Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetMessageTime
cmp eax, 0xffffff02
jne 0x401061
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
ret
call sub.kernel32.dll_GetProcessHeap
cmp eax, 0xffffff0f
jne 0x4010e0
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
ret
call sub.user32.dll_GetMessageTime
cmp eax, 0xffffff02
jne 0x40118c
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
ret
call sub.user32.dll_GetMessageTime
cmp eax, 0xfffffedf
jne 0x40122e
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
call sub.advapi32.dll_ObjectOpenAuditAlarmA
ret
jmp 0x49839d
or ecx, 0xf29a9a1e
mov ebx, 0xf29ac9d4
jmp 0x49a83b
push 0xf2a13bb4
or edi, esi
sub edi, 0xf723cf02
dec esi
dec ebx
xor esi, ebx
add edx, edi
and ebx, edi
bswap edx
add esi, ebx
xor edx, edi
not edi
jmp 0x499dc0
push 0xf2a6e95b
mov ebx, esi
and ebx, edi
xor edx, 0xf73519b8
jmp 0x499a7d
push 0xf29f929f
neg esi
mov edi, ebx
or edi, edx
and esi, edx
sub edi, esi
ror edi, 2
add edx, ebx
dec ebx
jmp 0x4990b8
pop ecx
mov ebx, edi
or ebx, edi
or ebx, edi
xchg edx, edi
not edx
add ebx, esi
sub edx, 0xf76fef6a
xor ebx, edi
mov edx, esi
and edx, ebx
xor edi, ebx
add esi, ebx
not edx
mov esi, 0xf771507d
jmp 0x499ad5
push 0xf2a73571
inc esi
and ebx, edi
shl edi, 0xa
sub edi, esi
xor edx, esi
jmp 0x498ff0
call fcn.00499bb5
xor ebx, edi
add edi, edx
xor edi, edx
shl edx, 2
ror esi, 0x1c
and esi, edi
mov edx, edi
inc edx
or esi, edx
mov ebx, 0xf7b6484c
jmp 0x499297
mov ecx, 0x123b2f04
and ebx, 0xf8301e4c
sub edi, esi
mov esi, edi
neg edi
jmp 0x499ea6
mov ecx, 0x123b2f04
shl ebx, 0x1f
inc esi
and ebx, edx
xchg edx, ebx
xchg ebx, edx
or esi, 0xf83a3603
sub ebx, edx
and ebx, edi
jmp 0x49a884
push 0xf29fd094
xor edx, esi
and ebx, esi
xor edx, ebx
mov ebx, esi
xor esi, edx
xor ebx, esi
mov ebx, 0xf8475025
xor ebx, 0xf84792ce
inc ebx
mov esi, edx
and esi, edi
jmp 0x498f45
call ecx
bswap esi
and edi, edx
xor ebx, edx
dec esi
sub edi, 0xf86264ab
sub edx, 0xf86291be
shl esi, 6
xor edx, edi
sub edx, esi
sub edx, 0xf8634d3b
jmp 0x499783
pop ecx
dec ebx
or ebx, 0xf890eb0a
xor edx, esi
add edx, ebx
shl ebx, 0xa
ror edx, 0x10
bswap esi
jmp 0x49ab85
pop ecx
dec edx
xchg ebx, edx
and edi, ebx
sub edi, edx
sub edx, esi
dec ebx
and ebx, edx
xor edx, esi
mov esi, edi
neg edx
jmp 0x49a8e5
push 0xf2a71371
rol edx, 0x1c
xor edi, ebx
xor edi, 0xf93217e2
and ebx, esi
shr ebx, 5
xor ebx, edi
or ebx, edi
jmp 0x498c7c
pop ecx
or ebx, 0xf9364239
shl edx, 0xf
or edx, edi
add edx, 0xf936c75f
xor edx, ebx
and esi, ebx
add edi, esi
sub ebx, edx
and edx, 0xf937de04
not edi
and edx, esi
jmp 0x499de8
push 0xf2a69e94
add edi, 0xfa274a2c
and ebx, esi
not ebx
bswap edx
or esi, edi
sub edx, 0xfa2864d5
jmp 0x49a263
push 0xf2a17b5e
mov edi, 0xfa28a6df
sub ebx, edx
and esi, edx
shr edx, 1
and edi, esi
or edi, edx
and ebx, 0xfa29d9c6
sub edi, ebx
shr edi, 0x11
shl esi, 5
jmp 0x49a3db
pop ecx
xor edx, edi
dec edi
shr esi, 0x1d
jmp 0x499fe4
call fcn.00499bb5
sub ebx, esi
xor esi, edi
mov edx, ebx
xor edx, esi
add esi, 0xfa3e17f6
shr edx, 3
sub edx, edi
xchg edi, edx
jmp 0x499ec5
call ecx
and ebx, edx
neg edi
not ebx
add edx, ebx
or esi, 0xfa40b96d
jmp 0x498ab1
mov ecx, 0x123b2f04
mov ebx, edi
sub esi, ebx
bswap edx
or edx, esi
shl edi, 0xa
or esi, 0xfa5b865a
shr edx, 2
sub esi, 0xfa5bea81
add edi, edx
xchg ebx, edi
and ebx, 0xfa5c6f17
inc ebx
sub edx, 0xfa5cc557
ror edx, 0x1b
jmp 0x498d32
push 0xf2a116d2
xchg esi, edi
mov edx, ebx
xor ebx, esi
and edx, ebx
not edx
and edx, ebx
jmp 0x49887b
push 0xf2a6c60a
or edi, esi
xor esi, 0xfa8da5ab
add edi, edx
add edx, esi
xor esi, edx
add ebx, 0xfa8ef7b5
rol edi, 7
sub ebx, edi
or ebx, esi
and ebx, 0xfa905320
mov esi, 0xfa90ab70
xor ebx, esi
or ebx, esi
jmp 0x498900
push 0xf2a19edd
xchg ebx, esi
dec edx
xor edi, esi
mov edx, edi
add edi, esi
xor ebx, edi
xor edi, esi
ror esi, 0xd
neg esi
neg edi
and ebx, edi
or edx, 0xfacf5cb3
rol esi, 0x1a
add ebx, edi
inc edi
jmp 0x499fac
push 0xf29f41bc
or esi, ebx
bswap ebx
or edi, ebx
add esi, edi
and edi, 0xfb4f06a1
xchg edi, ebx
jmp 0x498a28
jmp loc.0049f000
pop ecx
sub edi, esi
sub edi, esi
or ebx, 0xfb57e643
xor edx, ebx
or esi, 0xfb5843c8
xchg edi, edx
or ebx, 0xfb58beac
dec edi
dec ebx
jmp 0x4994dd
pop ecx
or ebx, edi
add ebx, esi
mov esi, edx
inc esi
mov edx, ebx
and esi, 0xfb8fba2b
xor edx, esi
neg ebx
xchg edx, edi
xor edx, 0xfb931362
or edx, esi
mov edi, 0xfb93b5bc
add esi, edx
xor edx, 0xfb9462fa
mov ebx, 0xfb94b22b
jmp 0x499da2