Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetInputDesktop
cmp eax, 0xfffffefc
jne 0x401070
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
ret
call sub.user32.dll_GetKBCodePage
cmp eax, 0xfffffede
jne 0x4010f4
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
ret
call sub.user32.dll_GetInputDesktop
cmp eax, 0xfffffefb
jne 0x401191
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
ret
call sub.user32.dll_GetInputDesktop
cmp eax, 0xffffff2a
jne 0x401238
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ws2_32.dll_WSAAddressToStringA
call sub.advapi32.dll_AllocateLocallyUniqueId
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
call sub.ws2_32.dll_WSAAddressToStringA
call sub.ole32.dll_CoFreeUnusedLibraries
ret
jmp 0x48106c
sub ebx, esi
or ecx, ebx
jmp 0x482982
push 0x81a1759
ror ecx, 0x1e
or esi, edx
not ecx
dec ecx
inc edi
jmp 0x4839b2
push 0x81ed0d3
sub edx, edi
rol edi, 0x13
sub esi, 0xdc5c6ba
or ecx, esi
sub edi, ecx
and edx, 0xdc6682c
xchg edx, edi
mov ecx, esi
jmp 0x481bca
call ebx
or edi, 0xdc8d50f
mov ecx, 0xdc91549
jmp 0x482b17
call ebx
and ecx, 0xddc5882
or edi, ecx
xchg edi, ecx
shl ecx, 6
bswap edi
xor edi, esi
and edx, edi
or edi, 0xdddd724
rol edi, 5
add edx, esi
xchg esi, ecx
bswap esi
and ecx, 0xddede90
jmp 0x481941
call fcn.00483a7e
xor edx, 0xddf8571
shl ecx, 0x1d
add edi, ecx
and ecx, 0xde0d204
jmp 0x481c41
mov ebx, 0x123b2f04
mov ecx, 0xde14892
xchg edx, edi
mov edi, 0xde21f29
add edx, ecx
shl esi, 1
sub ecx, esi
sub edx, esi
and esi, edx
xor ecx, esi
xchg ecx, edx
jmp 0x4811f5
pop ebx
xor esi, edx
sub edi, ecx
shl esi, 0x1e
dec edx
rol edi, 0x1c
add esi, 0xe385b9e
rol edi, 5
jmp 0x483d6d
push 0x8188b96
xor esi, ecx
neg edi
inc edx
jmp 0x48323f
pop ebx
dec edi
shl esi, 0x1d
xchg edi, ecx
sub edx, edi
sub edi, 0xea99861
bswap edi
sub ecx, edi
xor edx, ecx
xor edi, 0xeaafb5f
add edi, ecx
dec ecx
mov ecx, 0xeac1e5e
jmp 0x483d21
push 0x823997a
or ecx, edx
bswap ecx
and edx, esi
mov ecx, edi
mov esi, edx
sub edi, edx
inc ecx
and esi, edi
bswap edi
jmp 0x4833a9
pop ebx
mov edx, ecx
mov edi, edx
add edi, ecx
bswap esi
shl edx, 8
xor edx, esi
add edx, edi
or edx, 0xeb20e83
mov edx, esi
and ecx, edx
or esi, 0xeb34782
xchg edx, edi
or esi, ecx
or edi, 0xeb46a09
jmp 0x481f23
pop ebx
xchg ecx, esi
mov edi, edx
sub edx, 0xedf32c2
nop
sub edi, esi
jmp 0x481ce2
push 0x81bc07f
shr esi, 0x18
xor edi, edx
and esi, edi
and esi, 0xef8f818
or esi, edi
ror esi, 9
add edx, edi
jmp 0x4835be
pop ebx
shl ecx, 0x1e
xchg edi, ecx
and esi, edi
add edi, 0xf073ec3
sub edx, ecx
inc esi
sub edi, 0xf089733
xor ecx, 0xf08fb43
sub esi, edx
jmp 0x483982
pop ebx
xor edx, ecx
or edi, esi
sub ecx, edi
xchg esi, edi
inc edx
xor ecx, edi
xor edi, ecx
sub edx, ecx
and esi, ecx
mov edx, ecx
jmp 0x483b4f
push 0x821e637
and ecx, 0xf137667
xor ecx, edx
add ecx, esi
jmp 0x483844
push 0x8205928
bswap ecx
sub esi, 0xf17e107
xor edx, edi
and edi, edx
not edi
and ecx, esi
xor edi, esi
mov edx, edi
jmp 0x4834ff
pop ebx
mov ecx, edx
or esi, 0xf303066
and edi, 0xf3090ee
add edi, esi
bswap ecx
xor esi, ecx
shr ecx, 0x1e
and edx, esi
jmp 0x482d4b
call fcn.00483a7e
sub edx, ecx
sub ecx, edx
xchg esi, edi
add edx, esi
and edx, edi
rol ecx, 3
add edx, esi
jmp 0x4811c6
push 0x81efc35
inc esi
and ecx, 0xf482d71
mov edi, esi
or edi, ecx
xor esi, edi
add ecx, esi
bswap esi
or ecx, edx
jmp 0x483100
pop ebx
rol edx, 0x10
nop
xor ecx, 0xf572eeb
shr edx, 9
xor edx, ecx
add esi, edx
and esi, 0xf58b47b
and esi, ecx
add edx, 0xf598c95
mov ecx, edi
jmp 0x48113d
call ebx
rol edx, 0x1a
or esi, ecx
shr edi, 0x1f
xor edx, ecx
nop
not edi
and ecx, edi
xor edi, esi
shl edi, 2
xor edi, esi
or edx, 0xf5e0f4f
sub ecx, 0xf5e7449
jmp 0x481fd7
pop ebx
mov edi, 0xf73968e
xor edi, edx
xor esi, edx
bswap edi
shr esi, 0x1d
xchg esi, edx
shr edx, 0x1b
sub esi, ecx
jmp 0x482cfd
push 0x82238d1
or ecx, edx
neg edi
xor esi, ecx
and edx, 0xfa8a14e
rol edx, 9
mov ecx, esi
neg ecx
mov edx, 0xfaa4a01
mov edi, 0xfaaa488
and ecx, esi
neg edi
jmp 0x482aa2
pop ebx
add ecx, edi
xor ecx, edi
add esi, edx
sub esi, 0xfc92637
bswap edi
not edi
and ecx, 0xfca5308
xchg esi, edx
xor edi, 0xfcb52ca
xchg edx, ecx
jmp 0x481b45
pop ebx
shl esi, 0xc
xchg ecx, esi
and ecx, esi
add edx, 0xfdd860c
sub edi, esi
or esi, ecx
jmp 0x483608
mov ebx, 0x123b2f04
inc ecx
and edi, esi
shr ecx, 0x18
or ecx, esi
and edx, esi
mov ecx, esi
sub ecx, edi
xchg esi, ecx
jmp 0x482374
mov ebx, 0x123b2f04
sub ecx, edi
xchg edi, ecx
mov ecx, edi
xchg ecx, edx
add edx, ecx
xchg edi, esi
dec edx
rol edi, 0x15
add esi, edx
or esi, edi
add ecx, 0x1021981f
jmp 0x483713
push 0x81dfa95
and edx, ecx
rol edi, 0x12
and esi, ecx
ror ecx, 8
xor edx, esi
sub edx, 0x1026c033
sub edx, esi
add edi, ecx
bswap edx
xchg ecx, esi
jmp 0x4825f3
mov ebx, 0x123b2f04
add edx, edi
add edi, edx
neg esi
add edi, ecx
jmp 0x483c49
call fcn.00483a7e
and esi, 0x106c408b
mov edx, 0x106cb3dc
not ecx
not esi
add edi, 0x106e14fe
xor edx, edi
bswap esi
xchg ecx, esi
add edx, edi
add ecx, esi
not edi
jmp 0x482acd
call ebx
mov edi, ecx
rol edx, 0x11
and ecx, 0x108c045b
xor edx, esi
or edi, esi
and edi, edx
sub edx, 0x108def25
nop
and esi, edx
xor ecx, edx
sub edx, esi
jmp 0x483145
push 0x820325b
xchg edi, esi
add edi, edx
xchg edi, ecx
sub esi, edi
shr ecx, 0x16
mov ecx, edx
bswap edi
xor esi, ecx
jmp 0x481a6a
mov ebx, 0x2774562b
and esi, ecx
xor ecx, edi
xchg edi, edx
ror esi, 0x1f
or edx, 0x10c052b9
jmp 0x482690
call fcn.00483a7e
not ecx
dec ecx
xchg edi, edx
shl edx, 0x11
or ecx, esi
or esi, 0x10d5e32f
sub ecx, edi
mov edx, esi
shr ecx, 0x11
mov edi, 0x10d7d3aa
jmp 0x483abd
push 0x81c43ae
add esi, 0x11074547
xor ecx, 0x1107be41
shr edi, 0xa
add esi, ecx
add esi, edi
xchg esi, edi
jmp 0x483340
push 0x81a68ee
and edi, 0x110d0dce
shr edi, 6
ror edx, 0xb
jmp 0x48201d
push 0x81832f2
bswap edi
dec ecx
or edi, 0x11330f75
inc esi
or edi, edx
mov edx, esi
or esi, edx
sub esi, edx
xchg edx, esi
inc edi
mov ecx, esi
mov ecx, edi
jmp 0x483ad2
pop ebx
bswap ecx
xor ecx, 0x113b285d
and edi, edx
ror esi, 1
jmp 0x4819db
mov ebx, 0x2774562b
and ecx, edi
xor edx, 0x115cb941
sub edi, edx
xor ecx, edi
or ecx, edx
or edi, esi
add edx, edi
and edi, esi
sub ecx, 0x115faa80
add edx, esi
mov ecx, edi
ror edi, 0xb
jmp 0x483dcd
call ebx
add edi, ecx
and esi, edi
and edi, ecx
add esi, ecx
xchg edi, edx
or edi, 0x1162d6bc
sub edx, 0x11630b9d
and esi, edx
sub edx, edi
xor edx, esi
shr esi, 0xb
mov edi, ecx
neg esi
shr edx, 0x1b
jmp 0x4817a2
push 0x81c1597
and edi, edx
or ecx, 0x1164ff2f
xor ecx, esi
add esi, ecx
or edi, ecx
shr esi, 9
neg ecx
jmp 0x482824
pop ebx
neg edx
add edi, ecx
and edx, edi
add edx, edi
bswap edx
shr edi, 0x16
mov ecx, esi
and edi, esi
sub esi, edx
add edi, 0x1177af21
mov esi, edi
neg edi
jmp 0x483c98
pop ebx
add esi, ecx
xor esi, ecx
add edi, 0x1185108b
xchg esi, ecx
mov esi, ecx
xor edi, edx
sub ecx, edx
or edx, ecx
mov edx, esi
xchg edx, ecx
jmp 0x48213e
push 0x82006e5
and edi, 0x11a5fbcd
not edx
sub esi, ecx
mov edi, 0x11a7259e
mov edx, esi
sub edi, ecx
or edi, ecx
mov edx, 0x11a81d7d
dec edi
xchg edx, esi
xor ecx, edx
xchg edx, ecx
or esi, ecx
add edi, 0x11aa1bf8
xchg ecx, esi
jmp 0x48254d
push 0x81b9556
rol edx, 0xf
mov edx, esi
bswap esi
dec edi
jmp 0x481995
pop ebx
sub edx, 0x11f6fc91
add esi, ecx
or edx, esi
shl edx, 0xa
mov edi, edx
and ecx, edx
rol esi, 0x10
ror ecx, 0x12
sub edx, 0x11f9e14c
xchg edi, esi
jmp 0x483ba7
mov ebx, 0x123b2f04
and edx, ecx
and edi, ecx
and edx, esi
rol edi, 0x1d
not edi
neg edx
xor esi, 0x122372be
inc esi
add edi, 0x122413ae
jmp 0x481b87
pop ebx
mov edi, 0x12278851
shr esi, 0xc
or edi, ecx
xor edi, 0x12282a4a
and edi, edx
xor edx, esi
mov ecx, esi
add ecx, 0x1228fdab
mov edx, 0x122936ac
nop
ror edx, 7
jmp 0x4829c2
push 0x818b639
mov edi, ecx
inc edx
and edx, 0x123e0a39
xchg ecx, esi
shr edi, 0x1a
jmp 0x481210
call ebx
and edi, 0x1244f6e7
xchg edi, ecx
shl edx, 0x1c
sub edx, esi
add esi, 0x12468ad9
mov ecx, 0x124705c6
jmp 0x481464
mov ebx, 0x123b2f04
xor esi, edi
sub ecx, edi
xor esi, edi
not esi
add esi, 0x125afaf7
xor esi, ecx
sub ecx, 0x125bc0c1
ror edi, 0x10
neg edx
inc esi
add edx, edi
jmp 0x483b76
push 0x823c52c
sub ecx, edx
xor esi, edx
sub edx, esi
add esi, edx
sub edi, edx
xor edx, 0x1262c439
mov edi, ecx
and edx, esi
xchg edx, esi
sub edi, edx
jmp 0x4821e9
push 0x8208516
and esi, edx
or edi, ecx
and edx, esi
inc edi
add esi, edx
mov ecx, esi
sub edi, esi
sub ecx, edx
mov ecx, edx
mov edx, ecx
and ecx, edi
xor ecx, edx
not esi
xor edi, 0x12a36bbd
inc edi
jmp 0x48211a
push 0x81bef47
and edi, esi
rol esi, 0x11
xor edi, edx
xor esi, edx
mov edi, ecx
and edi, edx
mov edi, ecx
bswap ecx
jmp 0x482afa
pop ebx
ror ecx, 0x1e
add edi, edx
sub edx, edi
xor edx, 0x12bb8716
xchg edi, ecx
or edi, ecx
sub ecx, esi
jmp 0x48175f
call fcn.00483a7e
shl esi, 0x18
sub esi, edi
and edi, 0x12dc0389
mov edx, esi
mov ecx, 0x12dc7100
and esi, ecx
or edx, edi
nop
xchg esi, ecx
and edi, esi
bswap ecx
jmp 0x48117c
push 0x8220da2
mov esi, edi
sub edi, 0x12fff6d1
xchg edi, esi
sub ecx, 0x1300911c
xchg edx, ecx
sub edx, ecx
jmp 0x481e28
push 0x8236db0
xchg ecx, edi
or edi, edx
and edx, ecx
shr ecx, 7
mov edx, edi
add esi, 0x1320ef83
not ecx
jmp 0x481787
push 0x81a4258
xchg esi, edi
xchg esi, ecx
mov ecx, esi
xchg edx, ecx
add esi, edi
or edx, edi
or ecx, edi
or edx, edi
xor edi, 0x132cd978
or esi, edi
neg esi
sub esi, edx
jmp 0x48285d
call ebx
or edx, esi
mov esi, 0x13552e45
shl esi, 9
sub edx, ecx
not edi
jmp 0x481c1a
push 0x8185d56
or ecx, 0x1356eb2a
or ecx, edx
jmp 0x4814e2
pop ebx
xchg ecx, edi
not edi
xor edx, ecx
jmp 0x481a3f
call fcn.00483a7e
sub edx, esi
shr ecx, 0x1f
mov edi, 0x1364ad18
mov edx, esi
xor edi, edx
xchg ecx, edi
not edi
sub ecx, edx
or edi, 0x136692c2
inc edx
sub edi, ecx
neg esi
and ecx, edx
and ecx, edi
mov esi, edx
mov ecx, edx
jmp 0x48327e
pop ebx
xchg edx, esi
xor esi, edx
add edi, 0x136a9b1f
xchg esi, ecx
jmp 0x482bd8
jmp loc.00488000
pop ebx
sub edx, 0x1398c4a8
add edx, esi
xor ecx, edx
dec edi
sub edx, ecx
or ecx, edx
xor edx, edi
mov edi, 0x139b998a
jmp 0x481a26
pop ebx
and edi, 0x13afc605
or esi, edi
xchg ecx, edx
shr esi, 8
shr edi, 0x16
jmp 0x48112a
pop ebx
xchg ecx, edi
or edi, 0x13b5ebf1
and edx, 0x13b64606
dec edx
or esi, edi
or esi, edx
or ecx, edx
or ecx, esi
xor edi, esi
dec ecx
and esi, edi
sub edi, 0x13b86db9
jmp 0x482fe3
call fcn.00483a7e
mov edx, edi
and ecx, edx
add edi, ecx
shl ecx, 5
xor ecx, esi
jmp 0x48246a