Function at 0x1000a260
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1001692e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.LoadCursorA
push str.USER32.dll
mov dword [esp + 0x1c], esi
mov dword [esi + 0x88], 0x1001721c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x7f8a
mov dword [esp + 0x1c], 0x7f00
mov dword [esp + 0x20], 0x7f03
mov dword [esp + 0x24], 0x7f89
mov dword [esp + 0x28], 0x7f8b
mov dword [esp + 0x2c], 0x7f01
mov dword [esp + 0x30], 0x7f81
mov dword [esp + 0x34], 0x7f88
mov dword [esp + 0x38], 0x7f80
mov dword [esp + 0x3c], 0x7f86
mov dword [esp + 0x40], 0x7f83
mov dword [esp + 0x44], 0x7f85
mov dword [esp + 0x48], 0x7f82
mov dword [esp + 0x4c], 0x7f84
mov dword [esp + 0x50], 0x7f04
mov dword [esp + 0x54], 0x7f02
lea ebx, [esp + 0x18]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [esp + 0x18]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000a336
xor ebp, ebp
push str.GDI32.dll
mov dword [esp + 0x64], ebp
mov dword [esi], 0x10017220
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x68]
mov dword [0x1001d468], eax
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000a37d.2
xor edx, edx
mov dl, byte [eax + 0x1000a570]
jmp dword [edx*4 + 0x1000a568]
mov dword [esi + 0x70], ecx
jmp 0x1000a390
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000adc0
test al, al
jne 0x1000a3b1
call dword [0x1001d45c]
push eax
mov dword [esi + 0x10c], eax
call dword [0x1001d460]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x70]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [0x1001cbd4]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x70]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov dword [esi + 0x30], ebp
push str.CreateCompatibleDC
mov byte [esi + 0x24], al
mov ecx, dword [0x1001d468]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x44]
mov edi, eax
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x44]
push eax
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
lea ebx, [esi + 0x5c]
push 1
push ecx
push edx
mov dword [ebx], ebp
lea ebp, [esi + 0x60]
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [ebp], 0
call fcn.1000aa30
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1000aa30
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x28]
push 1
push eax
push ecx
mov ecx, esi
call fcn.1000aa30
mov dword [esi + 0x6c], eax
mov edx, dword [0x1001d468]
push str.CreateDIBSection
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push ebx
mov edi, eax
push 0
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call edi
mov edx, dword [esi + 0x68]
push 0
push 0
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x44]
push ebp
push 0
push edx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
lea ecx, [esi + 0x78]
push 0
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
push ecx
push 0
push edx
push eax
call edi
mov dword [esi + 0x84], eax
mov ecx, dword [0x1001d468]
push str.SelectObject
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x58]
mov edi, eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push 0
lea ecx, [esi + 0x34]
push 0
push ecx
call dword [0x1001d464]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x58]
div dword [esi + 0x2c]
mov dword [esi + 0x20], 0
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
jb 0x1001a6ab
inc ecx
add byte [eax], al
inc ebx
jb 0x1001a6d4
popal
je 0x1001a6d7
push esp
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
push 0x33706c65
xor dl, byte [ebx + 0x6e]
popal
jo str.IMM32.dll
push 0x746f
add byte [eax], al
push eax
jb 0x1001a6fa
arpl word [ebp + 0x73], sp
jae 0x1001a6c3
xor al, byte [esi + 0x69]
jb 0x1001a708
je 0x1001a697
add byte [eax + 0x72], dl
push eax
jb 0x1001a70a
arpl word [ebp + 0x73], sp
jae 0x1001a6d3
xor cl, byte [esi + 0x65]
js 0x1001a719
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001a703
push edi
imul ebp, dword [esi + 0x64], 0x6554776f
js 0x1001a729
inc ecx
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x1001a729
push edi
imul ebp, dword [esi + 0x64], 0x73776f
dec ebp
jae 0x1001a73b
add byte [ebp + 0x65], cl
dec ebp
jae 0x1001a73b
popal
inc edx
outsd dx, dword [esi]
js 0x1001a710
add byte [ebp + 0x61], cl
dec ebp
popal
jo 0x1001a72a
push esi
imul esp, dword [ebp + 0x77], 0x6946664f
insb byte es:[edi], dx
add byte gs:[eax], al
add byte [ebx + 0x72], al
inc ebx
invalid
dec edi
inc si
imul ebp, dword [ebp], 0x72430000
inc ebx
invalid
popal
je 0x1001a74b
inc esi
imul ebp, dword [ebp + 0x4d], 0x69707061
outsb dx, byte [esi]
inc ecx
add byte [eax], al
dec ecx
dec ebp
dec ebp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [0x30255b0a], cl
or eax, 0x30255b0a
xor dh, byte [ebp + 0x2d]
and eax, 0x2d753230
and eax, 0x2d753230
and eax, 0x30252064
xor dh, byte [ebp + 0x3a]
and eax, 0x3a753230
and eax, 0x3a753230
and eax, 0x5d753230
cmp ah, byte [0x5d753230]
and byte [eax], ch
and eax, 0xa0d2973
add byte [eax], al
inc edi
je 0x1001a76d
je 0x1001a76d
arpl word [ecx + ebp*2 + 0x76], si
push edi
imul ebp, dword [esi + 0x64], 0x5d00776f
add byte [eax], al
add byte [0x4700000a], cl
inc edi
je 0x1001a78f
jns 0x1001a795
popal
insd dword es:[edi], dx
push esp
js 0x1001a7c2
inc ecx
add byte [ebx + 0x61], al
inc ebx
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
dec esi
js 0x1001a7cc
dec eax
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
insb byte es:[edi], dx
popal
jae 0x1001a7cf
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001a7d4
js 0x1001a7e5
add byte [eax], al
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001a7be
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001a7ee
jae 0x1001a7ea
je 0x1001a7ec
outsd dx, dword [esi]
outsb dx, byte [esi]
push ebx
je 0x1001a7fa
imul ebp, dword [esi + 0x67], 0x41
add byte [ecx + 0x6d], cl
dec ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
inc edi
je 0x1001a7da
je 0x1001a7da
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001a800
js 0x1001a811
add byte [eax], al
add byte [ebp + 0x79], cl
dec ebp
jns 0x1001a7e6
jb 0x1001a80a
popal
je 0x1001a80d
dec ebp
popal
add byte [eax], al
inc esi
jb 0x1001a814
push ebx
imul esp, dword [eax + eax + 0x53], 0x65537465
push ebx
je 0x1001a80b
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x6144726f
jns str.AllocateAndInitializeSid
jae 0x1001a826
arpl word [edx + 0x69], si
jb 0x1001a82e
jo 0x1001a83b
outsd dx, dword [esi]
jb 0x1001a80e
popal
arpl word [eax + eax], bp
insb byte es:[edi], dx
add byte [eax], al
add byte [ecx + 0x64], al
inc ecx
inc ecx
arpl word [ebx + 0x65], sp
jae 0x1001a84c
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
ja 0x1001a844
inc ecx
arpl word [ebp], sp
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x6c6341
add byte [eax], al
inc edi
je 0x1001a844
jp 0x1001a853
inc ecx
arpl word [eax + eax], bp
add byte [edi + 0x65], al
inc edi
je 0x1001a844
outsb dx, byte gs:[esi]
je 0x1001a865
push ebx
imul esp, dword [eax + eax], 0x6c410000
inc ecx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
inc ecx
je 0x1001a871
inc ecx
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
imul esp, dword [eax + eax], 0x6e490000
dec ecx
outsb dx, byte [esi]
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x646953
add byte [eax], al
add byte [ecx + 0x6e], cl
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
push ebx
arpl word gs:[ebp + 0x72], si
imul esi, dword [ecx + edi*2 + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0x726f
add byte [eax], al
push ebx
je 0x1001a89b
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x75636553
jb 0x1001a899
je 0x1001a8ab
inc esp
jae 0x1001a899
jb 0x1001a8a1
jo 0x1001a8ae
outsd dx, dword [esi]
jb 0x1001a83d
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x1001a89b
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0x41
add byte [eax], al
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
push 0x576b6f6f
imul ebp, dword [esi + 0x64], 0x4873776f
outsd dx, dword [esi]
outsd dx, dword [esi]
imul eax, dword [ebp + 0x78], 0
inc ebp
js str.Plugin
pop esp
push eax
insb byte es:[edi], dx
jne 0x1001a8d4
imul ebp, dword [esi], 0x65474853
push ebx
dec eax
inc edi
je 0x1001a8c9
dec eax
inc edi
je 0x1001a8c9
jo 0x1001a8dd
arpl word [ecx + 0x61], bp
insb byte es:[edi], dx
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x1001a8d3
popal
je 0x1001a8ee
inc ecx
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a8f3
imul ebp, dword [esi + 0x45], 0x646e
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a8ff
imul ebp, dword [esi + 0x53], 0x74726174
outsb dx, byte [esi]
push ebx
je 0x1001a8fe
jb 0x1001a913
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
insb byte es:[edi], dx
jne 0x1001a90b
imul ebp, dword [esi + 0x44], 0x74656c65
add byte gs:[eax], al
add byte [eax], al
and eax, 0x20202073
and eax, 0x20202073
and eax, 0x73
add byte [eax + 0x6c], dl
push eax
insb byte es:[edi], dx
jne 0x1001a92b
imul ebp, dword [esi + 0x44], 0x72637365
imul esi, dword [eax + 0x74], 0xb4ce0000
mov esp, 0xd8d4d3
arpl word [edx + 0x69], si
jo 0x1001a942
add byte [eax], al
into
mov ah, 0xbc
rcl esp, cl
fadd dword [eax]
aam 0xd8
add byte [eax], al
rcl cl, cl
mov esi, 0xd4d3bcad
add dl, dl
sar dword [esi - 0x2b2c4353], 1
rcl esp, cl
fadd dword [eax]
add byte [eax], al
add byte [0x2e2a5c73], ah
and eax, 0x2e2a5c73
sub al, byte [eax]
add byte [edx + 0x6c], al
inc edx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x49], bp
outsb dx, byte [esi]
jo 0x1001a96a
je 0x1001a8f7
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001a962
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
push ebx
je 0x1001a94f
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
inc esp
inc esp
popal
je 0x1001a979
add byte [eax], al
add byte [eax], al
inc ebp
insd dword es:[edi], dx
jo 0x1001a994
jns 0x1001a965
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
dec edi
jo 0x1001a994
add byte [edi + 0x70], cl
dec edi
jo 0x1001a994
outsb dx, byte [esi]
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001a983
insb byte es:[edi], dx
imul esi, dword [eax + 0x62], 0x6472616f
jo 0x1001a9a6
outsd dx, dword [esi]
popal
jb 0x1001a9ac
inc esp
popal
je 0x1001a9ad
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001a9a7
add byte [edi + 0x65], al
inc edi
je 0x1001a9a7
jns 0x1001a9c9
je 0x1001a9bd
insd dword es:[edi], dx
dec ebp
je 0x1001a9cf
imul esp, dword [ebx + 0x73], 0
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
dec esp
outsd dx, dword [esi]
popal
inc ebx
jne 0x1001a9e9
jae str.SetCursorPos
jb 0x1001a9bc
add byte [ebp + 0x73], al
inc esp
jae 0x1001a9f4
invalid
outsd dx, dword [esi]
jns 0x1001a9c7
inc ebx
jne str.keybd_event
jae 0x1001a9f7
jb 0x1001a98a
add byte [eax], al
push ebp
jae 0x1001a9f4
jb 0x1001a9c4
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001aa13
popal
inc ecx
add byte [eax], al
add byte [eax], al
push ebx
jns 0x1001aa1e
add byte [ebx + 0x79], dl
push ebx
jns 0x1001aa1e
invalid
je 0x1001aa12
insd dword es:[edi], dx
insd dword es:[edi], dx
push eax
popal
jb 0x1001aa13
insd dword es:[edi], dx
je 0x1001aa1b
jb 0x1001aa2b
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
inc ecx
add byte [eax], al
add byte [ebp + 0x6f], ch
insd dword es:[edi], dx
outsd dx, dword [esi]
jne 0x1001aa37
pop edi
jbe 0x1001aa2e
jbe 0x1001aa2e
outsb dx, byte [esi]
je str.MapVirtualKeyA
dec ebp
popal
jo 0x1001aa26
push esi
imul esi, dword [edx + 0x74], 0x4b6c6175
jns 0x1001aa1b
add byte [eax], al
push ebx
je 0x1001aa23
popal
jo 0x1001aa57
jne 0x1001aa57
add byte gs:[eax], al
push ebx
je 0x1001aa2f
jne 0x1001aa60
jae 0x1001aa5f
jb 0x1001aa42
outsd dx, dword [esi]
jae 0x1001a9f5
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x65], ch
imul esp, dword [ebp + 0x79], 0x62
imul esp, dword [ebp + 0x79], 0x62
pop edi
jbe 0x1001aa66
outsb dx, byte [esi]
je str.WindowFromPoint
push edi
imul ebp, dword [esi + 0x64], 0x7246776f
outsd dx, dword [esi]
insd dword es:[edi], dx
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x74655300
push ebx
je 0x1001aa6a
je str.SetRect
add byte [ebx + 0x65], dl
push ebx
je 0x1001aa6a
push ebx
je 0x1001aa6a
arpl word gs:[eax + eax + 0x47], si
inc edi
je 0x1001aa64
add byte [edi + 0x65], al
inc edi
invalid
je 0x1001aa64
inc ebx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
invalid
je 0x1001aa6c
jae 0x1001aa96
je 0x1001aa9c
jo 0x1001aa86
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [eax], al
push edx
insb byte es:[edi], dx
add byte [edx + 0x65], dl
push edx
insb byte es:[edi], dx
popal
jae str.GetCursorInfo
inc esp
inc ebx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
insb byte es:[edi], dx
add byte [eax], al
push ebx
insb byte es:[edi], dx
arpl word gs:[edi + ecx*2 + 0x62], si
push 0x65
arpl word [eax + eax], si
add byte [eax], al
inc ebx
jb 0x1001aabc
popal
je 0x1001aabf
inc esp
dec ecx
inc edx
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
arpl word [ecx + ebp*2 + 0x6f], si
je 0x1001aacb
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001aad0
popal
popal
je 0x1001aad3
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001aad4
je 0x1001aade
bound ebp, qword [ebp + 0x44]
inc ebx
add byte [eax], al
inc edi
inc esp
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebp + 0x6c], al
inc esp
insb byte es:[edi], dx
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001aaf3
dec edi
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
add byte [eax], al
inc esp
insb byte es:[edi], dx
je 0x1001ab03
je 0x1001ab03
inc esp
inc ebx
add byte [eax], al
add byte [eax], al
inc edi
je 0x1001aaeb
jne 0x1001ab1c
jae 0x1001ab1b
jb 0x1001aaf7
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001aafb
jne str.TerminateProcess
jae 0x1001ab2b
jb 0x1001ab0e
outsd dx, dword [esi]
jae 0x1001aac1
add byte [eax], al
add byte [edx + 0x69], al
inc edx
invalid
je 0x1001ab0a
insb byte es:[edi], dx
je 0x1001aacb
add byte [edi + 0x65], al
inc edi
je 0x1001ab14
dec ecx
inc edx
imul esi, dword [ebx + esi*2], 0x72430000
inc ebx
invalid
je 0x1001ab48
jae 0x1001aad6
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
invalid
add byte [eax], al
inc ebx
jb str.TerminateThread
popal
popal
je 0x1001ab43
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ab44
je 0x1001ab4e
bound ebp, qword [ebp + 0x42]
imul esi, dword [ebp + ebp*2 + 0x61], 0x5c000070
pop esp
arpl word [ebp + 0x64], bp
js 0x1001ab5d
insd dword es:[edi], dx
popal
jo 0x1001aaef
add byte [ebx + 0x6d], bl
pop esp
invalid
insd dword es:[edi], dx
js 0x1001ab5d
add byte gs:[eax], al
add byte [eax], al
add byte [eax], al
inc ebx
jb 0x1001ab64
add byte [ebx + 0x72], al
inc ebx
jb 0x1001ab64
popal
popal
je 0x1001ab67
push eax
imul esi, dword [eax + 0x65], 0x654b0000
dec ebx
invalid
jb 0x1001ab7a
insb byte es:[edi], dx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
inc esp
imul esi, dword [ebx + 0x63], 0x656e6e6f
arpl word [esi + ecx*2 + 0x61], si
arpl word [edi + 0x6e], bp
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
arpl word gs:[esi + ecx*2 + 0x61], si
insd dword es:[edi], dx
push eax
imul esi, dword [eax + 0x65], 0x72655400
push esp
invalid
invalid
add byte [ebp + 0x72], dl
push esp
invalid
invalid
push esp
jb 0x1001ab9d
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x72506574
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x1001ab3d
add byte [eax], al
add byte [ebp + 0x72], dl
push esp
invalid
invalid
push esp
jb 0x1001abb1
insd dword es:[edi], dx
imul ebp, dword [esi + 0x61], 0x68546574
jb 0x1001abb2
push esp
push 0x64616572
add byte [eax + 0x65], dl
push eax
invalid
popal
add byte fs:[eax + 0x65], dl
push eax
invalid
imul ecx, dword gs:[esi + 0x61], 0x6d
push eax
imul esi, dword [eax + 0x65], 0x45000000
inc ebp
js 0x1001abcc
add byte [eax], al
add byte [ebp + 0x78], al
inc ebp
js 0x1001abcc
je 0x1001abbc
imul ebp, dword [esi + 0x64], 0x4573776f
je 0x1001abbc
push edi
imul ebp, dword [esi + 0x64], 0x4573776f
outsd dx, dword fs:[esi]
ja 0x1001abde
inc ebp
js 0x1001ab6e
add byte [eax], al
inc edi
je 0x1001abcb
imul ebp, dword [esi + 0x64], 0x6854776f
jb 0x1001abe2
push 0x64616572
push eax
popal
push eax
jb 0x1001abf1
arpl word [ebp + 0x73], sp
jae 0x1001abd0
add byte fs:[eax], al
add byte [eax], al
dec ecx
jae 0x1001abe6
imul ebp, dword [esi + 0x64], 0x6956776f
jae 0x1001ac01
bound ebp, qword [ebp]
inc edi
je 0x1001abed
outsd dx, dword [esi]
jne 0x1001ac10
inc esi
imul ebp, dword [ebp + 0x4e], 0x45656d61
js 0x1001abf1
add byte [eax], al
add byte [eax], al
add byte [ebp + 0x6e], al
inc ebp
outsb dx, byte [esi]
add byte [eax], al
inc ebp
outsb dx, byte [esi]
jne 0x1001ac25
push eax
jb 0x1001ac2a
arpl word [ebp + 0x73], sp
jae 0x1001ac0d
jae 0x1001ac32
dec ebp
outsd dx, dword [esi]
jne 0x1001ac30
jae 0x1001abc7
add byte [eax + 0x53], dl
push eax
push ebx
inc ecx
push eax
dec ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
inc esp
bound esi, qword gs:[ebp + 0x67]
push eax
jb 0x1001ac47
jbe 0x1001ac49
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte gs:[bx + si], al
add byte [eax], al
push ebx
push ebx
push 0x6f647475
je 0x1001ac53
outsd dx, dword [esi]
ja str.SetThreadDesktop
outsb dx, byte [esi]
push eax
jb 0x1001ac5e
jbe str.SetThreadDesktop
insb byte es:[edi], dx
add byte gs:[bx + 0x65], al
inc edi
je 0x1001ac55
jae 0x1001ac67
jb 0x1001ac53
jb 0x1001ac53
bound ebp, qword [edx + 0x65]
arpl word [ecx + ecx*2 + 0x6e], si
outsw dx, word [esi]
jb 0x1001ac7c
popal
je 0x1001ac7b
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001ac70
push 0x64616572
inc esp
jae 0x1001ac90
je 0x1001ac96
jo 0x1001ac29
add byte [eax], al
add byte [edi + 0x70], cl
dec edi
jo 0x1001ac94
outsb dx, byte [esi]
add byte [eax], al
dec edi
jo 0x1001ac94
outsb dx, byte [esi]
inc esp
jae 0x1001ac9f
jae 0x1001ac9f
je 0x1001aca5
jo 0x1001ac79
add byte [eax], al
add byte [eax], al
dec edi
jo 0x1001aca4
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
jo 0x1001acb9
je 0x1001ac8a
jae str.CloseWindow
jae str.CloseWindow
je 0x1001acba
jo 0x1001ac4d
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001acba
inc esp
jae 0x1001acc4
je 0x1001acca
jo 0x1001ac5d
add byte [eax], al
add byte [ebx + 0x65], dl
push ebx
je 0x1001acb8
add byte [eax], al
push ebx
je 0x1001acb8
push 0x64616572
inc esp
popal
inc esp
jae 0x1001acd8
je 0x1001acde
jo 0x1001ac71
add byte [eax], al
add byte [eax], al
push eax
outsd dx, dword [esi]
add byte [eax], al
add byte [eax + 0x6f], dl
push eax
outsd dx, dword [esi]
jae 0x1001acec
dec ebp
jae 0x1001acef
jae 0x1001acde
popal
inc ecx
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x1001aced
jb 0x1001acf8
je 0x1001acdf
popal
inc esi
inc esi
imul ebp, dword [ebp], 0x4d000000
dec ebp
add byte [eax], al
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jp 0x1001ad05
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
arpl word [edi + 0x6d], bp
jo 0x1001ad0b
je 0x1001ad15
bound ebp, qword [ebp + 0x29]
add byte [eax], al
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ad1e
push edi
push edi
imul ebp, dword [esi + 0x64], 0x4300776f
inc ebx
push esi
imul esp, dword [ebp + 0x6f], 0x706143
outsd dx, dword gs:[esi]
inc ebx
popal
jo 0x1001acca
add byte [eax], al
arpl word [ecx + 0x70], sp
inc ebx
jb 0x1001ad37
popal
je 0x1001ad3a
inc ebx
popal
jo 0x1001ad4d
je 0x1001ad4f
jne 0x1001ad4d
jb 0x1001ad41
push edi
push edi
imul ebp, dword [esi + 0x64], 0x41776f
inc ecx
push esi
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x1001ad24
add byte [ecx + 0x56], al
inc ecx
push esi
dec ecx
inc ebx
inc ecx
push eax
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.ICOpen
popal
je 0x1001ad67
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsd dx, dword fs:[esi]
ja 0x1001ad4e
js 0x1001ad4c
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
je 0x1001ad57
jb 0x1001ad7e
jbe 0x1001ad7c
jb 0x1001ad5d
jae 0x1001ad7f
jb 0x1001ad87
jo str.ICSeqCompressFrameEnd
imul ebp, dword [edi + 0x6e], 0x41
add byte [ecx + 0x43], cl
dec ecx
inc ebx
add byte [eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ad71
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ada4
jae 0x1001ada8
inc esi
jb 0x1001ad99
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001ad85
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo str.d3555:03512161gpc
jae 0x1001adbc
inc esi
jb 0x1001adad
insd dword es:[edi], dx
push ebx
push ebx
je 0x1001adb2
jb 0x1001adc7
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001add1
jae 0x1001adc0
popal
add byte gs:[bx + si], al
add byte [ecx + 0x43], cl
dec ecx
inc ebx
dec edi
jo 0x1001adce
outsb dx, byte [esi]
add byte [eax], al
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001ade4
add byte gs:[ecx + 0x43], cl
dec ecx
inc ebx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001adf9
jae 0x1001adfd
outsd dx, dword [esi]
jb 0x1001add3
jb 0x1001adf4
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001addd
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001ae10
jae 0x1001ae14
inc esi
jb 0x1001ae05
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + esi + 0x35], ah
xor esi, dword fs:[0x3a35353d]
invalid
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor esi, dword fs:[0x3a35353d]
xor byte [ebx], dh
xor eax, 0x33303a35
xor esi, dword [0x31322a31]
xor eax, 0x31322a31
xor dword ss:[ebx], ebp
xor dword [ebx], ebp
jo 0x1001ae2f
add eax, 0x4020108
add dword [edx], eax
add al, 3
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add eax, dword [ecx]
add dword [eax], ecx
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [0x2010202]
add al, byte [ecx]
add al, byte [ecx]
add eax, dword [ebx]
add dword [edx], eax
add eax, dword [0x4020602]
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add eax, dword [ebx]
add al, byte [ecx]
add dword [ebx], eax
push es
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [edx]
add dword [edx], eax
add dword [edx], eax
push es
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x3060003
add ch, byte [ebx + 0x77]
imul esi, dword [edi + 0x75], 0x72
cmp dword [edx], ebp
sub eax, 0x2f737571
popal
arpl word [eax + 0x66], bp
jae 0x1001af21
pushal
insb byte es:[edi], dx
outsd dx, dword [esi]
push 0x79762873
jbe 0x1001af04
add al, 3
add dword [edx], eax
add eax, dword [0x1030602]
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx + 0x1d]
push es
add dl, byte [edi + 0x66]
push edi
jo 0x1001b084
push 0x6476636b
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
jbe 0x1001b0ea
and cl, byte [edx + 0x6c]
jne 0x1001b101
jo 0x1001b0ae
push ecx
popal
jno 0x1001b104
popal
popal
popal
and eax, 0x616f6046
add eax, dword [ecx]
add dword [eax], ecx
add dword [edx], eax
add al, 3
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add al, byte [ecx]
add eax, dword [ebx]
add dword [edx], eax
add eax, dword [0x4020602]
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add al, byte [edx]
add dword [edx], eax
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x55020302]
push ebp
pushal
pushal
jno 0x1001b16c
and cl, byte [ebp + ebp*2 + 0x74]
je 0x1001b182
and al, 0x50
pushal
jp 0x1001b185
insd dword es:[edi], dx
insw word es:[edi], dx
and dword [esi + 0x6d], eax
jo 0x1001b18a
insd dword es:[edi], dx
imul edi, dword [eax + 2], 0x1010304
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add al, byte [ebx]
add al, byte [0x2010403]
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + edx*2]
push esp
outsd dx, dword [esi]
arpl word fs:[eax + 0x60], si
and cl, byte [edi + 0x6d]
jno 0x1001b24a
ja 0x1001b1fa
push ecx
arpl word [edi + 0x74], si
imul esp, dword [edx + 0x67], 0x21
inc esi
arpl word [ecx + 0x60], si
jno 0x1001b24e
arpl word [ebp + eax + 2], sp
add al, byte [ecx]
add al, byte [ecx]
add al, byte [ebx]
add al, byte [0x2010403]
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, dword [edx]
add eax, 0x2010508
add eax, dword [edx]
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add eax, dword [0x1030602]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add esp, dword [eax]
and byte [ecx + 0x7a], dl
invalid
jno 0x1001b367
push 0x766c6d53
and byte [edi + 0x42], bl
push 0x644d616e
sub ch, byte gs:[bx + 0x78]
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [0x2010403]
add eax, dword [ecx + eax]
add al, byte [edx]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x5020302
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x2030201], al
add eax, 0x2010403
add al, 3
add eax, 0x5040208
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
or byte [ecx], al
add al, byte [ebx + eax]
add dword [ecx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, 0x2010202
add dword [ebx], eax
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x4020602
add dword [ebx], eax
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, dword [esi]
add al, byte [ecx]
add al, byte [esp + eax]
add eax, dword [ecx]
add al, byte [ebx]
add eax, 0x1030602
add al, byte [ebx]
add eax, 0x2050602
add al, byte [ecx]
add al, byte [ecx]
add al, byte [esi]
add al, byte [ebx]
add eax, dword [edx]
add dword [ecx], eax
add eax, 0x2010202
add dword [edx], eax
add eax, dword [edx]
add eax, 0x2010403
add al, byte [ebx]
add dword [edx], eax
add eax, dword [0x5020302]
or byte [0x38201], al
add byte [edx + 0x65], dl
push edx
dec edi
jo 0x1001b467
outsb dx, byte [esi]
dec ebx
jns 0x1001b448
add byte [edi + 0x65], al
inc edi
je 0x1001b45f
jns 0x1001b481
je 0x1001b475
insd dword es:[edi], dx
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
add byte [eax], al
add byte [esi + 0x4d], bh
jle 0x1001b467
dec eax
jp 0x1001b41d
add byte [eax], al
add byte [eax + 0x41], cl
dec eax
inc ecx
push edx
inc esp
push edi
inc ecx
push edx
inc ebp
pop esp
inc esp
inc ebp
push ebx
inc ebx
push edx
dec ecx
push eax
push esp
dec ecx
dec edi
dec esi
pop esp
push ebx
jns 0x1001b4ab
je 0x1001b49f
insd dword es:[edi], dx
pop esp
inc ebx
outsb dx, byte gs:[esi]
je 0x1001b4b3
popal
insb byte es:[edi], dx
push eax
jb 0x1001b4b5
arpl word [ebp + 0x73], sp
jae 0x1001b4ba
jae 0x1001b4bd
outsd dx, dword [esi]
jb 0x1001b4a9
xor byte [eax], al
add byte [edx + 0x65], dl
push edx
push edx
jae 0x1001b4cb
outsd dx, dword [esi]
jb 0x1001b4bf
dec ebx
jns 0x1001b49f
add byte [eax], al
push edx
push ebx
add byte [edx + 0x65], dl
push edx
push ebx
popal
jbe 0x1001b4cc
dec ebx
jns 0x1001b4ac
add byte [edi + 0x70], cl
dec edi
jo 0x1001b4d4
outsb dx, byte [esi]
push eax
jb 0x1001b4e2
arpl word [ebp + 0x73], sp
jae 0x1001b4cc
jae 0x1001b4ea
push esp
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0
add byte [eax], al
add byte [edi + ebp*2 + 0x6f], cl
dec esp
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
outsd dx, dword [esi]
imul esi, dword [ebp + 0x70], 0x50
jb 0x1001b4f2
jbe 0x1001b4f4
insb byte es:[edi], dx
push esi
popal
insb byte es:[edi], dx
jne 0x1001b4f9
inc ecx
add byte [eax], al
add byte [ecx + 0x64], al
inc ecx
push 0x75
jae 0x1001b512
push esp
outsd dx, dword [esi]
imul esp, dword [ebp + 0x6e], 0x50
jb 0x1001b50f
jbe 0x1001b511
insb byte es:[edi], dx
jae 0x1001b4ae
jae 0x1001b4ae
jae 0x1001b4ae
add byte [eax], al
push ebx
je str.RegisterServiceCtrlHandlerA
jb 0x1001b529
push ebx
jb 0x1001b52f
imul esp, dword [ebx + 0x65], 0x41
inc ebx
jb 0x1001b528
arpl word [ebp + 0x41], sp
add byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb 0x1001b528
popal
popal
je 0x1001b52b
push ebx
jb 0x1001b540
imul esp, dword [ebx + 0x65], 0x4c000041
dec esp
arpl word [ebp + 0x41], sp
inc ecx
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ebx + 0x53], bp
jb 0x1001b54e
imul esp, dword [ebx + 0x65], 0x61746144
bound esp, qword [ecx + 0x73]
add byte gs:[ebx + 0x68], al
inc ebx
push 0x65676e61
push ebx
push ebx
jb str.OpenEventA
imul esp, dword [ebx + 0x65], 0x666e6f43
imul esp, dword [edi + 0x32], 0x41
outsd dx, dword [esi]
outsb dx, byte [esi]
imul sp, word [edi + 0x32], 0x41
add byte [eax], al
add byte [eax], al
add byte [ebp + 0x6e], dl
push ebp
outsb dx, byte [esi]
push ebp
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x53], bp
jb 0x1001b57c
imul esp, dword [ebx + 0x65], 0x61746144
bound esp, qword [ecx + 0x73]
add byte gs:[eax], al
jae 0x1001b576
add byte [eax], al
add byte [eax], al
add byte [edx + 0x65], dl
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
push edx
imul esi, dword gs:[bp + di + 0x74], 0x65537265
jb 0x1001b596
imul esp, dword [ebx + 0x65], 0x6c727443
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
jb str.My_Win32_Applaction
add byte [ebx + 0x65], dl
push ebx
je 0x1001b587
jb 0x1001b5ad
imul esp, dword [ebx + 0x65], 0x74617453
jne 0x1001b5b3
add byte [eax], al
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
dec ebp
outsb dx, byte gs:[esi]
jne 0x1001b58e
add byte [eax], al
add byte [edx], bh
add byte [eax], al
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
add byte [eax], al
cmp al, byte [eax]
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
pop esp
dec esi
je 0x1001b5be
and eax, 0x64
dec edi
jo 0x1001b5cc
outsb dx, byte [esi]
inc ebp
jbe str.SeRestorePrivilege
outsb dx, byte [esi]
je 0x1001b5af
add byte [eax], al
dec ebp
jns 0x1001b593
push edi
imul ebp, dword [esi + 0x33], 0x70412032
xor esi, dword [edx]
and byte [ecx + 0x70], al
jo 0x1001b5e9
insb byte es:[edi], dx
popal
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [edi + 0x49], dl
push edi
dec ecx
dec esi
xor esi, dword [edx]
and byte [ecx + 0x70], al
jo 0x1001b5fa
imul esp, dword [ebx + 0x61], 0x6e6f6974
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001b5ef
add byte [eax], al
inc edi
je 0x1001b5ef
je 0x1001b60d
arpl word [ebx + 0x4f], bp
bound ebp, qword [edx + 0x65]
arpl word [eax + eax], si
inc edi
je 0x1001b5ef
jne 0x1001b620
jb 0x1001b621
jb 0x1001b615
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x1001b603
jb 0x1001b624
arpl word [ebp + 0x73], sp
jae 0x1001b5ba
add byte [eax], al
push ebx
inc edx
inc edx
popal
arpl word [ebx + 0x75], bp
jo 0x1001b615
jb 0x1001b630
jbe 0x1001b632
insb byte es:[edi], dx
add byte gs:[bx + si], al
add byte gs:[eax], al
add byte [ebx + 0x65], dl
push ebx
push edx
push ebx
push edx
jae 0x1001b64a
outsd dx, dword [esi]
jb 0x1001b63e
push eax
jb 0x1001b645
jbe 0x1001b647
insb byte es:[edi], dx
add byte gs:[bx + si], al
push ebx
jb 0x1001b65e
imul esp, dword [ebx + 0x65], 0x6c6c44
arpl word [ebp + 0x44], sp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
and eax, 0x61505c73
add byte [0x61505c73], ah
and eax, 0x61505c73
jb 0x1001b658
insd dword es:[edi], dx
je 0x1001b660
jb 0x1001b670
jb 0x1001b670
add byte [eax], al
add byte [ebx + 0x4f], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
and eax, 0x654e0064
dec esi
je 0x1001b63d
je 0x1001b63d
push esp
insd dword es:[edi], dx
jo 0x1001b643
imul ebp, dword [esi + 0x69], 0
push ebx
pop ecx
push ebx
push esp
inc ebp
dec ebp
pop esp
inc ebx
jne 0x1001b698
jb 0x1001b68d
outsb dx, byte [esi]
je 0x1001b66e
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x1001b6a1
outsd dx, dword [esi]
insb byte es:[edi], dx
push ebx
je 0x1001b691
push ebx
jb 0x1001b6af
imul esp, dword [ebx + 0x65], 0x5c73
pop esp
add byte [eax], al
inc edi
je 0x1001b69b
push edi
imul ebp, dword [esi + 0x64], 0x4473776f
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x1001b6bd
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x1001b695
add byte [eax], al
add byte [eax], al
and eax, 0x69000073
invalid
insd dword es:[edi], dx
jae 0x1001b6d7
jbe 0x1001b6c5
arpl word [eax], ax
add byte [ebx + 0x4f], dl
push ebx
dec edi
add byte [eax], al
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x1001b6d3
jb 0x1001b6e1
jae 0x1001b6e3
je 0x1001b6d3
push edi
imul ebp, dword [esi + 0x64], 0x2073776f
dec esi
push esp
pop esp
inc ebx
jne 0x1001b6f7
jb 0x1001b6ec
outsb dx, byte [esi]
je str._SystemRoot_System32_sv
jb 0x1001b700
imul ebp, dword [edi + 0x6e], 0x6376535c
push ebx
jbe 0x1001b6f7
dec eax
outsd dx, dword [esi]
jae 0x1001b70c
add byte [eax], al
add byte [eax], al
pop esp
push eax
popal
add byte [eax + edx*2 + 0x61], bl
pop esp
push eax
popal
jb 0x1001b702
insd dword es:[edi], dx
je 0x1001b70a
jb 0x1001b71a
add byte [ebx + 0x65], dl
push ebx
je 0x1001b6f2
imul ebp, dword [ebp + 0x41], 0x69727474
inc ecx
je 0x1001b726
jb 0x1001b71d
bound esi, qword [ebp + 0x74]
jae 0x1001b6fb
add byte [eax], al
push edx
inc esp
insb byte es:[edi], dx
je 0x1001b72a
dec ebx
jns 0x1001b70a
add byte [eax], al
add byte [edi + 0x6c], al
inc edi
insb byte es:[edi], dx
popal
bound eax, qword [eax]
add byte [eax], al
add byte [ebp + 0x5f], ch
insb byte es:[edi], dx
pop edi
pop edi
push edi
popal
imul esi, dword [eax + eax], 0x53250000
invalid
push ebx
and eax, 0x74737953
push ebx
jns 0x1001b757
jae 0x1001b759
je 0x1001b74b
insd dword es:[edi], dx
insd dword es:[edi], dx
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x1001b711
pop esp
push ebx
jns 0x1001b763
je 0x1001b757
insd dword es:[edi], dx
xor esi, dword [edx]
pop esp
jae 0x1001b76e
jbe 0x1001b6f9
add byte [eax], al
add byte [eax], al
arpl word [eax + 0x6f], bp
add byte [eax], al
add byte [ebx + 0x68], ah
arpl word [eax + 0x6f], bp
jae 0x1001b775
je 0x1001b730
js 0x1001b76a
js 0x1001b76a
and byte [0x6d69206b], ch
insd dword es:[edi], dx
jae 0x1001b784
jae 0x1001b784
arpl word [eax], ax
inc edi
je 0x1001b761
outsd dx, dword [esi]
jne 0x1001b784
inc esi
imul ebp, dword [ebp + 0x4e], 0x41656d61
dec esi
popal
insd dword es:[edi], dx
inc ecx
add byte [eax], al
inc ebp
js 0x1001b797
jo 0x1001b789
popal
outsb dx, byte [esi]
inc ebp
inc ebp
outsb dx, byte [esi]
jbe 0x1001b797
jb 0x1001b79f
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001b789
je 0x1001b7aa
imul ebp, dword [esi + 0x67], 0x4173
add byte [ebx + 0x6f], al
inc ebx
outsd dx, dword [esi]
jo 0x1001b7bd
inc esi
imul ebp, dword [ebp + 0x41], 0xa000000
add byte [edx], cl
add byte [eax], al
add byte [ebx + 0x3a], ah
arpl word [edx], di
pop esp
dec esi
push esp
pop edi
push eax
add byte [ecx + 0x74], ah
popal
je 0x1001b7c3
push 0x70
add byte [bx + di], dh
invalid
je 0x1001b7c3
push 0x70
add byte [bx + di], dh
invalid
xor dword cs:[esi], ebp
xor al, 0
xor al, 0
add byte [eax], al
outsb dx, byte [esi]
and byte fs:[ecx + ebp*2 + 0x63], ah
and byte fs:[ecx + ebp*2 + 0x63], ah
imul esp, dword [ebx + 0x74], 0x616e6f69
je 0x1001b7db
outsd dx, dword [esi]
outsb dx, byte [esi]
popal
jb 0x1001b7f0
add byte [ecx + 0x6e], ch
imul ebp, dword [esi + 0x63], 0x6572726f
arpl word [eax + 0x64], si
popal
je 0x1001b7e7
and byte [ebx + 0x68], ah
arpl word gs:[ebx], bp
add byte [eax], al
add byte [ecx + 0x6e], ch
imul ebp, dword [esi + 0x63], 0x6572726f
arpl word [eax + 0x68], si
popal
jb 0x1001b7c1
jb 0x1001b7c1
arpl word [eax + 0x65], bp
arpl word [ebx], bp
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001b80d
insb byte es:[edi], dx
imul esp, dword [eax + 0x77], 0x6f646e69
ja 0x1001b7d7
jae 0x1001b822
jp 0x1001b820
add byte [ebp + 0x6e], dh
jne 0x1001b82c
outsb dx, byte [esi]
imul ebp, dword [esi + 0x6f], 0x77
outsb dx, byte [esi]
ja 0x1001b831
and byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x1001b83b
jae 0x1001b83f
imul ebp, dword [edi + 0x6e], 0x74656d20
push 0x646f
pushal
mov bh, 1
add byte [eax - 0x49], ah
add dword [eax], edx
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [edx + 0x69], ah
je 0x1001b808
adc byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001b841
insb byte es:[edi], dx
imul esp, dword [eax + 0x62], 0x6c207469
bound ebp, qword [ecx + 0x74]
and byte [ebp + 0x6e], ch
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001b856
and byte [edx + 0x65], dh
jo 0x1001b858
jo 0x1001b858
popal
je 0x1001b7f6
add byte [eax], al
je 0x1001b869
outsd dx, dword [esi]
and byte [ebp + 0x61], ch
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
jns 0x1001b821
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001b86f
and byte [edi + 0x72], ch
and byte [ecx + ebp*2 + 0x73], ah
je 0x1001b871
outsd dx, dword [esi]
jb 0x1001b82b
imul esi, dword fs:[ebx + 0x74], 0x65636e61
and byte [ebx + 0x79], dh
jae 0x1001b883
popal
outsb dx, byte [esi]
arpl word [ebp + 0x20], sp
jae 0x1001b88f
insd dword es:[edi], dx
bound ebp, qword [edi + 0x6c]
jae str.invalid_stored_block_lengths
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [ebx + 0x74], dh
insb byte es:[edi], dx
imul esp, dword [eax + 0x73], 0x65726f74
and byte fs:[ebx + 0x74], dh
outsd dx, dword [esi]
jb 0x1001b88e
and byte fs:[edx + 0x6c], ah
and byte [edx + 0x6c], ah
bound ebp, qword [edi + ebp*2 + 0x63]
imul esp, dword [eax], 0x6c
outsd dx, dword [esi]
arpl word [ebx + 0x20], bp
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001b89f
jae 0x1001b839
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001b8a1
popal
insb byte es:[edi], dx
imul esp, dword [eax + 0x62], 0x6b636f6c
and byte [ecx + edi*2 + 0x70], dh
add byte gs:[eax], al
push 0xdc1001b7
mov eax, 0xcc341001
add dword [eax], edx
xor al, 0xcc
add dword [eax], edx
sar byte [eax - 0x473fefff], 1
add dword [eax], edx
mov ah, 0xb8
add dword [eax], edx
mov al, byte [0x901001b8]
mov eax, 0xb8781001
mov eax, 0xb8901001
add dword [eax], edx
js 0x1001b82a
adc byte [eax - 0x48], bh
mov eax, 0xcc341001
add dword [eax], edx
xor al, 0xcc
add dword [eax], edx
imul ebp, dword [esi + 0x63], 0x61706d6f
je 0x1001b8ea
bound ebp, qword [ebp + 0x20]
jbe 0x1001b8ec
and byte gs:[esi + 0x65], dh
jb 0x1001b8fc
imul ebp, dword [edi + 0x6e], 0
add byte [eax], al
add byte [edx + 0x75], ah
bound esi, qword [ebp + 0x66]
jb 0x1001b8b7
bound esi, qword [ebp + 0x66]
jb 0x1001b8b7
jb 0x1001b90c
outsd dx, dword [esi]
jb 0x1001b89d
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
outsb dx, byte [esi]
jae 0x1001b919
imul sp, word [ebx + 0x69], 0x6e65
je 0x1001b8cd
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jb str.invalid_distance_code
add byte [ecx + 0x74], ah
popal
invalid
popal
and byte [ebp + 0x72], ah
jb str.invalid_distance_code
jb 0x1001b8bf
add byte [ebx + 0x74], dh
jae 0x1001b936
jb 0x1001b929
popal
insd dword es:[edi], dx
and byte [ebp + 0x72], ah
jb 0x1001b93a
jb 0x1001b8cd
add byte [eax], al
add byte [esi + 0x69], ah
imul bp, word [ebp + 0x20], 0x7265
jb 0x1001b948
jb 0x1001b8db
add byte [ebx + 0x74], dh
jae 0x1001b952
jb 0x1001b945
popal
insd dword es:[edi], dx
and byte [ebp + 0x6e], ah
add byte fs:[eax], al
test al, 0x74
add dword [eax], edx
pop esp
jae 0x1001b8f0
adc byte [ecx], al
add dword [eax], eax
add byte [esi], bl
add dword [ecx], eax
add byte [eax], al
push ds
add dword [eax], eax
add byte [edi], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], ch
jns 0x1001b904
add byte [eax], al
add byte [eax], al
sub byte [ecx + 1], bh
adc al, dl
jae 0x1001b908
sal byte [ebx + 1], 1
adc byte [eax], al
add byte [eax], al
add byte [esi], bl
add byte [eax], al
add byte [eax], al
push ds
add byte [eax], al
add byte [edi], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x74], cl
add dword [eax], edx
add byte [eax], al
add byte [eax], al
adc eax, dword [eax]
add byte [eax], al
pop es
add byte [eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
jbe 0x1001b991
imul ebp, dword [esi + 0x76], 0x64696c61
and byte [ecx + ebp*2 + 0x73], ah
je 0x1001b99a
insb byte es:[edi], dx
imul esp, dword [eax + 0x64], 0x61747369
outsb dx, byte [esi]
arpl word [ebp + 0x20], sp
arpl word [edi + 0x64], bp
add byte gs:[eax], al
add byte [ecx + 0x6e], ch
invalid
outsb dx, byte [esi]
outsb dx, byte [esi]
jbe 0x1001b9a9
insb byte es:[edi], dx
imul esp, dword [eax + 0x6c], 0x72657469
popal
insb byte es:[edi], dx
das
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x1001b9c2
and byte [ebx + 0x6f], ah
add byte gs:[ecx], cl
add byte [eax], al
add byte [0x60000000], al
pop es
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push eax
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], dl
add byte [eax], al
add byte [eax + ecx], dl
add byte [ebx], dh
add byte [eax], al
push edx
pop es
add byte [eax], al
pop ds
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
rol byte [eax], 0
add byte [eax + 7], dl
pop es
add byte [eax], al
or al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pushal
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax], ah
add byte [eax], al
mov al, byte [pe_dos_header]
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
loopne 0x1001b9e6
add byte [eax], al
push eax
pop es
add byte [eax], al
push es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], bl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sbb byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
nop
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
cmp eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
js 0x1001ba16
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
rol byte [eax], 1
add byte [eax], al
push ecx
pop es
add byte [eax], al
adc dword [eax], eax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push 0
or byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax], dh
or byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax], cl
or byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
lock add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push esp
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], dl
add byte [eax], al
push ebp
or byte [eax], al
add bl, ah
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
sub eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
je 0x1001ba96
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor al, 0
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
enter 0, 0
push ecx
pop es
add byte [eax], al
or eax, 0
or byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ah
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
test al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add al, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
test byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
inc esp
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add al, ch
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
or byte [eax], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pop esp
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], bl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
cwde
add byte [eax], al
add byte [edi + eax], dl
add byte [ebx], dl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jl 0x1001bb16
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp al, 0
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
fadd dword [eax]
add byte [eax], al
push edx
pop es
add byte [eax], al
pop ss
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
or byte [eax], al
add byte [eax + eax], ch
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
mov eax, 0
or byte [eax], al
add byte [eax + eax], cl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
mov word [eax], es
add byte [eax], al
add byte [eax], cl
add byte [eax], al
dec esp
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add al, bh
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push edx
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], dl
add byte [eax], al
add byte [ebp + 8], dl
add byte [eax], al
mov dword [0x53000000], eax
pop es
add byte [eax], al
and eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jb 0x1001bb96
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
les eax, [eax]
add byte [eax], al
push ecx
pop es
add byte [eax], al
or eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
bound eax, qword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
and al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
movsb byte es:[edi], byte [esi]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], al
or byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
in al, 0
add byte [eax], al
push eax
pop es
add byte [eax], al
pop es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [edx], bl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sbb al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
xchg esp, eax
add byte [eax], al
add byte [edi + eax], dl
add byte [ebx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jp 0x1001bc16
add byte [eax], al
add byte [eax], cl
add byte [eax], al
cmp al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
aam 0
add byte [eax], al
push edx
pop es
add byte [eax], al
adc eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
sub al, byte [eax]
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
mov ah, 0
add byte [eax], al
add byte [eax], cl
add byte [eax], al
or al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
mov al, byte [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
dec edx
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add ah, dh
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
add eax, 0
or byte [eax], al
add byte [esi], dl
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push ss
add byte [eax], al
add al, al
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 7], dl
add byte [eax], al
xor eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jbe 0x1001bc96
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte ss:[eax], al
add byte [eax], al
or dword [eax], eax
add ah, cl
add byte [eax], al
add byte [ecx + 7], dl
add byte [eax], al
sldt word [eax]
add byte [eax], al
or byte [eax], al
add byte [esi], ah
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte es:[eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x8000000], ch
add byte [eax], al
push es
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], al
or byte [eax], al
add byte [esi], al
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
in al, dx
add byte [eax], al
add byte [eax + 7], dl
add byte [eax], al
or dword [eax], eax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
pop esi
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], bl
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x7540000], bl
add byte [eax], al
arpl word [eax], ax
add byte [eax], al
add byte [eax], cl
add byte [eax], al
jle 0x1001bd16
add byte [eax], al
add byte [eax], cl
add byte [eax], al
add byte ds:[eax], al
add byte [eax], al
or dword [eax], eax
add ah, bl
add byte [eax], al
add byte [edx + 7], dl
add byte [eax], al
sbb eax, dword [eax]
add byte [eax], al
add byte [eax], cl
add byte [eax], al
outsb dx, byte [esi]
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], ch
add byte [eax], al
add byte [eax], al
or dword [eax], eax
add byte [eax + eax + 0x8000000], bh
add byte [eax], al
push cs
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [esi], cl
or byte [eax], al
add byte [esi], cl
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
cld
add byte [eax], al
add byte [eax + 7], ah
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
push ecx
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [ecx], dl
add byte [eax], al
add byte [ebp + 8], dl
add byte [eax], al
add dword [eax], 0
add byte [edx + 7], dl
add byte [eax], al
pop ds
add byte [eax], al
add byte [eax], al
or byte [eax], al
add byte [ecx], dh
add byte [eax], al
add byte [eax], cl
add byte [eax], al
xor dword [eax], eax
add byte [eax], al
add byte [ecx], cl
add byte [eax], al
ret 0