Function at 0x475271
Capabilities:
Encrypt data using aes

Disassembly:
add ecx, 4
mov dword [ecx], edi
pop ecx
jmp 0x475278
lea esp, [esp + 4]
popal
jmp 0x47525b
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
lea edi, [ecx*4]
jmp 0x4752a1

Function at 0x4752c1
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4752f7
and edi, ecx
pushal
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4752e1

Function at 0x475321
Capabilities:
Encrypt data using aes

Disassembly:
mov dword [esp], esi
clc
push word [esp + 2]
jmp 0x47536e
lea esp, [esp + 1]
jmp 0x475394
lea esp, [esp + 2]
and edx, ecx
stc
sub esp, 0x11
push dword [esp + 5]
jmp 0x475358
and edx, ecx
jmp 0x4753e4
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
sub esp, 0x10
add esp, 0xe
lea esp, [esp + 2]
jmp 0x47537e
push ecx
pushal
mov dword [esp + 0x18], esi
sub esp, 0x10
lea esp, [esp + 0x10]
jmp 0x475417
lea esp, [esp + 0x18]
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
mov edx, dword [esp]
mov dx, word [esp]
jmp 0x4753c8
lea esp, [esp + 2]
mov dword [esi + 8], edi
mov edi, dword [esp]
mov di, sp
push bp
jmp 0x47547f
popal
add ecx, 0xc
mov edx, dword [ecx]
pop ecx
sub esp, 0x1e
jmp 0x4753f8
mov edi, dword [edi*4 + reloc.USER32.dll_MessageBoxA]
call fcn.0047545d
lcall 0xef97, 0x26eb8c1e
mul cl
and byte [ebx - 0x72a99906], cl
and al, 2
mov edi, edx
push si
lea esp, [esp + 2]
shr edi, 0x18
pushfd
jmp 0x475423
lea esp, [esp + 2]
mov ebx, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
mov edi, ebx
lea edi, [ecx + esi]
jmp 0x475439

Function at 0x4754e2
Capabilities:
Encrypt data using aes

Disassembly:
pushfd
and edx, ecx
push ebx
jmp 0x47585a
and edx, ecx
clc
clc
xor edi, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x475654
lea ebx, [ebx + 0xc]
mov dword [ebx], edi
pop ebx
call 0x475521
dec dword [ebp - 4]
push ebx
mov ebx, esi
jmp 0x475537
mov edx, dword [edx*4 + reloc.USER32.dll_MessageBoxA]
and ebx, ecx
lea esp, [esp + 0x28]
xor edi, dword [ebx*4 + reloc.USER32.dll_MessageBoxA]
jmp 0x4754eb

Function at 0x4763f9
Capabilities:
Encrypt data using aes

Disassembly:
push es
cmc
xor byte [esi + 0x61], dh
retf
call 0x47643e
cld
jo 0x47589a
xor dword [eax - 0x3f], reloc.USER32.dll_MessageBoxA
ja 0x47586e
jmp 0x476592
jb 0x4758ac
mov dx, 0x5a67
clc
push eax
jmp 0x476516
shr edx, 8
lea esp, [esp + 8]
mov byte [ecx + 1], dl
jmp 0x4758ac
mov edx, eax
sub esp, 5
mov dword [esp], esp
lea esp, [esp + 1]
jmp 0x4764a4
lea esp, [esp + 0x1c]
mov byte [ecx], dl
cmp edi, 2
jmp 0x4763fe

Function at 0x48b65d
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
add edi, eax
jmp 0x48ac10
jmp 0x48b521

Function at 0x4c7203
Capabilities:
Execute anti-debugging instructions

Disassembly:
cbw
neg dx
jo 0x4c720d
bswap edx
jmp 0x4c7219
mov dword [esp], esi
xchg word [esp + 1], bx
jmp 0x4c71ed
bswap edx
mov dx, word [esp]
jmp 0x4c725a
mov dx, word [esp]
btr edx, ebp
jmp 0x4c725d
lea edx, reloc.USER32.dll_MessageBoxA
jmp fcn.004646da
btr edx, ebp
mov word [edi], ax
mov dx, word [esp]
neg ebx
jmp 0x4c726c
jg 0x4c7244
lea edx, reloc.USER32.dll_MessageBoxA
jmp fcn.004646da