Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
and edi, edx
sub ecx, esi
dec edi
mov ecx, edx
call sub.kernel32.dll_GetCommandLineA
xchg esi, edx
xchg edi, ecx
sub esi, ecx
mov ecx, edx
mov esi, edi
or edi, ecx
bswap edx
xor esi, edi
cmp eax, 0xffffff2b
jne 0x4010af
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
ret
and esi, edi
xchg edi, edx
and esi, edx
call sub.kernel32.dll_GetCurrentThread
xchg edx, ecx
xchg edx, esi
add esi, edi
cmp eax, 0xfffffef3
jne 0x401153
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
ret
add ecx, edi
or ecx, esi
or edx, ecx
shl esi, 0x15
call sub.kernel32.dll_GetCommandLineA
or ecx, edx
or esi, edi
and ecx, 0x7dbdeaad
xchg esi, edi
sub edx, 0x7dbe5423
sub esi, 0x7dbe8a7e
cmp eax, 0xfffffee4
jne 0x40121b
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_NtReleaseSemaphore
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_NtReleaseSemaphore
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.advapi32.dll_GetTrusteeNameA
call sub.ntdll.dll_RtlSizeHeap
ret
jmp 0x494411
rol esi, 4
add edx, ecx
not ecx
sub esi, edi
jmp 0x495f26
mov ecx, 0x123b2f04
sub edx, esi
and ebx, edi
sub ebx, esi
shr esi, 0xf
or esi, ebx
mov ebx, edx
xor edx, 0x8226a0b1
bswap esi
mov edx, edi
or ebx, 0x8227f1e8
rol ebx, 1
mov edx, 0x82285a3b
and esi, ebx
jmp 0x496d8d
mov ecx, 0x123b2f04
add edi, edx
dec edx
sub esi, edx
and esi, edx
and edi, edx
sub edx, edi
or esi, edx
shr edi, 0xa
mov esi, edx
and edx, 0x8289ab62
dec edx
mov esi, edx
shr edx, 0x12
mov esi, edi
xchg esi, edi
jmp 0x494ce8
jmp loc.0049a410
push 0x80442316
add esi, ebx
shr ebx, 4
dec ebx
add edi, ebx
xor ebx, 0x82a86a89
xor edx, edi
inc edx
jmp 0x494d6f
push 0x80444b40
xchg edx, edi
mov ebx, edi
inc edx
neg ebx
not ebx
and ebx, esi
jmp 0x495dcf
call ecx
and edx, ebx
bswap esi
or esi, edx
dec ebx
or ebx, edx
and ebx, edi
or ebx, 0x82f7e545
mov esi, edx
rol esi, 0x18
and ebx, esi
shl edx, 4
mov edx, ebx
and edi, ebx
jmp 0x496496
push 0x8043546c
ror ebx, 8
or edi, 0x831a67df
sub edx, 0x831a9a31
xchg ebx, edx
sub edi, esi
shl ebx, 0x17
sub ebx, edi
add edi, 0x831d30db
add ebx, 0x831d67b4
sub edi, edx
add edi, esi
and ebx, edx
not ebx
jmp 0x495c12
call fcn.004971c8
sub ebx, edx
dec ebx
add edi, edx
dec ebx
neg edi
jmp 0x496b60
pop ecx
or edx, esi
or edi, edx
mov edx, edi
add edi, ebx
sub edx, edi
and edx, edi
xor ebx, edx
mov edi, esi
mov esi, edi
jmp 0x494d07
pop ecx
xchg edi, esi
mov ebx, 0x83a4a999
xor esi, 0x83a4e4ee
and esi, 0x83a52086
not esi
ror edx, 0x1f
add edx, edi
jmp 0x495429
mov ecx, 0x123b2f04
mov edi, edx
xor edi, ebx
add ebx, esi
xor esi, edx
shr ebx, 0x10
add edi, edx
sub ebx, 0x83ac495e
bswap edx
sub ebx, 0x83acc3c4
jmp 0x495596
push 0x8044735e
and edi, esi
and edi, ebx
neg esi
not edi
sub esi, edx
and esi, edi
add edx, 0x83cc0099
or esi, ebx
xchg ebx, edx
or edx, esi
sub edi, esi
mov esi, ebx
add ebx, esi
and edi, esi
jmp 0x494b37
push 0x804221a1
xor edx, 0x83e25b2c
shl edx, 0xe
xchg edi, ebx
add edx, 0x83e2fb83
ror edi, 6
mov edx, esi
sub edx, 0x83e3a15e
and edx, 0x83e3d7ed
or edi, edx
jmp 0x496d69
pop ecx
bswap ebx
inc edi
sub ebx, edi
xchg esi, ebx
not edi
rol ebx, 5
bswap ebx
shl ebx, 0x18
and esi, edi
jmp 0x495bae
call ecx
add esi, 0x84b106e0
mov edx, edi
dec edi
xchg edi, esi
neg ebx
neg esi
jmp 0x495a95
push 0x804259a1
mov esi, ebx
mov edx, 0x84d5da4b
xchg ebx, esi
xor esi, ebx
and edx, edi
and edx, esi
xor esi, edx
ror esi, 4
bswap edi
xchg ebx, esi
xor edi, edx
jmp 0x49450b
call fcn.004971c8
shr edx, 4
and edx, esi
or edi, esi
and ebx, edi
and edi, 0x84d9302f
mov ebx, edi
or edi, 0x84d9a70c
rol edi, 6
add esi, ebx
mov edi, edx
sub edi, esi
xchg esi, edx
xchg edx, esi
xchg edx, edi
add esi, edi
jmp 0x49520d