New Text Document (10)

7/17/2019 New Text Document (10)

1/93

__size32 WriteProcessMemory = 0x1b880;// 4 bytes__size32 Sleep = 0x1b856;// 4 bytes__size32 SetConsoleTextAttribute = 0x1b800;// 4 bytesunsigned char global19 = 0;unsigned short global18 = 0;

__size32 global17 = 0x1718a0f;// 4 bytesunsigned char global16 = 0;unsigned short global15 = 0x6174;unsigned char global14 = 0;unsigned short global13 = 0x4074;unsigned char global12 = 0;

__size32 GetStdHandle = 0x1b7d2;// 4 bytesunsigned short global10 = 0;

__size32 global9 = 0x150840f;// 4 bytesunsigned char global8 = 0;unsigned short global7 = 0;

__size32 global6 = 0x171840f;// 4 bytesunsigned char global5 = 0;unsigned short global4 = 0x9090;

__size32 global3 = 0x90909090;// 4 bytesint global0 = 0xbb40e64e;

__size32 ReadProcessMemory = 0x1b86c;// 4 bytes

void proc1();

void proc2();

// address: 0x401100int main(int argc, int argv, int envp) { __size8 al; // r8 unsigned int al_1; // r8{1062} unsigned int al_2; // r8{1059} __size8 al_3; // r8{257} unsigned int al_4; // r8{2557} unsigned int al_5; // r8{3093} unsigned int al_6; // r8{3439} __size16 ax; // r0 short ax_1; // r0{4605}

short ax_2; // r0{4545} __size32 eax; // r24 int eax_1; // r24{4499} int eax_2; // r24{1053} __size32 eax_3; // r24{949} __size32 eax_4; // r24{3482} __size32 eax_5; // r24{3685} __size32 ebp; // r29 __size32 ebp_1; // r29{4783} __size32 ecx; // r25 __size32 edi; // r31 __size32 edi_1; // r31{4785} __size32 edx; // r26

__size32 esi; // r30 __size32 esi_1; // r30{4784} __size32 *esp; // r28 void *esp_1; // r28 __size32 esp_2; // r28{1016} __size32 esp_3; // r28{961} __size32 esp_4; // r28{359} int esp_5; // r28{7} __size32 local0; // m[esp - 4] int local1; // m[esp - 4]{701}

7/17/2019 New Text Document (10)

2/93

void *local10; // m[esp_1 - 4]{2714} int local100; // %flags{395} int local1000; // %CF{821} int local1001; // %CF{779} int local1002; // %CF{737} int local1003; // %CF{422} int local1004; // %CF{464} int local1005; // %CF{506} int local1006; // %CF{548} int local1007; // %CF{596} int local1008; // %CF{638} int local1009; // %CF{680} int local101; // %flags{353} int local1010; // %CF{722} int local1011; // %CF{764} int local1012; // %CF{806} int local1013; // %CF{848} int local1014; // %CF{890} int local1015; // %CF{934} int local1016; // %CF{965} int local1017; // %CF{983} int local1018; // %CF{1087} int local1019; // %CF{1094} int local102; // %flags{347}

int local1020; // %CF{479} int local1021; // %CF{437} int local1022; // %CF{395} int local1023; // %CF{353} int local1024; // %CF{347} int local1025; // %CF{341} int local1026; // %CF{299} int local1027; // %CF{257} int local1028; // %CF{284} int local1029; // %CF{236} int local103; // %flags{341} int local1030; // %CF{326} int local1031; // %CF{380}

int local1032; // %CF{1247} int local1033; // %CF{1247} int local1034; // %CF{1247} int local1035; // %CF{1247} int local1036; // %CF{1247} int local1037; // %CF{1247} int local1038; // %CF{1247} int local1039; // %CF{1247} int local104; // %flags{299} int local1040; // %CF{4506} int local1041; // %CF{4470} int local1042; // %CF{1247} int local1043; // %CF{4456}

int local1044; // %CF{1247} int local1045; // %CF{4442} int local1046; // %CF{1247} int local1047; // %CF{4428} int local1048; // %CF{1247} int local1049; // %CF{1247} int local105; // %flags{257} int local1050; // %CF{1247} int local1051; // %CF{1247} int local1052; // %CF{1247}

7/17/2019 New Text Document (10)

3/93

int local1053; // %CF{1247} int local1054; // %CF{1247} int local1055; // %CF{4748} int local1056; // %CF{1247} int local1057; // %CF{1247} int local1058; // %CF{1247} int local1059; // %CF{1247} int local106; // %flags{284} int local1060; // %CF{1247} int local1061; // %CF{4706} int local1062; // %CF{4596} int local1063; // %CF{1247} int local1064; // %CF{1247} int local1065; // %CF{1247} int local1066; // %CF{1247} int local1067; // %CF{1247} int local1068; // %CF{1247} int local1069; // %CF{1247} int local107; // %flags{236} int local1070; // %CF{1247} int local1071; // %CF{1247} int local1072; // %CF{4566} int local1073; // %CF{1247} int local1074; // %CF{1247}

int local1075; // %CF{4734} int local1076; // %CF{1247} int local1077; // %CF{1247} int local1078; // %CF{1247} int local1079; // %CF{1247} int local108; // %flags{326} int local1080; // %CF{1247} int local1081; // %CF{1247} int local1082; // %CF{1247} int local1083; // %CF{1247} int local1084; // %CF{1247} int local1085; // %CF{1247} int local1086; // %CF{1247}

int local1087; // %CF{4692} int local1088; // %CF{1247} int local1089; // %CF{1247} int local109; // %flags{380} int local1090; // %CF{1247} int local1091; // %CF{1247} int local1092; // %CF{1247} int local1093; // %CF{1247} int local1094; // %CF{1247} int local1095; // %CF{1247} int local1096; // %CF{1247} int local1097; // %CF{1247} int local1098; // %CF{1247}

int local1099; // %CF{1247} unsigned int local11; // m[esp_1 - 4]{2703} int local110; // %flags{1247} int local1100; // %CF{1247} int local1101; // %CF{1247} int local1102; // %CF{1247} int local1103; // %CF{1247} int local1104; // %CF{1247} int local1105; // %CF{1247} int local1106; // %CF{1247}

7/17/2019 New Text Document (10)

4/93

int local1107; // %CF{1247} int local1108; // %CF{1247} int local1109; // %CF{1247} int local111; // %flags{1247} int local1110; // %CF{1247} int local1111; // %CF{1247} int local1112; // %CF{1247} int local1113; // %CF{1247} int local1114; // %CF{1247} int local1115; // %CF{1247} int local1116; // %CF{1247} int local1117; // %CF{4656} int local1118; // %CF{1247} int local1119; // %CF{1247} int local112; // %flags{1247} int local1120; // %CF{1247} int local1121; // %CF{1247} int local1122; // %CF{1247} int local1123; // %CF{1247} int local1124; // %CF{4626} int local1125; // %CF{1247} int local1126; // %CF{1247} int local1127; // %CF{1247} int local1128; // %CF{1247}

int local1129; // %CF{1247} int local113; // %flags{1247} int local1130; // %CF{1247} int local1131; // %CF{1247} int local1132; // %CF{1247} int local1133; // %CF{1247} int local1134; // %CF{1247} int local1135; // %CF{1247} int local1136; // %CF{1247} int local1137; // %CF{1247} int local1138; // %CF{1247} int local1139; // %CF{1247} int local114; // %flags{1247}

int local1140; // %CF{1247} int local1141; // %CF{1247} int local1142; // %CF{1247} int local1143; // %CF{1247} int local1144; // %CF{1247} int local1145; // %CF{1247} int local1146; // %CF{1247} int local1147; // %CF{1247} int local1148; // %CF{1247} int local1149; // %CF{1247} int local115; // %flags{1247} int local1150; // %CF{1247} int local1151; // %CF{1247}

int local1152; // %CF{1247} int local1153; // %CF{1247} int local1154; // %CF{1247} int local1155; // %CF{1247} int local1156; // %CF{1247} int local1157; // %CF{1247} int local1158; // %CF{1247} int local1159; // %CF{1247} int local116; // %flags{1247} int local1160; // %CF{1247}

7/17/2019 New Text Document (10)

5/93

int local1161; // %CF{1247} int local1162; // %CF{1247} int local1163; // %CF{1247} int local1164; // %CF{1247} int local1165; // %CF{1247} int local1166; // %CF{1247} int local1167; // %CF{1247} int local1168; // %CF{1247} int local1169; // %CF{4536} int local117; // %flags{1247} int local1170; // %CF{1247} int local1171; // %CF{1247} int local1172; // %CF{1230} int local1173; // %CF{1213} int local1174; // %CF{1196} int local1175; // %CF{1179} int local1176; // %CF{1162} int local1177; // %CF{1145} int local1178; // %CF{1128} int local1179; // %CF{955} int local118; // %flags{4504} int local1180; // %CF{949} int local1181; // %CF{905} int local1182; // %CF{1723}

int local1183; // %CF{1723} int local1184; // %CF{1723} int local1185; // %CF{1723} int local1186; // %CF{1723} int local1187; // %CF{1723} int local1188; // %CF{1723} int local1189; // %CF{1723} int local119; // %flags{4468} int local1190; // %CF{1723} int local1191; // %CF{1723} int local1192; // %CF{1723} int local1193; // %CF{1723} int local1194; // %CF{1723}

int local1195; // %CF{1723} int local1196; // %CF{1723} int local1197; // %CF{1723} int local1198; // %CF{1723} int local1199; // %CF{1723} void *local12; // m[esp_1 - 4]{2621} int local120; // %flags{1247} int local1200; // %CF{1723} int local1201; // %CF{1723} int local1202; // %CF{1723} int local1203; // %CF{1723} int local1204; // %CF{1723} int local1205; // %CF{1723}

int local1206; // %CF{1723} int local1207; // %CF{1723} int local1208; // %CF{1723} int local1209; // %CF{1723} int local121; // %flags{4454} int local1210; // %CF{1706} int local1211; // %CF{1689} int local1212; // %CF{1672} int local1213; // %CF{1655} int local1214; // %CF{1638}

7/17/2019 New Text Document (10)

6/93

int local1215; // %CF{1621} int local1216; // %CF{1604} int local1217; // %CF{1587} int local1218; // %CF{1570} int local1219; // %CF{1553} int local122; // %flags{1247} int local1220; // %CF{1536} int local1221; // %CF{1519} int local1222; // %CF{1502} int local1223; // %CF{1485} int local1224; // %CF{1468} int local1225; // %CF{1451} int local1226; // %CF{1434} int local1227; // %CF{1417} int local1228; // %CF{1400} int local1229; // %CF{1383} int local123; // %flags{4440} int local1230; // %CF{1366} int local1231; // %CF{1349} int local1232; // %CF{1332} int local1233; // %CF{1315} int local1234; // %CF{1298} int local1235; // %CF{1281} int local1236; // %CF{1264}

int local1237; // %CF{2139} int local1238; // %CF{2139} int local1239; // %CF{2139} int local124; // %flags{1247} int local1240; // %CF{2139} int local1241; // %CF{2139} int local1242; // %CF{2139} int local1243; // %CF{2139} int local1244; // %CF{2139} int local1245; // %CF{2139} int local1246; // %CF{2139} int local1247; // %CF{2139} int local1248; // %CF{2139}

int local1249; // %CF{2139} int local125; // %flags{4426} int local1250; // %CF{2139} int local1251; // %CF{2139} int local1252; // %CF{2139} int local1253; // %CF{2139} int local1254; // %CF{2139} int local1255; // %CF{2139} int local1256; // %CF{2139} int local1257; // %CF{2122} int local1258; // %CF{2105} int local1259; // %CF{2088} int local126; // %flags{1247}

int local1260; // %CF{2071} int local1261; // %CF{2054} int local1262; // %CF{2037} int local1263; // %CF{2020} int local1264; // %CF{2003} int local1265; // %CF{1986} int local1266; // %CF{1969} int local1267; // %CF{1952} int local1268; // %CF{1935} int local1269; // %CF{1918}

7/17/2019 New Text Document (10)

7/93

int local127; // %flags{1247} int local1270; // %CF{1901} int local1271; // %CF{1884} int local1272; // %CF{1867} int local1273; // %CF{1740} int local1274; // %CF{1833} int local1275; // %CF{1826} int local1276; // %CF{2479} int local1277; // %CF{2479} int local1278; // %CF{2479} int local1279; // %CF{2479} int local128; // %flags{1247} int local1280; // %CF{2479} int local1281; // %CF{2479} int local1282; // %CF{2479} int local1283; // %CF{2479} int local1284; // %CF{2479} int local1285; // %CF{2479} int local1286; // %CF{2479} int local1287; // %CF{2479} int local1288; // %CF{2479} int local1289; // %CF{2479} int local129; // %flags{1247} int local1290; // %CF{2479}

int local1291; // %CF{2479} int local1292; // %CF{2479} int local1293; // %CF{2479} int local1294; // %CF{2479} int local1295; // %CF{2479} int local1296; // %CF{2462} int local1297; // %CF{2445} int local1298; // %CF{2428} int local1299; // %CF{2411} unsigned int local13; // m[esp_1 - 4]{2610} int local130; // %flags{1247} int local1300; // %CF{2394} int local1301; // %CF{2377}

int local1302; // %CF{2360} int local1303; // %CF{2343} int local1304; // %CF{2326} int local1305; // %CF{2309} int local1306; // %CF{2292} int local1307; // %CF{2275} int local1308; // %CF{2258} int local1309; // %CF{2241} int local131; // %flags{1247} int local1310; // %CF{2224} int local1311; // %CF{2207} int local1312; // %CF{2190} int local1313; // %CF{2173}

int local1314; // %CF{2156} int local1315; // %CF{2589} int local1316; // %CF{2582} int local1317; // %CF{2900} int local1318; // %CF{2900} int local1319; // %CF{2900} int local132; // %flags{1247} int local1320; // %CF{2900} int local1321; // %CF{2900} int local1322; // %CF{2900}

7/17/2019 New Text Document (10)

8/93

int local1323; // %CF{2900} int local1324; // %CF{2900} int local1325; // %CF{2900} int local1326; // %CF{2883} int local1327; // %CF{2866} int local1328; // %CF{2849} int local1329; // %CF{2832} int local133; // %flags{4746} int local1330; // %CF{2682} int local1331; // %CF{2675} int local1332; // %CF{2792} int local1333; // %CF{2785} int local1334; // %CF{3316} int local1335; // %CF{3316} int local1336; // %CF{3316} int local1337; // %CF{3316} int local1338; // %CF{3316} int local1339; // %CF{3316} int local134; // %flags{1247} int local1340; // %CF{3316} int local1341; // %CF{3316} int local1342; // %CF{3316} int local1343; // %CF{3316} int local1344; // %CF{3316}

int local1345; // %CF{3316} int local1346; // %CF{3316} int local1347; // %CF{3316} int local1348; // %CF{3316} int local1349; // %CF{3316} int local135; // %flags{1247} int local1350; // %CF{3316} int local1351; // %CF{3316} int local1352; // %CF{3316} int local1353; // %CF{3316} int local1354; // %CF{3299} int local1355; // %CF{3282} int local1356; // %CF{3265}

int local1357; // %CF{3248} int local1358; // %CF{3231} int local1359; // %CF{3214} int local136; // %flags{1247} int local1360; // %CF{3197} int local1361; // %CF{3180} int local1362; // %CF{3163} int local1363; // %CF{3036} int local1364; // %CF{3019} int local1365; // %CF{3002} int local1366; // %CF{2985} int local1367; // %CF{2968} int local1368; // %CF{2951}

int local1369; // %CF{2934} int local137; // %flags{1247} int local1370; // %CF{2917} int local1371; // %CF{3123} int local1372; // %CF{3116} int local1373; // %CF{4187} int local1374; // %CF{4187} int local1375; // %CF{4187} int local1376; // %CF{4187} int local1377; // %CF{4187}

7/17/2019 New Text Document (10)

9/93

int local1378; // %CF{4187} int local1379; // %CF{4187} int local138; // %flags{1247} int local1380; // %CF{4187} int local1381; // %CF{4187} int local1382; // %CF{4187} int local1383; // %CF{4187} int local1384; // %CF{4187} int local1385; // %CF{4187} int local1386; // %CF{4187} int local1387; // %CF{4187} int local1388; // %CF{4187} int local1389; // %CF{4187} int local139; // %flags{4704} int local1390; // %CF{4187} int local1391; // %CF{4144} int local1392; // %CF{3991} int local1393; // %CF{3974} int local1394; // %CF{3957} int local1395; // %CF{3939} int local1396; // %CF{3482} int local1397; // %CF{3367} int local1398; // %CF{3350} int local1399; // %CF{3333}

void *local14; // m[esp_1 - 4]{3711} int local140; // %flags{4594} int local1400; // %CF{3466} int local1401; // %CF{3740} int local1402; // %CF{3735} int local1403; // %CF{3537} int local1404; // %CF{3532} int local1405; // %CF{3685} int local1406; // %CF{3669} int local1407; // %CF{3517} int local1408; // %CF{3720} int local1409; // local58{4230} int local141; // %flags{1247}

int local1410; // local519{4231} int local1411; // local980{4232} int local1412; // local55{4244} int local1413; // local516{4245} int local1414; // local977{4246} int local1415; // local52{4258} int local1416; // local513{4259} int local1417; // local974{4260} int local1418; // local47{4272} int local1419; // local508{4273} int local142; // %flags{1247} int local1420; // local969{4274} int local1421; // local44{4286}

int local1422; // local505{4287} int local1423; // local966{4288} int local1424; // local41{4300} int local1425; // local502{4301} int local1426; // local963{4302} int local1427; // local38{4314} int local1428; // local499{4315} int local1429; // local960{4316} int local143; // %flags{1247} int local1430; // local35{4328}

7/17/2019 New Text Document (10)

10/93

int local1431; // local496{4329} int local1432; // local957{4330} int local1433; // local31{4342} int local1434; // local492{4343} int local1435; // local953{4344} int local1436; // local28{4356} int local1437; // local489{4357} int local1438; // local950{4358} int local1439; // local77{4370} int local144; // %flags{1247} int local1440; // local538{4371} int local1441; // local999{4372} int local1442; // local74{4384} int local1443; // local535{4385} int local1444; // local996{4386} int local1445; // local71{4398} int local1446; // local532{4399} int local1447; // local993{4400} int local1448; // local68{4412} int local1449; // local529{4413} int local145; // %flags{1247} int local1450; // local990{4414} int local1451; // local125{4426} int local1452; // local586{4427}

int local1453; // local1047{4428} int local1454; // local123{4440} int local1455; // local584{4441} int local1456; // local1045{4442} int local1457; // local121{4454} int local1458; // local582{4455} int local1459; // local1043{4456} int local146; // %flags{1247} int local1460; // local119{4468} int local1461; // local580{4469} int local1462; // local1041{4470} __size32 local1463; // ebp{4491} __size32 local1464; // esi{4492}

__size32 local1465; // edi{4493} int local1466; // local4{4810} int local1467; // local118{4504} int local1468; // local579{4505} int local1469; // local1040{4506} int local147; // %flags{1247} int local1470; // local247{4534} int local1471; // local708{4535} int local1472; // local1169{4536} int local1473; // local150{4564} int local1474; // local611{4565} int local1475; // local1072{4566} int local1476; // local140{4594}

int local1477; // local601{4595} int local1478; // local1062{4596} int local1479; // local202{4624} int local148; // %flags{1247} int local1480; // local663{4625} int local1481; // local1124{4626} int local1482; // local195{4654} int local1483; // local656{4655} int local1484; // local1117{4656} int local1485; // local165{4690}

7/17/2019 New Text Document (10)

11/93

int local1486; // local626{4691} int local1487; // local1087{4692} int local1488; // local139{4704} int local1489; // local600{4705} int local149; // %flags{1247} int local1490; // local1061{4706} int local1491; // local153{4732} int local1492; // local614{4733} int local1493; // local1075{4734} int local1494; // local133{4746} int local1495; // local594{4747} int local1496; // local1055{4748} __size32 local1497; // ebp_1{4783} __size32 local1498; // esi_1{4784} __size32 local1499; // edi_1{4785} unsigned int local15; // m[esp_1 - 4]{3700} int local150; // %flags{4564} int local151; // %flags{1247} int local152; // %flags{1247} int local153; // %flags{4732} int local154; // %flags{1247} int local155; // %flags{1247} int local156; // %flags{1247} int local157; // %flags{1247}

int local158; // %flags{1247} int local159; // %flags{1247} unsigned int local16; // m[esp_1 - 4]{3497} int local160; // %flags{1247} int local161; // %flags{1247} int local162; // %flags{1247} int local163; // %flags{1247} int local164; // %flags{1247} int local165; // %flags{4690} int local166; // %flags{1247} int local167; // %flags{1247} int local168; // %flags{1247} int local169; // %flags{1247}

void *local17; // m[esp_1 - 4]{3508} int local170; // %flags{1247} int local171; // %flags{1247} int local172; // %flags{1247} int local173; // %flags{1247} int local174; // %flags{1247} int local175; // %flags{1247} int local176; // %flags{1247} int local177; // %flags{1247} int local178; // %flags{1247} int local179; // %flags{1247} void *local18; // m[esp_1 - 8]{2573} int local180; // %flags{1247}

int local181; // %flags{1247} int local182; // %flags{1247} int local183; // %flags{1247} int local184; // %flags{1247} int local185; // %flags{1247} int local186; // %flags{1247} int local187; // %flags{1247} int local188; // %flags{1247} int local189; // %flags{1247} unsigned int local19; // m[esp_1 - 8]{2545}

7/17/2019 New Text Document (10)

12/93

int local190; // %flags{1247} int local191; // %flags{1247} int local192; // %flags{1247} int local193; // %flags{1247} int local194; // %flags{1247} int local195; // %flags{4654} int local196; // %flags{1247} int local197; // %flags{1247} int local198; // %flags{1247} int local199; // %flags{1247} int local2; // m[esp - 4]{869} unsigned int local20; // m[esp_1 - 28]{1050} int local200; // %flags{1247} int local201; // %flags{1247} int local202; // %flags{4624} int local203; // %flags{1247} int local204; // %flags{1247} int local205; // %flags{1247} int local206; // %flags{1247} int local207; // %flags{1247} int local208; // %flags{1247} int local209; // %flags{1247} void *local21; // m[esp_1 - 28]{1078} int local210; // %flags{1247}

int local211; // %flags{1247} int local212; // %flags{1247} int local213; // %flags{1247} int local214; // %flags{1247} int local215; // %flags{1247} int local216; // %flags{1247} int local217; // %flags{1247} int local218; // %flags{1247} int local219; // %flags{1247} void *local22; // m[esp_1 - 8]{3457} int local220; // %flags{1247} int local221; // %flags{1247} int local222; // %flags{1247}

int local223; // %flags{1247} int local224; // %flags{1247} int local225; // %flags{1247} int local226; // %flags{1247} int local227; // %flags{1247} int local228; // %flags{1247} int local229; // %flags{1247} unsigned int local23; // m[esp_1 - 8]{3427} int local230; // %flags{1247} int local231; // %flags{1247} int local232; // %flags{1247} int local233; // %flags{1247} int local234; // %flags{1247}

int local235; // %flags{1247} int local236; // %flags{1247} int local237; // %flags{1247} int local238; // %flags{1247} int local239; // %flags{1247} void *local24; // m[esp_1 - 8]{2776} int local240; // %flags{1247} int local241; // %flags{1247} int local242; // %flags{1247} int local243; // %flags{1247}

7/17/2019 New Text Document (10)

13/93

int local244; // %flags{1247} int local245; // %flags{1247} int local246; // %flags{1247} int local247; // %flags{4534} int local248; // %flags{1247} int local249; // %flags{1247} unsigned int local25; // m[esp_1 - 8]{2748} int local250; // %flags{1230} int local251; // %flags{1213} int local252; // %flags{1196} int local253; // %flags{1179} int local254; // %flags{1162} int local255; // %flags{1145} int local256; // %flags{1128} int local257; // %flags{955} int local258; // %flags{949} int local259; // %flags{905} int local26; // %flags{695} int local260; // %flags{1723} int local261; // %flags{1723} int local262; // %flags{1723} int local263; // %flags{1723} int local264; // %flags{1723} int local265; // %flags{1723}

int local266; // %flags{1723} int local267; // %flags{1723} int local268; // %flags{1723} int local269; // %flags{1723} int local27; // %flags{695} int local270; // %flags{1723} int local271; // %flags{1723} int local272; // %flags{1723} int local273; // %flags{1723} int local274; // %flags{1723} int local275; // %flags{1723} int local276; // %flags{1723} int local277; // %flags{1723}

int local278; // %flags{1723} int local279; // %flags{1723} int local28; // %flags{4356} int local280; // %flags{1723} int local281; // %flags{1723} int local282; // %flags{1723} int local283; // %flags{1723} int local284; // %flags{1723} int local285; // %flags{1723} int local286; // %flags{1723} int local287; // %flags{1723} int local288; // %flags{1706} int local289; // %flags{1689}

int local29; // %flags{695} int local290; // %flags{1672} int local291; // %flags{1655} int local292; // %flags{1638} int local293; // %flags{1621} int local294; // %flags{1604} int local295; // %flags{1587} int local296; // %flags{1570} int local297; // %flags{1553} int local298; // %flags{1536}

7/17/2019 New Text Document (10)

14/93

int local299; // %flags{1519} int local3; // m[esp - 4]{1247} int local30; // %flags{695} int local300; // %flags{1502} int local301; // %flags{1485} int local302; // %flags{1468} int local303; // %flags{1451} int local304; // %flags{1434} int local305; // %flags{1417} int local306; // %flags{1400} int local307; // %flags{1383} int local308; // %flags{1366} int local309; // %flags{1349} int local31; // %flags{4342} int local310; // %flags{1332} int local311; // %flags{1315} int local312; // %flags{1298} int local313; // %flags{1281} int local314; // %flags{1264} int local315; // %flags{2139} int local316; // %flags{2139} int local317; // %flags{2139} int local318; // %flags{2139} int local319; // %flags{2139}

int local32; // %flags{695} int local320; // %flags{2139} int local321; // %flags{2139} int local322; // %flags{2139} int local323; // %flags{2139} int local324; // %flags{2139} int local325; // %flags{2139} int local326; // %flags{2139} int local327; // %flags{2139} int local328; // %flags{2139} int local329; // %flags{2139} int local33; // %flags{695} int local330; // %flags{2139}

int local331; // %flags{2139} int local332; // %flags{2139} int local333; // %flags{2139} int local334; // %flags{2139} int local335; // %flags{2122} int local336; // %flags{2105} int local337; // %flags{2088} int local338; // %flags{2071} int local339; // %flags{2054} int local34; // %flags{695} int local340; // %flags{2037} int local341; // %flags{2020} int local342; // %flags{2003}

int local343; // %flags{1986} int local344; // %flags{1969} int local345; // %flags{1952} int local346; // %flags{1935} int local347; // %flags{1918} int local348; // %flags{1901} int local349; // %flags{1884} int local35; // %flags{4328} int local350; // %flags{1867} int local351; // %flags{1740}

7/17/2019 New Text Document (10)

15/93

int local352; // %flags{1833} int local353; // %flags{1826} int local354; // %flags{2479} int local355; // %flags{2479} int local356; // %flags{2479} int local357; // %flags{2479} int local358; // %flags{2479} int local359; // %flags{2479} int local36; // %flags{695} int local360; // %flags{2479} int local361; // %flags{2479} int local362; // %flags{2479} int local363; // %flags{2479} int local364; // %flags{2479} int local365; // %flags{2479} int local366; // %flags{2479} int local367; // %flags{2479} int local368; // %flags{2479} int local369; // %flags{2479} int local37; // %flags{695} int local370; // %flags{2479} int local371; // %flags{2479} int local372; // %flags{2479} int local373; // %flags{2479}

int local374; // %flags{2462} int local375; // %flags{2445} int local376; // %flags{2428} int local377; // %flags{2411} int local378; // %flags{2394} int local379; // %flags{2377} int local38; // %flags{4314} int local380; // %flags{2360} int local381; // %flags{2343} int local382; // %flags{2326} int local383; // %flags{2309} int local384; // %flags{2292} int local385; // %flags{2275}

int local386; // %flags{2258} int local387; // %flags{2241} int local388; // %flags{2224} int local389; // %flags{2207} int local39; // %flags{695} int local390; // %flags{2190} int local391; // %flags{2173} int local392; // %flags{2156} int local393; // %flags{2589} int local394; // %flags{2582} int local395; // %flags{2900} int local396; // %flags{2900} int local397; // %flags{2900}

int local398; // %flags{2900} int local399; // %flags{2900} int local4; // m[esp - 4]{1016} int local40; // %flags{695} int local400; // %flags{2900} int local401; // %flags{2900} int local402; // %flags{2900} int local403; // %flags{2900} int local404; // %flags{2883} int local405; // %flags{2866}

7/17/2019 New Text Document (10)

16/93

int local406; // %flags{2849} int local407; // %flags{2832} int local408; // %flags{2682} int local409; // %flags{2675} int local41; // %flags{4300} int local410; // %flags{2792} int local411; // %flags{2785} int local412; // %flags{3316} int local413; // %flags{3316} int local414; // %flags{3316} int local415; // %flags{3316} int local416; // %flags{3316} int local417; // %flags{3316} int local418; // %flags{3316} int local419; // %flags{3316} int local42; // %flags{695} int local420; // %flags{3316} int local421; // %flags{3316} int local422; // %flags{3316} int local423; // %flags{3316} int local424; // %flags{3316} int local425; // %flags{3316} int local426; // %flags{3316} int local427; // %flags{3316}

int local428; // %flags{3316} int local429; // %flags{3316} int local43; // %flags{695} int local430; // %flags{3316} int local431; // %flags{3316} int local432; // %flags{3299} int local433; // %flags{3282} int local434; // %flags{3265} int local435; // %flags{3248} int local436; // %flags{3231} int local437; // %flags{3214} int local438; // %flags{3197} int local439; // %flags{3180}

int local44; // %flags{4286} int local440; // %flags{3163} int local441; // %flags{3036} int local442; // %flags{3019} int local443; // %flags{3002} int local444; // %flags{2985} int local445; // %flags{2968} int local446; // %flags{2951} int local447; // %flags{2934} int local448; // %flags{2917} int local449; // %flags{3123} int local45; // %flags{695} int local450; // %flags{3116}

int local451; // %flags{4187} int local452; // %flags{4187} int local453; // %flags{4187} int local454; // %flags{4187} int local455; // %flags{4187} int local456; // %flags{4187} int local457; // %flags{4187} int local458; // %flags{4187} int local459; // %flags{4187} int local46; // %flags{695}

7/17/2019 New Text Document (10)

17/93

int local460; // %flags{4187} int local461; // %flags{4187} int local462; // %flags{4187} int local463; // %flags{4187} int local464; // %flags{4187} int local465; // %flags{4187} int local466; // %flags{4187} int local467; // %flags{4187} int local468; // %flags{4187} int local469; // %flags{4144} int local47; // %flags{4272} int local470; // %flags{3991} int local471; // %flags{3974} int local472; // %flags{3957} int local473; // %flags{3939} int local474; // %flags{3482} int local475; // %flags{3367} int local476; // %flags{3350} int local477; // %flags{3333} int local478; // %flags{3466} int local479; // %flags{3740} int local48; // %flags{695} int local480; // %flags{3735} int local481; // %flags{3537}

int local482; // %flags{3532} int local483; // %flags{3685} int local484; // %flags{3669} int local485; // %flags{3517} int local486; // %flags{3720} int local487; // %ZF{695} int local488; // %ZF{695} int local489; // %ZF{4357} int local49; // %flags{695} int local490; // %ZF{695} int local491; // %ZF{695} int local492; // %ZF{4343} int local493; // %ZF{695}

int local494; // %ZF{695} int local495; // %ZF{695} int local496; // %ZF{4329} int local497; // %ZF{695} int local498; // %ZF{695} int local499; // %ZF{4315} int local5; // m[esp - 4]{4187} int local50; // %flags{695} int local500; // %ZF{695} int local501; // %ZF{695} int local502; // %ZF{4301} int local503; // %ZF{695} int local504; // %ZF{695}

int local505; // %ZF{4287} int local506; // %ZF{695} int local507; // %ZF{695} int local508; // %ZF{4273} int local509; // %ZF{695} int local51; // %flags{695} int local510; // %ZF{695} int local511; // %ZF{695} int local512; // %ZF{695} int local513; // %ZF{4259}

7/17/2019 New Text Document (10)

18/93

int local514; // %ZF{695} int local515; // %ZF{695} int local516; // %ZF{4245} int local517; // %ZF{695} int local518; // %ZF{695} int local519; // %ZF{4231} int local52; // %flags{4258} int local520; // %ZF{695} int local521; // %ZF{695} int local522; // %ZF{653} int local523; // %ZF{611} int local524; // %ZF{569} int local525; // %ZF{563} int local526; // %ZF{521} int local527; // %ZF{863} int local528; // %ZF{863} int local529; // %ZF{4413} int local53; // %flags{695} int local530; // %ZF{863} int local531; // %ZF{863} int local532; // %ZF{4399} int local533; // %ZF{863} int local534; // %ZF{863} int local535; // %ZF{4385}

int local536; // %ZF{863} int local537; // %ZF{863} int local538; // %ZF{4371} int local539; // %ZF{821} int local54; // %flags{695} int local540; // %ZF{779} int local541; // %ZF{737} int local542; // %ZF{422} int local543; // %ZF{464} int local544; // %ZF{506} int local545; // %ZF{548} int local546; // %ZF{596} int local547; // %ZF{638}

int local548; // %ZF{680} int local549; // %ZF{722} int local55; // %flags{4244} int local550; // %ZF{764} int local551; // %ZF{806} int local552; // %ZF{848} int local553; // %ZF{890} int local554; // %ZF{934} int local555; // %ZF{965} int local556; // %ZF{983} int local557; // %ZF{1087} int local558; // %ZF{1094} int local559; // %ZF{479}

int local56; // %flags{695} int local560; // %ZF{437} int local561; // %ZF{395} int local562; // %ZF{353} int local563; // %ZF{347} int local564; // %ZF{341} int local565; // %ZF{299} int local566; // %ZF{257} int local567; // %ZF{284} int local568; // %ZF{236}

7/17/2019 New Text Document (10)

19/93

int local569; // %ZF{326} int local57; // %flags{695} int local570; // %ZF{380} int local571; // %ZF{1247} int local572; // %ZF{1247} int local573; // %ZF{1247} int local574; // %ZF{1247} int local575; // %ZF{1247} int local576; // %ZF{1247} int local577; // %ZF{1247} int local578; // %ZF{1247} int local579; // %ZF{4505} int local58; // %flags{4230} int local580; // %ZF{4469} int local581; // %ZF{1247} int local582; // %ZF{4455} int local583; // %ZF{1247} int local584; // %ZF{4441} int local585; // %ZF{1247} int local586; // %ZF{4427} int local587; // %ZF{1247} int local588; // %ZF{1247} int local589; // %ZF{1247} int local59; // %flags{695}

int local590; // %ZF{1247} int local591; // %ZF{1247} int local592; // %ZF{1247} int local593; // %ZF{1247} int local594; // %ZF{4747} int local595; // %ZF{1247} int local596; // %ZF{1247} int local597; // %ZF{1247} int local598; // %ZF{1247} int local599; // %ZF{1247} unsigned int local6; // m[esp_1 - 8]{1761} int local60; // %flags{695} int local600; // %ZF{4705}

int local601; // %ZF{4595} int local602; // %ZF{1247} int local603; // %ZF{1247} int local604; // %ZF{1247} int local605; // %ZF{1247} int local606; // %ZF{1247} int local607; // %ZF{1247} int local608; // %ZF{1247} int local609; // %ZF{1247} int local61; // %flags{653} int local610; // %ZF{1247} int local611; // %ZF{4565} int local612; // %ZF{1247}

int local613; // %ZF{1247} int local614; // %ZF{4733} int local615; // %ZF{1247} int local616; // %ZF{1247} int local617; // %ZF{1247} int local618; // %ZF{1247} int local619; // %ZF{1247} int local62; // %flags{611} int local620; // %ZF{1247} int local621; // %ZF{1247}

7/17/2019 New Text Document (10)

20/93

int local622; // %ZF{1247} int local623; // %ZF{1247} int local624; // %ZF{1247} int local625; // %ZF{1247} int local626; // %ZF{4691} int local627; // %ZF{1247} int local628; // %ZF{1247} int local629; // %ZF{1247} int local63; // %flags{569} int local630; // %ZF{1247} int local631; // %ZF{1247} int local632; // %ZF{1247} int local633; // %ZF{1247} int local634; // %ZF{1247} int local635; // %ZF{1247} int local636; // %ZF{1247} int local637; // %ZF{1247} int local638; // %ZF{1247} int local639; // %ZF{1247} int local64; // %flags{563} int local640; // %ZF{1247} int local641; // %ZF{1247} int local642; // %ZF{1247} int local643; // %ZF{1247}

int local644; // %ZF{1247} int local645; // %ZF{1247} int local646; // %ZF{1247} int local647; // %ZF{1247} int local648; // %ZF{1247} int local649; // %ZF{1247} int local65; // %flags{521} int local650; // %ZF{1247} int local651; // %ZF{1247} int local652; // %ZF{1247} int local653; // %ZF{1247} int local654; // %ZF{1247} int local655; // %ZF{1247}

int local656; // %ZF{4655} int local657; // %ZF{1247} int local658; // %ZF{1247} int local659; // %ZF{1247} int local66; // %flags{863} int local660; // %ZF{1247} int local661; // %ZF{1247} int local662; // %ZF{1247} int local663; // %ZF{4625} int local664; // %ZF{1247} int local665; // %ZF{1247} int local666; // %ZF{1247} int local667; // %ZF{1247}

int local668; // %ZF{1247} int local669; // %ZF{1247} int local67; // %flags{863} int local670; // %ZF{1247} int local671; // %ZF{1247} int local672; // %ZF{1247} int local673; // %ZF{1247} int local674; // %ZF{1247} int local675; // %ZF{1247} int local676; // %ZF{1247}

7/17/2019 New Text Document (10)

21/93

int local677; // %ZF{1247} int local678; // %ZF{1247} int local679; // %ZF{1247} int local68; // %flags{4412} int local680; // %ZF{1247} int local681; // %ZF{1247} int local682; // %ZF{1247} int local683; // %ZF{1247} int local684; // %ZF{1247} int local685; // %ZF{1247} int local686; // %ZF{1247} int local687; // %ZF{1247} int local688; // %ZF{1247} int local689; // %ZF{1247} int local69; // %flags{863} int local690; // %ZF{1247} int local691; // %ZF{1247} int local692; // %ZF{1247} int local693; // %ZF{1247} int local694; // %ZF{1247} int local695; // %ZF{1247} int local696; // %ZF{1247} int local697; // %ZF{1247} int local698; // %ZF{1247}

int local699; // %ZF{1247} void *local7; // m[esp_1 - 8]{1772} int local70; // %flags{863} int local700; // %ZF{1247} int local701; // %ZF{1247} int local702; // %ZF{1247} int local703; // %ZF{1247} int local704; // %ZF{1247} int local705; // %ZF{1247} int local706; // %ZF{1247} int local707; // %ZF{1247} int local708; // %ZF{4535} int local709; // %ZF{1247}

int local71; // %flags{4398} int local710; // %ZF{1247} int local711; // %ZF{1230} int local712; // %ZF{1213} int local713; // %ZF{1196} int local714; // %ZF{1179} int local715; // %ZF{1162} int local716; // %ZF{1145} int local717; // %ZF{1128} int local718; // %ZF{955} int local719; // %ZF{949} int local72; // %flags{863} int local720; // %ZF{905}

int local721; // %ZF{1723} int local722; // %ZF{1723} int local723; // %ZF{1723} int local724; // %ZF{1723} int local725; // %ZF{1723} int local726; // %ZF{1723} int local727; // %ZF{1723} int local728; // %ZF{1723} int local729; // %ZF{1723} int local73; // %flags{863}

7/17/2019 New Text Document (10)

22/93

int local730; // %ZF{1723} int local731; // %ZF{1723} int local732; // %ZF{1723} int local733; // %ZF{1723} int local734; // %ZF{1723} int local735; // %ZF{1723} int local736; // %ZF{1723} int local737; // %ZF{1723} int local738; // %ZF{1723} int local739; // %ZF{1723} int local74; // %flags{4384} int local740; // %ZF{1723} int local741; // %ZF{1723} int local742; // %ZF{1723} int local743; // %ZF{1723} int local744; // %ZF{1723} int local745; // %ZF{1723} int local746; // %ZF{1723} int local747; // %ZF{1723} int local748; // %ZF{1723} int local749; // %ZF{1706} int local75; // %flags{863} int local750; // %ZF{1689} int local751; // %ZF{1672}

int local752; // %ZF{1655} int local753; // %ZF{1638} int local754; // %ZF{1621} int local755; // %ZF{1604} int local756; // %ZF{1587} int local757; // %ZF{1570} int local758; // %ZF{1553} int local759; // %ZF{1536} int local76; // %flags{863} int local760; // %ZF{1519} int local761; // %ZF{1502} int local762; // %ZF{1485} int local763; // %ZF{1468}

int local764; // %ZF{1451} int local765; // %ZF{1434} int local766; // %ZF{1417} int local767; // %ZF{1400} int local768; // %ZF{1383} int local769; // %ZF{1366} int local77; // %flags{4370} int local770; // %ZF{1349} int local771; // %ZF{1332} int local772; // %ZF{1315} int local773; // %ZF{1298} int local774; // %ZF{1281} int local775; // %ZF{1264}

int local776; // %ZF{2139} int local777; // %ZF{2139} int local778; // %ZF{2139} int local779; // %ZF{2139} int local78; // %flags{821} int local780; // %ZF{2139} int local781; // %ZF{2139} int local782; // %ZF{2139} int local783; // %ZF{2139} int local784; // %ZF{2139}

7/17/2019 New Text Document (10)

23/93

int local785; // %ZF{2139} int local786; // %ZF{2139} int local787; // %ZF{2139} int local788; // %ZF{2139} int local789; // %ZF{2139} int local79; // %flags{779} int local790; // %ZF{2139} int local791; // %ZF{2139} int local792; // %ZF{2139} int local793; // %ZF{2139} int local794; // %ZF{2139} int local795; // %ZF{2139} int local796; // %ZF{2122} int local797; // %ZF{2105} int local798; // %ZF{2088} int local799; // %ZF{2071} void *local8; // m[esp_1 - 8]{2511} int local80; // %flags{737} int local800; // %ZF{2054} int local801; // %ZF{2037} int local802; // %ZF{2020} int local803; // %ZF{2003} int local804; // %ZF{1986} int local805; // %ZF{1969}

int local806; // %ZF{1952} int local807; // %ZF{1935} int local808; // %ZF{1918} int local809; // %ZF{1901} int local81; // %flags{422} int local810; // %ZF{1884} int local811; // %ZF{1867} int local812; // %ZF{1740} int local813; // %ZF{1833} int local814; // %ZF{1826} int local815; // %ZF{2479} int local816; // %ZF{2479} int local817; // %ZF{2479}

int local818; // %ZF{2479} int local819; // %ZF{2479} int local82; // %flags{464} int local820; // %ZF{2479} int local821; // %ZF{2479} int local822; // %ZF{2479} int local823; // %ZF{2479} int local824; // %ZF{2479} int local825; // %ZF{2479} int local826; // %ZF{2479} int local827; // %ZF{2479} int local828; // %ZF{2479} int local829; // %ZF{2479}

int local83; // %flags{506} int local830; // %ZF{2479} int local831; // %ZF{2479} int local832; // %ZF{2479} int local833; // %ZF{2479} int local834; // %ZF{2479} int local835; // %ZF{2462} int local836; // %ZF{2445} int local837; // %ZF{2428} int local838; // %ZF{2411}

7/17/2019 New Text Document (10)

24/93

int local839; // %ZF{2394} int local84; // %flags{548} int local840; // %ZF{2377} int local841; // %ZF{2360} int local842; // %ZF{2343} int local843; // %ZF{2326} int local844; // %ZF{2309} int local845; // %ZF{2292} int local846; // %ZF{2275} int local847; // %ZF{2258} int local848; // %ZF{2241} int local849; // %ZF{2224} int local85; // %flags{596} int local850; // %ZF{2207} int local851; // %ZF{2190} int local852; // %ZF{2173} int local853; // %ZF{2156} int local854; // %ZF{2589} int local855; // %ZF{2582} int local856; // %ZF{2900} int local857; // %ZF{2900} int local858; // %ZF{2900} int local859; // %ZF{2900} int local86; // %flags{638}

int local860; // %ZF{2900} int local861; // %ZF{2900} int local862; // %ZF{2900} int local863; // %ZF{2900} int local864; // %ZF{2900} int local865; // %ZF{2883} int local866; // %ZF{2866} int local867; // %ZF{2849} int local868; // %ZF{2832} int local869; // %ZF{2682} int local87; // %flags{680} int local870; // %ZF{2675} int local871; // %ZF{2792}

int local872; // %ZF{2785} int local873; // %ZF{3316} int local874; // %ZF{3316} int local875; // %ZF{3316} int local876; // %ZF{3316} int local877; // %ZF{3316} int local878; // %ZF{3316} int local879; // %ZF{3316} int local88; // %flags{722} int local880; // %ZF{3316} int local881; // %ZF{3316} int local882; // %ZF{3316} int local883; // %ZF{3316}

int local884; // %ZF{3316} int local885; // %ZF{3316} int local886; // %ZF{3316} int local887; // %ZF{3316} int local888; // %ZF{3316} int local889; // %ZF{3316} int local89; // %flags{764} int local890; // %ZF{3316} int local891; // %ZF{3316} int local892; // %ZF{3316}

7/17/2019 New Text Document (10)

25/93

int local893; // %ZF{3299} int local894; // %ZF{3282} int local895; // %ZF{3265} int local896; // %ZF{3248} int local897; // %ZF{3231} int local898; // %ZF{3214} int local899; // %ZF{3197} unsigned int local9; // m[esp_1 - 8]{2500} int local90; // %flags{806} int local900; // %ZF{3180} int local901; // %ZF{3163} int local902; // %ZF{3036} int local903; // %ZF{3019} int local904; // %ZF{3002} int local905; // %ZF{2985} int local906; // %ZF{2968} int local907; // %ZF{2951} int local908; // %ZF{2934} int local909; // %ZF{2917} int local91; // %flags{848} int local910; // %ZF{3123} int local911; // %ZF{3116} int local912; // %ZF{4187} int local913; // %ZF{4187}

int local914; // %ZF{4187} int local915; // %ZF{4187} int local916; // %ZF{4187} int local917; // %ZF{4187} int local918; // %ZF{4187} int local919; // %ZF{4187} int local92; // %flags{890} int local920; // %ZF{4187} int local921; // %ZF{4187} int local922; // %ZF{4187} int local923; // %ZF{4187} int local924; // %ZF{4187} int local925; // %ZF{4187}

int local926; // %ZF{4187} int local927; // %ZF{4187} int local928; // %ZF{4187} int local929; // %ZF{4187} int local93; // %flags{934} int local930; // %ZF{4144} int local931; // %ZF{3991} int local932; // %ZF{3974} int local933; // %ZF{3957} int local934; // %ZF{3939} int local935; // %ZF{3482} int local936; // %ZF{3367} int local937; // %ZF{3350}

int local938; // %ZF{3333} int local939; // %ZF{3466} int local94; // %flags{965} int local940; // %ZF{3740} int local941; // %ZF{3735} int local942; // %ZF{3537} int local943; // %ZF{3532} int local944; // %ZF{3685} int local945; // %ZF{3669} int local946; // %ZF{3517}

7/17/2019 New Text Document (10)

26/93

int local947; // %ZF{3720} int local948; // %CF{695} int local949; // %CF{695} int local95; // %flags{983} int local950; // %CF{4358} int local951; // %CF{695} int local952; // %CF{695} int local953; // %CF{4344} int local954; // %CF{695} int local955; // %CF{695} int local956; // %CF{695} int local957; // %CF{4330} int local958; // %CF{695} int local959; // %CF{695} int local96; // %flags{1087} int local960; // %CF{4316} int local961; // %CF{695} int local962; // %CF{695} int local963; // %CF{4302} int local964; // %CF{695} int local965; // %CF{695} int local966; // %CF{4288} int local967; // %CF{695} int local968; // %CF{695}

int local969; // %CF{4274} int local97; // %flags{1094} int local970; // %CF{695} int local971; // %CF{695} int local972; // %CF{695} int local973; // %CF{695} int local974; // %CF{4260} int local975; // %CF{695} int local976; // %CF{695} int local977; // %CF{4246} int local978; // %CF{695} int local979; // %CF{695} int local98; // %flags{479}

int local980; // %CF{4232} int local981; // %CF{695} int local982; // %CF{695} int local983; // %CF{653} int local984; // %CF{611} int local985; // %CF{569} int local986; // %CF{563} int local987; // %CF{521} int local988; // %CF{863} int local989; // %CF{863} int local99; // %flags{437} int local990; // %CF{4414} int local991; // %CF{863}

int local992; // %CF{863} int local993; // %CF{4400} int local994; // %CF{863} int local995; // %CF{863} int local996; // %CF{4386} int local997; // %CF{863} int local998; // %CF{863} int local999; // %CF{4372}

L-1:

7/17/2019 New Text Document (10)

27/93

esp_5 = (esp - 4 & 0xfffffff8) - 440; *(int*)(esp_5 + 436) = global0 ^ esp_5; *(__size32*)(esp_5 - 4) = esi; *(__size32*)(esp_5 - 8) = edi; *(__size32*)(esp_5 - 12) = esp_5 + 20; *(__size32*)(esp_5 - 16) = 32; GetCurrentProcess();L-1: *(__size32*)(esp_5 - 20) = eax; OpenProcessToken();L-1: if (eax == 0) {L-1: local0 = *(esp + 28); CloseHandle(*(esp - 4));L-1: *(__size32*)(esp + 412) = global3; *(__size16*)(esp + 416) = (unsigned short) (global4); *(__size8*)(esp + 418) = (unsigned char) (global5); *(__size32*)(esp + 48) = 0x461c3c00; *(__size32*)(esp + 24) = 0; *(__size8*)(esp + 16) = 0; *(__size8*)(esp + 17) = 0; *(__size8*)(esp + 18) = 0;

*(__size8*)(esp + 19) = 0; *(__size32*)(esp + 296) = 0; *(__size32*)(esp + 252) = 0x4019999a; *(__size32*)(esp + 340) = 0x40066666; *(__size32*)(esp + 260) = 0x40466666; *(__size32*)(esp + 368) = 0x40066666; *(__size32*)(esp + 268) = 0x3fa66666; *(__size32*)(esp + 112) = 0x3f99999a; *(__size32*)(esp + 120) = 0x40666666; *(__size32*)(esp + 128) = 0x40066666; *(__size32*)(esp + 136) = 0x40666666; *(__size32*)(esp + 144) = 0x40666666; *(__size32*)(esp + 152) = 0x40466666;

*(__size32*)(esp + 160) = 0x40066666; *(__size32*)(esp + 168) = 0x40066666; *(__size32*)(esp + 176) = 0x40066666; *(__size32*)(esp + 184) = 0x3fa00000; *(__size32*)(esp + 192) = 0x3fa00000; *(__size32*)(esp + 200) = 0x3f8ccccd; *(__size32*)(esp + 208) = 0x3f99999a; *(__size32*)(esp + 216) = 0x3f19999a; *(__size32*)(esp + 224) = 0x3f4ccccd; *(__size32*)(esp + 232) = 0x3f8ccccd; *(__size32*)(esp + 240) = 0x3fc00000; *(__size32*)(esp + 248) = 0x3fb33333; *(__size32*)(esp + 256) = 0x3f666666;

*(__size32*)(esp + 264) = 0x40000000; *(__size32*)(esp + 272) = 0x3f800000; *(__size32*)(esp + 280) = 0x3f800000; *(__size32*)(esp + 288) = 0x3f800000; *(__size32*)(esp + 104) = 0x41c80000; *(__size32*)(esp + 324) = 0x420c0000; *(__size32*)(esp + 364) = 0x41f00000; *(__size32*)(esp + 116) = 0x41c80000; *(__size32*)(esp + 348) = 0x41f00000; *(__size32*)(esp + 124) = 0x420c0000;

7/17/2019 New Text Document (10)

28/93

*(__size32*)(esp + 276) = 0x41c80000; *(__size32*)(esp + 132) = 0x41f00000; *(__size32*)(esp + 376) = 0x420c0000; *(__size32*)(esp + 140) = 0x41f00000; *(__size32*)(esp + 284) = 0x420c0000; *(__size32*)(esp + 148) = 0x42200000; *(__size32*)(esp + 356) = 0x41c80000; *(__size32*)(esp + 156) = 0x41f00000; *(__size32*)(esp + 292) = 0x420c0000; *(__size32*)(esp + 164) = 0x420c0000; *(__size32*)(esp + 384) = 0x42200000; *(__size32*)(esp + 172) = 0x42200000; *(__size32*)(esp + 300) = 0x41c80000; *(__size32*)(esp + 180) = 0x41f00000; *(__size32*)(esp + 392) = 0x420c0000; *(__size32*)(esp + 188) = 0x420c0000; *(__size32*)(esp + 308) = 0x42200000; *(__size32*)(esp + 196) = 0x42340000; *(__size32*)(esp + 380) = 0x42200000; *(__size32*)(esp + 204) = 0x42340000; *(__size32*)(esp + 316) = 0x42480000; *(__size32*)(esp + 212) = 0x42200000; *(__size32*)(esp + 372) = 0x42340000; *(__size32*)(esp + 220) = 0x42480000;

*(__size32*)(esp + 108) = 0x41c80000; *(__size32*)(esp + 228) = 0x41f00000; *(__size32*)(esp + 388) = 0x420c0000; *(__size32*)(esp + 236) = 0x425c0000; *(__size32*)(esp + 332) = 0x420c0000; *(__size32*)(esp + 244) = 0x42480000; *(__size32*)(esp + 360) = 0x42820000; *(__size32*)(esp + 420) = global6; *(__size16*)(esp + 424) = (unsigned short) (global7); *(__size8*)(esp + 426) = (unsigned char) (global8); *(__size32*)(esp + 436) = global9; *(__size16*)(esp + 440) = (unsigned short) (global10); *(__size8*)(esp + 442) = (unsigned char) (global12);

*(__size16*)(esp + 76) = (unsigned short) (global13); *(__size8*)(esp + 78) = (unsigned char) (global14); *(__size16*)(esp + 88) = (unsigned short) (global15); *(__size8*)(esp + 90) = (unsigned char) (global16); *(__size32*)(esp + 428) = global17; *(__size16*)(esp + 432) = (unsigned short) (global18); local0 = -11; *(__size8*)(esp + 434) = (unsigned char) (global19); (*GetStdHandle)(ebp, (unsigned short) (global19), (unsigned char) (global19), (global19), ecx, edx, esp - 4, esi, GetStdHandle, LOGICALFLAGS32(eax), LOGICALFLAGS32(eax), LOGICALFLAGS32(eax));L-1: *(__size32*)(esp + 12) = eax;

local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: esi = SetConsoleTextAttribute; local107 = LOGICALFLAGS32(eax); local1409 = local107; local1410 = local568; local1411 = local1029; if (eax == 0) {

7/17/2019 New Text Document (10)

29/93

L-1: local58 = local1409; local519 = local1410; local980 = local1411; local0 = 0x414e40; ax = proc1(*(esp - 4), ax, al_3, eax, ecx, edx, ebp, esi, edi, , local58, local519, local980); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local106 = LOGICALFLAGS32(eax); local1412 = local106; local1413 = local567; local1414 = local1028; if (eax == 0) {

L-1: local55 = local1412; local516 = local1413; local977 = local1414; local0 = 0x414e60; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local55, local516, local977); /* Warning: also results in al, eax, ecx, edx,esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, ,ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp+ 4));

L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local108 = LOGICALFLAGS32(eax); local1415 = local108; local1416 = local569; local1417 = local1030; if (eax == 0) {L-1: local52 = local1415;

local513 = local1416; local974 = local1417; local0 = 0x414e60; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi,, local52, local513, local974); /* Warning: also results in al, eax, ecx,edx, esp, ebp, esi, edi */L-1: local0 = 0x414e7c; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi,, local102, local563, local1024); /* Warning: also results in al, eax, ecx

7/17/2019 New Text Document (10)

30/93

, edx, esp, ebp, esi, edi */L-1: local0 = 0x414e7c; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi,, local101, local562, local1023); /* Warning: also results in al, eax, ecx, edx, esp_4, ebp, esi, edi */L-1: *(__size32*)(esp_4 + 8) = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp_4, 12, esp_4 + 12), ADDFLAGS32(esp_4, 12, esp_4 + 12), ADDFLAGS32(esp_4, 12, esp_4 + 12));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local109 = LOGICALFLAGS32(eax); local1418 = local109; local1419 = local570; local1420 = local1031; if (eax == 0) {L-1: local47 = local1418;

local508 = local1419; local969 = local1420; local0 = 0x414e80; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi,edi, , local47, local508, local969); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi,, ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax;

local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local81 = LOGICALFLAGS32(eax); local1421 = local81; local1422 = local542; local1423 = local1003; if (eax == 0) {L-1: local44 = local1421; local505 = local1422; local966 = local1423;

local0 = 0x414e8c; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local44, local505, local966); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi,edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1:

7/17/2019 New Text Document (10)

31/93

*(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local82 = LOGICALFLAGS32(eax); local1424 = local82; local1425 = local543; local1426 = local1004; if (eax == 0) {L-1: local41 = local1424; local502 = local1425; local963 = local1426; local0 = 0x414ea4; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local41, local502, local963); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1:

*(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local83 = LOGICALFLAGS32(eax); local1427 = local83; local1428 = local544; local1429 = local1005; if (eax == 0) {L-1: local38 = local1427; local499 = local1428;

local960 = local1429; local0 = 0x414eb0; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local38, local499, local960); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52;

*(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local84 = LOGICALFLAGS32(eax); local1430 = local84; local1431 = local545; local1432 = local1006; if (eax == 0) {L-1: local35 = local1430;

7/17/2019 New Text Document (10)

32/93

local496 = local1431; local957 = local1432; local0 = 0x414ebc; ax = proc1(*(esp - 4), ax, al, eax, ecx,edx, ebp, esi, edi, , local35, local496, local957); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: local0 = 0x414ecc; ax = proc1(*(esp - 4), ax, al, eax, ecx,edx, ebp, esi, edi, , local63, local524, local985); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)(esp + 4) = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 8, esp + 8), ADDFLAGS32(esp, 8, esp + 8), ADDFLAGS32(esp, 8, esp + 8));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local85 = LOGICALFLAGS32(eax); local1433 = local85;

local1434 = local546; local1435 = local1007; if (eax == 0) {L-1: local31 = local1433; local492 = local1434; local953 = local1435; local0 = 0x414ed0; ax = proc1(*(esp - 4), ax, al, eax,ecx, edx, ebp, esi, edi, , local31, local492, local953); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11;

(*edi)(*(esp - 4), ax, al, eax, ecx,edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp+ 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local86 = LOGICALFLAGS32(eax); local1436 = local86; local1437 = local547; local1438 = local1008;

if (eax == 0) {L-1: local28 = local1436; local489 = local1437; local950 = local1438; local0 = 0x414ee8; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local28, local489, local950); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1:

7/17/2019 New Text Document (10)

33/93

*(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax,ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4,esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local87 = LOGICALFLAGS32(eax); local1439 = local87; local1440 = local548; local1441 = local1009; if (eax == 0) {L-1: local77 = local1439; local538 = local1440; local999 = local1441; local0 = 0x414eec; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local77, local538, local999); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1:

*(__size32*)esp = -11; (*edi)(local1, ax, al, eax,ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4,esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local88 = LOGICALFLAGS32(eax

); local1442 = local88; local1443 = local549; local1444 = local1010; if (eax == 0) {L-1: local74 = local1442; local535 = local1443; local996 = local1444; local0 = 0x414f04; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local74, local535, local996); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */

L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) =eax; local0 = esp + 52; *(__size32*)(esp - 8) =

7/17/2019 New Text Document (10)

34/93

eax; GetConsoleScreenBufferInfo();L-1: local89 = LOGICALFLAGS32(eax); local1445 = local89; local1446 = local550; local1447 = local1011; if (eax == 0) {L-1: local71 = local1445; local532 = local1446; local993 = local1447; local0 = 0x414f08; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local71, local532, local993); /*Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), a

x, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local90 = LOGICALFLAGS32(eax);

local1448 = local90; local1449 = local551; local1450 = local1012; if (eax == 0) {L-1: local68 = local1448; local529 = local1449; local990 = local1450;

local0 = 0x414f1c; ax = proc1(*(esp- 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local68, local529, local990); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp= -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADD

7/17/2019 New Text Document (10)

35/93

FLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp+ 12) = eax; local0 = esp + 52; *(__size32*)(esp- 8) = eax; GetConsoleScreenBufferInfo();L-1: local91 = LOGICALFLAGS32(eax); local1451 = local91; local1452 = local552; local1453 = local1013; if (eax == 0) {L-1: local125 = local1451; local586 = l

ocal1452; local1047 =local1453; local0 = 0x414f20; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local125, local586, local1047); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(local2, ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADD

FLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: *(__size32*)(esp + 12) = eax; local0 = esp+ 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local92 = LOGICALFLAGS32(eax);

local1454 =local92; local1455 =local553; local1456 =local1014; if (eax == 0) {L-1: local123

7/17/2019 New Text Document (10)

36/93

= local1454; local584= local1455; local1045 = local1456; local0 =0x414f38; ax = proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local123, local584,local1045); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi, edi */L-1: *(__size32*)esp = -11; (*edi)(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp +4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1: edi = eax; al = (unsigned char) esp + 52; ax = (unsigned short) esp + 52; local0 =

esp + 52; *(__size32*)(esp - 8) = eax; GetConsoleScreenBufferInfo();L-1: local93= LOGICALFLAGS32(eax_3); local1457 = local93; local1458 = local554; local145

9 = local1015; if (eax_3 == 0) {L-1: local121 = local1457; local582 = local1458; local1043 = local1459; local0 = 0x414f3c; ax =

proc1(*(esp - 4), ax, al, eax_3, ecx, edx, ebp, esi, edi, , local121, local582, local1043); /* Warning: also results in al, eax, ecx, edx, esp, ebp, esi,edi */L-1: local0 = 0x414f3c; ax =proc1(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi, edi, , local257, local718, local1179); /* Warning: also results in al, esp_3, ebp */L-1:

7/17/2019 New Text Document (10)

37/93

esi= Sleep; esp= esp_3 + 8; local94 = ADDFLAGS32(esp_3, 8, esp_3 + 8); local1460 = local94; local1461 = local555; local1462 = local1016;L-1: local119 = local1460; local580 = local1461; local1041 = local1462; local0 = 0x414f40; *(__size32*)(esp - 8) = 0; Find

WindowA(*(esp - 8), *(esp - 4));L-1: local0 = 10; (*esi)(local0, ax, al, eax, ecx, edx, ebp, esi, eax, , local119, local580, local1041);L-1: local95 = LOGICALFLAGS32(edi); local1460 = local95; loca

l1461 = local556; local1462 = local1017; if (edi == 0) {goto L-1; }L-1: local0 = esp + 36; *(__size32*)(esp - 8) = edi;

GetWindowThreadProcessId();L-1: *(__size32*)(esp - 12) = *(esp + 28); *(__size32*)(esp - 16) = 1; *(__size32*)(esp - 20) = 0x1fffff; Open

7/17/2019 New Text Document (10)

38/93

Process();L-1: edi= eax; *(__size32*)esp = eax; if (eax == 0) {L-1:esi = WriteProcessMemory;local1463 = ebp;local1464 = esi;local1465 = edi;local1466 = local4;L-1:ebp = local1463;esi = local1464;

edi = local1465;local4 = local1466;local0 = 0;*(__size32*)(esp - 8) = 4;*(void **)(esp - 12) = esp + 92;*(__size32*)(esp - 16) = 0xb6f5f0;

*(__size32*)(esp - 20) = edi;ReadProcessMemory();L-1:if (*(esp + 72)

7/17/2019 New Text Document (10)

39/93

GetAsyncKeyState();

L-1:

ax = (unsigned short) (int) ax_2;

if (((int) ax_2 & 0x80000) == 0) {L-1:

ax_1 = ax;

local0 = 113;

GetAsyncKeyState();L-1:

ax = (unsigned short) (int) ax_1;

if (((int) ax_1 & 0x80000) == 0) {L-1:

local0 = 116;

GetAsyncKeyState();

L-1:if (((int) ax & 0x80000) == 0) {

L-1:

tmpb = *(esp + 17) - 1;

if (*(esp + 17) != 1) {L-1:

ebp_1 = ebp;

esi_1 = esi;

edi_1 = edi;

eax = *(esp + 92);

local1497 = ebp_1;

local1497 = ebp_1;

local1498 = esi_1;

local1498 = esi_1;

local1499 = edi_1;

local1499 = edi_1;

if (eax == 0 || *(esp + 16) == 0) {L-1:

ebp_1 = local1497;

esi_1 = local1498;

7/17/2019 New Text Document (10)

40/93

edi_1 = local1499;

local0 = 10;

Sleep(*(esp - 4));

local1463 = ebp_1;

local1464 = esi_1;

local1465 = edi_1;

local1466 = local0;

goto L-1;

}

L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 40;*(__size32*)(esp - 16) = eax + 20;

*(__size32*)(esp - 20) = edi_1;

*(__size32*)(esp + 40) = eax + 20;

ReadProcessMemory();

L-1:

eax = *(esp + 20);

*(__size32*)(esp - 24) = 0;*(__size32*)(esp - 28) = 4;

*(void **)(esp - 32) = esp + 316;

*(__size32*)(esp - 36) = eax + 48;

*(__size32*)(esp - 40) = *esp;

ReadProcessMemory();

L-1:

*(__size32*)(esp - 44) = 0;

*(__size32*)(esp - 48) = 4;

*(void **)(esp - 52) = esp + 304;

*(__size32*)(esp - 56) = eax + 52;

*(__size32*)(esp - 60) = *(esp - 20);

7/17/2019 New Text Document (10)

41/93

(*ReadProcessMemory)(local4, (unsigned short) esp + 304,(unsigned char) esp + 304, esp + 304, ecx, edx, ebp_1, ReadProcessMemory, eax +56, , ADDFLAGS32(eax, 48, eax + 48), ADDFLAGS32(eax, 48, eax + 48), ADDFLAGS32(eax, 48, eax + 48));L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 396;

*(__size32*)(esp - 16) = edi;

edi = *(esp + 20);

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 396, (unsigned char) esp + 396, esp + 396, ecx, edx, ebp, esi, edi, , local473, local934, local1395);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 320;

*(__size32*)(esp - 16) = 0xb6f9cc;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 320, (unsigned char) esp + 320, esp + 320, ecx, edx, ebp, esi, edi, , local472, local933, local1394);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 328;

*(__size32*)(esp - 16) = 0xb6f9d0;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 328, (unsigned char) esp + 328, esp + 328, ecx, edx, ebp, esi, edi, , local471, local932, loc

al1393);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 304;

*(__size32*)(esp - 16) = 0xb6f3b8;

7/17/2019 New Text Document (10)

42/93

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 304, (unsigned cha

r) esp + 304, esp + 304, ecx, edx, ebp, esi, edi, , local470, local931, local1392);L-1:

eax = *(esp + 304);

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 32;

*(__size32*)(esp - 16) = eax + 1948;

*(__size32*)(esp - 20) = edi;

*(__size32*)(esp + 32) = eax + 1948;

(*esi)(local0, (unsigned short) eax + 1948, (unsigned char) eax + 1948, eax + 1948, esp + 32, edx, ebp, esi, edi, , ADDFLAGS32(eax,

1948, eax + 1948), ADDFLAGS32(eax, 1948, eax + 1948), ADDFLAGS32(eax, 1948, eax+ 1948));

local1497 = ebp;

local1499 = edi;L-1:

eax = *(esp + 32);

if (eax == 0) {L-1:

esi = WriteProcessMemory;local1498 = esi;

goto L-1;

}

L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 408;

*(__size32*)(esp - 16) = eax + 68;

*(__size32*)(esp - 20) = edi;

ReadProcessMemory();L-1:

*(__size32*)(esp - 24) = 0;

7/17/2019 New Text Document (10)

43/93

*(__size32*)(esp - 28) = 4;

*(void **)(esp - 32) = esp + 384;

*(__size32*)(esp - 36) = eax + 72;

*(__size32*)(esp - 40) = edi;

(*ReadProcessMemory)(local0, (unsigned short) esp + 384,

(unsigned char) esp + 384, esp + 384, ecx, edx, ebp, ReadProcessMemory, edi, , ADDFLAGS32(eax, 68, eax + 68), ADDFLAGS32(eax, 68, eax + 68), ADDFLAGS32(eax, 68, eax + 68));L-1:

eax = *(esp + 32);

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 44;

*(__size32*)(esp - 16) = eax + 20;

*(__size32*)(esp - 20) = edi;

*(__size32*)(esp + 44) = eax + 20;

(*esi)(local0, (unsigned short) eax + 20, (unsigned char) eax + 20, eax + 20, esp + 44, edx, ebp, esi, edi, , ADDFLAGS32(eax, 20, eax + 20), ADDFLAGS32(eax, 20, eax + 20), ADDFLAGS32(eax, 20, eax + 20));L-1:

eax = *(esp + 44);

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 80;

*(__size32*)(esp - 16) = eax + 48;

*(__size32*)(esp - 20) = *(esp + 20);

ReadProcessMemory();L-1:

*(__size32*)(esp - 24) = 0;

*(__size32*)(esp - 28) = 4;

*(void **)(esp - 32) = esp + 64;

*(__size32*)(esp - 36) = eax + 52;

*(__size32*)(esp - 40) = *esp;

(*ReadProcessMemory)(local0, (unsigned short) esp + 64,

7/17/2019 New Text Document (10)

44/93

(unsigned char) esp + 64, esp + 64, ecx, edx, ebp, ReadProcessMemory, eax + 56,, ADDFLAGS32(eax, 48, eax + 48), ADDFLAGS32(eax, 48, eax + 48), ADDFLAGS32(eax, 48, eax + 48));L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 400;

*(__size32*)(esp - 16) = edi;

edi = *(esp + 20);

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 400, (unsigned char) esp + 400, esp + 400, ecx, edx, ebp, esi, edi, , local469, local930, local1391);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;*(void **)(esp - 12) = esp + 312;

eax = *(esp + 32);

*(__size32*)(esp - 16) = eax + 1344;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) eax + 1344, (unsigned ch

ar) eax + 1344, eax + 1344, ecx, edx, ebp, esi, edi, , ADDFLAGS32(eax, 1344, eax + 1344), ADDFLAGS32(eax, 1344, eax + 1344), ADDFLAGS32(eax, 1344, eax + 13

44));L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 96;

*(__size32*)(esp - 16) = 0xb7cdbc;

*(__size32*)(esp - 20) = edi;

(*esi)(local5, (unsigned short) esp + 96, (unsigned char) esp + 96, esp + 96, ecx, edx, ebp, esi, edi, , local451, local912, local1373);L-1:

}L-1:

local0 = 0;

7/17/2019 New Text Document (10)

45/93

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 296;

*(__size32*)(esp - 16) = 0xb7cdc8;

*(__size32*)(esp - 20) = edi;

(*esi)(*(esp - 4), (unsigned short) esp + 296, (unsigned char) esp + 296, esp + 296, ecx, edx, ebp, esi, edi, , SUBFLAGS8(*(esp + 17),1, tmpb), tmpb == 0, *(esp + 17) < 1);

goto L-1;

}L-1:

al = *(esp + 15);

al_6 = al ^ 1;

*(int*)(esp + 15) = al ^ 1;

if ((al ^ 1) != 1) {

L-1:if (al_6 != 0) {

goto L-1;

}

L-1:

local0 = -11;

GetStdHandle(*(esp - 4));L-1:

al = (unsigned char) esp + 52;

ax = (unsigned short) esp + 52;

local0 = esp + 52;

*(__size32*)(esp - 8) = eax;

GetConsoleScreenBufferInfo();L-1:

local484 = LOGICALFLAGS32(eax_5);

local1491 = local484;

local1492 = local945;

local1493 = local1406;

if (eax_5 == 0) {

L-1:

7/17/2019 New Text Document (10)

46/93

esi = SetConsoleTextAttribute;L-1:

local153 = local1491;

local614 = local1492;

local1075 = local1493;

local0 = 0x414fe8;

ax = proc1(*(esp - 4), ax, al, eax_5, ecx, edx, ebp, esi, edi, , local153, local614, local1075); /* Warning: also results in al, esp, ebp, esi, edi */L-1:

*(__size32*)esp = 16;

MessageBeep();L-1:

local0 = -11;

GetStdHandle(*(esp - 4));

L-1:*(__size32*)(esp + 12) = eax;

local14 = esp + 52;

*(__size32*)(esp - 8) = eax;

GetConsoleScreenBufferInfo();

L-1:

local486 = LOGICALFLAGS32(eax);

local1494 = local486;local1495 = local947;

local1496 = local1408;

if (eax == 0) {

L-1:

local133 = local1494;

local594 = local1495;

local1055 = local1496;

edx = *(esp + 36);

eax = proc2(*(esp - 4), ax, al, eax, ecx, edx, ebp,esi, edi, , local133, local594, local1055); /* Warning: also results in esp, ebp, edi */L-1:

local0 = 0;

7/17/2019 New Text Document (10)

47/93

*(__size32*)(esp - 8) = 6;

*(void **)(esp - 12) = esp + 420;

*(__size32*)(esp - 16) = eax + 0x85732;

*(__size32*)(esp - 20) = edi;

WriteProcessMemory();

L-1:

*(__size32*)(esp - 24) = 0;

*(__size32*)(esp - 28) = 6;

*(void **)(esp - 32) = esp + 416;

*(__size32*)(esp - 36) = eax + 0x85753;

*(__size32*)(esp - 40) = edi;

WriteProcessMemory();L-1:

*(__size32*)(esp - 44) = 0;

*(__size32*)(esp - 48) = 2;

*(void **)(esp - 52) = esp + 36;

*(__size32*)(esp - 56) = eax + 0x85867;

*(__size32*)(esp - 60) = edi;

WriteProcessMemory();L-1:

*(__size32*)(esp - 64) = 0;

*(__size32*)(esp - 68) = 2;

*(void **)(esp - 72) = esp + 28;

*(__size32*)(esp - 76) = eax + 0x86967;

*(__size32*)(esp - 80) = edi;

WriteProcessMemory();L-1:

*(__size32*)(esp - 84) = 0;

*(__size32*)(esp - 88) = 6;

*(void **)(esp - 92) = esp + 348;

*(__size32*)(esp - 96) = eax + 0x86853;

*(__size32*)(esp - 100) = edi;

7/17/2019 New Text Document (10)

48/93

(*WriteProcessMemory)(local0, (unsigned short) eax +

0x86853, (unsigned char) eax + 0x86853, eax + 0x86853, ecx, edx, ebp, WriteProcessMemory, edi, , local479, local940, local1401);L-1:

local0 = 300;

Sleep(*(esp - 4));

goto L-1;

}L-1:

ecx = *(esp + 52);

*(__size32*)(esp - 12) = (ecx & 0xf0) + 15;

*(__size32*)(esp - 16) = *(esp + 4);

(*esi)(*(esp - 4), ax, al, eax, (ecx & 0xf0) + 15, edx,ebp, esi, edi, , ADDFLAGS32(ecx & 0xf0, 15, (ecx & 0xf0) + 15), ADDFLAGS32(ecx & 0xf0, 15, (ecx & 0xf0) + 15), ADDFLAGS32(ecx & 0xf0, 15, (ecx & 0xf0) + 15

));local1494 = local480;

local1495 = local941;

local1496 = local1402;

goto L-1;

}

L-1:

ecx = *(esp + 52);*(__size32*)(esp - 12) = (ecx & 0xf0) + 12;

*(__size32*)(esp - 16) = eax;

(*SetConsoleTextAttribute)(*(esp - 4), (unsigned short) esp

+ 52, (unsigned char) esp + 52, eax_5, (ecx & 0xf0) + 12, edx, ebp, SetConsoleTextAttribute, edi, , ADDFLAGS32(ecx & 0xf0, 12, (ecx & 0xf0) + 12), ADDFLAGS32(ecx & 0xf0, 12, (ecx & 0xf0) + 12), ADDFLAGS32(ecx & 0xf0, 12, (ecx & 0xf0) +12));

local1491 = local483;

local1492 = local944;

local1493 = local1405;

goto L-1;

}

L-1:

7/17/2019 New Text Document (10)

49/93

*(__size32*)(esp - 8) = -11;

GetStdHandle(*(esp - 8));L-1:

al = (unsigned char) esp + 48;

ax = (unsigned short) esp + 48;

local22 = esp + 48;

*(__size32*)(esp - 12) = eax;

GetConsoleScreenBufferInfo();L-1:

local478 = LOGICALFLAGS32(eax_4);

local1485 = local478;

local1486 = local939;

local1487 = local1400;

if (eax_4 == 0) {L-1:

esi = SetConsoleTextAttribute;L-1:

local165 = local1485;

local626 = local1486;

local1087 = local1487;

local0 = 0x414fcc;

ax = proc1(*(esp - 4), ax, al, eax_4, ecx, edx, ebp, esi, edi, , local165, local626, local1087); /* Warning: also results in al, esp, ebp, esi, edi */L-1:

*(__size32*)esp = 0;

MessageBeep();L-1:

local0 = -11;

GetStdHandle(*(esp - 4));L-1:

*(__size32*)(esp + 12) = eax;

local17 = esp + 52;

*(__size32*)(esp - 8) = eax;

GetConsoleScreenBufferInfo();

7/17/2019 New Text Document (10)

50/93

L-1:

local485 = LOGICALFLAGS32(eax);

local1488 = local485;

local1489 = local946;

local1490 = local1407;

if (eax == 0) {L-1:

local139 = local1488;

local600 = local1489;

local1061 = local1490;

edx = *(esp + 36);

eax = proc2(*(esp - 4), ax, al, eax, ecx, edx, ebp, esi,edi, , local139, local600, local1061); /* Warning: also results in esp, ebp, edi */

L-1:local0 = 0;

*(__size32*)(esp - 8) = 6;

*(void **)(esp - 12) = esp + 412;

*(__size32*)(esp - 16) = eax + 0x85732;

*(__size32*)(esp - 20) = edi;

WriteProcessMemory();

L-1:*(__size32*)(esp - 24) = 0;

*(__size32*)(esp - 28) = 6;

*(void **)(esp - 32) = esp + 392;

*(__size32*)(esp - 36) = eax + 0x85753;

*(__size32*)(esp - 40) = edi;

WriteProcessMemory();

L-1:

*(__size32*)(esp - 44) = 0;

*(__size32*)(esp - 48) = 2;

*(void **)(esp - 52) = esp + 372;

*(__size32*)(esp - 56) = eax + 0x85867;

7/17/2019 New Text Document (10)

51/93

*(__size32*)(esp - 60) = edi;

WriteProcessMemory();L-1:

*(__size32*)(esp - 64) = 0;

*(__size32*)(esp - 68) = 2;

*(void **)(esp - 72) = esp + 352;

*(__size32*)(esp - 76) = eax + 0x86967;

*(__size32*)(esp - 80) = edi;

WriteProcessMemory();L-1:

*(__size32*)(esp - 84) = 0;

*(__size32*)(esp - 88) = 6;

*(void **)(esp - 92) = esp + 332;

*(__size32*)(esp - 96) = eax + 0x86853;*(__size32*)(esp - 100) = edi;

(*WriteProcessMemory)(local0, (unsigned short) eax + 0x8

6853, (unsigned char) eax + 0x86853, eax + 0x86853, ecx, edx, ebp, WriteProcessMemory, edi, , local481, local942, local1403);L-1:

local0 = 300;

Sleep(*(esp - 4));L-1:

al_6 = *(esp + 19);

goto L-1;

}L-1:

ecx = *(esp + 52);

*(__size32*)(esp - 12) = (ecx & 0xf0) + 15;

*(__size32*)(esp - 16) = *(esp + 4);

(*esi)(*(esp - 4), ax, al, eax, (ecx & 0xf0) + 15, edx, ebp,

esi, edi, , ADDFLAGS32(ecx & 0xf0, 15, (ecx & 0xf0) + 15), ADDFLAGS32(ecx& 0xf0, 15, (ecx & 0xf0) + 15), ADDFLAGS32(ecx & 0xf0, 15, (ecx & 0xf0) + 15));

local1488 = local482;

local1489 = local943;

local1490 = local1404;

7/17/2019 New Text Document (10)

52/93

goto L-1;

}

L-1:

ecx = *(esp + 48);

*(__size32*)(esp - 16) = (ecx & 0xf0) + 10;

*(__size32*)(esp - 20) = eax;

(*SetConsoleTextAttribute)(*(esp - 4), (unsigned short) esp + 48, (unsigned char) esp + 48, eax_4, (ecx & 0xf0) + 10, edx, ebp, SetConsoleTextAttribute, edi, , ADDFLAGS32(ecx & 0xf0, 10, (ecx & 0xf0) + 10), ADDFLAGS32(ecx & 0xf0, 10, (ecx & 0xf0) + 10), ADDFLAGS32(ecx & 0xf0, 10, (ecx & 0xf0) + 10));

local1485 = local474;

local1486 = local935;

local1487 = local1396;

goto L-1;}

L-1:

al = *(esp + 14);

al_5 = al ^ 1;

ax = ((unsigned short) (int) ax_1 >> 8 & 0xff | (al)) >> 8 & 0xff |(al ^ 1);

*(int*)(esp + 14) = al ^ 1;

if ((al ^ 1) != 1) {L-1:

if (al_5 != 0) {

goto L-1;

}L-1:

local0 = -11;

GetStdHandle(*(esp - 4));L-1:

*(__size32*)(esp + 12) = eax;

local0 = esp + 52;

*(__size32*)(esp - 8) = eax;

GetConsoleScreenBufferInfo();

7/17/2019 New Text Document (10)

53/93

L-1:

local450 = LOGICALFLAGS32(eax);

local1482 = local450;

local1483 = local911;

local1484 = local1372;

if (eax == 0) {L-1:

local195 = local1482;

local656 = local1483;

local1117 = local1484;

local0 = 0x414fbc;

esp = proc1(*(esp - 4), ax, al_5, eax, ecx, edx, ebp, esi, edi, , local195, local656, local1117); /* Warning: also results in ebp, esi,edi */

L-1:*(__size32*)esp = 16;

MessageBeep();

L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 184;

*(__size32*)(esp - 16) = 0xc8c450;*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 184, (unsigned char) e

sp + 184, esp + 184, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 192;

*(__size32*)(esp - 16) = 0xc8c530;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 192, (unsigned char) esp + 192, esp + 192, ecx, edx, ebp, esi, edi, , local440, local901, local1362);L-1:

7/17/2019 New Text Document (10)

54/93

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 200;

*(__size32*)(esp - 16) = 0xc8c6f0;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 200, (unsigned char) e

sp + 200, esp + 200, ecx, edx, ebp, esi, edi, , local439, local900, local1361);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 208;

*(__size32*)(esp - 16) = 0xc8c760;

*(__size32*)(esp - 20) = edi;(*esi)(local0, (unsigned short) esp + 208, (unsigned char) e

sp + 208, esp + 208, ecx, edx, ebp, esi, edi, , local438, local899, local1360);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 216;

*(__size32*)(esp - 16) = 0xc8c7d0;*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 216, (unsigned char) e

sp + 216, esp + 216, ecx, edx, ebp, esi, edi, , local437, local898, local1359);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 224;

*(__size32*)(esp - 16) = 0xc8c840;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 224, (unsigned char) esp + 224, esp + 224, ecx, edx, ebp, esi, edi, , local436, local897, local1358);L-1:

7/17/2019 New Text Document (10)

55/93

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 232;

*(__size32*)(esp - 16) = 0xc8c8b0;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 232, (unsigned char) e

sp + 232, esp + 232, ecx, edx, ebp, esi, edi, , local435, local896, local1357);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 240;

*(__size32*)(esp - 16) = 0xc8c4c0;

*(__size32*)(esp - 20) = edi;(*esi)(local0, (unsigned short) esp + 240, (unsigned char) e

sp + 240, esp + 240, ecx, edx, ebp, esi, edi, , local434, local895, local1356);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 248;

*(__size32*)(esp - 16) = 0xc8c5a0;*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 248, (unsigned char) e

sp + 248, esp + 248, ecx, edx, ebp, esi, edi, , local433, local894, local1355);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 256;

*(__size32*)(esp - 16) = 0xc8c610;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 256, (unsigned char) esp + 256, esp + 256, ecx, edx, ebp, esi, edi, , local432, local893, local1354);L-1:

7/17/2019 New Text Document (10)

56/93

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 264;

*(__size32*)(esp - 16) = 0xc8c680;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 264, (unsigned char) e

sp + 264, esp + 264, ecx, edx, ebp, esi, edi, , local412, local873, local1334);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 272;

*(__size32*)(esp - 16) = 0xc8c960;

*(__size32*)(esp - 20) = edi;(*esi)(local0, (unsigned short) esp + 272, (unsigned char) e

sp + 272, esp + 272, ecx, edx, ebp, esi, edi, , local477, local938, local1399);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 280;

*(__size32*)(esp - 16) = 0xc8c9d0;*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 280, (unsigned char) e

sp + 280, esp + 280, ecx, edx, ebp, esi, edi, , local476, local937, local1398);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 288;

*(__size32*)(esp - 16) = 0xc8cb90;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 288, (unsigned char) esp + 288, esp + 288, ecx, edx, ebp, esi, edi, , local475, local936, local1397);L-1:

7/17/2019 New Text Document (10)

57/93

local0 = -11;

GetStdHandle(*(esp - 4));

L-1:

*(__size32*)(esp + 12) = eax;

local0 = esp + 52;

*(__size32*)(esp - 8) = eax;

GetConsoleScreenBufferInfo();L-1:

if (eax == 0) {L-1:

local0 = 300;

Sleep(*(esp - 4));

goto L-1;

}L-1:

ecx = *(esp + 52);

*(__size32*)(esp - 12) = (ecx & 0xf0) + 15;

*(__size32*)(esp - 16) = *(esp + 4);

SetConsoleTextAttribute();

goto L-1;

}L-1:

ecx = *(esp + 52);

local449 = ADDFLAGS32(ecx & 0xf0, 12, (ecx & 0xf0) + 12);

*(__size32*)(esp - 12) = (ecx & 0xf0) + 12;

*(__size32*)(esp - 16) = *(esp + 4);

SetConsoleTextAttribute();

local1482 = local449;

local1483 = local910;

local1484 = local1371;

goto L-1;

}L-1:

7/17/2019 New Text Document (10)

58/93

*(__size32*)(esp - 8) = -11;

GetStdHandle(*(esp - 8));

L-1:

*(__size32*)(esp + 8) = eax;

local24 = esp + 48;

*(__size32*)(esp - 12) = eax;

GetConsoleScreenBufferInfo();L-1:

local411 = LOGICALFLAGS32(eax);

local1479 = local411;

local1480 = local872;

local1481 = local1333;

if (eax == 0) {

L-1:local202 = local1479;

local663 = local1480;

local1124 = local1481;

local0 = 0x414fac;

esp = proc1(*(esp - 4), ((unsigned short) (int) ax_1 >> 8 & 0xff

| (al)) >> 8 & 0xff | (al ^ 1), al ^ 1, eax, ecx, edx, ebp, esi, edi, , local202, local663, local1124); /* Warning: also results in ebp, esi, edi */

L-1:*(__size32*)esp = 0;

MessageBeep();

L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 252;

*(__size32*)(esp - 16) = 0xc8c450;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 252, (unsigned char) esp +252, esp + 252, ecx, edx, ebp, esi, edi, , ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4), ADDFLAGS32(esp, 4, esp + 4));L-1:

local0 = 0;

7/17/2019 New Text Document (10)

59/93

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 340;

*(__size32*)(esp - 16) = 0xc8c530;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 340, (unsigned char) esp +

340, esp + 340, ecx, edx, ebp, esi, edi, , local407, local868, local1329);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 260;

*(__size32*)(esp - 16) = 0xc8c6f0;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 260, (unsigned char) esp +

260, esp + 260, ecx, edx, ebp, esi, edi, , local406, local867, local1328);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 368;

*(__size32*)(esp - 16) = 0xc8c760;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 368, (unsigned char) esp +368, esp + 368, ecx, edx, ebp, esi, edi, , local405, local866, local1327);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 268;

*(__size32*)(esp - 16) = 0xc8c7d0;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 268, (unsigned char) esp +

268, esp + 268, ecx, edx, ebp, esi, edi, , local404, local865, local1326);L-1:

local0 = 0;

*(__size32*)(esp - 8) = 4;

*(void **)(esp - 12) = esp + 112;

7/17/2019 New Text Document (10)

60/93

*(__size32*)(esp - 16) = 0xc8c840;

*(__size32*)(esp - 20) = edi;

(*esi)(local0, (unsigned short) esp + 112, (unsigned char) esp +

112, esp + 112, ecx, edx, ebp, esi, edi, , local395, local856, local1317);L-1:

local0 = 0;

*(__s