Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api
Start service

Disassembly:
call sub.kernel32.dll_GetSystemDefaultLCID
cmp eax, 0xffffff22
jne 0x4010a2
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.kernel32.dll_VirtualQuery
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.ntdll.dll_RtlSetSecurityObject
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.kernel32.dll_VirtualQuery
ret
call sub.kernel32.dll_GetUserDefaultLangID
cmp eax, 0xffffff23
jne 0x40112b
call sub.ntdll.dll_RtlSetSecurityObject
call sub.kernel32.dll_VirtualQuery
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
ret
call sub.kernel32.dll_GetUserDefaultLangID
cmp eax, 0xffffff0d
jne 0x4011a5
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.ntdll.dll_RtlSetSecurityObject
call sub.kernel32.dll_VirtualQuery
call sub.ntdll.dll_RtlSetSecurityObject
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_StartServiceW
call sub.kernel32.dll_VirtualQuery
call sub.kernel32.dll_VirtualQuery
ret
call sub.kernel32.dll_GetUserDefaultLangID
cmp eax, 0xffffff1f
jne 0x401247
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.ntdll.dll_RtlSetSecurityObject
call sub.ntdll.dll_RtlSetSecurityObject
call sub.advapi32.dll_StartServiceW
call sub.ntdll.dll_RtlSetSecurityObject
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.kernel32.dll_VirtualQuery
call sub.advapi32.dll_WriteEncryptedFileRaw
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_StartServiceW
call sub.advapi32.dll_WriteEncryptedFileRaw
ret
jmp 0x475581
or edx, ebx
ror edx, 0x13
jmp 0x476cf1
pop esi
or edi, ebx
xor ebx, edi
bswap ebx
mov edi, 0xeb438f4a
mov ebx, 0xeb43c205
or edi, 0xeb43f9cc
shl ebx, 4
jmp 0x476969
call fcn.0047834f
and ebx, edx
add ebx, ecx
and ecx, edx
add ecx, 0xeb487eae
or edx, edi
inc ecx
add edx, ecx
xchg edx, ecx
xchg ecx, ebx
add ecx, edx
or edi, ebx
xor ecx, edx
and ebx, 0xeb4a5ba9
mov ecx, edi
xchg edx, edi
dec edx
jmp 0x478058
push 0xe1862f4d
or edx, edi
shl ecx, 0xf
xor edi, ecx
ror edx, 0x19
nop
add edi, 0xeb4c546e
xchg ebx, edx
mov ecx, 0xeb4cbee2
xor edi, ecx
jmp 0x477d40
push 0xe181882e
xor edi, 0xeb5167d6
mov ecx, 0xeb519ac1
xchg edx, ecx
and ebx, ecx
add edx, edi
mov ebx, ecx
ror ecx, 0x17
rol edi, 3
mov edx, 0xeb5310af
jmp 0x4772cc
call esi
mov ebx, edi
inc edi
dec edx
mov ecx, edi
shr ebx, 0xc
or ebx, ecx
or edi, 0xeb57bd06
jmp 0x476583
push 0xe1813215
sub edi, ebx
or ebx, edx
add edi, ebx
bswap ecx
sub edx, ebx
add ebx, ecx
xor ebx, edi
jmp 0x4770fe
pop esi
mov edx, ebx
mov ecx, edx
add edx, 0xeb5f3323
and ecx, ebx
or edx, ecx
add edx, edi
xchg ecx, edx
dec ecx
xchg edi, ebx
xor ebx, 0xeb60a91b
xchg ecx, edx
sub edi, ecx
shr edi, 4
jmp 0x476d45
pop esi
and edx, ecx
ror ebx, 0xb
and edx, ecx
bswap edx
add edx, ecx
xor edx, edi
sub ecx, ebx
xor edx, ebx
jmp 0x47631e
mov esi, 0x2774562b
xor ecx, 0xeb790a23
and ecx, edx
mov edi, 0xeb7972b4
nop
sub edi, 0xeb79dfc7
or ecx, edx
add ebx, 0xeb7a5071
sub edx, ebx
mov edx, ecx
or edi, edx
xor ebx, edi
jmp 0x4775a6
pop esi
add edi, edx
add ebx, edx
add ebx, edi
bswap ebx
xor ebx, edx
ror ecx, 0x19
or edi, edx
add edx, edi
xor edi, ecx
xchg edi, ecx
mov edi, ebx
bswap ebx
xor ecx, edi
jmp 0x4759a2
pop esi
and edi, edx
dec ecx
xchg ebx, edi
and ecx, 0xeb7ebcf7
bswap edx
and ecx, 0xeb7f26b6
shl ebx, 0xe
add edi, ecx
mov ebx, 0xeb7fcc9b
jmp 0x4778b0
pop esi
sub edi, edx
bswap ecx
sub edx, edi
mov ebx, 0xeb83d22a
and ecx, edx
or ecx, edx
xor edi, 0xeb84789e
shr ebx, 0x14
or edx, 0xeb84e255
ror edx, 9
sub ebx, edx
jmp 0x477eac
push 0xe178e4a8
xor edi, edx
xor edi, ebx
dec ecx
xor edx, ebx
add edi, edx
jmp 0x475d39
call esi
and edi, 0xeb8aaf7e
xor ebx, ecx
xchg edx, ebx
add edx, edi
xchg ebx, edx
add edx, ebx
sub edi, 0xeb8be083
xchg ecx, ebx
ror ebx, 2
jmp 0x477458
call esi
not edx
xchg edx, edi
mov edi, 0xeb8d0978
inc edx
sub edx, edi
sub ecx, 0xeb8da515
or edi, 0xeb8dd83a
mov ebx, ecx
ror edx, 1
jmp 0x477c19
pop esi
xor ebx, edx
neg ecx
add ebx, edx
mov ebx, ecx
sub ecx, edi
xor ecx, edx
shl ecx, 0x10
or edx, edi
mov edi, ebx
mov edx, edi
jmp 0x477622
push 0xe17b95c2
mov edi, 0xeb9ff887
not edx
xor ecx, edi
xor ebx, edi
and ecx, 0xeba0d77a
sub edx, edi
xor edx, edi
jmp 0x475db6
pop esi
add edi, ecx
xor ebx, 0xeba30e4a
xchg edi, edx
mov edx, ecx
mov edx, edi
and ecx, edx
add ecx, edx
mov edi, ebx
xor edx, edi
mov ecx, ebx
add edx, 0xeba501e5
jmp 0x47701f
pop esi
sub ebx, edx
or ecx, 0xeba5815a
sub edx, edi
add ebx, edx
xchg edx, edi
rol ebx, 1
mov ebx, 0xeba68c2f
xchg ebx, edi
sub edi, edx
inc edx
jmp 0x47576b
call esi
and ebx, edx
sub edx, ebx
or edx, ecx
mov ebx, edx
dec ecx
sub ebx, edx
nop
sub edi, ecx
sub edi, ecx
not ecx
jmp 0x477f50
push 0xe17dc63c
shr ebx, 1
or edi, ebx
add ebx, edi
mov edx, edi
xor edi, ecx
sub ebx, 0xebb4ad5b
or edi, edx
not ecx
jmp 0x477fa2
pop esi
xchg edx, ebx
rol edi, 0x1b
xor edx, 0xebb6db31
and ebx, edx
neg ecx
add edi, 0xebb7f86f
xchg ebx, ecx
shr edx, 0x10
sub ecx, edx
xor edi, edx
shl ebx, 0x11
or ecx, edi
xchg edx, ecx
jmp 0x475f95
pop esi
and ebx, edx
or edi, ebx
xor ebx, ecx
mov edi, 0xebc171f8
xor edi, ebx
and ecx, ebx
add edx, ecx
mov edi, 0xebc249e5
or edi, 0xebc27ff5
mov edx, edi
mov ebx, ecx
jmp 0x476548
push 0xe1791026
or edi, ebx
xor edx, edi
add edi, ebx
sub edx, ebx
mov edx, edi
and ebx, 0xebc55fc2
jmp 0x4760c9
push esp
mov ebx, edi
or edx, ebx
sub edx, edi
or ecx, 0xebc640e0
mov edi, ebx
mov ebx, edx
mov edi, ecx
ror edx, 0x17
shr edx, 0xd
xor ebx, edi
jmp 0x4763f3
push 0xe1844b21
xor ebx, edi
shr ecx, 0x13
mov edx, edi
or edx, edi
shl edx, 5
or ebx, edx
jmp 0x47731d
mov esi, 0x123b2f04
sub edx, 0xebcb8002
xor edi, ecx
mov edi, edx
add ebx, edi
or edi, 0xebcc59a1
sub edx, edi
jmp 0x477201
push 0xe1778553
and edx, ebx
and ecx, ebx
add ebx, edx
shr edx, 0x15
not edx
or ecx, edi
sub edi, ecx
add ecx, ebx
ror edx, 0x17
and ecx, edx
and ecx, edx
or ecx, 0xebd2615a
xchg ecx, edi
xchg edi, ecx
jmp 0x477c6d
call esi
xor edx, ecx
bswap ebx
add edx, ebx
add edi, ebx
mov edx, edi
dec ecx
shr ecx, 0xd
mov edi, 0xebe5dffc
rol edx, 1
jmp 0x475926
push 0xe17a640f
and edi, edx
add ecx, 0xebe88030
sub ebx, ecx
xor ecx, ebx
rol ebx, 0x1f
jmp 0x477dca
call fcn.0047834f
shr ecx, 6
inc edi
xor edx, ecx
xchg ebx, edx
bswap ecx
jmp 0x477e70
mov esi, 0x2774562b
and edx, ecx
xchg edi, ecx
and ecx, edx
neg ebx
or ebx, 0xebfc3a55
mov edx, 0xebfc6e2b
mov edx, ecx
jmp 0x47633a
push 0xe1793a98
and ebx, 0xebfceb98
add edi, edx
xor ebx, ecx
and ecx, ebx
or ebx, ecx
or edx, ebx
xor ebx, 0xebfe2e1d
xor ecx, edi
neg ecx
ror ebx, 0x14
dec edi
jmp 0x4777da
push 0xe1897ce8
xor edi, ecx
or ebx, 0xec00a62a
or edi, ecx
and edi, edx
dec ebx
mov edi, ecx
xchg edx, ecx
mov ecx, edi
jmp 0x476ed6
mov esi, 0x2774562b
and edi, 0xec1982b0
or edx, edi
xor edi, edx
mov edx, ebx
not edi
xchg edx, ecx
jmp 0x4755f8
push esp
ror edx, 0xe
and edi, ecx
or edi, ecx
not ebx
and edx, edi
neg edi
or ecx, 0xec1d6bed
sub ebx, ecx
or edi, ecx
sub ecx, 0xec1e11d3
xor edx, ebx
shl ebx, 8
bswap ebx
mov edx, edi
jmp 0x475d53
push 0xe18ae37e
dec ecx
xchg ebx, ecx
xchg edx, ecx
xor edi, 0xec2832d2
and edi, edx
inc ebx
or edx, edi
xchg ebx, ecx
jmp 0x4764f0
pop esi
and ebx, edi
neg edx
add ecx, 0xec29b98c
or edx, ebx
dec ecx
and ebx, edi
add ebx, ecx
rol ecx, 0x10
neg ecx
jmp 0x47775e
call fcn.0047834f
sub ecx, 0xec2b4867
sub ecx, edx
mov ebx, edi
add ebx, edx
xor edi, edx
or edi, edx
shl edx, 0xe
shr ecx, 0x10
add edx, 0xec2cee0f
add ecx, edx
jmp 0x475f5b
mov esi, 0x2774562b
mov ecx, edi
or ebx, 0xec2ffa06
add ebx, 0xec30312b
or edi, ecx
xor edi, ecx
bswap edi
ror ebx, 6
jmp 0x477a5d
push 0x40
add edi, 0xec3666c0
mov edx, ebx
or ecx, 0xec36d9c9
or ebx, edi
dec edi
or edx, edi
and ecx, ebx
or ecx, edx
jmp 0x47646a
push 0xe1895146
shr ebx, 0xb
xor edi, edx
xor ecx, 0xec3891c4
sub ebx, ecx
mov edx, ebx
xor ecx, edi
not ebx
or ecx, edi
sub ebx, ecx
mov ebx, edi
or ebx, edx
xor edx, 0xec3a648f
jmp 0x4760f1
push 0x74181
mov edx, ecx
neg ecx
inc edi
inc edi
ror ebx, 0x18
and edi, ebx
jmp 0x476ca4
push 0xe18b114c
add edx, ebx
mov ebx, ecx
add edx, 0xec486aed
and edx, ecx
inc edx
shl edi, 0x16
jmp 0x477f09
pop esi
and edi, ebx
rol edi, 1
xor ecx, edx
xor edx, ebx
and edi, ecx
and edx, ecx
bswap edx
dec edx
not ecx
jmp 0x477e03
pop esi
or edx, ebx
sub edx, edi
ror edi, 7
mov edx, ebx
or edx, ebx
mov edx, ecx
add ebx, edi
jmp 0x4771a8
pop esi
mov edi, edx
rol ebx, 0x16
mov edi, edx
or edi, ebx
add ebx, ecx
sub ecx, edi
xchg ebx, edi
jmp 0x475ba0
pop esi
add edx, 0xec61d371
shr ebx, 0x1b
dec ebx
mov ecx, 0xec627edc
or ecx, 0xec62b5ea
and edi, 0xec62e8c2
sub edi, edx
xchg ecx, edi
add ebx, edx
mov edi, edx
jmp 0x47833d
pop esi
rol edx, 0xc
and edi, ebx
and ebx, edx
xor ecx, edx
xor ecx, ebx
jmp 0x475c5b
pop esi
not ecx
xchg ebx, edi
or ecx, edi
mov edi, 0xec74cb0e
dec ecx
xchg ebx, edx
jmp 0x476598
pop esi
not ecx
xor ebx, 0xec90d02e
shl ebx, 0x1a
mov ecx, 0xec913dde
xchg ebx, edi
xor edi, ebx
or edx, ebx
sub edx, 0xec9219cb
and ebx, edi
shl edx, 0x13
or edx, ebx
jmp 0x475979
push 0xe183f3c3
and ebx, edx
and ebx, edx
and ebx, 0xec93645e
inc ebx
xor ebx, ecx
sub edx, ebx
and edi, ecx
and edx, ebx
sub ebx, ecx
sub edx, ebx
add ecx, 0xec950e98
jmp 0x476e4d
push 0xe188f9ea
sub edi, ecx
mov edi, ecx
xor ebx, ecx
and edx, ebx
xor ebx, 0xec9830f1
shl edx, 0x1e
xor ebx, ecx
xchg ebx, edi
and ebx, edx
xor ebx, 0xec9943d5
rol ebx, 9
and edi, ecx
add ecx, ebx
jmp 0x477e86
pop esi
or edi, ecx
rol edi, 0x17
sub ecx, ebx
ror ecx, 0x10
jmp 0x475905
push 0x401400
xchg ecx, ebx
xor ecx, edi
sub ebx, edi
and edi, edx
sub edx, 0xecc4a034
shl edx, 0xb
or edx, 0xecc50a61
add ecx, ebx
add ecx, ebx
jmp 0x4759f2
push 0xe1774c44
sub edx, 0xece64615
inc ecx
xchg edi, edx
add edx, edi
add ecx, 0xece71678
shr ebx, 7
sub ebx, edx
add ebx, edi
or ecx, 0xece7f031
or edi, ebx
and edx, 0xece8594c
sub edx, 0xece88c98
and edx, edi
shr ecx, 0xc
jmp 0x475e09
pop esi
rol ecx, 2
sub edx, ecx
and edx, 0xeceb49b6
and edi, ebx
and ecx, ebx
mov edi, edx
xchg ebx, edx
mov edi, ebx
and ebx, edi
add ecx, 0xececb5b2
add edx, edi
bswap edi
jmp 0x4769d9
call esi
xor ebx, edx
add ebx, edi
shr ebx, 0x11
sub ecx, ebx
mov ecx, 0xecee3260
xchg ebx, edx
and ebx, edx
add ecx, 0xeceed851
and ebx, edi
not edi
jmp 0x477ceb
call esi
or ebx, ecx
xchg ebx, ecx
and edx, ecx
ror ecx, 0xa
xor edx, 0xecf94f08
or ebx, ecx
and ebx, ecx
and edi, ecx
xchg ebx, edi
and ebx, ecx
add ebx, edi
and ebx, 0xecfab0a1
jmp 0x477141
push 0xe1841f8c
xchg ecx, edx
shl edi, 0x1f
mov edx, 0xecfb68ff
add edi, 0xecfb9c7d
xor edx, ebx
jmp 0x475d73
call fcn.0047834f
and ebx, edi
rol edi, 9
mov ecx, ebx
xchg ebx, edi
sub edx, edi
sub ecx, edx
xor edi, 0xecff3b5f
add ebx, ecx
dec edi
add ecx, 0xecffd7f1
ror ebx, 0x10
jmp 0x476f33
mov esi, 0x123b2f04
mov edi, 0xed03aa33
and edx, ecx
mov ebx, 0xed0415b1
rol ecx, 0xd
ror ecx, 0x10
mov ecx, ebx
xchg edx, edi
xchg ebx, ecx
or edx, edi
or ebx, edi
or edx, ebx
jmp 0x476f83
call fcn.0047834f
xchg ebx, edi
or edx, 0xed073f38
or ebx, 0xed07724f
mov ecx, edi
xchg edx, edi
neg edx
jmp 0x475a14
call esi
xchg ebx, edx
sub edx, 0xed089e99
sub edi, edx
or edi, ebx
sub edx, ebx
xor edx, ebx
sub edi, edx
mov edx, 0xed09e1e3
add ebx, edi
xor edi, edx
add ecx, ebx
or edi, 0xed0aaca5
jmp 0x475bc4
call fcn.0047834f
dec ecx
sub edx, ebx
add ebx, edx
or ebx, 0xed0e59a4
jmp 0x47730f
push 0xe187c0e4
add edx, ecx
rol ebx, 0x15
xchg edi, edx
xor ecx, 0xed12159a
jmp 0x477b6f
push 0xe183127b
xor edi, 0xed16e41f
shl ebx, 0xd
or ebx, edx
and edi, 0xed181e3f
mov ecx, edi
and edi, ecx
neg ecx
sub edi, ebx
bswap ebx
xor ecx, 0xed1a6b24
ror edx, 0x1e
jmp 0x4761fd
pop esi
and ebx, edx
xchg ebx, ecx
mov edi, 0xed1e26fc
inc ecx
xor edx, 0xed1ef526
rol edx, 0x12
or edi, ecx
or edi, ecx
add ecx, ebx
sub edx, edi
jmp fcn.00476757
pop esi
xor edi, ebx
and edi, ebx
neg edi
add edi, 0xed2aa346
sub edi, 0xed2ad6cf
or edi, ebx
dec ecx
shr ecx, 0x18
or edx, edi
sub ecx, edx
shr ecx, 0x10
jmp 0x476302
push 0xe1815c19
add ebx, edi
or ebx, 0xed2ca5a7
or ecx, 0xed2cd8f4
xchg edx, ebx
add edx, 0xed2d40fb
sub edx, ebx
ror edx, 5
jmp 0x475692
push 0xe187945d
dec edx
xchg edx, ecx
add edi, ecx
xchg edx, edi
mov edx, ebx
xor ebx, edx
xchg edx, ecx
xor edx, ebx
mov ebx, ecx
rol ecx, 4
jmp 0x476fca
pop esi
sub ebx, ecx
add ecx, ebx
xchg edx, edi
xchg edx, ecx
add ebx, edi
mov edi, ecx
rol ecx, 0x13
or edi, ebx
add ecx, edx
or ebx, edi
xor edi, edx
mov edx, ecx
xchg edi, edx
or edx, ebx
jmp 0x477f30
pop esi
xor ecx, 0xed370dcb
or edi, ecx
mov edi, edx
and edi, ebx
sub ebx, edx
neg ecx
or edx, ecx
sub ecx, 0xed387cd9
xchg edi, ebx
xchg edx, edi
mov edi, edx
sub ebx, edi
shl edx, 7
jmp 0x47587e
call fcn.0047834f
add ebx, edx
and ebx, edx
xchg ecx, edi
bswap edx
or ebx, edx
sub edi, ecx
mov ebx, ecx
add ecx, edx
or ecx, edx
xor ebx, ecx
xchg edi, ebx
and edi, ecx
jmp 0x47735f
push 0xe18b684e
xchg edi, edx
mov ebx, ecx
ror ebx, 0x13
xor ebx, edi
mov ebx, edi
mov ebx, 0xed450672
and edx, ebx
xor edx, ecx
mov ecx, edi
and edi, 0xed45dcb0
neg ebx
or ecx, ebx
jmp 0x477d9b
mov esi, 0x2774562b
and edx, edi
xchg edi, edx
or ecx, edx
xchg edx, ecx
sub edx, 0xed475d6f
xor edx, edi
xchg edi, ebx
xor edx, ebx
xor ecx, 0xed48375b
jmp 0x476f15
mov esi, 0x2774562b
add ebx, 0xed4a185d
xor edx, 0xed4a4e7d
bswap edx
add edi, ecx
add edx, 0xed4aeb57
shr edx, 0x1e
and ebx, edi
not ecx
xchg edi, ebx
or edi, edx
jmp 0x47754a
call esi
not edx
or ecx, edi
ror edi, 0x16
jmp 0x47666c
push 0xe18477f5
xchg ebx, edx
or edi, edx
not edx
inc ecx
sub ebx, 0xed4fdbe9
shr ecx, 0xd
or ecx, 0xed504249
xor ecx, edx
add edx, edi
rol edx, 0x1a
jmp 0x477711
push 0xe17e1d08
inc edi
ror edi, 0x11
and ebx, ecx
and ebx, 0xed51d289
nop
neg edi
sub edx, ecx
jmp 0x4758d7
call esi
add edi, ebx
or ebx, ecx
add ebx, ecx
or edx, edi
xor edi, ecx
xchg ebx, edx
add ebx, edi
or edx, 0xed55576d
xor edx, edi
jmp 0x4755a6
call esi
xor ecx, 0xed563e31
and edi, ecx
or ecx, edi
neg ecx
jmp 0x475a67
call fcn.0047834f
xchg ecx, ebx
and ecx, ebx
and ebx, ecx
bswap ecx
sub edx, ecx
dec ebx
and edx, ecx
mov ebx, ecx
mov ebx, ecx
xor edi, ecx
sub ecx, edx
sub edi, 0xed659c95
xchg edx, edi
xchg edi, ecx
shr ebx, 0x12
jmp 0x476d6c
call esi
and ecx, 0xed682d31
or ecx, ebx
ror edi, 0x1b
xchg edi, ebx
sub ebx, edi
neg ecx
add edx, ebx
shl ecx, 2
mov ebx, ecx
xchg ebx, ecx
and ebx, edi
sub edi, ecx
add edi, ecx
mov edx, edi
and ebx, edx
jmp 0x475cfe
pop esi
neg ebx
bswap ebx
add ecx, ebx
xchg ebx, ecx
mov edi, ecx
and ebx, edx
jmp 0x477a37
call fcn.0047834f
sub ecx, 0xed7fe8c5
and edi, 0xed801fe8
or edi, ebx
xor ecx, edi
sub ebx, 0xed80b809
sub ecx, 0xed80eed5
add edi, ebx
dec edx
and ebx, ecx
or edx, ebx
ror edi, 0xd
neg ebx
jmp 0x476e25
call fcn.0047834f
mov edi, ebx
or edx, ecx
sub edx, edi
neg ecx
or edi, edx
rol ecx, 0x1d
sub edi, ecx
xchg edi, ecx
or edx, 0xed868ee8
jmp 0x47740f
push 0xe17b3fe6
ror edx, 2
mov edi, ecx
mov ecx, edx
mov edi, 0xed8d9953
add ecx, 0xed8dfa02
add edi, ecx
sub edx, ecx
jmp 0x477b30
push 0xe184a001
neg ebx
mov edx, ecx
shl ebx, 0x19
sub edx, edi
add edx, 0xed9d9389
xchg ebx, ecx
mov edi, 0xed9dfabc
inc ebx
xor ecx, 0xed9e644a
or ebx, edi
or edx, 0xed9ecd35
jmp 0x4783c8
pop esi
not ecx
or ecx, edi
xor ebx, edi
xor edi, ecx
mov ebx, edx
add ecx, ebx
sub edx, 0xeda60ed4
xor edx, edi
jmp 0x475628
mov esi, 0x123b2f04
ror ebx, 0x1a
inc edi
or edx, edi
or edi, ecx
and ebx, edi
mov edi, ebx
or ecx, 0xedb0c91f
shr edi, 0x1c
jmp 0x4773d5
pop esi
mov ecx, 0xedc3ab3c
and ecx, 0xedc410f4
ror ecx, 0x11
bswap edx
ror edi, 0x13
sub ebx, edi
add ecx, ebx
or edi, 0xedc672f3
sub ebx, ecx
xor edi, edx
dec ebx
sub ebx, 0xedc7f662
ror edx, 9
rol edi, 0x1c
jmp 0x477977
push 0xe18769a7
xchg edi, ecx
sub edi, 0xedd99c6b
add edi, 0xedd9fd72
xor edi, edx
sub edi, ebx
add ecx, edi
nop
jmp 0x477123
call fcn.0047834f
add edi, ebx
add ebx, edx
ror edi, 0xf
sub edx, ebx
or edi, 0xede22fc7
shl ebx, 2
neg ecx
or edx, 0xede557be
xchg ebx, ecx
or ecx, 0xede61a67
ror ebx, 4
shr ecx, 2
jmp 0x476237
call fcn.0047834f
or edx, 0xede76be4
sub edi, ecx
xor edi, ebx
mov ebx, ecx
mov ebx, edx
and ebx, edi
inc edx
and edi, edx
add edx, ebx
sub ebx, ecx
bswap edx
mov edi, ecx
jmp 0x4756ed
push 0xe180dc0d
rol ecx, 3
add edx, edi
add edx, ebx
rol edi, 0xe
mov edi, ecx
mov ecx, edi
shl ecx, 9
sub ecx, edi
add ebx, edx
bswap edi
mov edi, 0xedf45cd1
jmp 0x4782ee
call fcn.0047834f
xor ebx, 0xedf4deff
and edx, edi
rol edi, 0x1d
and edx, ebx
xchg edi, ebx
bswap ebx
mov edi, ecx
or ebx, edi
and edi, edx
or ebx, edx
ror edx, 0x1d
jmp 0x475be5
push 0xe17b690c
mov edx, edi
sub edx, ebx
and edx, ebx
add edi, ecx
mov ecx, edi
xor edi, ecx
add edx, edi
jmp 0x475b66
mov esi, 0x2774562b
dec edi
rol edx, 0x1b
mov ebx, 0xee1545f4
add edi, edx
and ebx, edx
and ecx, 0xee166680
or ecx, edx
xchg ecx, edi
and ecx, ebx
not edx
jmp 0x476e80
pop esi
and edx, ecx
bswap ebx
mov edi, 0xee286fb4
add edx, edi
jmp 0x476b98
push 0xe177af55
bswap ebx
sub edi, ebx
shr ebx, 0xe
sub ebx, 0xee325bd5
and edx, ecx
jmp 0x477289
pop esi
add edx, ebx
rol ebx, 0x1a
xor edi, 0xee40d067
shr edx, 8
xchg edx, edi
shr ebx, 7
sub edi, 0xee4292e2
xor ebx, edx
add ecx, ebx
mov edx, ebx
nop
xor edx, ecx
shl ecx, 7
jmp 0x476695
push 0xe1865b22
mov edi, edx
shr edi, 0x1a
not edx
and edi, edx
add ebx, ecx
add edi, ecx
xor edx, ecx
dec ebx
shl ebx, 0x14
not edx
sub ecx, edx
mov edi, ecx
sub ecx, edx
add ecx, 0xee4f2649
add ecx, edi
jmp 0x4760aa
push 0xe18b97ab
neg ecx
shl ecx, 0x1e
mov edx, 0xee56c2c8
rol edi, 0x16
or edx, 0xee57831e
mov ebx, edi
add edi, edx
add edx, ecx
or edi, ecx
xor ecx, ebx
sub ebx, 0xee59d406
add ebx, edi
jmp 0x47811f
mov esi, 0x123b2f04
ror edi, 0x13
xor edx, ecx
xchg edx, edi
and edx, 0xee5bea1a
jmp 0x47813f
pop esi
sub ebx, 0xee5ef7eb
or ebx, edx
or ebx, ecx
dec ecx
sub ecx, edi
add edx, ecx
sub ebx, 0xee6132a6
sub ebx, edi
sub edx, edi
and ecx, ebx
inc edx
or edi, 0xee6354bd
jmp 0x478479
call esi
mov ecx, 0xee6ab311
nop
xor edi, 0xee6b7ab3
inc ebx
or ebx, edx
jmp 0x4783aa
push 0xe18925a0
and edx, 0xee6cd538
xor edi, 0xee6d3e20
or edi, ebx
mov ebx, ecx
xor edi, ecx
add edx, edi
xor edx, edi
and ecx, edi
xor edi, edx
xor edi, ecx
jmp 0x476414
push 0xe17cc100
sub edx, 0xee72d0dc
add edx, 0xee73320e
xor edi, edx
sub ecx, ebx
mov edi, edx
xchg edi, ebx
ror ecx, 0xb
add edx, ecx
and edx, ecx
or edi, 0xee762f6c
and ecx, edi
mov ecx, ebx
add ecx, 0xee77c75c
jmp 0x476386
push 0xe18b3caf
xchg edx, ebx
mov ecx, ebx
xor ebx, ecx
add ebx, edi
inc edx
add ecx, 0xee7d7d68
xor edi, ebx
mov edx, 0xee7e5778
xchg edx, ecx
mov edx, 0xee7f141e
jmp 0x47725f
pop esi
xor ebx, 0xee7f9415
or ecx, 0xee800b93
xor ebx, edi
not edx
and ebx, ecx
neg edx
and edi, 0xee81ec0c
jmp 0x47679f
pop esi
or edx, 0xee826572
xchg ecx, edx
xchg ecx, ebx
xchg ecx, edi
and edx, ebx
or ecx, edi
shr ecx, 9
jmp 0x475c3c
push 0xe17df252
xchg ebx, ecx
xor edi, ebx
add ecx, ebx
xchg edx, edi
sub ecx, 0xee8d4acf
mov ebx, ecx
xor ecx, 0xee90a138
and edi, 0xee90fec8
inc edi
dec ebx
jmp 0x477344
call esi
and edi, edx
rol ecx, 0x17
or ecx, ebx
add edx, ebx
mov ebx, ecx
xchg ebx, edx
or ebx, 0xee9f6dad
xchg ecx, ebx
xchg edx, ebx
xor edx, ebx
mov edi, ecx
jmp 0x478248
mov esi, 0x123b2f04
add edi, ecx
and ecx, edi
or edx, ebx
mov ebx, edx
xchg edi, ebx
add edi, edx
or ebx, edi
xchg ecx, edx
xor ecx, 0xeeab079b
jmp 0x47600d
call fcn.0047834f
ror edx, 0x1e
mov ebx, 0xeeab8182
xchg ebx, edi
or edx, ecx
or ecx, edx
ror edx, 0x14
sub edi, edx
xor ebx, 0xeeacb9b0
jmp 0x477384
pop esi
xchg ecx, ebx
inc ecx
rol edi, 0x17
xor edi, ecx
and edi, 0xeeba6bd2
sub edx, 0xeeba9cd7
add edi, ebx
shl edi, 0x1f
shl edx, 0x18
dec ebx
dec ecx
jmp 0x476992
push 0xe18108af
xor edx, ebx
xor ebx, ecx
xor ecx, edx
and edx, ecx
neg edi
and ebx, 0xeec3b027
and ecx, edx
add edx, ecx
and edi, 0xeec44e79
jmp 0x475733
pop esi
mov ebx, edx
shl ebx, 0x10
mov ebx, edx
add ebx, ecx
ror ecx, 0x16
jmp 0x478503
pop esi
sub edx, edi
mov ebx, 0xeecf21a2
xor ebx, edi
and edx, 0xeecf8976
xchg ecx, ebx
or ecx, ebx
rol ebx, 0x15
mov edx, edi
jmp 0x47705a
mov esi, 0x2774562b
shr edi, 8
xor ecx, 0xeed0de20
mov edi, ecx
add ecx, ebx
bswap edi
sub edx, 0xeed1b955
add edx, ecx
jmp 0x4779f2
mov esi, 0x4132136a
and ebx, edi
or ebx, 0xeedc6679
mov edx, edi
shl edi, 0x12
add ecx, ebx
add edx, edi
add ecx, ebx
xor ecx, 0xeedda055
rol ebx, 0xd
and edi, ebx
shr edi, 0x16
xchg ebx, edx
mov edi, ebx
or ecx, ebx
jmp 0x4779c0
pop esi
bswap edi
mov edx, edi
mov edx, edi
not edx
or ebx, edi
not edi
xchg edx, edi
xor ecx, edi
add ecx, 0xeee4e94d
add edx, ebx
jmp 0x4770d9