Function at 0x401000
Capabilities:
Create process on windows
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api

Disassembly:
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xfffffef9
jne 0x401098
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
ret
call sub.user32.dll_GetCaretBlinkTime
cmp eax, 0xffffff17
jne 0x40110d
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
ret
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xffffff2a
jne 0x401196
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.kernel32.dll_SetFileShortNameW
call sub.kernel32.dll_SetFileShortNameW
ret
call sub.user32.dll_GetCaretBlinkTime
cmp eax, 0xfffffeda
jne 0x4011f7
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
ret
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xffffff33
jne 0x401276
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_ZwCreateProcess
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_NtDuplicateObject
call sub.kernel32.dll_SetFileShortNameW
call sub.ntdll.dll_ZwCreateProcess
call sub.kernel32.dll_SetFileShortNameW
ret
jmp 0x498592
or ecx, 0x1fec3a71
xor edx, esi
xchg edi, esi
and ecx, 0x1fecdfba
inc edi
or ecx, edi
ror ecx, 0x11
and esi, edx
jmp 0x499c0d
mov esi, 0x2774562b
xor ebx, 0x260682db
rol ecx, 0x11
shl edi, 0x1e
xor edx, ecx
xchg ecx, edi
shl edx, 0x1b
or ecx, edi
jmp 0x49a69f
push 0x20019416
sub ecx, edi
add edx, ebx
inc edi
xor ebx, ecx
and ecx, ebx
mov edi, 0x2611d5b9
add ecx, edx
or edx, edi
or ecx, edx
shl ebx, 0x1e
xor ebx, ecx
inc edx
jmp 0x499f34
push 0x2000298c
shl edx, 0x1f
sub edx, edi
or edi, 0x261a438e
xor ecx, edi
rol ebx, 0x1e
xchg ecx, edx
shl ebx, 8
add edi, edx
rol edi, 0xa
or ebx, edx
add edx, ebx
jmp 0x49986a
pop esi
xchg ecx, edi
sub edi, edx
shl edi, 2
mov edx, ebx
mov edi, 0x26297ab0
xor edx, 0x2629c67e
xchg edx, ebx
ror edx, 0xb
add ebx, 0x262a660f
jmp 0x49b0e1
call fcn.0049b3d7
mov edx, ebx
sub ebx, edi
add edx, ecx
dec edi
add edi, edx
and ecx, 0x2630b6c7
add ecx, edx
neg ecx
jmp 0x49a518
pop esi
and edi, 0x26327073
and ecx, edi
inc edx
not edx
not ecx
add ecx, edi
and ebx, edi
mov edx, 0x264abbf3
jmp 0x49ae97
pop esi
or edx, ebx
add edx, edi
xor ecx, ebx
jmp 0x499f00
pop esi
xchg ecx, ebx
and edi, 0x266809a8
sub edx, ecx
add edi, ecx
xor ebx, edx
jmp 0x49b32f
mov esi, 0x2774562b
xchg edx, edi
xor ebx, edx
sub ecx, 0x26a07020
neg ebx
bswap ebx
dec ebx
sub edi, 0x26a16670
and ebx, edx
inc edx
add edi, ebx
xchg edx, edi
jmp 0x49a4e9
call esi
sub edx, ebx
xor edi, ecx
bswap ebx
bswap edi
sub ebx, edi
inc edx
shl edi, 0x16
jmp 0x499759
call esi
sub edi, 0x26ce392b
or edi, ecx
sub ecx, edi
xchg ebx, edi
sub ecx, edx
or edi, ebx
or ebx, edi
mov ebx, edx
jmp 0x4987a1
push 0x1ffba620
mov ecx, edi
xchg ebx, edx
xchg edx, ecx
and edx, ecx
shr edi, 0xf
inc edx
jmp 0x49ae0e
pop esi
and edx, ecx
xor ebx, edx
shl ecx, 0x14
sub ecx, 0x26edbd2b
sub edx, edi
sub edi, ebx
sub ebx, edi
mov edx, ebx
mov edx, edi
xor ecx, 0x26eef93a
xor ebx, edx
xchg edi, ebx
jmp 0x49ab30
mov esi, 0x2774562b
inc edi
xor edi, ebx
sub edi, 0x26f0171e
dec edi
sub edx, ecx
mov edx, 0x26f0b165
xor edx, edi
sub edi, edx
add edx, ecx
xor edx, 0x26faf79b
add ecx, ebx
and ebx, 0x26fb7542
jmp 0x49a7c1
call fcn.0049b3d7
sub ebx, edx
mov ecx, ebx
and ecx, edx
shr ebx, 0xb
shr ecx, 0x17
neg ecx
bswap ecx
or ecx, edi
jmp 0x499b27
push 0x1ffa530f
or edi, ecx
and ebx, 0x271ecaa5
shl edx, 0x1f
bswap ecx
xor edx, edi
xor ecx, edi
nop
xchg ecx, edi
jmp 0x4993eb
push 0x20016b93
sub edx, 0x2736e9f9
neg edx
inc ecx
and edx, ecx
mov edx, 0x27383c1e
xchg ebx, edx
add ecx, ebx
mov ebx, ecx
mov edi, ecx
shl ecx, 0x1f
xor ecx, edx
and edi, ebx
sub edi, ebx
or ecx, ebx
jmp 0x4986be
call fcn.0049b3d7
and ecx, edi
bswap edi
xor edi, ebx
and edi, edx
add ecx, edx
or edx, 0x273f668a
jmp 0x498a68
push 0x1ff2a7b1
xor edi, ecx
inc ecx
dec ebx
bswap ecx
or edi, ebx
sub ecx, ebx
xchg ebx, edx
and ecx, edx
xchg ecx, edi
mov ecx, ebx
sub edx, ecx
jmp 0x49866f
mov esi, 0x123b2f04
sub ecx, edi
inc edx
and edx, ecx
add edx, 0x275d7eb3
bswap ecx
or edi, ecx
jmp 0x49a805
mov esi, 0x123b2f04
not ecx
mov ecx, 0x28680ec8
ror edi, 0x14
sub edi, 0x2868d9f3
add ebx, edx
add ebx, ecx
bswap ebx
and ecx, edx
and edx, 0x286af029
jmp 0x498784
call fcn.0049b3d7
add edx, ecx
bswap ecx
or edi, edx
ror edi, 0x12
inc ecx
neg edi
or ecx, 0x288e4a43
mov edx, edi
mov ebx, 0x288f04bb
xchg ecx, edi
mov ebx, 0x288fd3d6
jmp 0x498b1a
pop esi
and ebx, edx
not edx
sub edx, ebx
or ecx, edx
bswap edi
jmp 0x499b5e
push 0x1ffa7ed6
and edx, ecx
ror edx, 0x1d
shr edi, 0x18
sub ebx, edx
and ecx, ebx
sub ecx, ebx
or ecx, ebx
inc ebx
xchg edi, ecx
shl ebx, 8
shl edi, 0x1e
shr edi, 0xf
shr edx, 0xc
xchg ebx, edx
nop
jmp 0x49b0a1
call esi
mov edx, ecx
sub edx, edi
jmp 0x498913
pop esi
ror edi, 0x1a
mov edx, edi
rol edi, 0x1d
sub ebx, edx
or edi, ebx
xchg ecx, edx
jmp 0x498c43
pop esi
and ebx, 0x29038dfd
add ebx, edx
and ebx, 0x29045325
xchg ecx, ebx
mov edi, ebx
xchg edi, edx
sub edx, ecx
xchg edi, ebx
jmp 0x498f52
pop esi
bswap ecx
or ebx, 0x2909fab2
or edi, ebx
sub ecx, ebx
xor ecx, ebx
or edi, edx
jmp 0x49a0f3
mov esi, 0x2774562b
shr edi, 7
ror edx, 0x1d
nop
and ebx, ecx
jmp 0x49ad82
call esi
xchg edx, ecx
or ebx, edi
add ecx, edx
not edi
or edx, edi
add ecx, 0x2913c9cd
jmp 0x498733
push 0x1ff9548c
and edx, 0x292d0235
or edi, 0x292d781a
xor ebx, edi
mov edi, edx
add ebx, edi
ror ebx, 4
sub ecx, edx
and ebx, edi
and edx, ebx
jmp 0x49914b
pop esi
add edi, ecx
add edi, ebx
and ebx, 0x29de813c
or ecx, ebx
or edx, ecx
sub ebx, edx
and edi, ecx
mov ebx, edi
xor edi, ebx
or edx, edi
jmp 0x49b2da
call esi
sub edi, ecx
add ecx, 0x29e08983
and edx, 0x29e0e060
xor ecx, edi
inc edx
bswap ecx
or edx, ecx
xor ecx, 0x29e211b1
mov edx, 0x29e24ac7
add ebx, edi
jmp 0x49a3f8
pop esi
mov ebx, ecx
sub ebx, edi
and ecx, 0x2a0c771f
xor edi, 0x2a0ca81a
and ebx, 0x2a0cdc63
and ebx, ecx
mov ebx, edi
xchg ebx, edi
or edi, 0x2a0dc80d
add ebx, ecx
add edi, edx
or ecx, 0x2a0e74da
add ebx, edi
jmp 0x49a07a
mov esi, 0x123b2f04
or edx, edi
xchg edx, edi
and edi, ecx
xchg ecx, edx
nop
xor edx, ebx
add ebx, edi
mov ecx, edi
add edx, ebx
jmp 0x4991cd
pop esi
sub ecx, 0x2a40d716
add edi, ecx
ror ebx, 0x10
xchg ebx, edx
add edi, ecx
xor ebx, edi
sub ecx, ebx
or ecx, edx
jmp 0x499cbb
call esi
mov ebx, ecx
mov ebx, edi
add ecx, edx
or ebx, ecx
sub edx, ebx
add ebx, edi
rol edi, 1
jmp 0x49a350
push 0x1ffdfb66
mov edx, 0x2a8da0b0
sub edx, edi
mov edx, ebx
mov ebx, ecx
bswap ecx
and edi, ecx
xchg edi, ecx
shr edx, 4
jmp 0x498a12
push 0x1ff16f07
ror ecx, 6
add edi, ebx
ror edi, 0x1f
or ecx, edi
add edx, ecx
sub ecx, 0x2aaf2ad5
mov edx, ecx
not ebx
mov edi, ecx
xchg ebx, edx
xchg edx, edi
xor edx, ebx
dec edi
or ebx, ecx
mov edi, ebx
jmp 0x49ad5f
push 0x1ff7433e
sub ecx, ebx
sub ebx, ecx
or ebx, 0x2ac70bee
add ebx, edx
or ebx, ecx
or ebx, edx
add edx, edi
or ecx, ebx
or edx, ecx
mov ebx, 0x2ac8f9e8
add edi, edx
xor ebx, 0x2ac961c5
jmp 0x49ae2e
call esi
xor edi, edx
not edi
neg edi
add ebx, edi
or edi, ecx
add edi, 0x2acf96f8
and ebx, 0x2acfc803
jmp 0x499ed0
pop esi
shl edx, 0x1e
xor edx, edi
sub ecx, 0x2ad39a69
xchg ecx, ebx
not edx
and edi, 0x2ad4d861
and edi, ecx
mov ebx, 0x2ad59d78
xor edx, ecx
and ecx, ebx
jmp 0x4996b2
push 0x1ff10f14
xor ebx, edi
sub edi, ecx
xor edx, ebx
xchg ecx, edi
add ebx, edx
sub ebx, edi
mov ebx, 0x2aec5d83
sub edi, 0x2aecb2dd
and edx, edi
jmp 0x49b2f5
push 0x1ff53804
add ecx, 0x2aed9c2b
add ecx, ebx
ror edi, 0x16
and edi, 0x2aeecee8
xor ecx, 0x2aef3177
xchg edx, ecx
shl edi, 6
mov ebx, ecx
jmp 0x49a5dc
pop esi
xchg ebx, edi
inc ecx
xor edi, edx
or edi, ebx
mov ebx, 0x2b026286
neg ebx
sub ebx, ecx
or ebx, edx
add edi, ebx
or ebx, edx
jmp 0x499596
pop esi
add edi, ebx
bswap ecx
sub ebx, edi
or ebx, 0x2b063bb5
sub ebx, ecx
add ebx, 0x2b07000d
mov edi, 0x2b07773d
sub edi, ebx
sub edi, ecx
sub edi, ecx
jmp 0x499c30
call fcn.0049b3d7
sub edi, ebx
sub edi, edx
sub edx, ecx
add ecx, 0x2b161b85
or ecx, 0x2b169510
bswap edx
sub edi, ebx
jmp 0x49aef7
push 0x1ff717a2
add edi, ecx
dec ebx
xchg edi, ebx
mov edi, 0x2b3fb611
or ecx, edx
add ebx, edi
or edi, ebx
sub ecx, ebx
jmp 0x499ac7
mov esi, 0x123b2f04
sub ecx, ebx
xchg ecx, ebx
and edi, 0x2b616c0b
mov ecx, ebx
add edx, edi
jmp 0x49a8c3
pop esi
neg ecx
inc edi
mov ecx, edx
neg ecx
inc ecx
sub ebx, edx
or ecx, edi
or edx, ecx
add ecx, 0x2b83967a
and ebx, 0x2b8415f6
add ecx, 0x2b847434
add edi, ebx
sub ebx, 0x2b853f90
mov edx, ecx
jmp 0x49947e
push 0x1fff1dad
dec edi
and edx, ebx
dec ebx
shl edx, 0x15
rol edi, 7
and ebx, 0x2b885dba
mov ecx, 0x2b88bcb2
add edx, 0x2b892257
add ebx, 0x2b898666
sub edx, edi
sub edi, ebx
sub ebx, ecx
ror edx, 0x13
jmp 0x499eb8
push 0x2001c033
sub ebx, edi
bswap ecx
xchg edi, edx
and edi, edx
mov edx, edi
xchg edx, ebx
jmp 0x499fc4
mov esi, 0x123b2f04
ror ebx, 0xc
xchg edi, ecx
bswap ebx
ror edi, 0xc
xchg edi, ebx
rol edx, 0x15
xchg edi, edx
xchg edx, ebx
jmp 0x499d22
call esi
or ebx, edi
inc ecx
mov edi, ebx
sub edi, 0x2b93c742
add edi, ecx
or edi, ebx
or ecx, ebx
jmp 0x499c9f
call esi
sub edi, ecx
shl ecx, 0x16
xchg ecx, ebx
mov ebx, edx
sub edi, ebx
xor edx, edi
jmp 0x49abae
push 0x2001ecd2
mov ecx, 0x2bad106c
neg ebx
xchg edi, edx
sub ecx, edx
xor ebx, ecx
inc edx
sub edx, ecx
bswap edx
and ebx, edi
mov edx, ebx
jmp 0x498f89
call fcn.0049b3d7
not edx
xor edx, edi
sub ecx, 0x2bb2414a
mov ebx, 0x2bb2bf9a
not ebx
mov edx, ebx
jmp 0x49aeaf
push 0x1ff58d41
or ecx, 0x2bb4084c
and ecx, 0x2bb472ce
ror ecx, 0x1e
xchg edx, ecx
xchg ecx, ebx
xor edx, ecx
dec edx
mov ebx, ecx
and ecx, edx
rol ebx, 0x19
mov edi, edx
shl ecx, 0x1c
neg ebx
or ebx, ecx
rol ebx, 0x1c
jmp 0x49af6a
pop esi
mov edx, 0x2bdcb6b5
xor ecx, 0x2bdd3c3d
add ebx, edi
or ebx, ecx
jmp 0x49a7e8
pop esi
add edi, 0x2c0c89e6
or edi, edx
rol edi, 0x10
inc edi
add edi, 0x2c0d6783
xor edi, ecx
rol ebx, 0x17
or edi, ecx
sub edi, 0x2c157474
mov ebx, edx
dec edx
mov ebx, edi
add ecx, 0x2c16f0fe
jmp 0x499492
pop esi
rol ebx, 7
ror edi, 7
xchg ebx, ecx
bswap ecx
xchg ecx, edi
mov ebx, edx
ror edi, 6
xchg ecx, edi
sub ebx, 0x2c97b72d
sub edi, ecx
jmp 0x498907
pop esi
or edx, edi
xchg edi, ebx
neg ebx
jmp 0x49ad2e
pop esi
and ecx, edx
xchg edi, ecx
shl edi, 6
xor edi, ecx
xor ebx, edi
sub edx, 0x2cb27534
jmp 0x49936b
call fcn.0049b3d7
sub edi, ecx
sub ecx, ebx
or edi, ecx
or edi, ebx
ror edx, 0x10
add ecx, 0x2cca3e68
shl ebx, 0xd
sub ebx, 0x2ccaa49e
dec ebx
xor edi, ecx
sub edi, ebx
add edi, edx
not ecx
xchg edx, edi
jmp 0x49996c
call esi
or edx, 0x2cd11d59
xor ecx, edi
mov ecx, edx
bswap ebx
mov ecx, edx
xchg ebx, edx
xchg edi, ebx
xor ecx, edx
mov ebx, edx
shr ecx, 0x11
jmp 0x49aee8
push 0x1ff5677c
dec ecx
and ebx, edi
add ebx, edx
shl ebx, 9
ror ecx, 0x1e
add ecx, edi
not ecx
bswap edx
sub edx, edi
dec ebx
xor edi, ebx
xor edx, ebx
add edx, edi
and ecx, edx
sub edi, ecx
sub edx, edi
jmp 0x49a001
call fcn.0049b3d7
xchg ebx, edi
sub ebx, edi
rol ecx, 0x17
and edi, edx
xor ebx, edx
sub edx, ebx
mov edi, 0x2d047779
sub ecx, edi
add edx, edi
dec edi
jmp 0x499455
call fcn.0049b3d7
add edi, edx
sub edx, edi
inc ebx
mov edx, 0x2d536037
ror edi, 2
xor ebx, edx
xchg edx, ebx
xchg ecx, ebx
xchg ecx, ebx
add edi, 0x2d561001
sub edx, ecx
jmp 0x499f8a
push 0x1ff86376
xor ecx, edx
rol edi, 7
and edi, 0x2d6caa38
sub ecx, edi
xor edi, edx
xchg edi, edx
xchg edx, ebx
jmp 0x49b032
jmp loc.004a0000
call fcn.0049b3d7
mov ecx, ebx
and edx, edi
not ecx
bswap ecx
mov ecx, ebx
jmp 0x49950d
pop esi
inc ebx
inc ecx
or edx, ecx
and edi, 0x2de82b6c
and ebx, edx
inc ecx
shr ebx, 9
sub edx, edi
bswap edx
and ebx, edx
rol ecx, 0x15
jmp 0x499de2
call fcn.0049b3d7
shr edi, 0x15
xor edx, ecx
or edx, 0x2dec9144
shl edi, 0x19
xor edx, 0x2ded9fc2
sub ebx, edi
xchg edx, ebx
neg ecx
nop
mov edi, ecx
bswap edi
or ecx, 0x2e0589c5
and ecx, 0x2e05ee9b
and edx, edi
xor edi, ebx
jmp 0x499f67
pop esi
mov ebx, edx
xor edx, edi
neg edi
not ebx
sub ecx, edi
xor edi, 0x2e0c75b1
or edi, ebx
and edx, 0x2e0cdcc1
xor edi, edx
xchg edx, ebx
xchg edi, ebx
jmp 0x499928
push 0x1ff3f6d9
shr ecx, 0x15
or edi, ecx
add edi, ebx
add edx, ebx
not ecx
and edi, ecx
xor edx, ebx
mov edi, edx
jmp 0x498c93
pop esi
rol ebx, 0x13
or edi, 0x2e52e6bb
bswap edi
nop
sub ecx, ebx
xchg edx, ebx
add ebx, ecx
and edi, 0x2e542bac
jmp 0x498c6c
push 0x1ffc1172
and ebx, ecx
sub edx, ecx
rol ebx, 4
mov ebx, ecx
jmp 0x49b157
mov esi, 0x123b2f04
or edx, edi
sub edi, 0x2e55c74c
shr edi, 0x1a
mov ebx, edx
xchg ebx, edi
or edx, edi
ror edi, 0x11
shr ebx, 0x13
not ecx
jmp 0x499fe4
call fcn.0049b3d7
mov ecx, edx
xchg edi, ebx
or edx, edi
xor ecx, 0x2e5a084f
or ecx, ebx
mov ebx, edi
sub ecx, edx
xor edx, edi
mov edx, ecx
xor edi, 0x2e60bea3
inc ecx
jmp 0x4996d0
push 0x1ffbea77
sub ecx, 0x2e744ed2
sub edi, ecx
or ebx, edx
bswap ecx
sub edx, ebx
shr edx, 3
rol edx, 0x17
or ebx, ecx
jmp 0x49ad4c
mov esi, 0x123b2f04
add ebx, edx
neg edx
shr edi, 8
add edi, edx
or edi, edx
mov edi, 0x2e897073
or ebx, ecx
not ecx
and edx, 0x2e8a3cc3
jmp 0x498e70
pop esi
neg edi
inc ecx
and ecx, 0x2e8ed7d4
or ecx, ebx
xchg ebx, ecx
ror edi, 0x15
xchg edi, ebx
jmp 0x498e43
call esi
and edx, ecx
rol edi, 0x1c
sub edi, ebx
mov ecx, ebx
xor ebx, edi
and edx, 0x2e9104dc
jmp 0x4994c6
pop esi
inc edi
add edx, 0x2e948665
or edi, edx
jmp 0x498dfe
call esi
add ecx, edi
sub edi, 0x2e95da53
mov edi, ecx
or ecx, edi
or ebx, ecx
xor ecx, 0x2e978b5d
add ecx, ebx
shl edx, 6
add edi, edx
jmp 0x49a458
push 0x1ff5bb12
rol ecx, 0xf
add edx, ecx
mov ecx, edx
and edi, 0x2ea35ddd
mov ecx, edx
shl edx, 0xb
add ebx, 0x2ea4b440
jmp 0x4994dc
mov esi, 0x123b2f04
sub ebx, 0x2ef85b38
rol ebx, 0x12
sub ecx, edx
xchg edx, ebx
sub ebx, 0x2ef9da42
add edx, edi
or ecx, edi
and edx, edi
xchg ebx, edx
xchg edi, edx
mov ecx, edi
jmp 0x49ab4f
mov esi, 0x2774562b
xchg edi, edx
add ebx, edi
xor edx, ebx
bswap ecx
shl edi, 0x1c
jmp 0x498d5d
push 0x1ffffcfb
ror ebx, 1
or ebx, 0x2f0b15b1
bswap ebx
xor edx, ecx
mov ebx, ecx
or edx, 0x2f0cce67
or edx, edi
sub ecx, ebx
bswap ecx
or ecx, ebx
shr edx, 8
or edx, ebx
xor ecx, ebx
jmp 0x49870b
push 0x1ffc4247
xchg ebx, edx
and ebx, edx
jmp 0x499f4a
push 0x1ffdcedc
or ebx, edi
or ecx, 0x2f868a91
bswap edx
mov ebx, 0x2f877b9a
xchg edi, ecx
jmp 0x499a10
push 0x1ff14138
xchg ebx, ecx
shl edi, 4
xor edi, edx
xor edi, ebx
add edx, ecx
sub ecx, ebx
or edx, edi
rol edx, 0x1b
jmp 0x499a9a
push 0x1ff3cb84
xchg edx, edi
mov edi, edx
or edx, ebx
or edi, edx
mov ecx, edi
xchg ebx, edx
mov ecx, edi
xor edi, 0x2f8e9cb6
jmp 0x49aca5
push 0x1ff39c59
mov ecx, edx
and ecx, ebx
sub ecx, ebx
sub ebx, edi
add edx, 0x2f911060
add ebx, edx
and edx, 0x2f91d81c
rol edi, 4
jmp 0x49b311