Function at 0x401000
Capabilities:
Create process on windows
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edi, ebx
call sub.user32.dll_GetActiveWindow
or ebx, ecx
cmp eax, 0xffffff14
jne 0x4010ab
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
ret
add ecx, 0xf32e1faa
mov ecx, 0xf32e9249
or edi, edx
call sub.user32.dll_GetClipboardViewer
xor edx, ecx
mov ecx, 0xf3300a1b
mov ebx, edx
add ebx, 0xf330dfac
or edi, 0xf3311cfe
or edi, 0xf3315a80
cmp eax, 0xffffff21
jne 0x40114d
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
ret
shl ecx, 0x13
sub edi, ecx
xchg ecx, edi
or edx, edi
mov edi, 0xf33435cd
call sub.user32.dll_GetClipboardViewer
bswap ecx
inc ebx
mov edx, edi
bswap edx
sub edx, ecx
and ecx, edi
inc ecx
shr edi, 0xe
cmp eax, 0xffffff2b
jne 0x4011d0
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_NtOpenEventPair
ret
xchg edx, edi
or edi, ecx
or ecx, ebx
and edx, edi
mov ebx, ecx
call sub.user32.dll_GetActiveWindow
xchg edi, edx
cmp eax, 0xffffff18
jne 0x40125b
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_NtOpenEventPair
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.ntdll.dll_ZwCreateProcessEx
call sub.advapi32.dll_IsValidSid
ret
jmp 0x494637
add ebx, 0xf44da7f8
xor edi, ecx
rol edi, 0xe
or ecx, edi
bswap edx
ror ecx, 1
jmp 0x4955be
push 0xf463f2e7
ror ecx, 0xc
rol ecx, 0x18
add edi, ebx
rol ecx, 0xc
sub ebx, ecx
sub edi, ecx
xchg ecx, ebx
and edi, ebx
add edi, 0xfa398553
inc ebx
rol ebx, 9
jmp 0x496833
pop esi
shr edx, 0x15
mov edi, ecx
mov ebx, edi
mov edi, ecx
or edi, ebx
add ecx, edx
jmp 0x496ede
push 0xf475ca32
sub edi, edx
xchg edi, ecx
add ecx, 0xfa5211c2
rol ecx, 0x1f
add edx, ecx
dec ecx
neg ebx
sub ecx, 0xfa544814
and edx, 0xfa54b944
add ecx, ebx
jmp 0x496d36
push 0xf464914c
xor edx, edi
xchg edi, ebx
jmp 0x494734
push 0xf464db8d
shl edx, 0x1f
sub edx, edi
not ecx
and ecx, edi
or ebx, edi
inc edx
xor edx, ecx
add edx, ecx
xchg edx, edi
xchg edx, ecx
xor edx, 0xfa5b54e7
mov edi, edx
xor edx, ebx
jmp 0x496593
pop esi
add ecx, edx
and edx, ecx
and ebx, edx
or ecx, ebx
or ecx, edi
shr ecx, 4
sub ebx, edx
jmp 0x4946fc
push 0xf4598937
shr ecx, 7
sub edx, ecx
neg edi
mov ebx, 0xfa6fe0a7
sub edx, ebx
nop
xor ecx, 0xfa713ff3
sub edx, ebx
jmp 0x49725d
pop esi
neg edx
xor ecx, ebx
and ebx, edx
xor ecx, edi
sub ebx, edi
sub edx, ebx
bswap ecx
shr edx, 0xe
or edx, ebx
or ebx, ecx
and edi, ebx
ror edi, 7
jmp 0x49684d
push 0xf467bde6
or edi, edx
xor edi, ecx
xor ebx, edi
xor ecx, ebx
xchg edx, ebx
xchg edx, ecx
shl edi, 0x11
and edi, edx
jmp 0x494a47
call esi
nop
sub ecx, ebx
add edx, 0xfab192a0
and edi, ecx
dec edi
xor edi, 0xfab97a5c
add ecx, ebx
xchg ebx, edx
inc edx
mov ebx, ecx
mov edx, ecx
and edi, 0xfabc0ea1
jmp 0x49503f
push 0xf472a279
add edx, edi
mov ebx, edi
sub ebx, edx
xor ecx, ebx
shl edx, 0xd
and edx, ebx
or ebx, 0xfacee354
mov ecx, edx
xor edi, ebx
xchg edx, edi
and ebx, edi
sub edi, ebx
jmp 0x494b86
push 0xf4680eaf
not edi
ror ecx, 7
or edx, edi
shr ecx, 0x19
mov edx, ebx
mov ebx, edi
add edi, ebx
shl edi, 0x1e
inc ecx
jmp 0x494a65
mov esi, 0x123b2f04
or edi, edx
xchg ebx, ecx
shr ebx, 0x1f
shr ecx, 7
dec ecx
xchg ebx, ecx
jmp 0x496c04
pop esi
neg ecx
mov ebx, 0xfaf69260
not ebx
and ebx, ecx
and edi, edx
or edi, ecx
and edi, ebx
xchg edi, edx
sub edi, 0xfafbaa36
xchg edi, ebx
mov ebx, 0xfafc8d63
bswap ebx
shr ebx, 0xd
add ecx, ebx
jmp 0x496d78
pop esi
add edi, edx
sub edi, edx
sub edi, 0xfb0c998c
shl ecx, 0xa
neg ebx
sub ebx, edi
and ecx, edx
jmp 0x494c66
push 0xf472f1a3
add edx, ecx
rol ebx, 0xa
or ebx, edi
shl edi, 1
add edi, 0xfb185138
or edx, 0xfb18cef7
mov ebx, 0xfb1cb281
and ebx, ecx
ror edi, 6
sub edx, edi
and ebx, ecx
or edx, ebx
jmp 0x4960f3
pop esi
add ecx, ebx
sub ecx, 0xfb3ca89b
and edx, 0xfb3d1675
mov ecx, edi
and edi, 0xfb3df880
or ecx, edx
xor edx, 0xfb40f5ce
bswap edi
or ebx, 0xfb41df8d
add edx, edi
add edx, 0xfb42c046
sub edx, 0xfb432e05
sub edx, ecx
jmp 0x495446
pop esi
and ecx, edi
xor ecx, ebx
neg ebx
not ebx
add edx, 0xfb4987af
xchg edx, ebx
xor ecx, edi
xchg ecx, ebx
and ecx, 0xfb4b6bc3
jmp 0x49559f
call fcn.00495754
and ecx, 0xfb5d5b4a
not edi
or ecx, 0xfb5e2e61
and edx, ebx
bswap edx
and edx, edi
neg ebx
sub edi, 0xfb606bfd
jmp 0x496caa
mov esi, 0x123b2f04
shl ecx, 7
sub ebx, edx
add ecx, 0xfb61d268
or ebx, edx
or edi, ecx
or ebx, edx
mov edx, edi
xchg ecx, edi
mov ecx, edx
sub ebx, edx
jmp 0x496d64
pop esi
or edx, ecx
and ecx, ebx
add edi, 0xfb684b71
mov edx, ebx
xor edx, edi
or edi, 0xfb69a038
jmp 0x495081
pop esi
xchg edx, ebx
rol ebx, 0xb
and edx, edi
or edx, edi
or ecx, edi
shl edi, 0x1e
jmp 0x494e45
pop esi
xchg edx, edi
or edi, edx
not edi
xchg edx, ecx
shl ecx, 0x1c
jmp 0x494865
call esi
mov edi, ecx
mov edx, edi
sub ecx, edx
jmp 0x496a80
mov esi, 0x2774562b
or ebx, ecx
shr edx, 0x1d
and ecx, 0xfba4f0cb
sub ebx, ecx
and ebx, ecx
jmp 0x49542e
push 0xf45e931d
neg ecx
shr edi, 0x17
shr ecx, 0x13
mov edx, ebx
jmp 0x495cba
pop esi
and ebx, ecx
sub ebx, edx
xor ecx, edi
xchg edi, ecx
shl edx, 6
inc edx
jmp 0x496954
pop esi
rol edx, 9
add edi, ebx
shl edi, 0xd
xchg ecx, edi
mov ebx, ecx
shl ebx, 0x19
jmp 0x494acd
pop esi
ror ecx, 1
or edi, ecx
add edx, edi
rol ebx, 0x18
mov edx, ecx
and ebx, 0xfbfa7f58
mov edx, ebx
jmp 0x4953fe
mov esi, 0x2774562b
add ecx, edx
sub edi, 0xfbfbf072
shr ebx, 0x11
add ecx, edx
neg edx
sub ebx, edi
xor ebx, 0xfbfe1d77
xor ecx, edi
or ebx, 0xfbff07aa
sub ebx, 0xfbff7942
and edx, edi
jmp 0x49562d
push 0xf471ffdc
sub edi, ecx
add ebx, 0xfc00e120
dec ebx
and ebx, edx
sub edi, ecx
and ebx, 0xfc02ae18
jmp 0x496fb1
push 0xf4607446
or ecx, ebx
neg edi
and ebx, edi
rol edi, 0x10
add edi, 0xfc140ec4
xor ebx, edi
jmp 0x496dcb
call esi
or ecx, 0xfc151afd
sub edi, edx
jmp 0x4969c8
call esi
sub ebx, ecx
or ecx, edi
xor ebx, 0xfc607075
xor ecx, edi
or ecx, edi
jmp 0x496574
pop esi
xchg ecx, edx
xchg ebx, ecx
xchg edi, ebx
and ecx, edi
add edi, 0xfc6df5d6
inc ebx
add ecx, 0xfc6ee60b
mov edi, ebx
neg edi
xor ebx, 0xfc7037f0
xor ecx, ebx
jmp 0x4973ae
pop esi
or ecx, edi
add edi, edx
shl edi, 2
or edi, edx
not edx
xchg ecx, ebx
dec edi
sub ebx, 0xfc7717e6
neg edx
or ebx, ecx
mov edx, edi
or ecx, 0xfc78e5bd
xchg edx, ecx
jmp 0x494770
push 0xf46ebcbc
shl edx, 0xe
and edx, ebx
ror edi, 0x16
neg ecx
not ebx
xchg edi, ebx
shl edx, 0x1f
or edi, ebx
jmp 0x4959b5
mov esi, 0x2774562b
sub edx, edi
rol ebx, 8
add ebx, ecx
xor ecx, edx
jmp 0x496b45
call fcn.00495754
rol ecx, 5
xor edi, ebx
shl ebx, 4
xor ecx, 0xfcbb6b05
add ecx, edi
xor ebx, edx
add edi, edx
neg edx
jmp 0x494929
push 0xf471ac0c
xchg edx, ebx
xchg edi, edx
shr ebx, 0xd
inc edx
xor edx, edi
add ebx, ecx
shl edi, 0xd
shl edx, 0x1d
or ecx, 0xfcc7f2c3
or edx, 0xfcc8648d
xchg ecx, ebx
xor ebx, 0xfcc946d8
jmp 0x4950cc
call fcn.00495754
mov ebx, edi
or ecx, edx
xchg edx, ebx
and edi, edx
xchg edx, ecx
add edi, ebx
xchg edx, edi
jmp 0x495178
pop esi
neg ebx
and edx, ebx
mov edi, ebx
bswap edi
inc ecx
mov edi, ecx
jmp 0x496238
push 0xf46aa138
xor edx, ecx
xchg edx, ecx
or ebx, edi
add ebx, ecx
bswap ecx
xor edx, 0xfcdb5c8a
rol ecx, 0x1d
and ecx, edi
jmp 0x495aa1
call fcn.00495754
sub edx, ebx
not edi
or ecx, ebx
and ebx, ecx
sub edi, edx
not edi
xor ebx, ecx
xor edx, edi
jmp 0x4963ef
push 0xf457dc3e
dec ecx
and edi, 0xfd0dbcb0
sub edx, 0xfd0e2a9f
sub edi, ecx
bswap ebx
neg edx
neg edi
jmp 0x4967d2
push 0xf453e9e9
bswap ebx
and edi, edx
not ebx
and ecx, edx
or edi, ecx
xor ebx, edi
mov edi, edx
inc edi
or edi, edx
or edx, ecx
shr edx, 9
add ecx, edi
sub ebx, 0xfd15e7ec
mov edx, ebx
jmp 0x49637d
call fcn.00495754
sub ecx, ebx
add edx, ebx
ror edi, 0xf
xor ebx, 0xfd26ca57
add ebx, ecx
sub edi, edx
sub ecx, edx
add edx, 0xfd28986d
shl ecx, 0x13
jmp 0x494e56
pop esi
or ebx, edx
or edi, ecx
mov ebx, edi
xchg edi, ebx
xor edi, edx
xor edx, edi
jmp 0x49515d
push 0xf454f5de
or edx, ebx
xchg edi, ecx
add ecx, 0xfe30e16c
or ebx, edi
or edx, edi
xor edi, ecx
xor edi, ecx
ror ebx, 0xf
rol edi, 0x16
or edx, 0xfe36f73b
inc edx
bswap edi
jmp 0x494e90
mov esi, 0x123b2f04
sub ebx, 0xfe98e689
mov edi, ecx
add edi, ecx
xchg ebx, ecx
mov edx, ecx
shr ebx, 0x1f
neg ebx
xor ecx, 0xfe9cac87
or edi, ecx
xor edi, 0xfe9dae13
xchg ebx, ecx
shl ecx, 0x14
jmp 0x4953de
call esi
xchg edx, ecx
mov ebx, ecx
xchg edx, ecx
rol edx, 6
xchg ebx, ecx
xor ebx, edx
xor edi, ebx
or edi, 0xfea28220
mov edx, edi
or edx, 0xfea36d9f
shr edi, 5
xor ebx, edi
and ecx, 0xfea71d3b
sub ebx, ecx
ror ebx, 0x1d
jmp 0x494b44
push 0xf46af013
add edx, ebx
ror ecx, 0xa
shr edi, 8
and ebx, ecx
shl ecx, 0x11
jmp 0x494d43
pop esi
mov edi, edx
sub ebx, ecx
and ebx, 0xfec78e54
or edx, edi
shr ecx, 0x14
not ebx
mov ebx, ecx
xor edx, edi
jmp 0x4947ef
mov esi, 0x123b2f04
add edx, edi
and ebx, ecx
or ecx, ebx
rol ecx, 9
and edi, 0xff16d8e1
xor edx, ebx
mov edx, edi
not edx
add edx, 0xff18c918
or ebx, edi
rol edi, 0x1c
ror ecx, 0x19
sub edx, 0xff1abf3d
dec ecx
inc edi
xor edi, ecx
jmp 0x494d1d
pop esi
and edx, edi
xor edi, edx
sub edx, ebx
or ebx, edx
rol ecx, 0xd
not ecx
add ebx, 0xff81729a
and edi, edx
sub edi, 0xff8262c2
neg edi
xor edx, 0xff836732
jmp 0x494ca2
call esi
add ebx, edi
or ecx, 0xffc4c70d
bswap ebx
xor edi, ecx
xchg edx, ebx
shl ecx, 3
jmp 0x49469d
push 0xf46dcc9d
add edi, edx
xor edx, ecx
xchg edx, ecx
or edi, ecx
mov ebx, edi
or edi, 0x27d6f8
dec ebx
mov ecx, edi
shl edx, 3
not ebx
or ebx, edi
mov edx, 0x2f8b47
jmp 0x49696b
mov esi, 0x2774562b
sub ebx, edx
and edx, ebx
xor ecx, ebx
xor ebx, edx
mov edi, ebx
add edi, ecx
shl edx, 0xf
add ebx, edi
or edi, 0x9097cc
jmp 0x4964bd
call fcn.00495754
or edx, ebx
ror ecx, 0x11
add ecx, edx
shr ecx, 0x18
shr ecx, 0x19
neg ecx
xor edi, ebx
xor ecx, 0xb9fe95
bswap edi
and edi, edx
jmp 0x496879
push 0xf46a4f7e
add edi, ecx
mov ebx, ecx
xchg ebx, edi
sub edi, ebx
xor edi, edx
sub edx, ebx
shr edx, 1
xor ecx, ebx
and edx, edi
or ebx, edi
and ecx, 0xd15545
xor ebx, 0xd1c5c8
shr ebx, 0x14
jmp 0x495476
push 0xf4676b92
xor ecx, edi
and ebx, edx
dec ecx
shl edx, 3
and edx, 0xec946c
xor ebx, edx
inc ebx
xchg edi, ecx
dec edi
sub ebx, edi
jmp 0x49490e
pop esi
xor edi, edx
sub ebx, 0xfd2f78
sub edx, ecx
xor edx, ebx
and ebx, edx
neg ebx
sub ecx, 0x105e066
sub ecx, edi
jmp 0x496f15
pop esi
dec ecx
not ecx
or ecx, ebx
mov edi, ebx
bswap ecx
add edx, ecx
xchg edi, edx
and edx, ecx
xor edx, 0x11d1a3b
add ebx, ecx
sub edx, 0x11df9d9
neg ecx
sub edi, edx
and ebx, edx
mov ebx, edi
xchg edx, ebx
jmp 0x49464e
push 0xf4544c52
mov ecx, edi
sub ecx, edi
add ecx, edx
jmp 0x496abf
call esi
and edi, ebx
sub ebx, ecx
bswap edx
sub ebx, edi
dec edx
xor edx, ebx
shr ecx, 8
jmp 0x495af6
call fcn.00495754
dec ebx
xor edx, ecx
and ebx, ecx
sub edi, 0x1809978
xor ecx, 0x1811044
rol edi, 9
add edi, edx
nop
add ebx, ecx
xchg edx, ebx
jmp 0x4951b5
pop esi
dec edx
mov edx, edi
shl ecx, 0x1b
mov ebx, 0x1b1697b
xchg ecx, ebx
add ecx, ebx
or edi, ecx
sub edi, ecx
xor ebx, edx
jmp 0x4968fc
pop esi
sub ebx, edx
sub edi, ebx
ror ebx, 3
xchg ecx, edx
bswap edx
or edi, 0x1b8fb7d
or ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, edx
jmp 0x496540
mov esi, 0x2774562b
or edx, ebx
mov edx, ecx
and ecx, edi
nop
shl ecx, 0x16
or ebx, 0x1c41d75
add edx, 0x1c489ed
neg ebx
shr edx, 0xf
jmp 0x4961e9
pop esi
and ecx, edx
shl ecx, 0xf
and ecx, edx
bswap ecx
jmp 0x495dce
mov esi, 0x2774562b
add ecx, ebx
add ecx, edi
add ecx, edi
or ecx, ebx
xor ecx, edx
jmp 0x4954b8
push 0xf464423d
add edi, edx
add edi, ecx
xor edx, 0x252708a
ror edx, 0xf
ror edi, 3
jmp 0x494726
pop esi
and ebx, 0x25403ca
xchg ecx, edx
xor edi, ebx
mov edx, ecx
shr edi, 0x1c
or edx, 0x25df482
add edx, ebx
xor edx, ecx
ror edx, 0x16
sub ecx, edi
shr edx, 0x12
ror edx, 1
xchg ecx, ebx
jmp 0x4962ae
call esi
or edi, ebx
add ebx, edi
or edx, 0x2608e91
xor ebx, 0x260cef5
bswap edx
or edx, ecx
add ebx, edi
add edi, ecx
and edi, edx
xor edi, ecx
shl ecx, 0x14
and edx, ecx
and edx, ebx
jmp 0x494dc4
pop esi
mov ebx, 0x2745385
dec ecx
or edx, ebx
xor edx, edi
sub edx, 0x2755e3c
and edi, ebx
sub ecx, 0x2763bfe
mov edx, ebx
add ecx, ebx
xor edi, edx
xchg edx, ebx
or edx, ebx
xor edx, edi
xor edx, ebx
jmp 0x495240
jmp loc.0049ac58
pop esi
dec ebx
xor edx, ebx
mov ecx, ebx
not ecx
and ecx, edi
rol ecx, 5
mov edi, ebx
xor ebx, edi
inc ebx
jmp 0x496350
push 0xf46e1a08
add ebx, ecx
add ebx, 0x2849f4a
xor ebx, ecx
sub ebx, ecx
or edx, ecx
xor ecx, edx
mov ebx, 0x28ad61b
or ecx, ebx
jmp 0x496a0d
pop esi
and edi, edx
or edi, edx
and edx, 0x299a64b
sub ecx, 0x29a1e80
xor ecx, ebx
sub edx, edi
xchg edx, edi
ror edx, 0xc
xchg ecx, ebx
jmp 0x496707
push 0xf46e6e82
mov ecx, 0x2a15f00
and ecx, 0x2a3f26e
not ebx
mov ebx, ecx
add edx, edi
xor edx, 0x2a81a10
xor edx, ecx
shl edx, 0xb
not ecx
shl edi, 0x14
xor ecx, edi
xchg edi, ebx
not edx
xor ecx, edx
mov edi, edx
jmp 0x49535d
pop esi
ror edx, 0x1d
and edx, ebx
and ebx, 0x2cbe907
or edi, ecx
or ecx, 0x2ccf9bf
mov ecx, 0x2cd92c1
sub edx, edi
jmp 0x4951fe
push 0xf454a1fc
not edx
ror ebx, 0xe
sub edi, 0x2d54ca0
mov ebx, 0x2d5b62b
mov ebx, edx
or ecx, 0x2db2ff9
inc ecx
xor edx, ecx
sub edx, 0x2dce899
and edi, ecx
sub ecx, edx
ror ecx, 0x12
or ebx, 0x2deb086
jmp 0x495873
call fcn.00495754
sub ebx, ecx
xchg ecx, ebx
xchg edi, edx
dec edx
xor ecx, ebx
neg ebx
sub ebx, 0x2ee92c5
xor ecx, 0x2f07d19
sub ecx, edx
add ebx, edi
jmp 0x496b8d
call esi
bswap ebx
dec ecx
shr edx, 0x1a
inc edi
jmp 0x49722d
call fcn.00495754
rol edi, 0x1f
xor ebx, edx
dec edx
mov ebx, 0x32010cc
xor ebx, edx
xor ecx, 0x320fc8b
bswap edi
xchg edx, ebx
xchg ebx, edx
ror edx, 0x18
mov ecx, 0x3234fd1
and ecx, 0x323bae9
sub ebx, edx
jmp 0x4959e5
call esi
and ebx, edx
or edi, ebx
rol ecx, 0x12
or edx, ebx
xchg edx, ebx
bswap edi
and edx, 0x33380fc
xor edi, ebx
bswap edi
xor edi, ecx
xor ecx, edx
dec edx
mov ebx, edi
or ecx, edx
neg ecx
jmp 0x496d0b
pop esi
add ebx, 0x35acb21
xor edx, ecx
shl ecx, 0x1f
xchg ebx, edx
or edx, edi
shl edx, 0xc
add edi, ebx
shl edi, 0xa
bswap edx
and edi, ebx
xchg ecx, edx
xchg ecx, edi
xor edx, 0x361e1d0
jmp 0x4956b6
mov esi, 0x123b2f04
xor ebx, edi
nop
rol ecx, 8
mov edi, edx
and edx, 0x366c730
shr edi, 4
xor edi, 0x367bee3
or ebx, edx
and edi, 0x36840b4
rol ecx, 0xc
xor ebx, edi
jmp 0x496928
call fcn.00495754
add edx, edi
or ebx, ecx
and ecx, ebx
not edi
or ebx, ecx
jmp 0x495ef2
pop esi
or edx, ecx
not ecx
shr edx, 0xe
ror ebx, 0x1f
dec ebx
xor ecx, edx
bswap ecx
shr edx, 5
or ecx, edx
and ebx, 0x3822701
and edx, ecx
and ebx, edi
jmp 0x494d66
push 0xf460c537
add ecx, ebx
shr edi, 1
and edi, 0x39eb2ab
add ecx, edx
and ebx, 0x39f8fa9
rol ecx, 0xf
mov edi, 0x3a09495
bswap edx
mov ebx, edx
bswap edx
xor ebx, 0x3a8c341
jmp 0x4972a2
pop esi
bswap edi
not edx
xor ebx, 0x3c44283
sub edx, edi
mov edi, 0x3c56498
sub edi, edx
neg ecx
sub ecx, 0x3cb4444
shl ecx, 0x1a
jmp 0x4962e4
push 0xf46d819c
sub edx, ecx
rol edx, 5
xor ecx, edx
ror ecx, 0x1d
mov edx, 0x3eb9b1f
nop
sub edx, ebx
jmp 0x495f9f
push 0xf4725174
sub ebx, 0x40789ad
and edx, edi
mov ebx, edi
shr edx, 0xd
xor edi, ecx
add ecx, ebx
sub edi, 0x4282bad
xor ebx, ecx
jmp 0x4949a3
push 0xf4616882
xor edx, ecx
xchg edx, ebx
inc edx
sub edi, ebx
bswap ebx
rol edx, 0x16
jmp 0x4953b9
pop esi
or edi, ebx
or edx, 0x4d86b1b
xor ecx, 0x4d8a802
mov ebx, 0x4da27c6
xchg edi, ebx
add ecx, edx
sub edx, ebx
shl edx, 8
or ebx, edx
xchg edi, edx
dec edi
neg edi
xchg edi, ecx
add edi, ecx
inc ecx
and edx, ecx
jmp 0x495011
push 0xf459dfed
mov edx, ecx
or edi, ebx
add edx, 0x4e60a37
mov ecx, 0x4e64a9f
jmp 0x49509b
push 0xf461188b
dec edi
xchg ebx, ecx
or ecx, edx
xor edx, ebx
dec ebx
xor ebx, edx
rol ebx, 4
rol ecx, 0xd
sub ecx, ebx
or edi, 0x4eb5e4a
xor ecx, edx
xchg edi, ecx
jmp 0x497046
push 0xf45e4422
or edx, edi
xchg edx, ebx
or ebx, edi
sub ebx, 0x510ce39
and edi, ebx
and edx, ecx
add ecx, edx
jmp 0x494f48