Function at 0x78ed9a
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0
mov bl, byte [esp + 4]
jmp 0x78d387
dec cl
setnp ah
call 0x78d451
xlatb
dec esi
fdivr qword [ebx - 0x59a02eaa]
rcl dword [eax - 0x2d]
dec edx
aas
pop edi
inc edi
je 0x78d406
jbe 0x78d419
inc eax
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
jae 0x78d425
inc eax
inc eax
push ecx
inc edx
inc ebp
aas
inc ecx
push ebp
pop edi
inc ebx
jbe 0x78d432
jbe 0x78d425
arpl word [eax + 0x40], ax
pop eax
pop edx
add byte [edi], bh
pop edi
inc edi
je 0x78d439
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x78d438
jae 0x78d412
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
jae 0x78d451
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc edx
inc esp
pop eax
pop edx
add cl, bh
cmc
pushfd
outsd dx, dword [esi]
ljmp 0x3f18
inc eax
jae 0x78d47d
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc edx
inc esp
pop eax
pop edx
add byte [edi], bh
pop edi
push esp
push 0x5f776f72
jb 0x78d48a
ja 0x78d47c
inc ebx
pop edi
jb 0x78d494
outsd dx, dword [esi]
jb 0x78d465
jae 0x78d49b
inc eax
inc eax
pop ecx
inc ecx
pop eax
dec eax
inc eax
pop edx
add byte [edi], bh
jae 0x78d499
insb byte es:[edi], dx
inc ax
push ecx
inc ebx
outsd dx, dword [esi]
jb 0x78d4a1
inc ecx
jo 0x78d4af
insb byte es:[edi], dx
imul esp, dword [ebx + 0x61], 0x6e6f6974
inc eax
inc eax
xor byte [eax + 0x41], dl
push esi
xor dword [eax + 0x41], eax
add byte [esi - 0x45], ah
cmp edi, ebp
mov bx, 0xfd3b
cld
mov ebp, 0xff89db52
xchg byte [esp + 0xf], ch
jmp 0x78d4a3
scasd eax, dword es:[edi]
mov dh, 0x3f
ja 0x78d4cd
outsd dx, dword [esi]
jne 0x78d4e1
inc eax
jae 0x78d4e4
inc eax
inc eax
xor edx, dword [esi + 0x3f]
and al, 0x62
popal
jae 0x78d4e4
arpl word [edi + 0x6f], bx
pop edi
outsd dx, dword [esi]
jae 0x78d4f4
jb 0x78d4e7
popal
insd dword es:[edi], dx
inc eax
pop edi
push edi
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d4f3
arpl word [eax + 0x61], bp
jb 0x78d4ee
je 0x78d503
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78d500
jae 0x78d4d6
pop edi
push edi
inc eax
jae 0x78d50f
inc eax
inc eax
inc eax
inc eax
xor dword [eax + 0x41], eax
inc ecx
add byte [esi - 0x75], ah
push esp
and al, 5
mov dx, word [esp + 5]
cpuid
pop word [esp + 0xc]
mov ecx, dword [esp + 0x10]
jmp 0x78d506
inc ecx
push eax
inc ecx
push esi
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6d], bp
insd dword es:[edi], dx
jo 0x78d519
xor dword [edx], esi
inc eax
pop edi
dec esi
inc eax
pop edx
add byte [ebp + 0x3f3ed7a4], dh
mov ch, 0xa4
xlatb
aas
aas
xor al, 0x3f
and al, 0x5f
pop ecx
popal
jb 0x78d55d
outsb dx, byte [esi]
inc eax
inc esp
inc eax
jae 0x78d568
je 0x78d559
inc eax
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
push eax
inc edx
inc esp
inc eax
pop edx
add byte [edi], cl
xor dword [esi - 0x43], esp
in al, 0xff
rdtsc
mov bp, 0xffe4
mov eax, edx
pop si
pop esi
mov bp, word [esp]
jmp 0x78d54b
bound ebx, qword [ebp + 0x4e5f3fec]
ja 0x78d581
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6d], bp
jo 0x78d569
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6d], bp
jo 0x78d571
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc eax
jae 0x78d5ae
inc eax
inc eax
inc ebx
inc ecx
push eax
inc ecx
push esi
xor dword [edx], esi
xor eax, dword [eax + 0x5f]
dec esi
inc eax
pop edx
add byte [ebx - 0x163ba371], bh
mov ebx, 0xe9c45c8f
call 0x78d5d8
inc dword [ebx + reloc.SHELL32.dll_ShellExecuteW]
invalid
test dword [edi - 0x3a], edx
jno 0x78d5ce
jo 0x78d5d2
jae 0x78d5ca
push 0xffffffffffffff85
aas
test dword [edi], edi
pop edi
pop eax
jb 0x78d5db
outsb dx, byte [esi]
je 0x78d5d2
imul ebp, dword [ebp + 0x65], reloc.SHELL32.dll_ShellExecuteW
insd dword es:[edi], dx
pop edi
jb 0x78d5e1
outsd dx, dword [esi]
jb 0x78d5b2
inc eax
jae 0x78d5e8
inc eax
inc eax
pop ecx
inc ecx
pop eax
push eax
inc edx
inc esp
inc eax
pop edx
add byte [0xbe4324b6], dh
pop eax
and eax, 0xad5e3bab
mov dh, 0x24
inc ebx
mov esi, 0x3bab2558
pop esi
lodsd eax, dword [esi]
dec edx
dec esi
fnstcw word [edi]
imul ebp, dword [ebp + 0x62], 0x3f406575
and al, 0x62
popal
jae 0x78d604
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78d5e1
pop edi
push edi
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d60f
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78d61c
pop edi
push edi
inc eax
jae 0x78d62b
inc eax
inc eax
inc eax
inc eax
jae 0x78d631
inc eax
inc eax
push ecx
inc ecx
inc ebp
aas
inc ecx
push esi
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
inc eax
xor al, byte [eax + 0x41]
inc eax
inc ecx
inc edx
push esi
xor esi, dword [edx]
inc eax
inc eax
pop edx
add byte [edi], cl
mov bl, 0xe5
lea ecx, [ebx + edi]
bsr di, bp
std
and eax, 0x3663dc1b
jmp 0x78d634
dec ebx
cmp byte [ebx], bl
jb 0x78d65a
jl 0x78d62e
pop edi
pop eax
imul ebp, dword [esi + 0x76], 0x64696c61
pop edi
popal
jb 0x78d663
jne 0x78d66b
outsb dx, byte gs:[esi]
je 0x78d642
jae 0x78d678
inc eax
inc eax
pop ecx
inc ecx
pop eax
push eax
inc edx
inc esp
inc eax
pop edx
add byte [edi - 0x2a], cl
inc ecx
pop edi
inc ebx
outsb dx, byte [esi]
pop edi
outsd dx, dword fs:[esi]
pop edi
bound esi, qword [edx + 0x6f]
jb 0x78d68d
popal
arpl word fs:[ecx + 0x73], sp
je 0x78d684
popal
je 0x78d687
je 0x78d692
jb 0x78d691
popal
popal
pop edi
pop edi
js 0x78d69b
imul esi, dword [eax + eax - 1], reloc.SHELL32.dll_ShellExecuteW
xlatb
je 0x78d634
push dword [esp + 9]
mov edx, edi
mov ax, bx
mov ch, byte [esp + 1]
mov eax, esi
jmp 0x78d71f
invalid
jb 0x78d69c
jae 0x78d6d2
inc eax
inc eax
pop ecx
inc ecx
pop eax
dec eax
inc eax
pop edx
add byte [ecx + 0x6d], cl
popal
inc esp
imul esi, dword [edx + 0x65], 0x726f7463
jns 0x78d6bc
outsb dx, byte [esi]
je 0x78d6ec
jns 0x78d6d0
outsd dx, dword [esi]
inc esp
popal
je 0x78d6e2
add byte [edi], bh
pop edi
dec ebp
popal
imul esp, dword [ebp + 0x6c], 0x6f
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax + 0x5f], ax
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6d], bp
insd dword es:[edi], dx
jo 0x78d6d4
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc eax
jae 0x78d711
je 0x78d702
inc eax
inc eax
inc eax
inc ebx
inc ecx
push eax
inc ecx
push esi
xor dword [edx], esi
xor eax, dword [eax + 0x41]
inc edx
push esi
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
xor eax, dword [eax + 0x48]
push eax
inc ecx
push esi
xor dword [edx], esi
xor eax, dword [eax + 0x50]
xor dh, byte [ebx]
inc eax
push eax
inc edx
push esi
xor dh, byte [ebx]
inc eax
inc eax
pop edx
add byte [edi], bh
pop edi
pop eax
outsd dx, dword [esi]
jne 0x78d742
pop edi
outsd dx, dword [esi]
pop di
jb 0x78d735
outsb dx, byte [esi]
inc eax
jae 0x78d74e
inc eax
inc eax
pop ecx
inc ecx
pop eax
push eax
inc edx
inc esp
inc eax
pop edx
add byte [esi - 0x2b], dl
inc ebp
sub al, 0xdf
aas
rol byte [esi - 0x2c], 0xb3
dec esi
mov bl, 0x4e
cmpsd dword [esi], dword es:[edi]
jb 0x78d6ef
imul ecx, dword [esi], reloc.SHELL32.dll_ShellExecuteW
sbb ebx, dword [esi - 0x57]
aas
pop edi
push edi
pop edi
inc edi
je 0x78d76f
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x78d76e
jae 0x78d748
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
jae 0x78d787
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc edx
inc edi
pop eax
pop edx
add byte [esi - 0x75], ah
insb byte es:[edi], dx
and al, 2
mov bp, word [esp + 2]
xchg cx, si
mov ah, 0x3a
push dword [esp + 9]
jmp 0x78d752
aas
ja 0x78d7a1
je 0x78d7a3
inc eax
imul ebp, dword [edi + 0x73], 0x7361625f
inc eax
jae 0x78d7a9
inc eax
jae 0x78d7bb
inc eax
inc eax
inc eax
push ecx
inc edx
inc ebp
pop edi
dec edx
pop eax
pop edx
add byte [edi - 0x41eddbb4], al
mov edi, 0x8a44b6f3
iretd
xchg dword [esp + 0x12], ecx
mov esi, 0x44b6f3bf
mov cl, bh
dec cx
xchg ch, al
jmp 0x78d9bc
inc eax
imul ebp, dword [edi + 0x73], reloc.SHELL32.dll_ShellExecuteW
inc eax
jae 0x78d7ee
inc eax
inc eax
push ecx
inc ecx
inc ebp
pop edi
dec edx
pop edi
dec edx
inc eax
pop edx
add byte [edi], bh
aas
jne 0x78d7f8
arpl word [ecx + 0x75], sp
push 0x78655f74
arpl word [ebp + 0x70], sp
je 0x78d801
outsd dx, dword [esi]
outsb dx, byte [esi]
inc eax
jae 0x78d811
inc eax
inc eax
pop ecx
inc ecx
pop edi
dec esi
pop eax
pop edx
add byte [esi + 0x12e78012], dl
and bh, 0x12
cld
adc ecx, dword [edx + reloc.SHELL32.dll_ShellExecuteW]
jae 0x78d7f6
imul ebp, dword [edi + 0x73], reloc.SHELL32.dll_ShellExecuteW
inc eax
popal
jae 0x78d823
inc eax
jae 0x78d835
inc eax
inc eax
push ecx
inc edx
inc ebp
dec eax
pop eax
pop edx
add byte [edi], bh
pop edi
pop eax
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
je 0x78d83c
pop edi
jb 0x78d84a
outsd dx, dword [esi]
jb 0x78d81b
jae 0x78d851
inc eax
inc eax
pop ecx
inc ecx
pop eax
push eax
inc edx
inc esp
inc eax
pop edx
add byte [0x673fc754], ah
outsd dx, dword [esi]
outsd dx, dword [esi]
inc eax
imul ebp, dword [edi + 0x73], 0x7361625f
bound esp, qword [ecx + 0x73]
jae 0x78d85f
inc eax
inc eax
jae 0x78d871
inc eax
inc eax
push ecx
inc edx
inc ebp
pop edi
dec esi
pop eax
pop edx
add byte [edi], bh
aas
xor dword [edi], edi
and al, 0x62
popal
jae 0x78d87a
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78d857
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d884
arpl word [eax + 0x61], bp
jb 0x78d87f
je 0x78d894
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78d8a5
inc eax
inc eax
push ebp
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [edi], bh
aas
aas
and al, 0x62
popal
jae 0x78d8ad
arpl word [edi + 0x6f], bx
jae 0x78d8bd
jb 0x78d8b0
popal
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d8bb
je 0x78d8cb
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
jae 0x78d8d6
inc eax
inc eax
inc eax
jae 0x78d8dc
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
dec ecx
inc eax
pop edx
add byte [edi], bh
pop edi
pop edi
inc ebp
js 0x78d8e1
jo 0x78d8f5
jo 0x78d8f5
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
push eax
je 0x78d8f9
inc ebx
jne 0x78d8fc
jb 0x78d8f1
outsb dx, byte [esi]
je 0x78d8d4
js 0x78d8f4
jo 0x78d908
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
pop eax
push eax
inc ecx
pop eax
inc eax
pop edx
add byte [esi + 0x79], ch
pop eax
mov ebx, 0x3f3f0d92
xor dword [edi], edi
and al, 0x62
popal
jae 0x78d91a
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], reloc.SHELL32.dll_ShellExecuteW
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78d92b
jb 0x78d91e
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d929
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc esp
inc eax
jae 0x78d944
inc eax
inc eax
inc eax
jae 0x78d94a
inc eax
inc eax
push ebp
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [edi], bh
jae 0x78d95c
outsb dx, byte [esi]
arpl word [eax + 0x3f], ax
and al, 0x62
popal
jae 0x78d955
arpl word [edi + 0x73], bx
je 0x78d963
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
jne 0x78d95d
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d965
arpl word [eax + 0x61], bp
jb 0x78d960
je 0x78d975
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc esp
inc eax
jae 0x78d980
inc eax
inc eax
inc eax
jae 0x78d986
inc eax
inc eax
dec ebp
inc ecx
inc ebp
dec eax
pop eax
pop edx
add byte [ebx + 0x26eb8c1e], bl
iretd
mov ebx, gs
iretd
inc eax
aas
and al, 0x62
popal
jae 0x78d999
arpl word [edi + 0x73], bx
je 0x78d9a7
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78d9a9
pop edi
je 0x78d9b9
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78d98c
inc esp
inc eax
jae 0x78d9c4
inc eax
inc eax
inc eax
jae 0x78d9ca
je 0x78d9bb
inc eax
inc eax
inc eax
dec ebp
inc ecx
inc ebp
pop eax
inc ecx
inc edx
push esi
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
popal
insb byte es:[edi], dx
inc eax
xor al, byte [eax + 0x40]
pop edx
add byte [edi], bh
pop edi
pop edi
inc ebp
js 0x78d9d5
jo 0x78d9e9
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
jb 0x78d9ce
je 0x78d9e7
jb 0x78d9f0
outsd dx, dword [esi]
ja 0x78d9c3
inc eax
pop ecx
inc ecx
pop eax
push eax
inc edx
pop eax
inc eax
pop edx
add dh, bh
je 0x78d97a
lea edi, [esi + ebx*4 - 0x18]
popal
int1
nop
arpl si, ax
and byte [ebx - 0x66], ah
cmc
in al, 0x3f
jb 0x78da05
jae 0x78da17
popal
je 0x78da0b
inc eax
imul ebp, dword [edi + 0x73], reloc.SHELL32.dll_ShellExecuteW
jae 0x78da0a
bound esp, qword [ecx + 0x73]
inc eax
jae 0x78da26
inc eax
inc eax
push ecx
inc edx
inc ebp
dec eax
pop eax
pop edx
add byte [edi], cl
mov esp, 0x24448bc0
pop es
bsf eax, eax
mov eax, dword [esp + 7]
mov byte [esp + 0x10], ch
insb byte es:[edi], dx
and al, 0x10
mov cx, word [esp + 0x13]
and al, 0x13
jmp 0x78db11
add dword [eax], eax
add byte [edi], dl
aas
jae 0x78da3d
outsd dx, dword [esi]
ja 0x78da45
popal
outsb dx, byte [esi]
jns 0x78da3f
inc eax
aas
and al, 0x62
popal
jae 0x78da4c
arpl word [edi + 0x73], bx
je 0x78da5a
jb 0x78da4e
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78da5c
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78da7d
inc eax
inc eax
inc eax
dec ebp
inc ecx
inc ebp
pop edi
dec edx
pop eax
pop edx
add byte [esi + 0x49], bh
call 0x6cdf4f5a
aas
jne 0x78da80
insb byte es:[edi], dx
outsd dx, dword [esi]
ja 0x78da5e
aas
and al, 0x62
popal
jae 0x78da8d
arpl word [edi + 0x73], bx
je 0x78da9b
jae 0x78da9c
jb 0x78da8f
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78da9d
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78dab2
inc eax
inc esp
inc eax
jae 0x78dab8
inc eax
inc eax
inc eax
inc eax
jae 0x78dabe
inc eax
inc eax
dec ebp
inc ecx
inc ebp
dec eax
pop eax
pop edx
add byte [edi + 0x54], dl
push ebx
push ecx
jne 0x78dabf
jb 0x78dad5
push ebx
jae 0x78dad3
jae 0x78dad3
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
jb 0x78dad6
popal
je 0x78dad5
outsd dx, dword [esi]
outsb dx, byte [esi]
push edi
add byte [ebx], cl
mov byte [0x555f3fdd], al
outsb dx, byte [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ebx + 0x40], bp
aas
and al, 0x62
popal
jae 0x78daeb
arpl word [edi + 0x73], bx
je 0x78daf9
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dafb
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78db10
jae 0x78dade
inc eax
inc esp
inc eax
jae 0x78db16
inc eax
inc eax
inc eax
jae 0x78db1c
inc eax
inc eax
push ebp
inc ecx
inc ebp
pop eax
pop eax
pop edx
add byte [edi + 0x69], dl
outsb dx, byte [esi]
dec eax
je 0x78db2c
push edi
imul ebp, dword [esi + 0x48], 0x41707474
jo 0x78dafb
push edx
jno 0x78db35
jno 0x78db35
jne 0x78db26
jae 0x78db37
jae 0x78db37
dec eax
popal
jb 0x78db3d
add byte [esi], ah
scasb al, byte es:[edi]
cmp al, 0x5b
mov dh, 0x62
aas
push es
mov cl, 0x3f
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ebx + 0x40], bp
aas
and al, 0x62
popal
jae 0x78db4a
arpl word [edi + 0x73], bx
je 0x78db58
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc ax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78db5a
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78db3d
inc esp
inc eax
jae 0x78db75
inc eax
inc eax
inc eax
jae 0x78db7b
inc eax
inc eax
push ebp
inc ecx
inc ebp
pop eax
pop eax
pop edx
add byte [esi + 0xf], ah
stosd dword es:[edi], eax
retf 0x990f
bts dx, cx
setns dl
pop dword [esp + 0xc]
cdq
ret 0x448f
jmp 0x78dd7d
push edi
imul ebp, dword [esi + 0x48], 0x51707474
je 0x78db9e
push ecx
jne 0x78db96
jb 0x78dbac
inc esp
popal
je 0x78db98
inc ecx
jbe 0x78db9b
imul ebp, dword [ecx + 0x62], reloc.SHELL32.dll_ShellExecuteW
aas
js 0x78dbb8
bound ebp, qword [ebp]
invalid
je 0x78dbb7
inc eax
aas
and al, 0x62
popal
jae 0x78dbb9
arpl word [edi + 0x73], bx
je 0x78dbc7
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc ax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dbc9
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dbea
je 0x78dbdb
inc eax
inc eax
inc eax
dec ebp
inc ecx
inc ebp
pop edi
dec edx
push eax
inc ecx
inc esp
pop edi
dec edx
inc eax
pop edx
add byte [edi + 0x65], al
je 0x78dbd0
imul ebp, dword [ebp + 0x56], reloc.SHELL32.dll_ShellExecuteW
outsd dx, dword [esi]
outsb dx, byte [esi]
dec ecx
outsb dx, byte [esi]
outsw dx, word [esi]
push ebx
imul edi, dword [edx + 0x65], 0x99120057
push edi
add byte [edx], dl
cdq
adc bl, byte [ecx + 0x769b6809]
je 0x78dba0
or dword [eax - 0x65], ebp
jbe 0x78dc19
cli
push 0x5b14fa0f
mov dl, 0xad
lodsd eax, dword [esi]
aas
aas
xor dword [edi], edi
and al, 0x62
popal
jae 0x78dc1f
arpl word [edi + 0x73], bx
pop edi
jae 0x78dc2e
je 0x78dc2d
jb 0x78dc21
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dc2f
jb 0x78dc2a
je 0x78dc3f
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78dc12
inc esp
inc eax
jae 0x78dc4a
inc eax
inc eax
inc eax
jae 0x78dc50
je 0x78dc41
inc eax
inc eax
inc eax
push ebp
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [edx + 0x6c], al
jne 0x78dc4f
je 0x78dc5b
outsd dx, dword [esi]
je 0x78dc57
inc esi
imul ebp, dword [esi + 0x64], 0x69766544
arpl word [ebp + 0x43], sp
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x78dc63
add byte [ecx + 0x46cbac3e], dh
movsb byte es:[edi], byte [esi]
adc dword [ebx], reloc.SHELL32.dll_ShellExecuteW
push ss
add dword [eax + 0x3f], 0x75707378
je 0x78dc83
jne 0x78dc88
outsb dx, byte [esi]
inc eax
aas
and al, 0x62
popal
jae 0x78dc85
arpl word [edi + 0x73], bx
je 0x78dc93
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dc95
popal
jb 0x78dc90
je 0x78dca5
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dcb6
je 0x78dca7
inc eax
inc eax
inc eax
dec ebp
inc ecx
inc ebp
pop edi
dec edx
push eax
inc edx
inc esp
pop edi
dec edx
inc eax
pop edx
add byte [edi], bh
aas
xor byte [edi], bh
and al, 0x62
popal
jae 0x78dcc4
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x74736f69
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78dcd5
jb 0x78dcc8
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dcd3
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dcf4
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc eax
push eax
inc ecx
push esi
aas
and al, 0x62
popal
jae 0x78dcf9
arpl word [edi + 0x73], bx
je 0x78dd07
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dd09
je 0x78dd19
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
xor dword [eax + 0x40], eax
inc eax
pop edx
add byte [ebx], al
mov edx, 0x7465733f
bound esi, qword [ebp + 0x66]
inc eax
aas
and al, 0x62
popal
jae 0x78dd32
imul esp, dword [ebx + 0x5f], reloc.SHELL32.dll_ShellExecuteW
popal
arpl word [edi + 0x73], bx
je 0x78dd40
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
jne 0x78dd3a
inc ax
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dd42
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dd63
inc eax
inc eax
dec ebp
inc ecx
inc ebp
push eax
inc ecx
push esi
xor dword [edx], esi
inc eax
push eax
xor al, byte [eax + 0x50]
inc ecx
inc esp
pop edi
dec edx
inc eax
pop edx
add byte [edi], bh
imul bp, word [esp + ebp*2 + 0x40], 0x243f
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x40736f69
insb byte es:[edi], dx
inc eax
aas
and al, 0x62
popal
jae 0x78dd78
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78dd55
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dd82
arpl word [eax + 0x61], bp
jb 0x78dd7d
je 0x78dd92
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dda3
inc eax
inc eax
push ecx
inc edx
inc ebp
inc esp
pop eax
pop edx
add byte [edx + 0x1fec8515], bl
invalid
adc eax, 0xfe1fec85
adc al, 0x86
adc al, 0x73
xchg byte [ebx + esi*2], dl
jae 0x78dcd2
mov gs, word [edi + esi*4 - 0x62]
insb byte es:[edi], dx
mov bh, 0x9e
jmp 0x3fb88854
imul ebp, dword [edi + 0x73], reloc.SHELL32.dll_ShellExecuteW
and al, 0x63
push 0x745f7261
jb 0x78ddc6
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dde7
inc eax
inc eax
dec ecx
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [ebp - 0x95c44b], cl
lea esi, reloc.SHELL32.dll_ShellExecuteW
cmc
push ebp
xchg word [esp + 8], dx
xchg dword [esp + 9], ebx
jmp 0x78de9a
ret 0x6c42
jae 0x78de19
push edx
popal
imul ebp, dword fs:[edi], reloc.SHELL32.dll_ShellExecuteW
aas
jae 0x78de17
je 0x78de27
je 0x78de17
je 0x78de1d
inc eax
aas
and al, 0x62
popal
jae 0x78de28
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78de05
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78de32
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78de53
inc eax
inc eax
push ecx
inc ecx
inc ebp
pop eax
dec eax
pop edi
dec esi
inc eax
pop edx
add byte [edi], bh
pop edi
push eax
outsb dx, byte [esi]
imul ebp, dword [esi + 0x63], 0x62243f40
popal
jae 0x78de63
arpl word [edi + 0x73], bx
je 0x78de71
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78de73
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
jae 0x78de8e
je 0x78de7f
inc eax
inc eax
inc eax
inc eax
jae 0x78de94
inc eax
inc eax
dec ecx
inc ecx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [eax - 0x2f], al
inc ecx
and bl, dl
cmp al, dl
push ebx
retf 0x723f
rcl byte [ebx - 0x36]
aas
jb 0x78de9c
bound esi, qword [ebp + 0x66]
inc eax
aas
and al, 0x62
popal
jae 0x78deab
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78de88
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78deb5
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78ded6
inc eax
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc ecx
push esi
aas
and al, 0x62
popal
jae 0x78deda
arpl word [edi + 0x73], bx
je 0x78dee8
jae 0x78dee9
jb 0x78dedc
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78deea
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
jae 0x78df05
inc eax
inc eax
inc eax
xor al, byte [eax + 0x58]
pop edx
add byte [ebp + 0x44882a3c], cl
and al, 8
lea edi, [edx + ebp]
mov byte [esp + 8], al
sub cl, byte [eax - 0x76f7dbbc]
je 0x78dec8
mov dword [esp + 5], esi
add esp, 0
jmp 0x78df8c
add eax, 0xe900c483
fild word [eax]
add byte [eax], al
xchg esp, eax
pop es
aas
jae 0x78df18
je 0x78df25
inc eax
aas
and al, 0x62
popal
jae 0x78df25
arpl word [edi + 0x73], bx
je 0x78df33
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78df35
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78df18
inc esp
inc eax
jae 0x78df50
inc eax
inc eax
inc eax
jae 0x78df56
inc eax
inc eax
dec ecx
inc ecx
inc ebp
pop eax
push eax
inc ecx
inc esp
xor byte [eax], dh
inc eax
pop edx
add byte [edx + 0x6c], al
jne 0x78df5a
je 0x78df66
outsd dx, dword [esi]
je 0x78df62
inc esi
imul ebp, dword [esi + 0x64], 0x7478654e
inc esp
jbe 0x78df6f
imul esp, dword [ebx + 0x65], reloc.SHELL32.dll_ShellExecuteW
lds esi, [ebx + edx*4]
arpl word [ebp], sp
mov esp, 0x34c5a22c
xchg ebx, eax
mov ecx, 0x5f575f3f
inc edi
je 0x78df7c
popal
jns 0x78df8e
inc eax
pop edi
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6e], bp
outsw dx, word [esi]
inc eax
jae 0x78df9b
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc edx
inc edi
pop eax
pop edx
add byte [edx + 0x6c], al
inc edx
insb byte es:[edi], dx
jne 0x78df9c
je 0x78dfa8
outsd dx, dword [esi]
je 0x78dfa4
inc esi
imul ebp, dword [esi + 0x64], 0x73726946
je 0x78df8a
jbe 0x78dfb2
arpl word [ebp], sp
cwde
aas
jo 0x78dfc1
jo 0x78dfc6
je 0x78dfc5
jb 0x78df94
inc eax
aas
and al, 0x62
popal
jae 0x78dfc3
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x65727473
popal
arpl word [edi + 0x73], bx
je 0x78dfd1
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78dfd3
je 0x78dfe3
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78dff4
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [ebp - 0x7699e5cc], cl
lea esi, [edx + ebx]
mov word [esp + 6], di
sbb ah, byte [esi - 0x77]
jl 0x78dfb7
push es
push dword [esp + 3]
mov bh, byte [esp + 0x17]
pop ss
jmp 0x78dfe3
je 0x78e00e
inc eax
aas
and al, 0x62
popal
jae 0x78e017
arpl word [edi + 0x73], bx
je 0x78e025
jb 0x78e019
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
jne 0x78e01f
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e027
jb 0x78e022
je 0x78e037
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e048
je 0x78e039
inc eax
inc eax
inc eax
dec ecx
inc ecx
inc ebp
pop eax
push eax
inc ecx
inc esp
xor byte [eax], dh
inc eax
pop edx
add byte [esi - 0x3f], ah
rol dword [esi], 0xff
je 0x78e00e
rol cx, 6
push dword [esp + 6]
push es
pushal
lea esp, [esp + 0x41]
bswap eax
call 0x78e12f
das
add dword [eax], eax
add byte [edi], ch
aas
bound esp, qword gs:[ecx + 0x63]
imul eax, dword [eax + 0x3f], 0x24
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x65727473
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e07f
jb 0x78e07a
je 0x78e08f
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78e094
inc eax
inc esp
inc eax
jae 0x78e09a
je 0x78e08b
inc eax
inc eax
inc eax
inc eax
jae 0x78e0a0
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [ecx], ah
aas
jo 0x78e0b1
jb 0x78e07f
aas
and al, 0x62
popal
jae 0x78e0ae
arpl word [edi + 0x73], bx
je 0x78e0bc
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e0be
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e0df
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [edx + 0x6c], al
jne 0x78e0e0
je 0x78e0ec
je 0x78e0ec
outsd dx, dword [esi]
je 0x78e0e8
push 0x646e6946
push edx
popal
imul ebp, dword fs:[edi + 0x43], 0x65736f6c
inc esi
imul ebp, dword [esi + 0x64], 0x69646152
outsd dx, dword [esi]
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x78e0f3
add byte [ebx - 0x1e], dh
jae 0x78e073
jo 0x78e0aa
loop 0x78e0a8
adc esi, dword [edi + reloc.SHELL32.dll_ShellExecuteW]
mov bh, 0x27
mov bh, 0xd2
and dword [edx + reloc.SHELL32.dll_ShellExecuteW], ebx
jae 0x78e107
lcall 0x6673, 0x4f5f3fda
js 0x78e0e3
js 0x78e0e3
aas
and al, 0x62
popal
jae 0x78e112
imul esp, dword [ebx + 0x5f], reloc.SHELL32.dll_ShellExecuteW
popal
arpl word [edi + 0x6f], bx
pop edi
outsd dx, dword [esi]
jae 0x78e122
jb 0x78e115
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e120
je 0x78e130
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e141
inc eax
inc eax
push ecx
inc ecx
inc ebp
pop eax
pop eax
pop edx
add byte [edi + 0x64], al
imul esi, dword [eax + 0x4c], 0x4964616f
dec ecx
insd dword es:[edi], dx
popal
inc esi
inc esi
jb 0x78e156
insd dword es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x49], 0x35004d43
aas
jo 0x78e164
dec ecx
inc ebx
dec ebp
add byte [0x7470703f], dh
jo 0x78e169
je 0x78e168
jb 0x78e137
inc eax
aas
and al, 0x62
popal
jae 0x78e166
arpl word [edi + 0x73], bx
je 0x78e174
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc ax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e176
je 0x78e186
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e197
je 0x78e188
inc eax
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [edx - 0x16fddb8c], cl
je 0x78e156
add ch, cl
add eax, dword cs:[eax]
add byte [ecx], dh
cmpsb byte [esi], byte es:[edi]
xor al, 0x53
scasb al, byte es:[edi]
pop es
inc ecx
fisttp dword [ebx + 0x2e]
invalid
invalid
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e1c3
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e1a6
inc esp
inc eax
jae 0x78e1de
je 0x78e1cf
inc eax
inc eax
inc eax
inc eax
jae 0x78e1e4
inc eax
inc eax
push ecx
inc edx
inc ebp
push eax
inc ecx
push esi
aas
and al, 0x62
popal
jae 0x78e1e8
arpl word [edi + 0x6f], bx
jae 0x78e1f8
jb 0x78e1eb
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e1f6
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e1d9
inc esp
inc eax
jae 0x78e211
inc eax
inc eax
inc eax
xor al, byte [eax + 0x58]
pop edx
add byte [edi + 0x64], al
imul esi, dword [eax + 0x43], 0x74616572
inc edi
imul esi, dword fs:[eax + 0x43], 0x74616572
inc esi
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x78e1fb
popal
insd dword es:[edi], dx
imul ebp, dword [ecx + edi*2 + 0x46], 0x4e6d6f72
popal
insd dword es:[edi], dx
add byte gs:[ecx + 0x67653f28], cl
jo 0x78e23e
mov dword [eax], ebp
aas
jo 0x78e23e
jb 0x78e20c
aas
and al, 0x62
popal
jae 0x78e23b
arpl word [edi + 0x73], bx
je 0x78e249
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
popal
jb 0x78e246
je 0x78e25b
jb 0x78e24b
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
je 0x78e260
inc eax
inc esp
inc eax
jae 0x78e266
inc eax
inc eax
inc eax
jae 0x78e26c
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [edi + 0x64], al
imul esi, dword [eax + 0x47], 0x65477465
outsb dx, byte [esi]
outsb dx, byte gs:[esi]
jb 0x78e27a
arpl word [esi + 0x6f], ax
outsb dx, byte [esi]
je 0x78e25d
popal
insd dword es:[edi], dx
imul ebp, dword [ecx + edi*2 + 0x53], 0x53736e61
jb 0x78e28d
add byte [edi + ecx*8 + 0x5f], bl
cmp cl, cl
jle 0x78e227
iretd
pushal
not byte [ecx + 0x6c1dd760]
jg 0x78e275
aas
xor byte [edi], bh
and al, 0x62
popal
jae 0x78e2a7
arpl word [edi + 0x73], bx
je 0x78e2b5
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e2b7
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc esp
inc eax
jae 0x78e2d2
je 0x78e2c3
inc eax
inc eax
inc eax
inc eax
jae 0x78e2d8
inc eax
inc eax
dec ecx
inc ecx
inc ebp
inc eax
pop eax
pop edx
add byte [edi + 0x64], al
imul esi, dword [eax + 0x53], 0x65547465
js 0x78e2ed
push esp
js 0x78e2ed
push edx
outsb dx, byte gs:[esi]
jb 0x78e2e9
outsb dx, byte [esi]
dec eax
imul ebp, dword [esi + 0x74], 0x5ac45f00
cmp eax, 0x71eb65cc
loope 0x78e211
jmp 0x78e300
jae 0x78e259
jmp 0x78e307
jae 0x78e312
arpl word [edi + 0x73], bx
je 0x78e320
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e322
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e305
inc esp
inc eax
jae 0x78e33d
inc eax
inc eax
inc eax
jae 0x78e343
inc eax
inc eax
push ecx
inc ecx
inc ebp
pop edi
dec edx
push eax
inc edx
inc esp
pop edi
dec edx
inc eax
pop edx
add byte [edi + 0x5f], bl
jae 0x78e357
pop edi
js 0x78e34b
jo 0x78e35f
jo 0x78e35f
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
je 0x78e366
outsb dx, byte [esi]
pop edi
jae 0x78e367
jb 0x78e364
outsd dx, dword [esi]
jns 0x78e2f7
test al, 0x36
movsb byte es:[edi], byte [esi]
ret
aas
jae 0x78e373
jne 0x78e379
arpl word [eax + 0x3f], ax
aas
and al, 0x62
popal
jae 0x78e376
arpl word [edi + 0x73], bx
je 0x78e384
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e386
jb 0x78e381
je 0x78e396
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e3a7
inc eax
inc eax
push ecx
inc ecx
inc ebp
dec eax
inc esp
inc eax
pop edx
add byte [edi + 0x65], bl
js 0x78e3a5
jo 0x78e3b9
jo 0x78e3b9
pop edi
push 0x6c646e61
jb 0x78e382
pop edi
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
add byte [eax + 0x363f3f9b], bh
aas
wait
aas
aas
aas
and al, 0x62
popal
jae 0x78e3ca
arpl word [edi + 0x6f], bx
jae 0x78e3da
jb 0x78e3cd
popal
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e3d8
pop edi
je 0x78e3e8
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e3bb
inc esp
inc eax
jae 0x78e3f3
inc eax
inc eax
inc eax
jae 0x78e3f9
je 0x78e3ea
inc eax
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
push eax
inc ecx
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
inc eax
pop edx
inc eax
pop edx
add byte [edi + 0x5f], bl
pop edi
pop edi
jae 0x78e41d
imul ebp, dword fs:[edi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
outsd dx, dword [esi]
outsb dx, byte [esi]
pop edi
jbe 0x78e41c
jo 0x78e42a
imul ebp, dword [esi + 0x74], reloc.SHELL32.dll_ShellExecuteW
outsb dx, byte [esi]
je 0x78e422
add dl, dh
add dl, dh
aas
aas
aas
and al, 0x62
popal
jae 0x78e430
arpl word [edi + 0x6f], bx
jae 0x78e440
jb 0x78e433
popal
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e43e
jb 0x78e439
je 0x78e44e
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e45f
je 0x78e450
inc eax
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor byte [ecx], dh
inc eax
dec ebx
inc eax
pop edx
add byte [edi + 0x5f], bl
jae 0x78e473
pop edi
je 0x78e47c
jo 0x78e46a
pop edi
imul ebp, dword [esi + 0x66], 0x65645f6f
jae 0x78e483
jb 0x78e480
jns 0x78e472
insb byte es:[edi], dx
imul esi, dword [ebx + 0x74], 0xfd6ded00
test byte [edi - 0x5f], dh
ja 0x78e3bf
mov eax, dword [reloc.SHELL32.dll_ShellExecuteW]
std
jle 0x78e40d
mov eax, dword [esi - reloc.SHELL32.dll_ShellExecuteW]
aas
jo 0x78e48c
xchg byte [eax - 0x31], ah
push esi
sar dword [edi], 0x70
bound esp, qword [ecx + 0x73]
inc eax
popal
jae 0x78e492
inc eax
aas
and al, 0x62
popal
jae 0x78e49d
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], reloc.SHELL32.dll_ShellExecuteW
popal
arpl word [edi + 0x73], bx
je 0x78e4ab
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc ax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e4ad
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e490
inc esp
inc eax
jae 0x78e4c8
inc eax
inc eax
inc eax
jae 0x78e4ce
inc eax
inc eax
dec ecx
inc edx
inc ebp
push eax
inc ecx
inc esp
pop eax
pop edx
add byte [ebp - 0x77fddb9c], cl
sub al, 0x24
mov byte [esp], ch
mov bx, di
setl bl
ret
xchg dx, cx
jmp 0x78e54d
aas
insb byte es:[edi], dx
jne 0x78e4f4
jae 0x78e4ea
push 0x62243f40
inc eax
aas
and al, 0x62
popal
jae 0x78e4f2
arpl word [edi + 0x6f], bx
jae 0x78e502
jb 0x78e4f5
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e500
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e521
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor dword [edx], esi
inc eax
pop eax
pop edx
add byte [edi], bh
jo 0x78e534
je 0x78e501
aas
and al, 0x62
popal
jae 0x78e530
arpl word [edi + 0x6f], bx
pop edi
outsd dx, dword [esi]
jae 0x78e540
jb 0x78e533
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e53e
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78e55f
je 0x78e550
inc eax
inc eax
inc eax
push ecx
inc ecx
inc ebp
inc ecx
inc ecx
push esi
xor dword [edx], esi
inc eax
inc esp
xor al, byte [eax + 0x44]
inc eax
pop edx
add byte [ecx - 0x39], al
push edi
xor al, cl
stc
stc
js 0x78e4f2
mov dword [eax - 0x66], edi
aad 0x44
neg esi
sub dword [eax + 0x3f], ecx
jae 0x78e575
je 0x78e582
inc eax
aas
and al, 0x62
popal
jae 0x78e582
arpl word [edi + 0x73], bx
je 0x78e590
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e592
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
jae 0x78e575
inc eax
inc esp
inc eax
jae 0x78e5ad
inc eax
inc eax
inc eax
jae 0x78e5b3
je 0x78e5a4
inc eax
inc eax
inc eax
dec ecx
inc ecx
inc ebp
pop eax
push eax
inc ecx
inc esp
xor byte [eax + 0x5a], al
add byte [esi + 0xf], ah
mov ebp, 0xbfd8f6fb
cld
stosb byte es:[edi], al
and byte [edx], bh
bsr di, bx
sti
neg al
mov edi, 0x3a20aafc
mov di, bx
rcl cl, cl
jmp 0x78e57f
jmp 0x78e563
pop edi
pop edi
arpl word [ebp + 0x72], si
jb 0x78e5cf
outsb dx, byte [esi]
je 0x78e5cc
js 0x78e5d3
jo 0x78e5e7
imul ebp, dword [edi + 0x6e], reloc.SHELL32.dll_ShellExecuteW
outsb dx, byte [esi]
pop edi
arpl word [edi + 0x6e], bp
je 0x78e5e1
js 0x78e5f2
add byte [ebx - 0x3c6cf03a], cl
mov eax, esi
setae bl
xchg ebx, eax
ret
cpuid
xchg byte [esp], ch
mov word [esp], ax
xchg edi, eax
jmp 0x78e5b5
pop ds
xchg cx, ax
xchg ecx, eax
adc byte [ebx + 0x2d697061], dl
insd dword es:[edi], dx
jae 0x78e5c9
ja 0x78e607
outsb dx, byte [esi]
sub eax, 0x2d747263
jae 0x78e61a
imul ebp, dword fs:[edi + 0x2d], reloc.SHELL32.dll_ShellExecuteW
sub eax, 0x6c642e30
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
insb byte es:[edi], dx
add byte [ebx - 0x7699e114], al
jl 0x78e5e0
sub esp, 0x1e
mov word [esp + 0x17], di
pop ss
bswap ebx
lea ecx, [ebx + edi]
pop esi
jmp 0x78e62c
out dx, al
stc
pop edi
pop edi
jae 0x78e643
imul ebp, dword fs:[edi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
pop edi
jbe 0x78e64f
jo 0x78e650
imul ebp, dword [esi + 0x74], reloc.SHELL32.dll_ShellExecuteW
je 0x78e648
pop di
pop edi
jae 0x78e5e5
fcomp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
mov bl, 0x3e
mov edi, 0x27b94a2f
enter 0x5aaf, 0xffffffffffffffb3
mov edi, 0x27b94a2f
adc cl, byte [ebp + 0x756f633f]
lea edi, [edi]
arpl word [edi + 0x75], bp
je 0x78e639
jae 0x78e66f
inc eax
inc eax
xor edx, dword [esi + 0x3f]
and al, 0x62
popal
jae 0x78e66f
arpl word [edi + 0x6f], bx
pop edi
outsd dx, dword [esi]
jae 0x78e67f
jb 0x78e672
popal
insd dword es:[edi], dx
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e67d
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
xor dword [eax + 0x41], eax
add byte [edi + 0xf092444], cl
mov byte [0x509dd981], al
cdq
mov dh, 0xf8
pop dword [esp + 9]
cpuid
sbb ecx, 0xb699509d
clc
jmp 0x78e7a0
pop edi
jae 0x78e6ba
imul ebp, dword fs:[edi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
imul ebp, dword [edi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
outsd dx, dword [esi]
pop edi
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
pop edi
jbe 0x78e6c6
ja 0x78e6c5
jb 0x78e6c0
outsb dx, byte [esi]
je 0x78e6c0
add byte [ecx + 0x70], ah
imul ebp, dword [reloc.SHELL32.dll_ShellExecuteW], 0x632d6e69
jb 0x78e6dd
sub eax, 0x69727473
outsb dx, byte [esi]
sub eax, 0x312d316c
sub eax, 0x6c642e30
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [esi + 0x22d7b022], ah
int3
and dh, byte [eax - 0x1b33dd29]
not dword [bp + si - reloc.SHELL32.dll_ShellExecuteW]
sbb dh, byte [ebp + 0x64]
xchg edi, eax
xlatb
and cl, ah
in al, 0x67
not dword [edx + reloc.SHELL32.dll_ShellExecuteW]
xchg edi, eax
pop edi
pop edi
jae 0x78e704
imul ebp, dword fs:[edi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
outsd dx, dword [esi]
outsb dx, byte [esi]
pop edi
jbe 0x78e710
jo 0x78e711
imul ebp, dword [esi + 0x74], reloc.SHELL32.dll_ShellExecuteW
outsb dx, byte [esi]
jbe 0x78e70a
insb byte es:[edi], dx
imul esp, dword [edi + ebx*2 + 0x70], 0x6d617261
je 0x78e71a
jb 0x78e716
outsb dx, byte [esi]
outsd dx, dword [esi]
imul ebp, dword [esi + 0x66], 0x7cf6006f
outsb dx, byte [esi]
outsw dx, word [esi]
add dh, dh
jl 0x78e6d3
adc dh, byte [ebp - 0x7c]
jne 0x78e647
ror byte [ecx - 0x27], 0xb8
dec ebx
out dx, al
push 0x6765725f
imul esi, dword [ebx + 0x74], 0x745f7265
dec ecx
fnstcw word [eax + 0x5f68ee4b]
jb 0x78e733
imul esi, dword [bp + di + 0x74], reloc.SHELL32.dll_ShellExecuteW
jb 0x78e734
je 0x78e73f
push 0x64616572
pop edi
jb 0x78e73e
popal
pop edi
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
pop edi
js 0x78e74a
pop edi
popal
je 0x78e74e
js 0x78e754
je 0x78e74c
arpl word [ecx + 0x6c], sp
insb byte es:[edi], dx
bound esp, qword [ecx + 0x63]
imul eax, dword [eax], 0x5f
imul ebp, dword [esi + 0x76], 0x64696c61
pop edi
jo 0x78e762
jb 0x78e764
insd dword es:[edi], dx
je 0x78e76c
jb 0x78e768
outsb dx, byte [esi]
outsd dx, dword [esi]
imul ebp, dword [esi + 0x66], 0x6f6e5f6f
outsb dx, byte [esi]
outsd dx, dword [esi]
jb 0x78e779
je 0x78e78b
jb 0x78e786
add byte [ecx + 0x9fa9f0f], al
ret
setg dl
or ebx, eax
sub dword [eax + reloc.SHELL32.dll_ShellExecuteW], esp
pop ebp
popal
jo 0x78e792
sub eax, 0x772d736d
imul ebp, dword [esi + 0x2d], 0x2d747263
je 0x78e762
sub eax, 0x746e7572
imul ebp, dword [ebp + 0x65], 0x2d316c2d
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
jb 0x78e7ac
outsb dx, byte [esi]
je 0x78e7a3
insd dword es:[edi], dx
sub eax, 0x312d316c
sub eax, 0x6c642e30
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
sub eax, 0x2e302d31
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x69], bl
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
pop edi
je 0x78e7b7
popal
insb byte es:[edi], dx
imul edi, dword [edx + 0x65], 0x72616e5f
jb 0x78e7c8
outsb dx, byte [esi]
popal
jb 0x78e7ca
outsd dx, dword [esi]
ja 0x78e7ba
outsb dx, byte gs:[esi]
jbe 0x78e7c8
jb 0x78e7d0
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
je 0x78e767
lodsb al, byte [esi]
aas
ja 0x78e7d4
outsb dx, byte gs:[esi]
outsb dx, byte gs:[esi]
inc eax
aas
and al, 0x62
popal
jae 0x78e7de
arpl word [edi + 0x69], bx
outsd dx, dword [esi]
jae 0x78e7bb
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78e7e8
popal
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc esp
inc eax
jae 0x78e803
inc eax
inc eax
inc eax
jae 0x78e809
inc eax
inc eax
push ecx
inc edx
inc ebp
inc esp
inc esp
inc eax
pop edx
add byte [esi - 0x48fadb9c], al
adc al, 0x66
pop esi
xchg byte [esp + 5], ah
mov bh, 0x14
pop si
add eax, 0x5e6614b7
call 0x78e813
mov bl, 0x43
sal dword [esi + reloc.SHELL32.dll_ShellExecuteW], cl
add byte [ebx + 0x45b6d343], dh
lodsd eax, dword [esi]
xchg byte [ecx], dh
xor byte [ecx + 0x70], ah
imul ebp, dword [reloc.SHELL32.dll_ShellExecuteW], 0x632d6e69
jb 0x78e838
jo 0x78e822
sub eax, 0x772d736d
imul ebp, dword [esi + 0x2d], 0x2d747263
insd dword es:[edi], dx
jae 0x78e7ea
ja 0x78e828
outsb dx, byte [esi]
sub eax, 0x2d747263
sub eax, 0x61636f6c
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
popal
insb byte es:[edi], dx
sub eax, 0x312d316c
sub eax, 0x6c642e30
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x70], ah
imul ebp, dword [reloc.SHELL32.dll_ShellExecuteW], 0x632d6e69
jb 0x78e859
ja 0x78e849
outsb dx, byte [esi]
sub eax, 0x2d747263
arpl word [edi + 0x6e], bp
sub eax, 0x766e6f63
outsb dx, byte [esi]
jbe 0x78e850
jb 0x78e861
jb 0x78e861
sub eax, 0x312d316c
sub eax, 0x6c642e30
insb byte es:[edi], dx
add byte [edi + 0x72], bl
imul esi, dword gs:[bp + di + 0x74], 0x6f5f7265
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x78e871
je 0x78e869
pop edi
jne 0x78e87b
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [edx - 0xeddb94], cl
je 0x78e83e
add cl, byte [ebp - 0x14f9db9c]
pop esp
mov bh, 0x27
mov bh, 0x27
inc edx
mov cl, 0x5d
sub al, byte [ebp + 0x61]
inc ebp
popal
jo 0x78e895
sub eax, 0x772d736d
imul ebp, dword [esi + 0x2d], 0x2d747263
je 0x78e8a3
insd dword es:[edi], dx
sub eax, 0x312d316c
sub eax, 0x6c642e30
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x6c], bl
insb byte es:[edi], dx
imul esp, dword [edx + 0x6d], reloc.SHELL32.dll_ShellExecuteW
xor bl, byte [edi + 0x6c]
xor bl, byte gs:[edi + 0x6c]
outsd dx, dword [esi]
pop edi
jo 0x78e8cb
arpl word gs:[ecx + 0x73], bp
add ah, dh
out 0xe, eax
push cs
cdq
clc
pop edi
imul ebp, dword [esi + 0x69], 0x6c616974
imul edi, dword [edx + 0x65], 0x656e6f5f
js 0x78e8de
imul esp, dword [ecx + 0x6c], reloc.SHELL32.dll_ShellExecuteW
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x78e8de
je 0x78e8d6
je 0x78e8da
bound ebp, qword [ebp]
mov dx, 0xf098
and ecx, edi
mov ax, 0xcc43
xchg ebx, eax
not ebp
cpuid
jmp 0x78e8b8
add byte gs:[esi - 0x46], ah
cwde
invalid
imul ebp, dword [reloc.SHELL32.dll_ShellExecuteW], 0x632d6e69
jb 0x78e915
sub eax, 0x656c6966
jae 0x78e921
imul ebp, dword [ebp + 0x73], reloc.SHELL32.dll_ShellExecuteW
insd dword es:[edi], dx
jae 0x78e91e
insd dword es:[edi], dx
sub eax, 0x312d316c
sub eax, 0x6c642e30
insb byte es:[edi], dx
add dh, dh
aam 0x92
not ah
xchg edx, eax
mov eax, 0x896f0212
mov cl, 0x8e
bswap ebp
add esp, 6
jmp 0x78e915
rol byte [ebx + 0x6970613a], 0x2d
insd dword es:[edi], dx
jae 0x78e902
ja 0x78e940
imul ebp, dword [esi + 0x2d], reloc.SHELL32.dll_ShellExecuteW
outsb dx, byte [esi]
sub eax, 0x2d747263
jb 0x78e950
sub eax, 0x6874616d
insd dword es:[edi], dx
popal
je 0x78e949
sub eax, 0x312d316c
sub eax, 0x6c642e30
sub eax, 0x2e302d31
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [0x691e3784], dl
mov byte [ecx + 0x70], ah
imul ebp, dword [reloc.SHELL32.dll_ShellExecuteW], 0x632d6e69
jb 0x78e975
sub eax, 0x6c697475
imul esi, dword [ecx + edi*2 + 0x2d], 0x312d316c
sub eax, 0x6c642e30
jne 0x78e978
imul ebp, dword [ecx + ebp*2 + 0x74], reloc.SHELL32.dll_ShellExecuteW
sub eax, 0x2e302d31
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx - 0x40424a18], cl
mov al, 0xf4
jmp 0x78e8e4
mov ebp, eax
mov ch, 0xbd
mov edi, 0xc6ebf4b0
lea esp, [esp + 5]
jmp 0x78e97b
add eax, 0xaf2557eb
aas
pop edx
test eax, 0x6c5f425c
imul esp, dword [edx + 0x6d], 0x6573735f
xor bl, byte [edi + 0x73]
jno 0x78e9ab
je 0x78e99a
jo 0x78e9af
arpl word gs:[ecx + 0x73], bp
add byte gs:[edi + 0x6c], bl
jae 0x78e9a7
add byte [edi + 0x6c], bl
imul esp, dword [edx + 0x6d], reloc.SHELL32.dll_ShellExecuteW
xor bl, byte [edi + 0x73]
jae 0x78e9be
xor bl, byte gs:[edi + 0x73]
imul ebp, dword [esi + 0x5f], reloc.SHELL32.dll_ShellExecuteW
imul esi, dword [ebx + 0x65], 0x61ccfd00
jo 0x78e9c8
outsb dx, byte [esi]
pop edi
jo 0x78e9c6
arpl word gs:[ecx + 0x73], bp
add ch, bh
int3
sub eax, 0x772d736d
imul ebp, dword [esi + 0x2d], 0x2d747263
push 0x2d706165
insb byte es:[edi], dx
xor dword [reloc.SHELL32.dll_ShellExecuteW], ebp
xor byte [esi], ch
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi - 0x4ffbdbbc], cl
pop eax
pop dword [esp + 4]
mov al, 0x58
mov dh, byte [esp + 2]
mov byte [esp + 2], cl
call 0x78ea5f
pop edi
cmpsb byte [esi], byte es:[edi]
rcr dword [edi + 0x6c], 1
imul esp, dword [edx + 0x6d], 0x6573735f
xor bl, byte [edi + 0x63]
outsd dx, dword [esi]
jae 0x78e9ff
jo 0x78ea14
arpl word gs:[ecx + 0x73], bp
add byte gs:[edi + 0x61], dh
add byte [edi + 0x61], dh
jbe 0x78ea11
dec edi
dec edi
jne 0x78ea23
push ebp
outsb dx, byte [esi]
jo 0x78ea25
jo 0x78ea17
jb 0x78ea1d
dec eax
popal
jb 0x78e9bf
add byte [eax + 0x5f], dl
push eax
pop edi
insb byte es:[edi], dx
imul esp, dword [edx + 0x6d], 0x6573735f
xor bl, byte [edi + 0x70]
jae 0x78ea3b
xor bl, byte gs:[edi + 0x70]
outsd dx, dword [esi]
ja 0x78ea2e
jo 0x78ea43
arpl word gs:[ecx + 0x73], bp
add byte gs:[ecx + 0x76], ah
pop edi
jb 0x78ea3e
insd dword es:[edi], dx
pop edi
je 0x78ea43
bound esp, qword [ebp + 0x73]
je 0x78ea48
outsw dx, word gs:[esi]
jb 0x78ea63
pop edi
je 0x78ea5b
insd dword es:[edi], dx
jae 0x78ea6a
popal
insd dword es:[edi], dx
jo 0x78e9fa
fcom qword [edi - 0x39]
mov byte [0xc85abc51], al
pop esi
cmp eax, ecx
sub ah, ch
adc al, 0x87
pop edi
mov esp, 0x395ec85a
enter 0xffffffffffffe52a, 0x14
xchg dword [esi], ebp
pop edi
je 0x78ea6e
outsb dx, byte [esi]
popal
jb 0x78ea85
outsd dx, dword [esi]
ja 0x78ea75
ja 0x78ea81
imul ebp, dword [esi + 0x6d], reloc.SHELL32.dll_ShellExecuteW
outsb dx, byte [esi]
insd dword es:[edi], dx
popal
imul ebp, dword [esi + 0x5f], 0x6d6d6f63
pop edi
arpl word [edi + 0x6d], bp
insd dword es:[edi], dx
popal
outsb dx, byte [esi]
pop edi
pop edi
insb byte es:[edi], dx
imul ebp, dword [esi + 0x65], 0x5f766100
imul ebp, dword [esi + 0x74], reloc.SHELL32.dll_ShellExecuteW
popal
jbe 0x78ea9d
pop edi
ja 0x78eaae
jb 0x78eaa6
imul esi, dword [ebp + 0x5f], reloc.SHELL32.dll_ShellExecuteW
je 0x78eaa4
pop edi
pop edi
jb 0x78eaa4
insd dword es:[edi], dx
add byte gs:[ecx], bh
sbb byte [ecx + 0x76], ah
arpl word [edi + 0x64], bp
arpl word gs:[edi + 0x61], bx
popal
jbe 0x78eaae
outsd dx, dword [esi]
arpl word gs:[edi + 0x61], bx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [edi + 0x63], bx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x78eac0
js 0x78ead1
xor eax, dword [eax]
xchg ebp, ecx
mov si, cx
int1
jmp 0x78eabc
stc
out dx, al
inc eax
rol byte [esi + 0x21], 1
sal byte [edi - 0x33], 1
inc esi
and eax, edx
ja 0x78ea40
pop esp
scasd eax, dword es:[edi]
popal
jbe 0x78eade
outsd dx, dword [esi]
jb 0x78eae8
popal
je 0x78eadd
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [edi + 0x63], bx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x78eaee
js 0x78eaff
add byte [ecx + 0x76], ah
outsw dx, word [esi]
jb 0x78eaff
popal
je 0x78eaf4
outsb dx, byte [esi]
je 0x78eb10
outsd dx, dword [esi]
jb 0x78eb07
pop edi
imul ebp, dword gs:[esi + 0x69], reloc.SHELL32.dll_ShellExecuteW
mov dh, 0x61
jbe 0x78eb07
push 0x76656477
imul esp, dword [ebx + 0x65], 0x7874635f
pop edi
arpl word [ebp + 0x5f], sp
arpl word [eax + edi*2 + 0x5f], si
arpl word [edx + 0x65], si
popal
je 0x78eb20
add byte [ebp - 0x3b7cc9c4], cl
pop es
lea edi, [esi + esi]
add esp, 7
les eax, [edi]
xchg dword [esp], ebp
mov ah, byte [esp + 4]
pop esi
jmp 0x78eb56
and esp, dword [ecx + 0x76]
outsw dx, word [esi]
jb 0x78eb45
popal
je 0x78eb3a
popal
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [edi + 0x6f], bx
jne 0x78eb58
jo 0x78eb5b
je 0x78eb47
arpl word [edi + 0x6e], bp
je 0x78eb52
js 0x78eb63
je 0x78eb22
xor al, byte [eax]
dec ecx
fmul dword [esi + 0x29]
fsubr dword [ecx]
mov ch, 0xa4
xlatb
or dword ds:[ecx + 0x76], esp
pop edi
add byte [ecx - 0x28], cl
dec esi
sub eax, ebx
sub dword [ebp + reloc.SHELL32.dll_ShellExecuteW], esi
popal
jbe 0x78eb5e
je 0x78eb62
popaw
jne 0x78eb75
je 0x78eb6a
arpl word [eax + 0x61], bp
outsb dx, byte [esi]
outsb dx, byte [esi]
insb byte es:[edi], dx
pop edi
insb byte es:[edi], dx
popal
jns 0x78eb86
jne 0x78eb8d
add byte [ecx + 0x76], ah
outsw dx, word [esi]
jb 0x78eb8d
popal
je 0x78eb82
pop edi
imul bp, word [esi + 0x64], 0x735f
je 0x78eb9d
popal
insd dword es:[edi], dx
pop edi
imul ebp, dword [esi + 0x66], 0x7661006f
pop edi
je 0x78eb9a
pop edi
arpl word [eax + 0x61], bp
outsb dx, byte [esi]
outsb dx, byte [esi]
insb byte es:[edi], dx
pop edi
insb byte es:[edi], dx
popal
jns 0x78ebb6
jne 0x78ebbd
pop edi
outsb dx, byte [esi]
bound ebx, qword [edi + 0x63]
push 0x656e6e61
insb byte es:[edi], dx
insb byte es:[edi], dx
jae 0x78eb56
lea ecx, [edx*4]
xchg ebp, eax
add byte [eax], al
add byte [eax], al
add esp, 0
les eax, [eax]
not si
salc
jmp 0x78eb84
lahf
retf
jae 0x78ebe0
outsb dx, byte [esi]
imul ebx, dword [edi + 0x67], 0x65
je 0x78ebdd
jb 0x78ebe2
insd dword es:[edi], dx
add byte gs:[ecx - 0xf5b3525], al
mov word [edx], ds
shl byte [esi - 0x75], 1
xor al, 0x24
sbb ebx, 0x8cf0a4ca
sbb dl, al
mov si, word [esp]
retf 0xf0a4
mov esi, dword [esp]
xchg edx, ebx
jmp 0x78ec44
popal
jbe 0x78ebfc
bound esi, qword [ebp + 0x66]
jb 0x78ec17
jb 0x78ec09
pop edi
popal
pop edi
jb 0x78ec0f
insd dword es:[edi], dx
add dl, ch
adc dword [ebx], 0x76
test dword [edx], ebp
rol byte [edx + ebx*8 - 0x43], 1
dec esp
push dword [ecx + 0x70]
sub dl, al
inc esp
fidivr dword [ebp + 0x7071ff4c]
jno 0x78ec2f
jae 0x78ec22
jbe 0x78ec22
je 0x78ec26
bound edi, qword [ecx + 0x74]
jae 0x78ec2c
jo 0x78ec34
jb 0x78ec30
jae 0x78ec34
insd dword es:[edi], dx
jo 0x78ec42
add byte gs:[ebx + 0x6f], dh
jne 0x78ec4a
je 0x78ec4e
je 0x78ec4e
jne 0x78ec44
arpl word [eax + 0x5f], bp
push 0x7465735f
push ebx
pop edi
jae 0x78ec4a
je 0x78ec3a
popal
insd dword es:[edi], dx
jo 0x78ec57
push edx
popal
je 0x78ec55
add byte [edx - 0x7b], ch
xor al, 0x27
dec esi
popal
jbe 0x78ec5f
imul ebp, dword [esp + esi*2 + 0x65], reloc.SHELL32.dll_ShellExecuteW
popal
jb 0x78ec5e
jb 0x78ec63
jo 0x78ec6c
pop edi
jo 0x78ec68
jb 0x78ec7c
pop edi
jo 0x78ec81
jb 0x78ec0f
jae 0x78ec80
jne 0x78ec81
je 0x78ec85
jne 0x78ec7b
arpl word [eax + 0x5f], bp
jo 0x78ec91
push 0x7475705f
push ebx
je 0x78ec71
popal
insd dword es:[edi], dx
jo 0x78ec8e
jae 0x78ec84
imul esi, dword [ecx], reloc.SHELL32.dll_ShellExecuteW
sbb esi, dword [edx + 0x73]
xor dword [esi], esi
add cl, bl
cmp byte [ebx], bl
jb 0x78eca1
outsd dx, dword [esi]
jne 0x78ec9f
outsb dx, byte [esi]
je 0x78eca3
jne 0x78ec99
push 0x7465735f
inc ebx
je 0x78ec7f
push 0x656e6e61
insb byte es:[edi], dx
jae 0x78ec44
mov dx, word [esp]
lea ebp, reloc.SHELL32.dll_ShellExecuteW
mov dl, 0x73
add esp, 0
and al, 0xbb
xor al, byte [eax]
add byte [edx + 0xc48373], dh
jmp 0x78eced
xchg esp, eax
add byte [eax], al
add byte [ebp + 0x61], ch
add byte [eax], al
insd dword es:[edi], dx
popal
jbe 0x78ecc3
imul ebp, dword [esp + esi*2 + 0x65], reloc.SHELL32.dll_ShellExecuteW
popal
insb byte es:[edi], dx
je 0x78ecc6
jb 0x78ecc2
jb 0x78ecc7
jo 0x78ecd0
pop edi
arpl word [edx + 0x65], si
popal
je 0x78ecd4
pop edi
imul bp, word [esp + esi*2 + 0x65], 0x72
jae 0x78ece8
imul ebp, dword [esp + esi*2 + 0x65], reloc.SHELL32.dll_ShellExecuteW
jne 0x78ece9
je 0x78eced
je 0x78eced
jne 0x78ece3
arpl word [eax + 0x5f], bp
push 0x7365645f
pop edi
jae 0x78ecfa
jae 0x78ecfa
je 0x78ecf9
jb 0x78ecf7
outsd dx, dword [esi]
jns 0x78ecd3
outsb dx, byte [esi]
jae 0x78ed01
popal
outsb dx, byte [esi]
arpl word [ebp], sp
jl 0x78ece3
add byte [edi + ecx*2 - 0x2a], bh
salc
inc ecx
jae 0x78ed07
jne 0x78ed08
outsb dx, byte [esi]
je 0x78ed0c
jne 0x78ed02
push 0x6572635f
arpl word [edx + 0x65], si
popal
popal
je 0x78ed0c
dec ecx
outsb dx, byte [esi]
jae 0x78ed1f
popal
outsb dx, byte [esi]
arpl word [ebp], sp
jo 0x78ed26
push 0x64616572
pop edi
arpl word [edi + 0x6e], bp
pop edi
je 0x78ed28
insd dword es:[edi], dx
ja 0x78ed25
ja 0x78ed25
popal
imul esi, dword [eax + eax - 0x2c], reloc.SHELL32.dll_ShellExecuteW
add ah, dl
inc edi
aam 0x47
xlatb
mov dl, 0x41
out 0x7a, al
push ebp
jae 0x78ed40
outsd dx, dword [esi]
jne 0x78ed41
je 0x78ed45
je 0x78ed45
jne 0x78ed3b
push 0x6365725f
imul esi, dword gs:[esi + 0x65], 0x706d6153
insb byte es:[edi], dx
insd dword es:[edi], dx
jo 0x78ed52
jae 0x78ed48
pop edi
imul esi, dword [ecx], reloc.SHELL32.dll_ShellExecuteW
push si
sub esp, 0x11
not ebx
cpuid
mov dl, al
pop bx
shl byte [esi + 0x5b], 1
pop ebx
jmp 0x78fcec
pop esi
test eax, 0x1ce8
add byte [ebx + 0x61], dl
outsb dx, byte [esi]
xor byte cs:[esi], ch
insd dword es:[edi], dx
jo 0x78ed7e
aas
and al, 0x62
bound esp, qword [ecx + 0x73]
imul esp, dword [ebx + 0x5f], 0x65727473
popal
jae 0x78edad
arpl word [edi + 0x73], bx
je 0x78edbb
pop edi
jae 0x78edbc
jb 0x78edaf
popal
popal
insd dword es:[edi], dx
bound esi, qword [ebp + 0x66]
inc eax
inc esp
push ebp
aas
and al, 0x63
push 0x745f7261
jb 0x78edbd
imul esi, dword [ebx + esi*2 + 0x40], reloc.SHELL32.dll_ShellExecuteW
inc eax
inc eax
inc eax
jae 0x78edde
inc eax
inc eax
dec ecx
inc ecx
inc ebp
pop eax
dec eax
inc eax
pop edx
add byte [ebx - 0x137cfe3c], al
add cl, byte [edi]
xor dword [ecx - reloc.SHELL32.dll_ShellExecuteW], ecx
les ebx, [edx]
add esp, 1
sub esp, 2
rdtsc
mov dword [esp + 0x18], esi
add esp, 0x1a
je 0x78eda4
sbb byte [ebx + 0x148d1ac4], al
test dword [eax], eax
add byte [eax], al
add bl, ch
cmp al, byte [esi + 0x25d6b323]
mov bh, ah
cli
popfd
insb byte es:[edi], dx
fist dword [ecx]
lea esi, [esp + 0xa5]
xor ecx, 0x29e090e6
lea edx, [eax*4]
jmp 0x78edc7
nop
loopne 0x78edd0
pop dword [esp + 5]
mov ch, byte [esp + 5]
and al, 5
jmp 0x78ed75
xchg si, di
mov bh, byte [esp + 7]
xor ebp, edi
dec ebp
btr edi, eax
mov bl, 0xc7
invalid
mov dh, bl
jmp 0x78edf8
mov eax, edi
lea eax, [ecx*4]
lea esi, [eax + ebx]
push dword [esp + 3]
pop dword [esp + 7]
pop word [esp + 2]
and al, 2
jmp 0x78edb1
add esp, 2
lea esp, [esp + 8]
mov bh, byte [esp]
xchg cx, ax
sub esp, 0xe
jmp 0x78ee13
push edx
mov dword [esp + 6], edi
setnp al
lea edi, [edx*4]
lea esp, [esp + 3]
lea ecx, reloc.SHELL32.dll_ShellExecuteW
jmp 0x78ede2
add esp, 2
neg dx
rdtsc
xchg ebp, eax
mov ebx, dword [esp + 0xa]
mov edx, dword [esp + 1]
jmp 0x78ee60
lea eax, reloc.SHELL32.dll_ShellExecuteW
mov byte [esp + 0xd], cl
call 0x78ed9a
mov di, 0xd5b7
rcr ebp, 0xc
cpuid
mov al, 0xc9
call 0x78ee6b
and byte [ebx - 0x66], ah
cmc
in al, 0x17
cpuid
mov byte [esp + 3], al
call 0x78ee4a
jmp 0x78f003
pop dword [esp + 0xe]
cmp ebp, esi
mov bl, byte [esp]
sub esp, 0x1e
inc ebx
mov di, bp
jmp 0x78eee2
pop edx
dec di
std
push dword [esp + 0xd]
lea edx, [eax - 0xee]
rdtsc
jmp 0x78ee3b
stc
not edx
btr dx, sp
mov byte [esp + 7], bl
call fcn.0078eeca
or esp, dword [edx + reloc.SHELL32.dll_ShellExecuteW]
mov bh, cl
mov bl, byte [esp + 0xa]
mov dword [esp + 6], edx
dec dl
cpuid
setg cl
jmp 0x78eea1
dec edi
pop word [esp + 0x14]
rdtsc
mov edi, 0xb82c967e
lea esp, [esp + 0x1f]
mov ebx, dword [esp + 4]
jmp 0x78eeb7
mov edi, ebp
mov edx, 0x6768517a
xchg dh, dl
not edi
push dword [esp + 8]
setge cl
jmp 0x78ee70
mov esi, ecx
pop dword [esp + 0x1a]
mov bh, byte [esp + 0xb]
mov bx, 0x810f
mov cl, bl
cld
jmp 0x78ee8f
pop dword [esp + 6]
add esp, 6
pushal
mov ebx, dword [esp + 0x24]
cld
stc
jmp 0x78f14e