Function at 0x401000
Capabilities:
Encrypt data using chaskey
Get disk information
Identify system language via api

Disassembly:
call sub.user32.dll_GetInputDesktop
cmp eax, 0xfffffef2
jne 0x401066
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
ret
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xfffffef9
jne 0x401112
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
ret
call sub.user32.dll_GetInputDesktop
cmp eax, 0xffffff2d
jne 0x4011aa
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
ret
call sub.user32.dll_GetFocus
cmp eax, 0xffffff36
jne 0x401256
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
call sub.advapi32.dll_CreateRestrictedToken
call sub.advapi32.dll_CreateRestrictedToken
ret
jmp 0x475739
xor ecx, esi
sub ecx, esi
xchg esi, ebx
jmp 0x477728
pop edx
mov ecx, ebx
not ebx
or edi, esi
shr edi, 0xe
shr ebx, 0x1e
jmp 0x476e72
pop edx
sub edi, esi
add ecx, 0xbf61e373
xor esi, ecx
mov esi, 0xbf625394
xchg ecx, edi
sub esi, edi
sub esi, 0xbf630832
and ebx, esi
or ecx, edi
jmp 0x477fd8
mov edx, 0x5027095f
ror esi, 0x14
xchg esi, ebx
or esi, 0xbf675f92
xor ecx, 0xbf679677
bswap edi
or ecx, 0xbf68088c
shr edi, 0x15
add edi, esi
or ebx, ecx
and ecx, edi
xor ebx, edi
add ebx, 0xbf695f22
add esi, edi
jmp 0x4788db
mov edx, 0x2774562b
sub ecx, ebx
and edi, ecx
mov esi, edi
xor edi, 0xbf72f200
jmp 0x478e11
call edx
not edi
mov ebx, edi
or ecx, ebx
or esi, ecx
shl ebx, 0x1c
jmp 0x477f48
mov edx, 0x5027095f
sub edi, ecx
sub ebx, 0xbf77626d
mov edi, ebx
and edi, ecx
neg ebx
mov edi, esi
sub esi, ecx
sub ebx, 0xbf78aa54
jmp 0x4764be
push 0xbec65f01
xor esi, ecx
bswap edi
sub esi, ebx
inc esi
neg ebx
and ecx, edi
jmp 0x4771f3
push 0xbec1f7b0
not esi
sub ecx, edi
shr edi, 0x1b
and ecx, ebx
not ebx
jmp 0x47713a
pop edx
shr esi, 0x17
and edi, 0xbf84e730
sub ebx, edi
and edi, ecx
or ebx, esi
and ecx, edi
neg esi
xor esi, edi
xchg ecx, ebx
or esi, ecx
neg edi
add edi, esi
dec ecx
or ecx, esi
mov edi, 0xbf87c2e1
dec ebx
jmp 0x475744
push 0xbebedc3f
neg esi
sub edi, ebx
bswap ebx
add ecx, ebx
dec ecx
or edi, ecx
inc edi
sub esi, ebx
sub ecx, 0xbf8fabec
mov esi, ebx
and ecx, ebx
or edi, ebx
jmp 0x4764ec
pop edx
or ecx, edi
rol edi, 0x11
xor esi, 0xbf94f7d1
dec edi
add esi, edi
and ecx, edi
shr ecx, 0x1e
xchg ebx, edi
bswap edi
add edi, esi
neg ecx
xor ebx, 0xbf96fbe8
or esi, 0xbf973321
add esi, edi
xchg edi, ecx
jmp 0x4777bd
push 0xbecda88b
or edi, ecx
and ebx, ecx
shr esi, 9
shl esi, 0x1c
add ecx, edi
shl ecx, 3
jmp 0x4773f0
push 0xbeb32bfe
inc edi
add ebx, edi
and esi, edi
xor ecx, edi
or ebx, ecx
and edi, esi
sub ecx, ebx
add esi, edi
and ebx, esi
ror ebx, 0x18
neg ecx
xor edi, esi
and esi, ecx
jmp 0x478a3b
pop edx
shr edi, 0x19
xor edi, ecx
xor ecx, edi
mov edi, ecx
shr edi, 0x15
ror ecx, 0xc
sub edi, esi
mov ecx, esi
shr edi, 0x18
or ebx, ecx
mov edi, 0xbfb35e39
jmp 0x478297
push 0xbec1aef7
rol esi, 0x1f
add ebx, esi
not ebx
add ebx, esi
xor ecx, esi
jmp 0x475979
pop edx
shr ebx, 0xd
or edi, esi
mov esi, edi
xor esi, ebx
bswap esi
add esi, ecx
sub ebx, 0xbfc99cc2
shl esi, 9
jmp 0x476b09
push 0xbec3a7d1
neg ebx
and edi, ebx
or ecx, esi
inc ecx
sub ecx, esi
xor edi, ebx
xchg edi, esi
not ebx
add ecx, edi
and ebx, 0xbfdeeab1
jmp 0x4779ff
pop edx
sub ecx, 0xbfecd2eb
shl edi, 0xb
and ecx, esi
add edi, 0xbfed87f1
add ecx, 0xbfede1d7
and ecx, esi
xor ecx, 0xbfeeb869
mov ebx, esi
sub esi, ecx
add edi, ebx
sub ebx, esi
not edi
add edi, ebx
xor esi, edi
add ecx, esi
jmp 0x478c3f
push 0xbebc54e9
xor edi, 0xc0044a4c
dec ecx
or esi, 0xc004c840
mov esi, edi
add edi, ebx
xchg edi, esi
mov edi, esi
shl ecx, 0x11
xchg edi, esi
and ecx, esi
jmp 0x476a68
call edx
add esi, ebx
rol esi, 0x1c
not esi
sub ebx, 0xc00a0096
add edi, ecx
or ecx, esi
shr esi, 0x10
or edi, ecx
add ebx, edi
sub esi, 0xc00b7f6f
xor ebx, 0xc00bbe78
ror ecx, 0x16
jmp 0x475c2f
push 0xbeb8f36d
shl edi, 9
rol ecx, 0x1e
xchg ebx, edi
jmp 0x477184
pop edx
mov ecx, edi
or esi, 0xc0135ef0
sub ecx, esi
mov esi, ebx
inc ecx
ror edi, 0x1c
add ebx, esi
jmp 0x475caf
pop edx
mov ebx, edi
mov esi, ebx
mov ecx, edi
bswap ecx
sub esi, 0xc0193f7e
add ecx, edi
add edi, ebx
or edi, ecx
mov esi, ecx
jmp 0x475e6e
pop edx
xchg esi, ebx
add esi, ebx
xor ebx, ecx
xor esi, 0xc0390c99
bswap esi
dec ebx
neg ecx
xor ebx, edi
add esi, edi
inc esi
jmp 0x476418
mov edx, 0x5027095f
bswap ecx
mov ecx, esi
xor esi, ecx
add esi, 0xc03c1011
or ecx, edi
ror edi, 0x16
xchg ecx, ebx
dec ecx
add ebx, edi
xchg ecx, esi
jmp 0x477a5c
push 0xbebc0d83
add ebx, 0xc0409a97
dec esi
xchg edi, esi
and edi, esi
bswap ebx
not ecx
add ebx, edi
mov esi, 0xc042516e
or esi, 0xc043068d
xor edi, ebx
xchg esi, ebx
jmp 0x47606f
pop edx
shl edi, 2
xor ebx, edi
or esi, edi
add edi, 0xc04502ec
sub ecx, ebx
xchg esi, ebx
or ecx, ebx
mov ecx, esi
sub esi, 0xc0476116
xor ecx, esi
sub edi, esi
mov ecx, edi
jmp 0x47784f
push 0xbeaecdd5
not edi
or edi, esi
and ecx, 0xc04b5fb6
and ecx, 0xc04bc295
bswap esi
xchg edi, ebx
mov ebx, ecx
and esi, ebx
add edi, ebx
jmp 0x476a0e
pop edx
xor edi, 0xc04d5962
xchg ebx, esi
xchg ecx, edi
shl esi, 0x16
dec ebx
add edi, ecx
add edi, ebx
xchg ebx, esi
nop
jmp 0x475c0b
pop edx
ror ebx, 7
inc ebx
and esi, ecx
and ecx, esi
or esi, ecx
or ecx, 0xc050939e
and edi, 0xc050ca7c
or edi, 0xc05103b1
dec ebx
jmp 0x476ee5
push 0xbeabf9d4
mov ecx, edi
shr ecx, 0xc
xor edi, ecx
inc ecx
or ebx, 0xc054ec1c
xor esi, ebx
shr esi, 0xd
mov edi, esi
or edi, 0xc055d84a
jmp 0x47646f
pop edx
sub ebx, 0xc0562a9e
or esi, ecx
nop
xor ebx, esi
bswap ecx
or ecx, ebx
xchg esi, ebx
or esi, edi
jmp 0x478554
mov edx, 0x2774562b
mov esi, ebx
mov ecx, edi
add edi, ecx
ror ecx, 4
sub ebx, ecx
jmp 0x4780bb
call edx
and ecx, 0xc05c6f75
sub ecx, 0xc05ca8cb
add ecx, 0xc05ce03c
mov esi, ebx
rol edi, 0x10
bswap ecx
shr edi, 0x1c
jmp 0x4759c3
call fcn.00478e75
and ecx, 0xc05e1f80
bswap esi
mov ebx, esi
and ecx, 0xc05ed40c
xchg esi, ecx
mov esi, edi
add ecx, edi
sub edi, ecx
sub ecx, 0xc05fe68a
or ebx, 0xc0601e12
jmp 0x4785e2
push 0xbebf244c
xchg ecx, edi
xchg ebx, esi
shr ecx, 0x1f
add esi, 0xc06115f3
or edi, ebx
mov ecx, 0xc06193bb
xchg edi, ecx
xor edi, esi
or ebx, edi
jmp 0x478168
call fcn.00478e75
and edi, 0xc06c93f7
neg ecx
dec edi
shr edi, 0x11
or edi, ecx
xchg esi, ecx
xor ecx, 0xc06df164
xor edi, 0xc06e2ad8
and ecx, 0xc06e6207
dec esi
add ecx, ebx
not ecx
jmp 0x477de5
push 0xbec85948
shl ebx, 0x1b
add ebx, 0xc07268ae
add esi, 0xc072a01d
xchg ecx, edi
sub esi, edi
mov ecx, ebx
and esi, 0xc0737d40
xor edi, 0xc073b6ca
jmp 0x476ef6
call fcn.00478e75
sub edi, ecx
add ebx, esi
xchg ebx, edi
add esi, ebx
xchg ecx, edi
xor ebx, 0xc075248f
rol ecx, 2
or ecx, esi
jmp 0x4781da
push 0xbecae72b
shr esi, 0x1f
and ebx, esi
or ebx, ecx
mov esi, ecx
sub edi, ecx
mov ebx, edi
mov ecx, 0xc08d64d6
jmp 0x4762d1
call fcn.00478e75
xchg esi, ecx
mov edi, ebx
dec ecx
and edi, 0xc08f57bf
add esi, ecx
sub ebx, edi
dec edi
bswap ebx
xor edi, ebx
jmp 0x478410
push 0xbeca5617
add ecx, esi
and ebx, edi
or ecx, edi
shr ebx, 4
and ebx, 0xc0a9705d
and edi, ecx
or esi, ecx
sub ecx, 0xc0aa34f2
and ebx, ecx
xchg edi, ecx
xor ecx, esi
or esi, ebx
add ebx, esi
add esi, 0xc0ab9a9e
jmp 0x4774d9
call fcn.00478e75
or ebx, ecx
add ebx, esi
shr esi, 0xd
dec esi
sub ecx, 0xc0ace417
or ebx, ecx
sub edi, ebx
add edi, ecx
xor ecx, edi
sub ecx, edi
bswap edi
inc edi
add ebx, 0xc0aed6dc
shr ecx, 7
or esi, edi
jmp 0x476e39
push 0xbeb1a0f6
and esi, edi
neg esi
xor ecx, 0xc0b35a7f
mov esi, ecx
or esi, 0xc0b3d269
mov ecx, edi
and ebx, edi
add ebx, esi
or ebx, esi
mov ebx, edi
sub ecx, ebx
or ecx, ebx
sub edi, 0xc0b5bbf0
jmp 0x4785bd
call edx
add esi, ebx
rol ecx, 9
and ebx, edi
sub ebx, 0xc0b6d405
xor ebx, esi
or esi, edi
add esi, ecx
sub ebx, edi
xor esi, ebx
and ecx, ebx
sub ebx, edi
jmp 0x477438
push 0xbeaf0e49
sub esi, 0xc0b9204a
and esi, 0xc0b96770
jmp 0x4775c5
mov edx, 0x2774562b
add esi, ecx
add edi, 0xc0be6989
inc ecx
or esi, ebx
not esi
rol ebx, 8
xor ebx, 0xc0bf83a9
add esi, ebx
mov edi, 0xc0bfff04
neg ecx
sub ebx, 0xc0c071db
jmp 0x4789c6
pop edx
xchg ecx, esi
and edi, ecx
xor esi, 0xc0c8e38e
neg ebx
rol ebx, 0x19
xchg edi, esi
jmp 0x476135
pop edx
rol edi, 2
xor edi, ebx
xchg ebx, esi
and edi, ebx
sub ecx, 0xc0d1a58a
xor esi, ecx
jmp 0x476cff
pop edx
ror esi, 0xc
mov esi, ebx
ror ebx, 0x14
jmp 0x478be2
call fcn.00478e75
mov ebx, ecx
xchg edi, esi
bswap esi
mov esi, ecx
add ebx, ecx
or edi, ebx
sub edi, 0xc0e82d6e
inc edi
or esi, ecx
sub ebx, ecx
jmp 0x4770a2
pop edx
xchg ecx, ebx
mov edi, ebx
sub ebx, edi
rol edi, 4
and ecx, esi
or esi, 0xc0ea593b
xchg edi, ecx
nop
sub ecx, ebx
and edi, 0xc0eb39ff
jmp 0x4783ef
push 0xbeaa6e20
add ecx, edi
mov ebx, ecx
inc esi
xor ecx, edi
xor edi, 0xc0eed164
ror esi, 0xe
or edi, esi
jmp 0x477e43
push 0xbeb3ef81
or ebx, edi
nop
or ebx, esi
sub edi, 0xc0f4ee25
xor ecx, 0xc0f527cf
and ecx, edi
not ecx
or ecx, 0xc0f5dd04
or ecx, 0xc0f61682
mov ebx, edi
xor edi, esi
dec esi
add ecx, ebx
and esi, ecx
jmp 0x477a22
call edx
and edi, ecx
xor ecx, edi
neg edi
xchg esi, edi
not ecx
sub esi, ecx
jmp 0x47780b
push 0xbebe047b
sub ecx, esi
or ecx, ebx
mov ecx, 0xc10201a4
or esi, ebx
xor ebx, 0xc102715f
sub ecx, esi
sub edi, ecx
shl esi, 6
add edi, 0xc10362a1
neg ecx
mov ecx, esi
xor edi, ecx
rol esi, 9
or esi, 0xc1047d98
jmp 0x478b82
pop edx
or ebx, edi
xor edi, ecx
sub ecx, edi
mov esi, edi
bswap edi
and esi, ecx
xchg edi, ebx
jmp 0x477ae5
pop edx
shl ecx, 0x11
xchg esi, edi
or esi, 0xc10998d2
jmp 0x47727d
push 0xbec8a175
not ebx
sub ecx, edi
and ebx, esi
and esi, edi
and ecx, edi
or ecx, edi
xchg esi, ecx
sub esi, edi
or esi, ecx
or ebx, esi
or esi, ecx
jmp 0x477bac
push 0xbebe94e1
add ebx, 0xc1261cfa
add ecx, edi
and ebx, ecx
and ecx, ebx
xchg ebx, ecx
jmp 0x475a30
call edx
sub esi, edi
xchg ebx, esi
xchg esi, ebx
add edi, esi
sub ecx, esi
sub ebx, 0xc1286afd
add ebx, esi
rol esi, 0xa
add ebx, 0xc129218d
or esi, edi
jmp 0x4783a1
pop edx
add ecx, edi
inc ebx
ror esi, 0x16
shr esi, 3
shl edi, 0x1d
xchg ebx, esi
add ebx, 0xc12f223c
and ebx, ecx
jmp 0x47891b
mov edx, 0x2774562b
or edi, esi
xor edi, esi
shr edi, 0x1a
shr edi, 4
not edi
sub ebx, 0xc1330c36
or edi, ebx
shr edi, 9
and ecx, esi
not edi
or esi, 0xc1361860
sub edi, esi
add ebx, esi
jmp 0x477637
push 0xbeb93b1f
and ecx, ebx
sub edi, ecx
xor edi, esi
neg ebx
and ebx, 0xc139d548
xor ebx, edi
ror esi, 0xe
xchg esi, edi
jmp 0x478b0f
mov edx, 0x2774562b
xor ecx, 0xc140734f
dec ecx
xor ebx, edi
xor edi, ecx
or ecx, ebx
bswap edi
xchg ebx, ecx
or ecx, 0xc14249ae
and ecx, edi
and ecx, esi
xchg esi, ecx
sub edi, esi
neg edi
jmp 0x476959
push 0xbeb15e39
or edi, ecx
nop
or esi, 0xc14a19d0
add ebx, 0xc14a5152
sub esi, ebx
dec esi
dec esi
xchg edi, ebx
add ebx, edi
xor ebx, edi
xchg ecx, edi
xor ecx, edi
xor ecx, 0xc14c593b
mov esi, edi
sub esi, 0xc14cc7e6
jmp 0x4769bc
push 0xbec61713
and ecx, 0xc15205bb
and ebx, ecx
or ecx, esi
sub ebx, esi
add ebx, ecx
xchg esi, ecx
neg ebx
add edi, ecx
add ecx, edi
mov ebx, ecx
jmp 0x47590f
push 0xbecdf06f
sub edi, ebx
xor ecx, ebx
inc ecx
add esi, 0xc165e4ac
mov edi, esi
or edi, ecx
ror ebx, 0x16
mov ebx, edi
mov ebx, 0xc1670e15
xchg edi, esi
not edi
sub ecx, edi
not ebx
jmp fcn.00477964
pop edx
xchg esi, edi
sub ecx, edi
mov edi, ebx
xor edi, esi
xor edi, ebx
xor ecx, ebx
or ecx, ebx
or ebx, esi
neg ebx
not esi
mov edi, ecx
shr esi, 4
and esi, ebx
add esi, 0xc16d01b5
and edi, 0xc16d3bae
jmp 0x475f55
mov edx, 0x5027095f
rol esi, 0xd
or esi, ebx
add ebx, ecx
sub ecx, esi
mov ecx, ebx
xchg esi, ecx
sub esi, edi
shr ebx, 0x1f
xor esi, edi
jmp 0x477eec
push 0xbeca9e42
and ecx, esi
or ebx, edi
and ebx, edi
rol esi, 4
not ecx
mov ecx, ebx
and esi, edi
add ebx, 0xc17728c8
xchg esi, edi
jmp 0x47677c
pop edx
mov ebx, edi
xchg esi, ebx
sub ebx, 0xc179ebaa
jmp 0x476356
push 0xbeaf50d3
xor edi, ecx
or ebx, 0xc183a118
or ecx, 0xc183db59
inc ebx
neg ebx
shr ecx, 0xd
xchg ebx, edi
xchg esi, ebx
shl esi, 0x1c
shr ecx, 0xc
xor ecx, edi
dec edi
jmp 0x477465
call fcn.00478e75
rol esi, 0x15
xor edi, 0xc18c586a
nop
rol ebx, 4
sub ecx, 0xc18d099e
and ecx, ebx
xchg ebx, edi
add edi, ecx
jmp 0x477c73
push 0xbeaa2541
bswap edi
mov edi, ebx
and ebx, esi
mov esi, ebx
rol ecx, 0x1b
inc ecx
xchg ecx, esi
ror ebx, 0x1f
neg ecx
jmp 0x476d41
pop edx
xor ecx, ebx
rol esi, 0x19
mov edi, esi
or edi, esi
add ecx, ebx
or edi, esi
not ecx
rol edi, 0x1f
jmp 0x478311
call edx
mov edi, ecx
sub edi, esi
and edi, 0xc1a4f61b
xor ecx, ebx
xor esi, ecx
bswap ebx
mov ebx, 0xc1a5dc51
xor ebx, esi
mov edi, ebx
xor esi, ebx
or edi, ebx
mov ecx, esi
jmp 0x478138
pop edx
add ebx, esi
add edi, esi
not esi
neg ecx
jmp 0x475d5f
pop edx
and ebx, 0xc1ac9631
neg ecx
or ecx, 0xc1ad0c98
and ebx, ecx
inc ecx
neg ebx
sub ecx, 0xc1ae02f8
shr ecx, 4
or ebx, esi
or esi, ebx
shr ebx, 2
sub edi, ecx
sub ecx, esi
jmp 0x476cd0
pop edx
sub ecx, edi
inc ebx
sub ecx, esi
rol ebx, 8
or ecx, ebx
xor ecx, 0xc1b0da10
inc ebx
jmp 0x47615f
push 0xbeb865b8
sub edi, ecx
xor ebx, ecx
xchg ebx, edi
sub ebx, edi
sub esi, ebx
mov esi, edi
or edi, ecx
xor edi, 0xc1b301a1
mov ebx, edi
or ecx, 0xc1b372a5
or esi, 0xc1b3acf4
or edi, 0xc1b3e62f
jmp 0x477b88
push 0xbec3ef8e
or ecx, ebx
xchg ecx, ebx
rol ecx, 8
or esi, ecx
add edi, 0xc1d0153b
and ecx, ebx
or ecx, edi
and edi, esi
xor ecx, ebx
add ebx, esi
jmp 0x4757d8
push 0xbeb4306a
sub ecx, esi
bswap esi
add ebx, edi
and ebx, ecx
xchg ebx, edi
mov esi, ecx
mov ecx, edi
or edi, esi
jmp 0x4780f5
call fcn.00478e75
neg ecx
shl ecx, 1
mov edi, ebx
shr edi, 3
xchg edi, ecx
and edi, esi
ror esi, 0x12
or ebx, 0xc1d74bf8
jmp 0x477797
pop edx
bswap ecx
mov edi, esi
sub esi, edi
sub ecx, 0xc1df5b15
and ebx, ecx
rol ebx, 7
shr esi, 0xf
and ebx, edi
xchg esi, ecx
or esi, edi
or esi, 0xc1e0f839
xchg esi, ebx
add edi, ebx
sub ecx, esi
jmp 0x476322
pop edx
dec edi
xchg ebx, ecx
mov edi, ecx
rol edi, 0x1d
or ecx, 0xc1ea0c81
xchg ecx, edi
nop
not esi
mov ecx, edi
jmp 0x4763c8
push 0xbeb8acc4
add ecx, esi
xor esi, ecx
ror edi, 0x1e
add ecx, esi
xor ecx, edi
ror ecx, 1
and edi, ecx
jmp 0x4760f1
mov edx, 0x2774562b
or edi, esi
or ecx, 0xc1ed9ec0
jmp 0x4765a4
call edx
and ecx, edi
shr esi, 0xa
bswap ebx
xchg ecx, ebx
sub ebx, edi
bswap edi
sub ebx, ecx
mov ecx, 0xc1fd074c
jmp 0x477838
call edx
mov ecx, esi
or ebx, esi
add esi, ebx
or ecx, esi
shr ecx, 8
sub edi, 0xc216baad
mov esi, ecx
add esi, edi
dec ebx
jmp 0x47643d
mov edx, 0x2774562b
rol ecx, 0xc
add ebx, ecx
sub esi, 0xc21c27bb
bswap esi
not esi
or ebx, edi
inc ebx
xchg ebx, esi
xor edi, esi
add edi, ebx
jmp 0x476626
push 0xbeb3ad64
mov ebx, 0xc2240267
and edi, ebx
xor edi, esi
mov ecx, ebx
xchg esi, ebx
ror edi, 0x17
or ebx, ecx
add ecx, ebx
xchg ecx, edi
mov esi, ecx
xchg esi, ecx
xchg ecx, esi
jmp 0x476da7
call fcn.00478e75
xor edi, ebx
xchg esi, edi
add esi, ebx
and esi, ecx
xchg ecx, edi
neg esi
or esi, edi
sub esi, edi
add esi, ecx
and esi, edi
xor edi, ebx
mov esi, edi
inc edi
or esi, ecx
jmp 0x4758c2
pop edx
sub ebx, esi
xchg ebx, esi
xchg ecx, ebx
shl edi, 7
sub ecx, 0xc230df25
add esi, 0xc2311de5
sub ecx, edi
xor ecx, esi
and ebx, esi
not ecx
mov edi, ecx
ror edi, 0x10
xchg ebx, edi
add ecx, esi
jmp 0x477b6d
pop edx
dec ecx
bswap ecx
add ebx, edi
and esi, edi
neg esi
sub esi, ecx
xor edi, ebx
xchg esi, ecx
sub ecx, ebx
or esi, 0xc23ce879
sub edi, ecx
dec edi
sub edi, ebx
jmp 0x478d25
pop edx
rol ebx, 0x1d
inc ebx
xor ebx, 0xc2462154
xor edi, ecx
add esi, edi
jmp 0x477745
call fcn.00478e75
sub ecx, esi
ror esi, 0x14
mov esi, 0xc24be227
xchg ecx, ebx
or ecx, esi
shl ebx, 0x10
bswap ebx
sub ecx, esi
mov edi, ebx
xchg edi, ebx
jmp 0x478538
mov edx, 0x2774562b
sub ecx, 0xc250a83d
xchg ecx, edi
xor ebx, edi
xchg ebx, ecx
xchg edi, ebx
or ebx, esi
inc edi
xor esi, 0xc2526479
shl ebx, 0xc
mov ecx, edi
or esi, ebx
sub ebx, esi
sub esi, 0xc253932d
jmp 0x478c9c
pop edx
add edi, ecx
xor ebx, 0xc2555868
and ecx, ebx
mov esi, ebx
xchg ecx, ebx
bswap esi
or ecx, ebx
bswap edi
jmp 0x476b94
mov edx, 0x2774562b
mov esi, ebx
mov esi, ebx
xchg edi, ecx
inc edi
mov esi, ebx
not ecx
or ecx, esi
jmp 0x4767a5
call edx
xor ecx, ebx
or edi, 0xc2615cce
or ecx, 0xc2619437
mov ecx, esi
xchg ecx, edi
xor ecx, esi
sub ebx, ecx
mov ebx, esi
inc edi
xchg ecx, esi
xor ecx, esi
jmp 0x47863d
push 0xbeae8ad5
sub ebx, edi
or ebx, esi
xor edi, esi
mov esi, ecx
mov edi, ebx
sub edi, esi
or ecx, esi
or ecx, 0xc271773b
bswap ecx
xchg ebx, edi
and esi, 0xc2723028
rol ebx, 0x11
jmp 0x476389
call edx
xor edi, 0xc272cbd6
mov ecx, esi
sub esi, ecx
bswap ecx
jmp 0x475792
pop edx
not ecx
inc edi
xor ebx, ecx
and ebx, esi
add ebx, ecx
sub ecx, ebx
mov edi, ecx
shl ecx, 8
shr edi, 0xf
and esi, ebx
shl ecx, 0x14
jmp 0x476ed1
pop edx
rol esi, 0xb
xor ebx, 0xc2849598
neg edi
xchg ecx, ebx
or ebx, ecx
or esi, edi
jmp 0x4763ad
push 0xbecd5f15
and esi, ecx
xchg esi, ebx
ror ecx, 0xd
neg ecx
or ebx, 0xc289a874
xchg ebx, edi
mov ecx, edi
or esi, ecx
sub esi, edi
jmp 0x475b32
call edx
add ebx, edi
shl esi, 0x12
and esi, ebx
or ecx, edi
xor edi, ebx
xchg ecx, esi
inc ecx
xchg esi, ebx
xchg ecx, esi
xchg ecx, esi
rol ecx, 0x1b
xchg edi, ecx
jmp 0x475a89
call edx
shl ecx, 0xd
mov esi, ebx
shl esi, 0x11
not ecx
and ebx, ecx
shr esi, 3
mov edi, esi
or ecx, edi
xchg ecx, edi
jmp 0x477103
pop edx
sub edi, esi
sub ecx, 0xc29f665d
neg ebx
sub ecx, esi
sub ebx, esi
jmp 0x476926
mov edx, 0x2774562b
xchg esi, ecx
not ecx
add esi, edi
add esi, ebx
xchg ebx, edi
xor ebx, 0xc2a710b0
add esi, ebx
not ebx
mov ebx, ecx
and edi, ebx
shl ecx, 0xc
jmp 0x476cde
call edx
xor ecx, esi
or ebx, 0xc2a8e311
xor esi, edi
or ebx, esi
sub ecx, edi
xor ebx, esi
xchg ebx, ecx
xor ecx, 0xc2aa4399
mov ebx, edi
shl esi, 0x1d
or ecx, 0xc2aaeb91
xchg edi, esi
jmp 0x47806a
pop edx
not ecx
xor edi, ebx
and ebx, edi
shr ecx, 2
add ebx, edi
xor ecx, edi
mov ebx, 0xc2b0a56c
sub edi, 0xc2b0f580
jmp 0x4762b5
call fcn.00478e75
sub ebx, ecx
add ebx, ecx
xchg ecx, edi
shl esi, 0x18
and esi, edi
mov ecx, edi
sub ebx, edi
inc ebx
xor edi, 0xc2e60ef5
xor ecx, 0xc2e64767
and edi, 0xc2e68029
jmp 0x4782c2
push 0xbead40ad
sub ebx, 0xc2e79f79
add ebx, edi
add ecx, ebx
xchg esi, ebx
mov edi, 0xc2e87caa
xchg esi, ecx
sub edi, ecx
xor edi, ecx
sub ecx, esi
xchg esi, ecx
sub ebx, 0xc2e9da58
nop
jmp 0x47589d
call fcn.00478e75
add ebx, edi
xor ebx, esi
xchg esi, ebx
jmp 0x47649b
push 0xbeb36c47
add esi, ecx
or edi, ecx
and esi, ebx
or esi, ecx
add esi, 0xc2fb0eba
mov esi, 0xc2fb4608
sub ebx, 0xc2fb80da
dec ebx
neg esi
sub esi, ebx
xor ecx, esi
sub edi, ecx
jmp 0x477eaf
push 0xbeb982b4
ror ebx, 6
xor ecx, esi
not esi
sub esi, 0xc308a49f
mov edi, ecx
rol esi, 0x15
dec ebx
shl ebx, 0x1a
dec edi
jmp 0x4758ed
push 0xbebe4cf5
neg ebx
or esi, 0xc3611e74
and ebx, esi
inc ebx
inc esi
ror ebx, 0x17
ror ebx, 1
mov ebx, esi
sub ebx, edi
jmp 0x47708a
pop edx
mov edi, ecx
xor ebx, 0xc367f166
sub ecx, esi
shl esi, 2
nop
mov ecx, ebx
rol edi, 0x1e
sub edi, 0xc3696dcb
dec ebx
sub edi, ebx
jmp 0x4765fb
pop edx
and ecx, edi
add edi, ecx
dec ecx
sub ecx, 0xc36e98ef
add ebx, edi
mov ecx, esi
and edi, esi
sub ecx, ebx
jmp 0x477528
call fcn.00478e75
not edi
rol ecx, 0x1f
sub esi, edi
sub ecx, 0xc3763610
and edi, 0xc3767328
xor esi, edi
inc ebx
jmp 0x4769ec
push 0xbec5cff2
add ecx, edi
ror edi, 0x13
jmp 0x4772f5
call fcn.00478e75
or edi, esi
and ebx, esi
xchg ebx, ecx
or ebx, 0xc38f062c
sub ebx, ecx
add edi, esi
mov ecx, 0xc38fb834
mov ebx, ecx
shl ebx, 5
and ecx, edi
xchg ecx, esi
shl esi, 0xa
jmp 0x4760af