Function at 0x401000
Capabilities:
Create process on windows
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
neg esi
xchg edx, esi
not edi
add edi, ecx
call sub.user32.dll_GetActiveWindow
xchg ecx, edi
mov esi, ecx
not edi
add edx, ecx
cmp eax, 0xfffffef0
jne 0x40107b
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
ret
xchg ecx, edx
mov esi, ecx
add edx, ecx
mov esi, ecx
xchg ecx, edx
ror esi, 0x1d
call sub.user32.dll_GetActiveWindow
neg edi
xchg edi, ecx
neg edx
add esi, ecx
mov ecx, edx
rol edi, 7
cmp eax, 0xfffffee1
jne 0x401132
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
ret
xchg edi, edx
not edx
call sub.user32.dll_GetMenuCheckMarkDimensions
rol edi, 1
xor esi, edi
and esi, edi
sub ecx, edx
mov edx, ecx
add edi, ecx
xor edx, 0xad08ced9
cmp eax, 0xfffffeda
jne 0x4011e6
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
ret
and esi, edx
or ecx, edi
inc edx
sub esi, ecx
call sub.user32.dll_GetActiveWindow
xor ecx, edx
not esi
shr edx, 0x13
mov ecx, edx
and edi, esi
sub esi, edx
sub edi, edx
sub esi, edx
cmp eax, 0xfffffedc
jne 0x40127d
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.ntdll.dll_RtlDecodePointer
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.kernel32.dll_CreateProcessW
call sub.kernel32.dll_CreateProcessW
call sub.oleaut32.dll_VarMod
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
call sub.oleaut32.dll_VarMod
call sub.ntdll.dll_RtlDecodePointer
call sub.ntdll.dll_RtlDecodePointer
ret
jmp 0x49407d
not edi
shl edx, 3
sub edx, edi
mov esi, 0xaded1e16
or edx, esi
jmp 0x49495d
call ecx
ror esi, 0x18
add esi, edx
xor edi, edx
jmp 0x494252
pop ecx
add edi, 0xb47183b9
add ebx, edi
xchg esi, edi
not esi
mov edi, ebx
sub edi, 0xb47538b7
sub edx, ebx
xchg esi, ebx
jmp 0x495336
push 0xae05c13d
or ebx, esi
xor edi, ebx
or esi, ebx
dec edi
mov edx, 0xb47fc4ed
or esi, edx
or edx, edi
sub edx, 0xb480c601
jmp 0x495ae8
pop ecx
mov edx, esi
or edi, 0xb4873f3d
add edi, ebx
xor esi, edx
or edi, edx
jmp 0x49705e
push 0xadf306a8
xchg edx, edi
and ebx, edx
mov ebx, esi
bswap esi
sub edi, ebx
and esi, edi
xchg ebx, edi
sub esi, edi
xor esi, ebx
rol ebx, 5
xchg edx, edi
xchg ebx, edi
xchg esi, ebx
jmp 0x495219
push 0xadf6c35a
sub ebx, edi
shr esi, 0x1e
add edi, edx
or edx, ebx
rol ebx, 0x15
and edx, 0xb49e6c6c
or esi, 0xb49f0951
xor edx, 0xb49fbaec
bswap edx
and ebx, esi
sub edi, 0xb4a178c9
jmp 0x495ba2
call fcn.00497033
add edx, edi
ror ebx, 0x1c
jmp 0x4955f8
pop ecx
or ebx, 0xb4a5d461
and edx, 0xb4a62755
and ebx, 0xb4a69c89
ror ebx, 0xe
sub esi, ebx
xor ebx, edx
and esi, edi
xor edi, ebx
not ebx
sub ebx, 0xb4aac677
jmp 0x49672c
push 0xae0d7e62
bswap edi
sub ebx, esi
neg ebx
xor ebx, edx
shl esi, 3
sub edi, edx
add ebx, esi
ror edx, 0x10
or edi, esi
sub edx, esi
sub esi, ebx
jmp 0x496e96
push 0xadfd7f5c
and edi, 0xb4b2209c
xor edi, esi
rol esi, 0x1f
or esi, ebx
sub edx, edi
sub edi, esi
xor edx, 0xb4b5ed8b
xor esi, edi
or edx, 0xb4b70773
inc edx
neg esi
jmp 0x495559
push 0xae0b5424
xchg esi, edi
inc ebx
sub edi, ebx
jmp 0x495053
push 0xae041e83
xchg ebx, edx
mov edx, esi
and edx, ebx
xor edx, 0xb4c94ea2
add ebx, edi
and esi, edx
jmp 0x49520a
pop ecx
mov esi, 0xb4cb3086
sub edx, edi
add edx, edi
xchg edx, esi
and edx, esi
not esi
xor edi, ebx
xor edx, edi
rol esi, 4
jmp 0x4941cc
pop ecx
mov ebx, 0xb4d34d5f
xor edx, ebx
not edx
mov edx, edi
and edi, esi
shr ebx, 0x18
inc esi
xor edx, edi
mov ebx, edx
shr edi, 0x12
xchg ebx, edx
ror esi, 0x16
sub edi, 0xb4d85b89
xor edx, edi
rol edx, 0xc
jmp 0x49602c
pop ecx
or edx, 0xb4df458d
or edi, edx
and edi, ebx
neg esi
sub edi, esi
mov ebx, edi
mov ebx, edi
xor ebx, esi
and esi, edx
sub esi, 0xb4e21baf
inc ebx
jmp 0x49540b
push 0xae122d20
neg esi
xchg ebx, edi
xor esi, ebx
and esi, 0xb4f33a50
add edx, esi
mov edx, ebx
xor edi, ebx
bswap ebx
and ebx, esi
inc edi
shl edx, 9
bswap edx
mov ebx, edi
jmp 0x495007
push 0x40
shl ebx, 0x1c
add ebx, edx
sub esi, edi
xor edi, 0xb5179c7f
and ebx, edx
sub ebx, edx
ror edi, 0x1f
sub ebx, edi
xchg esi, ebx
sub ebx, edx
and edi, edx
and esi, 0xb51ca928
jmp 0x4954fe
push 0xae164807
not ebx
and ebx, 0xb53108f1
or edi, esi
rol edi, 9
and esi, edx
mov edx, 0xb5339901
or edi, 0xb5343396
xor esi, ebx
jmp 0x496763
call fcn.00497033
or edi, esi
neg ebx
sub esi, edi
neg ebx
dec edi
rol edx, 0x1f
xor esi, edx
mov ebx, esi
and ebx, edx
not esi
jmp 0x4940a0
pop ecx
sub edi, ebx
rol edx, 0x11
or ebx, edx
inc esi
nop
sub ebx, edx
or ebx, esi
xor edi, esi
bswap edi
and edx, edi
bswap edx
mov edx, esi
jmp 0x4948e6
mov ecx, 0x2774562b
add esi, ebx
sub esi, edx
dec esi
bswap ebx
and edi, edx
or edx, edi
xor edx, ebx
add esi, 0xb5600206
jmp 0x4953cc
push 0xae160f82
nop
and esi, edx
add esi, 0xb5660abc
xor edx, 0xb5665c42
xchg esi, edx
add esi, edx
sub esi, edi
dec edx
shl ebx, 0x18
xor esi, ebx
xor esi, ebx
jmp 0x4946bf
push 0xae12a396
xor ebx, edi
mov edx, ebx
shl ebx, 0x1a
dec esi
xchg edx, edi
mov ebx, edi
bswap ebx
add esi, edx
add edi, ebx
xchg edi, ebx
jmp 0x495dc4
push 0xae10850b
and esi, ebx
dec edi
shl edi, 4
and ebx, 0xb575de34
rol edx, 0x1a
jmp 0x495fd9
call ecx
mov edi, 0xb5769f9e
and ebx, edx
mov edi, esi
or edi, ebx
sub esi, edx
bswap edx
bswap esi
or esi, edi
jmp 0x494b1c
push 0xadf2ba25
bswap ebx
add ebx, 0xb5845fed
shr edi, 0x1c
or edx, edi
add edx, 0xb5855c02
add esi, edi
jmp 0x494266
pop ecx
sub edi, esi
sub edx, ebx
mov ebx, edi
xchg edx, edi
mov ebx, edx
sub edi, 0xb59cb29b
jmp 0x4947f1
push 0xae024093
mov esi, 0xb5a3537d
or edi, esi
inc edx
xor esi, edi
inc edx
or ebx, edx
xor ebx, 0xb5a6de61
or edi, edx
and edi, edx
jmp 0x495c63
mov ecx, 0x4132136a
xor ebx, edi
bswap edi
xor esi, ebx
add edx, esi
xchg esi, edi
xchg ebx, edi
mov esi, 0xb5b311a7
shr edi, 8
jmp 0x496b8d
call fcn.00497033
add edx, 0xb5c37739
or ebx, esi
add esi, edx
xor edx, esi
jmp 0x495265
pop ecx
add edx, edi
bswap esi
add edi, edx
inc esi
or edi, edx
xor esi, ebx
or esi, edx
dec edi
jmp 0x49435a
call ecx
ror edi, 0xf
xchg esi, edx
or edi, ebx
sub esi, edi
xor edx, esi
sub edx, ebx
mov edi, esi
or edx, esi
neg ebx
mov edi, ebx
neg esi
mov esi, 0xb5ce80d7
rol esi, 0x17
jmp 0x496430
mov ecx, 0x2774562b
sub edi, ebx
or edi, esi
inc ebx
add ebx, 0xb5d03b89
ror edx, 0x12
add edi, 0xb5d0dffc
and edi, ebx
jmp 0x495da0
mov ecx, 0x2774562b
rol ebx, 0xd
add esi, edi
not esi
xor ebx, 0xb5ec0f32
shl esi, 0xc
xchg esi, ebx
sub esi, edx
add edx, ebx
add edx, ebx
sub edi, edx
or edx, ebx
jmp 0x496708
call ecx
add edi, edx
and ebx, esi
and esi, 0xb5f4cd8d
bswap ebx
mov ebx, edi
xchg ebx, edx
jmp 0x4956b8
push 0xadfedbe1
xchg esi, edi
mov edx, 0xb6053aab
ror edx, 1
sub edx, ebx
sub esi, ebx
sub edi, 0xb6068083
and esi, edi
or edx, ebx
add ebx, edx
bswap edx
jmp 0x496d15
mov ecx, 0x2774562b
sub edi, edx
rol esi, 0x1a
inc edi
sub edx, esi
sub edx, ebx
rol edi, 3
rol edi, 0x1a
add edi, ebx
and edi, 0xb64b2450
xchg ebx, edx
sub edx, 0xb64c4a5f
jmp 0x496003
pop ecx
xor esi, ebx
xor edi, esi
ror edx, 0xa
add esi, edx
sub edx, 0xb652db57
shl edx, 0x1b
mov edi, 0xb6537f79
mov edi, ebx
and edi, edx
or ebx, esi
inc esi
jmp 0x4949f2
push 0xae12695c
mov ebx, 0xb668c294
add ebx, 0xb6696d8f
sub edx, esi
xchg edx, ebx
bswap edx
or ebx, esi
and edx, edi
jmp 0x4948c8
call fcn.00497033
sub edi, ebx
and edi, 0xb66dbcd7
and edi, edx
xor edx, edi
xor ebx, edi
dec esi
and esi, 0xb66f4c93
sub edi, 0xb66fa391
sub esi, edi
mov edx, edi
sub ebx, edi
xor edx, ebx
jmp 0x495d10
mov ecx, 0x2a371b56
sub edx, 0xb6715ad8
and edi, ebx
mov edi, 0xb6720b03
xor edx, ebx
rol ebx, 0x16
jmp 0x49613f
call ecx
xor edx, edi
add ebx, edx
ror edi, 3
add edi, ebx
xchg edx, esi
jmp 0x4965f0
push 0xae045daa
shr edi, 8
xchg edx, edi
jmp 0x495ef6
push 0xadf371b7
ror edx, 8
and esi, edi
sub esi, 0xb69e39e6
xchg edi, esi
xor edx, esi
xchg esi, edi
shr edi, 1
and edx, 0xb69fe06e
xchg ebx, esi
and edx, 0xb6a1239e
rol ebx, 9
jmp 0x494c8d
call ecx
mov edi, esi
and esi, edx
add edi, ebx
add ebx, esi
mov edx, edi
xchg esi, ebx
shr edx, 0x19
xor ebx, edx
rol ebx, 0x12
and ebx, edx
jmp 0x496aa4
pop ecx
inc edi
or esi, ebx
not edx
dec edx
not edi
dec edx
mov edi, 0xb6b84116
jmp 0x4967fb
call fcn.00497033
xchg esi, edx
mov ebx, edi
sub edi, edx
xchg edx, ebx
sub esi, ebx
xchg edi, ebx
and edi, ebx
xor edi, 0xb6c3b2af
jmp 0x49506f
push 0xadfd4298
sub edi, 0xb6c41f69
mov edi, edx
mov esi, ebx
sub edi, 0xb6c52489
mov esi, 0xb6c5b915
inc edx
xchg ebx, edx
or edi, 0xb6c84448
mov edx, ebx
jmp 0x4943a7
push 0xae066fc0
inc edi
sub ebx, edi
shl edx, 7
xchg esi, ebx
mov edi, esi
ror ebx, 6
add ebx, esi
bswap ebx
or esi, edx
or edi, ebx
neg edi
bswap edi
jmp 0x4963b6
call fcn.00497033
and ebx, edx
sub edx, ebx
not edi
rol ebx, 0x14
nop
bswap ebx
and edi, ebx
neg esi
jmp 0x494b57
pop ecx
shr edx, 0x1a
inc edx
nop
and edi, 0xb6db6b49
add edx, ebx
xor edx, 0xb6dc0813
xor esi, edi
or edi, 0xb6dcab48
mov edi, ebx
mov esi, edi
jmp 0x49590c
pop ecx
bswap edi
add ebx, edx
add edx, ebx
and edx, 0xb6de9f58
or edx, esi
or edi, ebx
and edi, 0xb6df9a32
jmp 0x496a84
push 0xae06347c
not edx
xchg edx, edi
mov edx, ebx
add edx, ebx
sub esi, edi
add esi, ebx
rol edx, 1
mov ebx, esi
bswap esi
jmp 0x495360
push 0x92c7d
add edx, edi
and esi, edx
ror ebx, 0x1e
and ebx, esi
inc edx
jmp 0x49662a
mov ecx, 0x2774562b
or esi, edi
xchg edi, ebx
sub edx, esi
bswap edx
xor edx, ebx
xchg edi, edx
xor edx, edi
or esi, edx
bswap esi
neg edi
dec ebx
jmp 0x49434b
call ecx
or edi, ebx
mov edx, ebx
and edi, esi
shl ebx, 0x1c
neg ebx
add edx, edi
mov edx, ebx
sub edx, ebx
or esi, edi
xor ebx, 0xb71c4831
sub esi, ebx
xor esi, 0xb71ce89f
mov ebx, 0xb71d3881
jmp 0x496b1d
pop ecx
rol edx, 0x12
bswap esi
bswap ebx
xchg esi, ebx
dec edx
sub esi, edx
shl ebx, 0x12
and edi, 0xb727522d
xor edi, 0xb72824c8
and ebx, 0xb72901d6
neg ebx
or edx, esi
and ebx, 0xb72b53f1
xchg edi, ebx
xor ebx, 0xb72cddc9
add ebx, 0xb72dad9c
jmp 0x4953e6
pop ecx
sub ebx, edx
sub edi, ebx
not ebx
mov edi, 0xb736e782
xor edx, 0xb73789a9
xchg edx, edi
not ebx
add esi, 0xb7396e36
not edi
inc edx
or edi, esi
jmp 0x495aa3
push 0xadfad5f0
xor ebx, esi
inc edx
inc edi
mov edx, esi
not edi
and edx, edi
rol ebx, 0xe
bswap ebx
jmp 0x495826
push 0xadfffd35
sub ebx, esi
inc edi
sub edx, 0xb776273f
shl esi, 0xb
rol edx, 0x12
neg esi
add edi, edx
sub edi, edx
xchg edi, ebx
not esi
mov ebx, edx
jmp 0x495d2f
push 0xadfb869b
and ebx, esi
not edi
not edi
nop
mov ebx, edx
bswap edx
or edx, ebx
jmp 0x494b7d
pop ecx
xchg edx, edi
shr esi, 0x1a
shl esi, 2
jmp 0x4943eb
pop ecx
mov ebx, 0xb78b1378
shr ebx, 0x10
and ebx, 0xb78bb41a
xor edx, edi
and ebx, esi
xchg edx, ebx
mov edx, esi
xor edi, esi
jmp 0x494a72
push 0xae020798
shl esi, 0x1d
mov esi, ebx
mov edx, esi
rol edi, 0x19
mov esi, 0xb79bd6ef
inc esi
ror edi, 0x17
inc edi
jmp 0x494a29
call fcn.00497033
add edi, esi
inc edi
or edx, 0xb7a49a93
and edi, ebx
jmp 0x49596c
call ecx
rol edi, 0x10
xor edx, edi
and edi, ebx
and ebx, edx
sub ebx, esi
bswap ebx
sub edx, 0xb7a7b409
xor ebx, edx
and edi, 0xb7a86088
not ebx
jmp 0x4944d5
call ecx
dec edi
inc edi
add edi, 0xb7a9caf5
xor edx, 0xb7aa1dcc
or esi, 0xb7aa91db
mov edi, 0xb7ab2364
shr esi, 0x17
sub ebx, edi
shl edi, 0xe
xor ebx, edi
and edx, edi
jmp 0x494f69
pop ecx
sub esi, edi
sub edx, ebx
or edi, edx
and edi, esi
jmp 0x494306
pop ecx
and edx, esi
xor ebx, edi
xchg ebx, edx
nop
or esi, edx
and edi, esi
add esi, edx
add esi, 0xb7c94c3a
sub ebx, edx
jmp 0x494567
mov ecx, 0x2774562b
dec edx
shl edi, 0xf
rol esi, 0xc
shl edx, 2
not ebx
or esi, ebx
and edx, 0xb7cc68d5
and edi, 0xb7ccd867
mov esi, edi
xchg edi, ebx
mov edi, ebx
jmp 0x495957
push 0xae05fa01
ror edx, 0xd
neg esi
sub edi, ebx
and edx, 0xb7cf2776
xor esi, edi
ror ebx, 0x13
xor edi, ebx
rol ebx, 0xa
sub edi, edx
add ebx, 0xb7d19481
and edi, esi
mov ebx, edx
jmp 0x4954c6
push 0xadf72465
xchg ebx, edx
xor esi, edx
jmp 0x496103
pop ecx
ror edi, 0x18
and edx, 0xb7e6c548
or ebx, 0xb7e715de
and edi, ebx
jmp 0x496467
push 0xae027a6c
bswap ebx
xor esi, ebx
xchg ebx, edx
and esi, edi
inc edx
mov edx, ebx
xchg edi, edx
add esi, edi
xor ebx, edi
jmp 0x496238
call ecx
not edi
add ebx, edi
neg esi
mov edx, ebx
mov esi, edx
mov edi, ebx
not edx
or edx, ebx
shl edx, 0x1e
xchg ebx, esi
jmp 0x494478
call ecx
add edi, edx
or ebx, 0xb805f76b
mov edx, ebx
xchg esi, ebx
xor edi, ebx
add edi, 0xb807a5f4
neg edi
xor edi, edx
jmp 0x496db1
push 0xae0032d6
mov edi, 0xb808b4f7
and edx, esi
ror ebx, 0xe
xchg edi, ebx
inc edi
add ebx, edi
jmp 0x49689f
call fcn.00497033
mov ebx, edi
xor edi, edx
ror esi, 0x14
add esi, ebx
inc ebx
sub edx, 0xb8162ce4
sub esi, 0xb8168d1b
sub ebx, edx
and ebx, edi
jmp 0x496253
push 0xae12da56
add ebx, edi
xor edx, esi
add ebx, 0xb8189c41
xor esi, edi
and ebx, esi
and edi, esi
xchg edi, ebx
jmp 0x49629e
push esp
xor edi, esi
and edi, 0xb8255e9d
and edx, edi
neg ebx
add ebx, edi
sub edi, 0xb8269d49
add edi, esi
or edx, esi
xor edi, esi
add edi, ebx
bswap edx
or esi, 0xb828fb0a
and edi, ebx
xchg edi, edx
jmp 0x496041
push 0xae0d173f
add edi, ebx
sub edi, esi
xchg esi, ebx
or edx, edi
sub edi, esi
add esi, ebx
or edi, ebx
or ebx, edx
mov esi, ebx
jmp 0x494385
mov ecx, 0x2774562b
sub ebx, edi
sub esi, edx
add esi, 0xb8376187
neg ebx
or ebx, edi
bswap esi
xchg edx, edi
dec edx
xor ebx, edi
and edx, ebx
jmp 0x4947c1
pop ecx
xor edx, 0xb848785f
sub esi, edi
dec edi
jmp 0x494431
push 0xae10c334
dec edx
bswap esi
xchg esi, ebx
and edi, ebx
or edi, esi
xchg esi, edx
mov esi, edx
and ebx, edi
and edx, edi
dec edi
xor edi, ebx
and ebx, 0xb8513036
xor ebx, esi
xor ebx, esi
mov ebx, esi
jmp 0x496491
call fcn.00497033
xor esi, edx
and edi, edx
sub ebx, edi
and edi, esi
dec edi
sub edi, edx
xor edx, ebx
xor esi, ebx
bswap esi
neg edi
mov edi, ebx
xor esi, 0xb856e992
not edi
xor edx, edi
jmp 0x4948ff
pop ecx
dec ebx
not edi
sub esi, ebx
mov esi, edx
bswap edi
sub edi, edx
sub edx, ebx
or ebx, esi
jmp 0x4959e9
push esp
and edx, 0xb85b2ce3
xor ebx, edi
add edx, ebx
and edx, edi
and edx, ebx
shr ebx, 0x1b
sub ebx, esi
sub esi, 0xb85d5ec9
jmp 0x494622
push 0xadf78b65
xor ebx, esi
not esi
mov edx, edi
add esi, 0xb8704911
ror edi, 2
add edi, esi
or edx, ebx
and edx, esi
xor esi, ebx
jmp 0x495abe
call fcn.00497033
and esi, 0xb875771f
add edx, esi
bswap ebx
and edi, 0xb876a08a
not esi
mov esi, edx
and ebx, edx
bswap edx
xchg ebx, edi
jmp 0x496879
mov ecx, 0x2a371b56
xor edi, esi
mov edi, 0xb8793ab9
inc edx
sub edi, ebx
sub edi, ebx
add edx, ebx
mov ebx, esi
sub ebx, edx
neg edx
mov edx, 0xb87c3bcb
add ebx, esi
and edx, esi
xor ebx, 0xb87d2a74
ror edi, 8
jmp 0x495026
mov ecx, 0x2774562b
xchg esi, edx
ror ebx, 0x13
or esi, edi
add esi, edi
add esi, ebx
mov edi, edx
dec edi
sub edi, edx
inc edi
jmp 0x495318
call ecx
and edx, edi
and esi, 0xb894fee1
ror edi, 0x15
add ebx, edi
sub ebx, edx
xor ebx, edx
mov edi, esi
jmp 0x49444b
push 0xae131756
xchg edx, esi
xchg esi, edi
add esi, edx
jmp 0x494f28
push 0xae06a866
xor edx, edi
mov esi, edi
add edi, edx
shl edx, 0xb
sub ebx, esi
mov ebx, edx
add ebx, edi
jmp 0x496163
pop ecx
add esi, edx
xchg edi, edx
add esi, ebx
add edi, edx
sub edx, ebx
or edx, esi
jmp 0x495659
push 0xae159d10
add edi, edx
mov esi, 0xb8e218be
xor edi, 0xb8e26a79
jmp 0x496979
mov ecx, 0x2a371b56
xor esi, edx
or edi, 0xb8e53d7f
xor ebx, 0xb8e59127
inc esi
sub ebx, edi
ror edx, 0x16
ror esi, 0x1f
add esi, edx
inc esi
add ebx, edi
sub edx, 0xb8e82209
jmp 0x4966bf
pop ecx
add esi, edi
xor esi, edx
and ebx, esi
sub ebx, edi
and ebx, esi
xchg esi, edi
dec ebx
or edi, 0xb8f71b69
mov edi, edx
or ebx, edi
sub ebx, edi
jmp 0x495bdb
pop ecx
xchg edx, ebx
add esi, edx
or ebx, esi
ror ebx, 4
add ebx, edi
and esi, 0xb8fcadba
xchg ebx, edi
shr esi, 2
ror ebx, 1
or ebx, edi
bswap edx
or ebx, edx
xor ebx, 0xb8fee324
jmp 0x495894
call fcn.00497033
dec edx
sub esi, edx
add edi, ebx
sub edi, ebx
xchg ebx, esi
and edi, ebx
sub edi, esi
add esi, edx
not edx
jmp 0x495990
pop ecx
sub esi, edi
add edi, 0xb907470d
sub edi, edx
mov edi, ebx
sub ebx, esi
xchg edx, edi
mov edi, 0xb908df1d
xor edi, esi
add esi, 0xb9097f59
bswap edi
xor edx, ebx
xor edx, ebx
or edi, esi
jmp 0x496dd5
push 0x401400
bswap esi
and edx, esi
xchg esi, ebx
shr edi, 1
neg esi
mov esi, ebx
shr ebx, 8
xor esi, edx
neg edx
xor edi, edx
ror esi, 0x1c
add edx, ebx
jmp 0x496f40
call fcn.00497033
or edi, 0xb91b2884
xor ebx, 0xb91b7c24
add ebx, edi
sub ebx, esi
or esi, 0xb91c7699
not ebx
or esi, edx
or esi, ebx
shr esi, 0x1c
jmp 0x494cf4
call fcn.00497033
dec edi
add edx, esi
xor ebx, 0xb921d9ca
xchg edi, ebx
mov edi, edx
ror esi, 0xd
sub edx, 0xb92319ae
and edx, edi
and edx, edi
jmp 0x495ca9
pop ecx
dec ebx
shr edi, 0x1f
and ebx, edi
xchg edi, ebx
inc ebx
mov edx, esi
add esi, ebx
mov edi, esi
jmp 0x496533
mov ecx, 0x2a371b56
neg ebx
sub esi, 0xb92b686b
add ebx, edi
or edx, 0xb92c1778
sub edi, ebx
xor edx, edi
sub ebx, edi
mov esi, ebx
jmp fcn.0049410c
push 0xae0cae3a
mov edi, 0xb9393efa
sub edi, 0xb93990c6
sub ebx, edi
sub edi, ebx
inc ebx
jmp 0x495eb1
pop ecx
sub edx, ebx
rol ebx, 4
ror edx, 6
sub esi, 0xb93dfd7f
mov ebx, esi
or edi, ebx
jmp 0x496bd6
call ecx
add edx, ebx
and edx, 0xb9452260
or ebx, edx
xor edx, ebx
mov edi, esi
xchg esi, edx
mov esi, 0xb946adf2
add edi, esi
and edx, 0xb94757c8
mov ebx, esi
jmp 0x4952a8
push 0xae006dba
add edx, 0xb9480aa6
mov edi, ebx
inc ebx
shr ebx, 0xa
sub edx, ebx
shl edx, 6
rol edi, 0x1a
jmp 0x49480e
push 0xae15d752
sub edi, esi
xor esi, ebx
shr edx, 0x1e
shr edx, 0xe
bswap edi
and esi, edx
neg ebx
not ebx
xor edx, esi
sub ebx, edx
nop
dec esi
add edi, 0xb961385b
add esi, ebx
and ebx, edi
jmp 0x494854
pop ecx
rol edi, 2
and ebx, 0xb9745ea1
ror ebx, 0xe
shr ebx, 0x14
mov edx, 0xb9755945
mov ebx, edx
and edx, ebx
or edi, ebx
mov edi, edx
sub ebx, edi
jmp 0x494d6e
pop ecx
mov edi, ebx
ror esi, 0x14
sub esi, ebx
neg edx
xchg edx, edi
dec ebx
sub ebx, edi
rol ebx, 7
inc edx
inc edi
dec edi
sub esi, 0xb97df5aa
jmp 0x4957c1
pop ecx
xor esi, ebx
neg edx
jmp 0x495801
pop ecx
mov edi, 0xb98c16e5
add edi, 0xb98c6957
mov edi, 0xb98cb99d
or esi, ebx
bswap ebx
xor ebx, 0xb98dab58
mov edx, esi
xor esi, edx
sub edi, edx
add esi, 0xb98ef0b5
mov edx, esi
mov edx, 0xb98f8f6b
mov edx, 0xb98fde3b
or edi, 0xb9903146
xor edi, edx
and ebx, edi
jmp 0x496a46
call fcn.00497033
neg edx
add esi, 0xb995aa61
sub edx, esi
xor esi, 0xb9964a62
xchg esi, edx
neg edi
and edx, edi
mov edi, ebx
mov edi, esi
rol esi, 0x14
jmp 0x495e46
pop ecx
add esi, edx
mov ebx, edi
sub edx, 0xb99d0568
xchg esi, edx
or edi, edx
neg edi
shr esi, 0x1d
or ebx, edi
or ebx, esi
shr edx, 0x19
jmp 0x49656d
mov ecx, 0x2a371b56
or esi, ebx
shr edx, 7
sub esi, edx
or ebx, 0xb9be7a56
dec esi
inc ebx
add edx, edi
mov esi, edi
xor ebx, 0xb9c0188c
ror ebx, 0xe
neg esi
shr edx, 0x1f
xchg esi, edx
ror ebx, 0x1e
jmp 0x494b06
pop ecx
xor esi, 0xb9ce7719
xchg esi, ebx
and edi, ebx
or ebx, 0xb9cf65bb
not edi
or edx, 0xb9d00954
or edi, 0xb9d067d1
jmp 0x49682a
pop ecx
ror edi, 0xb
xor edi, 0xb9d12398
not esi
or ebx, edi
shr ebx, 0xc
mov edi, edx
inc edi
add edx, edi
xor edx, esi
bswap esi
inc esi
xchg edx, esi
shr esi, 1
jmp 0x495fa2
mov ecx, 0x2774562b
inc edi
and edi, ebx
sub ebx, edi
dec esi
sub ebx, edi
and edi, edx
sub edi, esi
and esi, 0xb9e99012
jmp 0x496598
call ecx
add ebx, 0xb9f7f154
and ebx, edi
add edx, 0xb9f88f31
dec esi
sub ebx, edx
sub edi, 0xb9fa1ff3
xchg ebx, edi
and edx, ebx
add edi, edx
jmp 0x49583d
pop ecx
xor ebx, 0xba1fa56d
or edx, 0xba1ff6de
or edx, esi
and esi, edx
bswap edi
and esi, 0xba22458c
mov esi, edx
xor edx, esi
shr edx, 0xc
xchg edx, edi
shr edx, 0xc
sub esi, ebx
jmp 0x49420c