Function at 0x401000
Capabilities:
Decompress data using ucl
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub ecx, 0x372f5878
xor esi, ecx
xor esi, edx
or ecx, edx
sub ecx, 0x37305537
call sub.user32.dll_GetClipboardOwner
inc esi
and edx, 0x3730f279
xor ebx, edx
xchg esi, edx
xor esi, 0x3732073a
sub esi, ecx
xor edx, 0x3732e03a
cmp eax, 0xffffff35
jne 0x4010d7
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
ret
add esi, edx
xchg edx, esi
not edx
shr ecx, 0xe
sub ebx, esi
call sub.user32.dll_GetClipboardOwner
bswap ebx
xchg edx, ecx
add ecx, ebx
xor edx, esi
or esi, 0x373c5596
mov ebx, 0x373c937b
cmp eax, 0xffffff2c
jne 0x4011a1
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
ret
or esi, ebx
call sub.kernel32.dll_GetSystemDefaultLCID
or ecx, edx
xor ecx, edx
sub esi, ebx
add edx, esi
xor ecx, edx
xor ebx, edx
and ebx, 0x37423d71
xor ecx, 0x37427aab
cmp eax, 0xffffff37
jne 0x401262
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
call sub.advapi32.dll_LsaQueryTrustedDomainInfoByName
ret
jmp 0x4b750f
sub ebx, esi
and esi, 0x37dc0e4c
and edx, esi
jmp 0x4b9360
pop ebx
and edi, esi
bswap esi
and edx, esi
and ecx, edx
shr edx, 0xe
sub esi, edi
jmp 0x4b7d27
pop ebx
or ecx, edi
and edi, edx
not edi
mov ecx, edi
rol edx, 0x16
xchg ecx, edi
shr edx, 0x19
rol edx, 0x1b
xor ecx, edx
mov edi, 0x3cd34972
jmp 0x4b7d77
mov ebx, 0x2774562b
ror edi, 6
mov edx, esi
mov esi, edi
add ecx, esi
xor ecx, edx
add ecx, esi
or edx, 0x3ceef1e7
sub edx, ecx
xor ecx, esi
not esi
rol esi, 0xd
and edi, ecx
jmp 0x4b8a8e
pop ebx
mov edx, edi
add edi, 0x3cf0b2e3
mov edx, edi
xchg edi, edx
add esi, ecx
add edi, esi
xor esi, edx
mov ecx, edx
xchg ecx, edi
jmp 0x4badad
call ebx
xor edi, edx
or ecx, esi
or esi, edi
sub edi, ecx
mov edi, esi
nop
xchg ecx, edi
shl esi, 0x15
neg esi
jmp 0x4b9729
push 0x37e18b8e
shl edx, 0xd
dec edi
and edx, esi
sub edx, edi
xchg esi, edi
and edi, esi
add ecx, edx
xchg ecx, edx
and edi, 0x3d1521a7
dec esi
xor edx, ecx
jmp 0x4bb03d
push 0x37e3f535
xchg edi, ecx
inc ecx
shr esi, 5
xchg edx, edi
inc edi
xchg ecx, edx
and ecx, edx
mov edx, 0x3d1b9e92
xchg ecx, edx
xchg ecx, edx
not esi
jmp 0x4ba573
pop ebx
ror ecx, 0xa
mov ecx, edi
xchg esi, edi
shl edi, 0x19
rol edi, 0x13
bswap edx
or ecx, edx
or edx, esi
sub ecx, esi
jmp 0x4bb3b9
push 0x37e3a476
xor ecx, esi
add ecx, edx
neg edi
xor edx, edi
rol edx, 0xd
xchg esi, edx
add edx, esi
dec edi
jmp 0x4b797f
push 0x37e68d8c
xchg esi, edi
sub ecx, edx
and ecx, edx
add esi, 0x3d6e228c
xor edi, edx
ror ecx, 0x12
not edi
bswap ecx
and esi, ecx
jmp 0x4b8c0b
pop ebx
mov ecx, edx
dec edx
jmp 0x4ba0b5
jmp loc.004c07fa
mov ebx, 0x123b2f04
sub edi, edx
xor esi, edi
and esi, edi
add edx, 0x3db3e049
xchg edx, ecx
mov esi, edi
xchg ecx, edx
sub ecx, 0x3db7cdaa
sub edi, esi
sub edx, esi
xchg edx, esi
or edi, esi
and edx, ecx
jmp 0x4ba8fe
pop ebx
xchg esi, ecx
xchg ecx, edx
xchg edx, ecx
nop
xchg ecx, esi
mov edi, edx
shr esi, 7
jmp 0x4bae9e
push 0x37e890fe
nop
add edi, ecx
add esi, ecx
shr esi, 0x13
and edx, esi
mov edx, edi
add edi, 0x3dd25757
ror edx, 0xa
shl esi, 8
jmp 0x4ba5c0
push 0x37ea2414
add edi, esi
inc edi
sub edx, esi
neg edi
shl edx, 4
mov esi, ecx
rol edi, 0x1d
xchg edi, edx
xor esi, edi
jmp 0x4b9bfe
pop ebx
add edi, edx
sub esi, ecx
sub edi, 0x3e3b4ef8
or edx, esi
add ecx, 0x3e3df3e3
neg edi
xor ecx, edi
add edi, edx
dec edi
xor esi, edi
jmp 0x4b754f
call ebx
mov esi, ecx
bswap edi
jmp 0x4b8b09
pop ebx
neg esi
mov edi, edx
shr edx, 0xe
and esi, 0x3e540286
xor ecx, esi
xchg esi, ecx
add edx, 0x3e556b2b
or esi, 0x3e55d86f
or ecx, edi
jmp 0x4b8143
pop ebx
shr esi, 0x1f
and ecx, edx
mov edx, edi
sub edi, esi
rol edx, 3
mov edi, edx
jmp 0x4b7dfc
push 0x37ed4333
and edx, ecx
mov ecx, 0x3ebbe8ef
mov edx, 0x3ebc5b76
xor edx, 0x3ebcca6b
xor edx, 0x3ebd3a8f
add ecx, esi
and esi, ecx
and esi, edx
add edx, edi
or edx, ecx
neg ecx
mov edx, 0x3ec07ad7
and edx, esi
jmp 0x4b9a19
push 0x37e867e5
add edi, edx
and edx, ecx
mov edi, esi
xor edx, esi
add ecx, esi
add edi, esi
xor esi, edx
xor edx, edi
or ecx, 0x3ec2fe7e
xor edi, 0x3ec33e38
jmp 0x4b810f
call fcn.004b9d5a
xor esi, ecx
bswap ecx
or edi, esi
sub esi, ecx
or edx, edi
jmp 0x4ba4af
call fcn.004b9d5a
bswap edi
neg edi
inc edx
add edx, 0x3ee430cc
rol edx, 0xe
or edi, ecx
add edx, 0x3ee4ef9d
sub ecx, esi
and ecx, edx
jmp 0x4baec5
pop ebx
rol edi, 0x1a
or edx, esi
xor esi, ecx
or edx, ecx
dec esi
and ecx, edi
mov esi, 0x3ee7379d
xchg esi, edx
xor edx, esi
or edx, 0x3ee7fcd3
rol edi, 0x18
and esi, ecx
sub edx, esi
xor ecx, 0x3ee9463c
jmp 0x4bb404
push 0x37e8353c
neg edi
and edx, 0x3ee9dd9a
add ecx, 0x3eea1df6
or edx, ecx
xor edx, edi
xchg esi, edi
xchg edi, ecx
mov esi, ecx
add ecx, edi
mov edi, esi
jmp 0x4b898e
push 0x37eed786
nop
and ecx, edx
rol edi, 0x1f
xchg edx, edi
sub esi, edi
shr esi, 0x18
jmp 0x4ba7d5
mov ebx, 0x2774562b
xchg esi, ecx
mov edx, esi
jmp 0x4baac0
mov ebx, 0x123b2f04
or esi, edi
sub edi, esi
xchg ecx, edi
or edi, edx
jmp 0x4b8ae5
push 0x37f0cbc1
add edx, 0x3f2cc49c
neg edx
or edi, edx
xor ecx, edi
xor edx, ecx
xor esi, edx
mov ecx, 0x3f2f268f
jmp 0x4ba2cf
pop ebx
sub esi, edi
and ecx, esi
xor edx, ecx
xchg edx, ecx
sub edx, edi
add edx, ecx
mov edi, ecx
and edx, 0x3f6fd0ca
shl ecx, 6
shl edx, 7
jmp 0x4b8498
push 0x37dfd930
sub esi, edx
xor ecx, edx
xchg ecx, edi
xor edi, edx
xor edx, ecx
sub ecx, esi
ror edi, 4
rol edx, 0xd
jmp 0x4b7939
pop ebx
and esi, 0x3fe893f9
mov edx, 0x3fe8d09e
xor edx, 0x3fe91087
add esi, edx
xor esi, 0x3fe98fcb
sub edi, esi
mov edi, 0x3fea1554
xor ecx, esi
sub edi, esi
add esi, edx
add ecx, 0x3feb0dd5
jmp 0x4ba243
call fcn.004b9d5a
add esi, ecx
xchg edi, edx
sub edi, edx
jmp 0x4b78b3
mov ebx, 0x123b2f04
inc edx
rol esi, 0xc
ror esi, 0x1b
neg edx
and esi, edi
mov edx, ecx
xor esi, 0x400c385a
sub edx, 0x400c857c
xor esi, 0x400cc57e
bswap ecx
mov ecx, edx
ror esi, 4
neg ecx
jmp 0x4b9ee8
pop ebx
dec ecx
rol ecx, 0x13
bswap esi
bswap edx
mov esi, edi
sub edx, edi
shr esi, 0x18
and edx, 0x40286b17
add ecx, esi
xor esi, edx
sub edi, ecx
jmp 0x4b7b7f
mov ebx, 0x123b2f04
mov ecx, edi
xchg ecx, edi
bswap esi
add ecx, edi
xor edx, 0x402a711a
sub ecx, esi
sub ecx, 0x402aefa0
add edi, esi
sub edx, esi
sub edx, esi
add esi, edi
and edx, 0x402c44a9
mov ecx, edi
and esi, edx
nop
jmp 0x4b7ee4
push 0x37ed6e2f
neg edx
xchg esi, edi
sub ecx, edi
mov esi, 0x40935e12
ror edx, 0x19
xor edx, edi
and edx, ecx
shl edi, 0x1b
and edx, 0x40949a64
or esi, 0x4094daaa
jmp 0x4b77c1
call ebx
bswap ecx
and edx, edi
xor ecx, edx
sub ecx, edi
or edx, 0x40ba1e61
ror edi, 0x14
sub edx, edi
jmp 0x4ba39b
push 0x37ea5083
or edx, 0x40ca1f95
mov edi, ecx
or edi, edx
add edx, esi
jmp 0x4bb0f3
call fcn.004b9d5a
inc ecx
xor edi, ecx
add esi, edx
xchg ecx, edx
mov edi, esi
or ecx, edx
bswap ecx
inc esi
add edi, esi
xchg edi, ecx
jmp 0x4ba0d0
push 0x37f09d26
neg edi
sub edx, ecx
xor edi, edx
sub ecx, edx
mov ecx, edi
and ecx, edx
rol esi, 1
xchg ecx, edi
jmp 0x4b8dfb
call ebx
inc edi
sub esi, edi
mov edx, esi
mov edi, edx
rol edx, 8
xchg ecx, edi
mov edx, 0x41727ebb
rol esi, 0x13
jmp 0x4b807d
push 0x37e1e3ef
add edi, esi
bswap ecx
add ecx, edi
xchg ecx, edi
and edx, 0x41a2ad7e
xchg esi, edx
add edi, edx
mov edx, ecx
mov ecx, edi
mov edi, 0x41a4931e
shr ecx, 8
jmp 0x4b8029
pop ebx
sub edi, edx
add edx, 0x41afe154
and edi, 0x41b021b1
and edi, 0x41b05e70
add edx, edi
add edi, edx
xchg esi, ecx
bswap ecx
and esi, edx
bswap ecx
sub edx, ecx
jmp 0x4ba84d
push 0x37f0f7b1
or esi, edx
and ecx, edi
dec ecx
xchg ecx, esi
not esi
sub esi, ecx
sub edi, edx
neg edx
sub esi, edx
xor edx, ecx
jmp 0x4b974a
pop ebx
shl edx, 0xb
add esi, ecx
not esi
or ecx, edx
dec edx
neg esi
jmp 0x4b9013
pop ebx
mov esi, ecx
xor ecx, edx
not edx
xor esi, 0x4214490b
or edi, ecx
xchg edi, edx
add ecx, 0x42158969
jmp 0x4b77e9
call ebx
xor ecx, 0x42161f54
sub esi, edx
nop
add ecx, 0x421feb61
xor ecx, esi
xor ecx, edx
sub edi, edx
or esi, 0x4221b646
rol edi, 2
add edi, ecx
jmp 0x4ba493
push 0x37e4402e
mov edx, ecx
sub edx, edi
dec esi
sub edx, 0x42473eb2
neg ecx
sub edi, ecx
and edx, ecx
mov edx, esi
and edi, esi
add ecx, edi
and edx, 0x424e1f41
sub esi, 0x424e88c0
jmp 0x4b9601
push 0x37e8bc01
sub esi, ecx
sub ecx, edx
xor edi, esi
sub esi, edx
mov esi, 0x4260ec0c
xchg edx, esi
sub edx, 0x4261cf94
and edx, 0x42623796
and ecx, edx
jmp 0x4bae28
call ebx
xchg esi, ecx
or edi, esi
and edx, ecx
mov edi, esi
or edx, 0x42cd2b22
mov ecx, edi
mov edi, edx
rol ecx, 0xa
neg esi
xor edx, ecx
and ecx, edi
jmp 0x4bafe0
push 0x37ef029d
xor ecx, edx
bswap esi
mov esi, 0x42f4d542
shl edx, 0xa
xchg edx, edi
xor ecx, 0x42f58f9c
rol edi, 0x1d
jmp 0x4ba8e2
pop ebx
and ecx, 0x42fb757e
xor ecx, edx
mov edi, esi
ror edx, 0xa
xor ecx, 0x42fc73ea
add esi, 0x42fcae38
or esi, 0x42fceff5
xor ecx, 0x42fd2da4
jmp 0x4b8959
push 0x37ef2efd
rol ecx, 0x1e
shr edi, 0x1b
shl edi, 0x18
xor esi, 0x43058519
rol edi, 0x16
jmp 0x4bb37b
call fcn.004b9d5a
add edx, esi
mov edx, ecx
add esi, edx
dec ecx
neg edi
sub edi, esi
xor ecx, edi
or esi, edi
add edi, 0x43082859
neg esi
jmp 0x4b9b5d
call fcn.004b9d5a
xor edx, ecx
mov esi, edx
xor edx, edi
or esi, edx
or edx, edi
bswap edx
mov esi, ecx
jmp 0x4ba648
push 0x37eea8db
and edx, edi
or edx, edi
mov esi, ecx
mov edi, ecx
mov edi, ecx
add edi, edx
nop
jmp 0x4b8bf4
mov ebx, 0x123b2f04
xor esi, ecx
xchg edx, ecx
bswap esi
xchg ecx, edi
xor esi, edi
dec edx
xor ecx, esi
xchg edi, ecx
add esi, edx
sub edi, 0x44299ec3
add ecx, esi
neg edi
or edi, 0x442a578b
mov ecx, edi
xchg edi, edx
jmp 0x4b9556
pop ebx
xor esi, 0x44474d6e
xor edi, ecx
mov ecx, edi
sub edx, ecx
xor edx, edi
neg edi
rol esi, 0x1b
and ecx, 0x44490002
xor esi, 0x44494065
or esi, edx
jmp 0x4b769b
call ebx
not edi
or edi, edx
mov ecx, edi
mov ecx, edi
add edx, ecx
and edi, ecx
sub edi, 0x444b3765
sub ecx, edx
add edi, ecx
or edi, edx
or edx, 0x444c33eb
xor edx, esi
xor ecx, edx
xchg ecx, edx
jmp 0x4b947b
pop ebx
mov esi, 0x44d612f0
ror edi, 7
add edx, ecx
xchg edi, esi
xchg edx, esi
add edx, ecx
xor ecx, 0x44d8cb79
dec ecx
shr edi, 0xc
jmp 0x4b8b37
push 0x37e1b731
inc esi
and ecx, edx
xor esi, ecx
or ecx, 0x44e317f0
and edx, ecx
xchg ecx, edx
sub esi, ecx
jmp 0x4ba1ce
push 0x37ea7d04
sub edx, 0x44f9e432
mov edx, edi
and edi, esi
add edx, ecx
add edi, edx
bswap ecx
shr edi, 0xe
mov esi, ecx
inc ecx
bswap edx
xchg edi, ecx
sub esi, edi
jmp 0x4b8db8
call fcn.004b9d5a
xchg edi, esi
and ecx, edx
xchg edi, edx
dec edi
sub edx, esi
and edx, esi
or ecx, edx
rol ecx, 0x1d
mov ecx, 0x4542bf95
shr ecx, 0x1d
or esi, edi
and edx, edi
xor esi, ecx
jmp 0x4b8530
mov ebx, 0x123b2f04
xor ecx, esi
sub edi, esi
shr edx, 9
xchg edx, esi
mov edx, edi
dec edi
mov edx, 0x45b72606
or ecx, edx
neg esi
not ecx
xchg esi, edi
or edx, 0x45b85d5e
mov edi, 0x45b89ba3
jmp 0x4bb159
pop ebx
shr edi, 0x16
add edi, ecx
or edx, edi
add esi, edx
bswap ecx
jmp 0x4b8590
pop ebx
bswap esi
add edi, ecx
or edx, edi
mov esi, ecx
shl edi, 0x1c
add edx, esi
or ecx, edi
jmp 0x4b85f4