dword es:[edi], dx
add byte gs:[eax], al
mov dl, 2
jae 0x1001b8d2
jb 0x1001b8cd
outsb dx, byte [esi]
je 0x1001b8cd
add byte [edi + 0x72747302], bh
jae 0x1001b8e0
invalid
add byte [edi + 0x72747302], bh
jae 0x1001b8e0
invalid
je 0x1001b8df
outsb dx, byte [esi]
arpl word [ecx + 0x74], sp
add byte [edi + 0x72747302], dh
jae 0x1001b8ea
invalid
arpl word [eax + 0x72], bp
add byte [eax], al
cmpsd dword [esi], dword es:[edi]
add dh, byte [edx + 0x65]
jb 0x1001b8e5
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
cmp eax, 0x6f746102
popal
je 0x1001b8fa
imul eax, dword [eax], 0x5f00a600
pop edi
bound esp, qword [ebp + 0x67]
imul ebp, dword [esi + 0x74], 0x61657268
popal
js 0x1001b89f
add byte [eax + 2], al
arpl word [ecx + 0x6c], sp
inc eax
add ah, byte [ebx + 0x61]
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [ebp + 0x53], cl
dec ebp
push ebx
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebp
add byte [edi + 0x5f], bl
pop edi
pop edi
add byte [ebp], dl
pop edi
pop edi
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x1001b92b
je 0x1001b8c4
xchg byte [ecx], al
pop edi
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x1001b935
je 0x1001b8ce
add byte [esi], cl
push cs
add byte [edi], bh
aas
aas
xor dword [ecx + edi*2 + 0x70], esi
pop edi
imul ebp, dword [esi + 0x66], 0x5540406f
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [eax], al
lidt [edi + 0x69]
pop edi
imul ebp, dword [esi + 0x69], 0x72657474
insd dword es:[edi], dx
add byte [ebp + 0x64615f00], bl
pop edi
popal
push 0x75
jae 0x1001b96f
pop edi
imul si, word fs:[esi], 0xb700
add byte [edi + 0x61], dh
ja 0x1001b967
jbe 0x1001b96d
dec edi
jne 0x1001b97f
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001b975
add byte [eax], al
retf
add dh, al
add byte [edi + 0x61], dh
ja 0x1001b991
jbe 0x1001b997
dec edi
jne 0x1001b9a9
push edx
jae str.waveInAddBuffer
je 0x1001b93b
add byte [edi + 0x76617700], ah
ja 0x1001b9a1
jbe 0x1001b9a7
dec ecx
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001b9ae
add byte [ebp + 0x76617700], dh
ja 0x1001b9af
jbe 0x1001b9b5
dec ecx
outsb dx, byte [esi]
push ebp
outsb dx, byte [esi]
jo 0x1001b9c8
jo 0x1001b9ba
jb 0x1001b9c0
dec eax
popal
jb 0x1001b962
mov dl, 0
ja 0x1001b9c7
jbe 0x1001b9cd
dec ecx
outsb dx, byte [esi]
push edx
jae 0x1001b9d3
je 0x1001b970
je 0x1001b970
add byte [eax + eax + 0x65766177], dh
ja 0x1001b9d5
jbe 0x1001b9db
mov ah, 0
ja 0x1001b9d5
jbe 0x1001b9db
dec ecx
dec ecx
outsb dx, byte [esi]
push ebx
je 0x1001b9ea
jo 0x1001b97d
add ah, cl
add byte [edi + 0x61], dh
ja 0x1001b9e3
jbe 0x1001b9e9
dec edi
jne 0x1001b9fb
push edi
jb 0x1001b9f3
je 0x1001b9f1
add byte [eax], al
mov bl, 0
ja 0x1001b9f3
jbe 0x1001b9f9
dec ecx
outsb dx, byte [esi]
push ebx
je 0x1001b9fa
jb 0x1001ba0f
add byte [esi + 0x76617700], ah
ja 0x1001ba01
jbe 0x1001ba07
dec ecx
ja 0x1001ba01
jbe 0x1001ba07
dec ecx
outsb dx, byte [esi]
inc ecx
inc edx
jne 0x1001ba10
jb 0x1001b9ae
jb 0x1001b9ae
mov cl, 0
ja 0x1001ba13
jbe 0x1001ba19
dec ecx
outsb dx, byte [esi]
push eax
jb 0x1001ba1e
jo 0x1001ba1c
popal
jb 0x1001ba22
dec eax
popal
jb 0x1001b9c4
mov al, 0
ja 0x1001ba29
popal
jbe 0x1001ba2f
dec ecx
outsb dx, byte [esi]
dec edi
jo 0x1001ba34
outsb dx, byte [esi]
add byte [eax], al
lodsd eax, dword [esi]
add byte [edi + 0x61], dh
ja 0x1001ba37
popal
jbe 0x1001ba3d
dec ecx
outsb dx, byte [esi]
inc edi
je str.WSAIoctl
jne 0x1001ba4d
inc esp
jbe 0x1001ba57
add byte [eax], al
lds eax, [eax]
ja 0x1001ba4b
popal
jbe 0x1001ba51
dec edi
jne 0x1001ba63
push eax
jb 0x1001ba57
jo 0x1001ba55
jo 0x1001ba55
popal
jb 0x1001ba5b
dec eax
popal
jb 0x1001b9fd
jb 0x1001b9fd
jb 0x1001b9fd
add bl, al
add byte [edi + 0x61], dh
ja 0x1001ba63
popal
jbe 0x1001ba69
dec edi
jne 0x1001ba7b
dec edi
jo 0x1001ba6f
outsb dx, byte [esi]
add byte [ebp + 0x76617700], bh
ja 0x1001ba71
jbe 0x1001ba77
dec edi
popal
jbe 0x1001ba77
dec edi
jne 0x1001ba89
inc edi
je 0x1001ba67
jne 0x1001ba88
inc esp
jbe 0x1001ba92
jae str.WINMM.dll
add byte [edi + 0x49], dl
push edi
dec ecx
push edi
dec ecx
dec esi
dec ebp
dec ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], ch
add byte [edi + 0x53], dl
push edi
push ebx
push edi
push ebx
inc ecx
dec ecx
outsd dx, dword [esi]
arpl word [esp + ebp*2], si
add byte [edi + 0x53], dl
push edi
push ebx
add byte [eax], al
push edi
push ebx
xor bl, byte [edi + 0x33]
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
clc
add edi, dword [edi]
aas
pop edi
push esp
imul esp, dword [ecx + edi*2 + 0x40], 0x6162243f
aas
and al, 0x62
popal
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x69727473
jae 0x1001baba
arpl word [edi + 0x73], bx
je 0x1001bac8
jb 0x1001bac0
imul ebp, dword [esi + 0x67], 0x3f554440
outsb dx, byte [esi]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x1001bac7
je 0x1001bad7
popal
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
je 0x1001badc
inc eax
inc esp
inc eax
jae 0x1001bae2
inc eax
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001babe
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001baf9
inc eax
inc eax
inc ecx
inc ecx
inc ebp
pop eax
pop edi
dec esi
inc eax
pop edx
add byte [eax], al
jmp 0x4140f997
aas
aas
invalid
inc eax
inc eax
push esi
aas
and al, 0x61
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bb0a
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bb45
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [eax], al
sub eax, 0x435f3f03
aas
pop edi
inc ebx
inc eax
aas
xor dword [edi], edi
aas
pop edi
dec esi
jne 0x1001bb56
insb byte es:[edi], dx
jae 0x1001bb61
jb 0x1001bb2f
aas
and al, 0x62
popal
jae 0x1001bb5e
arpl word [edi + 0x73], bx
je 0x1001bb6c
jb 0x1001bb64
imul ebp, dword [esi + 0x67], 0x3f554440
outsb dx, byte [esi]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x1001bb6b
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bb62
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bb9d
inc eax
inc eax
inc ebx
inc ecx
push eax
inc edx
inc esp
pop eax
pop edx
inc eax
xor al, 0x44
inc edx
add byte [eax], ah
add al, 0x3f
aas
popal
jae 0x1001bbb1
imul esp, dword [edi + 0x6e], 0x62243f40
popal
jae 0x1001bbb1
arpl word [edi + 0x73], bx
je 0x1001bbbf
imul ebp, dword [esi + 0x67], 0x3f554440
and al, 0x63
push 0x745f7261
jb 0x1001bbbe
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
je 0x1001bbd3
inc eax
inc esp
inc eax
jae 0x1001bbd9
je 0x1001bbca
inc eax
inc eax
inc eax
push esi
aas
and al, 0x61
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bbb5
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bbf0
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor dword [edx], esi
inc eax
push eax
inc edx
inc esp
dec ecx
inc eax
pop edx
add byte [eax], al
dec edx
add edi, dword [edi]
aas
pop edi
inc ebp
outsd dx, dword [esi]
jae 0x1001bbd8
aas
and al, 0x62
popal
jae 0x1001bc07
imul esp, dword [ebx + 0x5f], 0x69727473
outsb dx, byte [esi]
inc eax
inc esp
push ebp
aas
arpl word [edi + 0x73], bx
je 0x1001bc15
imul ebp, dword [esi + 0x67], 0x3f554440
and al, 0x63
push 0x745f7261
jb 0x1001bc14
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
jae 0x1001bbf7
inc esp
inc eax
jae 0x1001bc2f
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bc0b
inc eax
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bc46
inc eax
inc eax
inc eax
inc ecx
inc ecx
inc ebp
pop eax
dec ecx
inc eax
pop edx
add byte [eax], al
xchg edx, eax
add edi, dword [edi]
aas
pop edi
inc edi
jb 0x1001bc54
ja 0x1001bc27
aas
and al, 0x62
popal
jae 0x1001bc56
arpl word [edi + 0x73], bx
je 0x1001bc64
imul ebp, dword [esi + 0x67], 0x3f554440
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x1001bc63
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
inc eax
jae 0x1001bc7e
inc eax
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
popal
je 0x1001bc87
jb 0x1001bc5a
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bc95
inc eax
inc eax
inc ecx
inc ecx
inc ebp
pop edi
dec esi
dec ecx
pop edi
dec esi
inc eax
pop edx
add byte [eax], al
add edi, dword [edi]
aas
add dl, dh
add edi, dword [edi]
aas
pop edi
push ebx
jo 0x1001bca3
imul esi, dword [eax + eax*2 + 0x3f], 0x73616224
imul esp, dword [ebx + 0x5f], 0x69727473
outsb dx, byte [esi]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x1001bcb6
popal
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
je 0x1001bccb
inc eax
inc esp
inc eax
jae 0x1001bcd1
inc eax
inc eax
push esi
aas
and al, 0x61
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bcad
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bce8
inc eax
inc eax
inc ecx
inc ecx
inc ebp
pop eax
pop eax
pop edx
add byte [esi], al
push es
add al, 0x3f
aas
pop edi
pop eax
jb 0x1001bce6
outsb dx, byte [esi]
inc eax
jae 0x1001bcfd
inc eax
inc eax
pop ecx
inc ecx
pop eax
pop eax
pop edx
add byte [ecx + 6], ah
aas
outsb dx, byte [esi]
jo 0x1001bd07
jae 0x1001bcda
aas
and al, 0x62
popal
jae 0x1001bd09
arpl word [edi + 0x73], bx
je 0x1001bd17
imul ebp, dword [esi + 0x67], 0x3f554440
and al, 0x63
push 0x745f7261
jb 0x1001bd16
arpl word [eax + 0x61], bp
jb 0x1001bd11
je 0x1001bd26
popal
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
je 0x1001bd2b
inc eax
inc esp
inc eax
jae 0x1001bd31
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
outsd dx, dword [esi]
jb 0x1001bd0d
inc esp
inc eax
xor al, byte [eax + 0x40]
inc eax
jae 0x1001bd48
inc eax
inc eax
xor cl, byte [ecx + 0x42]
add byte [eax], al
jmp 0x6260fbe4
aas
pop edi
push edx
inc eax
aas
and al, 0x62
popal
jae str.EnumProcessModules
arpl word [edi + 0x73], bx
je 0x1001bd64
imul ebp, dword [esi + 0x67], 0x3f554440
and al, 0x63
push 0x745f7261
jb 0x1001bd63
jb 0x1001bd5e
je 0x1001bd73
popal
imul esi, dword [ebx + esi*2 + 0x40], 0x74734044
inc eax
jae 0x1001bd7e
je 0x1001bd6f
inc eax
inc eax
inc eax
push esi
aas
and al, 0x61
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
je 0x1001bd87
outsd dx, dword [esi]
jb 0x1001bd5a
inc esp
inc eax
xor al, byte [eax + 0x40]
jae 0x1001bd95
inc eax
inc eax
inc ecx
inc ecx
inc ebp
inc ecx
inc ecx
inc ebp
push eax
inc edx
inc esp
inc eax
pop edx
add byte [ebp + 0x53], cl
dec ebp
push ebx
push ebx
push esi
inc ebx
push eax
xor byte ss:[esi], ch
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi], cl
add byte [edi + 0x65], al
inc edi
je 0x1001bd8f
outsd dx, dword [esi]
jne 0x1001bdb2
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
js 0x1001bd93
add byte [eax], al
add al, 0
inc ebp
outsb dx, byte [esi]
jne 0x1001bdc7
push eax
jb 0x1001bdcc
arpl word [ebp + 0x73], sp
jae 0x1001bdaf
jae 0x1001bdd4
dec ebp
outsd dx, dword [esi]
jne str.WININET.dll
jne str.WININET.dll
jae 0x1001bd69
add byte [eax + 0x53], dl
push eax
push ebx
inc ecx
push eax
dec ecx
inc esp
dec esp
dec esp
add byte [ebp], ah
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
jae 0x1001bde5
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001bdea
js 0x1001bdfb
add byte [edx], dh
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001bdd4
je 0x1001bdd4
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001be04
jae 0x1001be00
je 0x1001be02
outsd dx, dword [esi]
outsb dx, byte [esi]
push ebx
je 0x1001be10
imul ebp, dword [esi + 0x67], 0x35000041
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001bdf0
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001be16
js 0x1001be27
je str.IMM32.dll
add byte [ecx + 0x4d], cl
dec ecx
dec ebp
dec ecx
dec ebp
dec ebp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edx + 0x746e4900], bl
jb 0x1001be34
je 0x1001be1b
je 0x1001be1b
popal
inc esi
inc esi
imul ebp, dword [ebp], 0x4e495700
push edi
dec ecx
dec esi
push edi
dec ecx
dec esi
dec ecx
dec esi
inc ebp
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi], dl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001be59
jae 0x1001be5d
outsd dx, dword [esi]
jb 0x1001be33
jb 0x1001be54
add byte gs:[eax], al
add byte [eax], al
daa
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
jno 0x1001be3d
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001be70
jae str.MSVFW32.dll
jae 0x1001be48
inc esi
jb 0x1001be65
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[0x53434900], ah
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
dec ebp
jae 0x1001be89
popal
add byte gs:[bp + di], dl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001be88
add byte [ebx], bl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
inc edi
je 0x1001be75
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [edx], ah
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
dec edi
jo 0x1001be9c
outsb dx, byte [esi]
add byte [eax], al
push ds
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte es:[ecx + 0x43], cl
dec ecx
inc ebx
push ebx
jno 0x1001be8f
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001bec2
jae 0x1001bec6
inc esi
jb 0x1001beb7
insd dword es:[edi], dx
add byte gs:[eax], al
sub byte [eax], al
dec ecx
add byte [eax], ch
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
push ebx
jno 0x1001bea5
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001bed8
jb 0x1001becc
jae 0x1001bedc
jae 0x1001bedc
inc esi
jb 0x1001becd
insd dword es:[edi], dx
push ebx
je 0x1001bed2
popal
jb 0x1001bee7
add byte [ebp + 0x53], cl
dec ebp
push ebx
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x54], dl
push edi
push esp
push ebx
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
enter 0x5f01, 0x73
pop edi
invalid
add dword [edi + 0x73], ebx
pop edi
invalid
je 0x1001bf06
jb 0x1001befb
jbe 0x1001be98
ret
je 0x1001bf10
insb byte es:[edi], dx
ja 0x1001bf13
add ch, al
add dword [edi + 0x73], ebx
pop edi
jae 0x1001bf1b
invalid
jae 0x1001bf1b
jb 0x1001bf17
outsb dx, byte [esi]
imul esp, dword [ebx + 0x6d], 0x70
add byte [eax], al
add byte [eax], al
lodsb al, byte [esi]
jns 0x1001bef4
dec esp
add byte [eax], al
add byte [eax], al
in al, dx
mov esi, 0x10001
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, byte [eax]
add byte [eax], al
fdivr dword [esi - 0x411fffff]
mov esi, 0xbee00001
add dword [eax], eax
call 0x2001c097
out 0, eax
add byte [eax - 0x1a], al
add byte [eax], al
idiv dword [esi - 0x40fcffff]
adc bh, ah
add byte [eax], al
inc eax
out 0, al
add bh, dh
mov esi, 0xbf030001
add dword [eax], eax
add byte [eax], al
add dword [eax], eax
push ebx
jb 0x1001bf66
add byte [eax], al
add byte [ecx], al
add byte [ebx + 0x65], dl
jb 0x1001bf66
jb 0x1001bf21
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x65], dl
jb 0x1001bf71
imul esp, dword [ebx + 0x65], 0x6e69614d
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
outsb dx, byte [esi]
jae 0x1001bf7d
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
push ebx
jb 0x1001bf86
jb 0x1001bf13
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
and al, 0
adc byte [eax - 0x7d], ah
add byte [eax], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
and al, 0
adc byte [eax - 0x7d], ah
add byte [eax], dl
inc eax
into
add byte [eax], dl
mov al, byte [0x1000dc]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x7c], ah
arpl word [edi + esi*2 + 0x7b], di
imul ebp, dword [edi - 0x3b], 0x30
add dword [edi + 0x2b], esp
invalid
ror ch, cl
or al, 0x13
in al, dx
pop edi
xchg edi, eax
inc esp
pop ss
les esp, [edi + 0x5d643d7e]
sbb dword [ebx + 0x60], esi
or dword [edi - 0x24], 0x88902a22
inc esi
out dx, al
mov eax, 0xb5ede14
feni8087_nop
xor bh, byte [edx]
or cl, byte [ecx + 6]
and al, 0x5c
ret 0xacd3