Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
or ebx, 0xe50535dc
mov edi, 0xe505dbf0
inc esi
call sub.kernel32.dll_GetCurrentProcessId
sub ebx, edi
xchg esi, edi
or edx, 0xe5084d26
or esi, ebx
cmp eax, 0xffffff2e
jne 0x401083
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
ret
or ebx, 0xe50c399d
sub edi, edx
bswap esi
sub esi, edx
neg edx
or edi, ebx
shl ebx, 0x10
mov ebx, 0xe51015a9
call sub.kernel32.dll_GetCommandLineA
add edi, esi
shr ebx, 0x10
cmp eax, 0xfffffef9
jne 0x401110
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
ret
or edx, edi
rol edi, 4
call sub.kernel32.dll_GetCurrentProcessId
bswap edx
add esi, ebx
sub edi, ebx
and ebx, 0xe517e9c3
add edi, ebx
mov esi, ebx
dec ebx
cmp eax, 0xfffffef0
jne 0x4011aa
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.oleaut32.dll_VarR4FromBool
ret
sub ebx, edi
mov ebx, 0xe51dd5c3
bswap edi
sub ebx, edx
xchg ebx, esi
or esi, edi
mov esi, edi
call sub.kernel32.dll_GetCurrentProcessId
add edi, ebx
cmp eax, 0xfffffefb
jne 0x40124b
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.ntdll.dll_RtlPrefixString
call sub.oleaut32.dll_VarR4FromBool
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
call sub.advapi32.dll_RegConnectRegistryA
call sub.advapi32.dll_RegConnectRegistryA
call sub.ntdll.dll_RtlPrefixString
ret
jmp 0x49445b
rol ebx, 0xc
bswap ebx
or edi, edx
mov ebx, esi
jmp 0x496bb3
push 0xe6e2781d
or ebx, 0xebd414fa
xchg edx, ecx
mov ebx, ecx
mov ebx, ecx
inc edx
or edx, ebx
ror edi, 0x1a
sub ecx, edi
jmp 0x494b21
push 0xe6e6cd51
bswap ebx
sub edx, ecx
shr edi, 0x1e
not ecx
sub ecx, ebx
shr edx, 0xb
and edx, edi
or edx, ebx
or edi, 0xec3ec089
mov ebx, edi
jmp 0x4967c7
pop esi
xor ebx, edx
mov edi, ebx
xchg ecx, ebx
not edi
sub ecx, edx
or ecx, edi
jmp 0x495d4d
pop esi
xchg edi, edx
and ecx, ebx
add ecx, 0xec5f7538
add edi, ecx
xchg edi, edx
shl ecx, 4
mov edx, edi
or edi, 0xec656856
add edi, ecx
sub ecx, edi
or edi, ebx
and ecx, edi
and edx, 0xec66aa1d
or ebx, 0xec66eb82
dec edx
ror ebx, 0x1b
jmp 0x49507f
push 0xe702ef50
xor edi, edx
mov edi, ebx
add ecx, 0xec9d4345
add edi, ecx
shl ebx, 0x15
or edi, edx
neg ebx
jmp 0x4953c2
pop esi
and edi, ebx
xor ebx, 0xeccf4c4f
mov edi, ebx
and edi, edx
add ecx, ebx
sub ebx, ecx
or edi, edx
xor edi, edx
sub edi, 0xece2a449
shl edi, 0x1a
xor edi, ebx
and ecx, ebx
and ecx, 0xece4621e
jmp 0x494e1b
call esi
mov edx, 0xecf2adde
and ecx, 0xecf32f66
jmp 0x4956cd
push 0xe6e2d91d
or edi, 0xed17fd1b
xchg ebx, edi
mov edi, ecx
xchg ebx, edx
xor edi, 0xed19fa24
jmp 0x49514b
pop esi
and ecx, ebx
or ecx, edx
xchg ebx, ecx
and ecx, edi
add edi, ecx
xor ebx, ecx
inc ebx
jmp 0x494caf
push 0xe7070cb7
shl ecx, 0x1f
dec edi
and edx, ebx
jmp 0x496549
call esi
shl edi, 0x11
add edi, 0xed992fbe
sub ebx, 0xed99c132
mov edi, ecx
add edi, ecx
mov ebx, ecx
or edx, ebx
sub edx, edi
xchg ebx, ecx
not ebx
xchg ebx, ecx
or ebx, edx
and ecx, edi
or ecx, edi
xchg edi, ebx
jmp 0x496459
push 0xe6e671b0
dec edi
add edx, 0xedaf0bd8
xor ebx, edi
add ebx, edx
and edx, ebx
xor edi, 0xedb0db93
or ebx, edi
add edi, ecx
xor ebx, edi
or ebx, ecx
mov ecx, edx
sub ecx, 0xedb3ddee
add edx, edi
sub ebx, 0xedb4cec2
jmp 0x4946c8
pop esi
mov edi, edx
sub ecx, ebx
rol ecx, 7
dec ebx
mov edi, edx
shr edi, 0xc
or ecx, 0xedbf4df4
jmp 0x494c0e
call fcn.00496d18
or edi, ecx
xchg edi, ebx
add edx, 0xee118cca
mov edi, 0xee11fa77
mov edi, ecx
add edi, ebx
and edi, edx
mov edi, 0xee13ce3f
xchg ecx, edi
and ecx, edi
xchg edi, ecx
sub edi, edx
dec ebx
inc edi
jmp 0x494a72
push 0xe6ea307e
mov edx, ebx
sub ecx, edx
inc edi
mov edx, ecx
mov ebx, edx
xchg edi, ebx
sub edx, edi
xor edi, 0xee201a1f
or edx, ecx
mov edi, edx
and edx, 0xee21ac36
and ebx, edx
jmp 0x49643c
push 0xe6f74c76
and ebx, ecx
xor ecx, 0xee4054cc
and edx, edi
xor ebx, ecx
and edx, ecx
or edx, edi
neg ecx
dec ebx
add ecx, 0xee4bd22e
and ebx, ecx
jmp 0x495e67
mov esi, 0x2774562b
not edi
mov ecx, edx
add ebx, ecx
neg ecx
mov ebx, ecx
or edx, edi
mov edx, 0xee70c4e7
jmp 0x494f62
push 0xe703b007
xchg edx, edi
sub ecx, edi
and ebx, edx
ror edx, 0x13
xchg edi, ecx
not ebx
xchg edx, ecx
xchg ecx, edx
jmp 0x495a39
push 0xe7035155
sub edx, ecx
sub edx, edi
sub ecx, 0xeefe1946
or edx, edi
or ebx, edx
add edi, 0xeeff6e70
ror ecx, 0xb
xchg edi, edx
jmp 0x495231
call fcn.00496d18
add edi, 0xef08091f
xor ecx, edi
neg edi
add ecx, 0xef0970b9
rol edx, 3
xor edi, ecx
and edi, edx
add ebx, ecx
not ecx
xchg edi, edx
dec ebx
mov edi, 0xef1d3c97
sub ecx, ebx
xor ecx, 0xef1e2371
jmp 0x495e31
mov esi, 0x123b2f04
and ecx, ebx
xor ecx, edx
xor ecx, ebx
and edi, 0xef4a5c0e
not edx
or edx, 0xef4b44cc
add ecx, edx
and ecx, 0xef4c4817
and edx, edi
mov edx, ecx
bswap ebx
mov ecx, ebx
jmp 0x496bde
push 0xe7028b0f
add edx, ebx
not edi
add ecx, 0xef8fc70e
or ecx, edi
jmp 0x494941
pop esi
sub ecx, ebx
or ebx, edi
or ecx, edx
and ebx, 0xef9547a8
sub ecx, 0xef95a5b9
jmp 0x4947af
pop esi
xchg edx, ecx
nop
sub ecx, edi
xchg ecx, edx
or ebx, edi
dec ebx
neg edi
sub edi, 0xefc52d62
mov edx, 0xefc56a79
xor ecx, 0xefc5a85b
mov edx, 0xefc5e633
add edi, edx
dec edx
jmp 0x495fa7
call esi
bswap edx
bswap edi
or edi, ebx
mov ecx, ebx
add ecx, edi
mov edi, ebx
add ecx, edx
mov edi, ebx
jmp 0x496b8b
pop esi
add edi, 0xf019b128
or ebx, ecx
or edi, ebx
xor edi, ebx
or edi, ebx
jmp 0x4962ae
push 0xe707e8e7
xchg ecx, ebx
and edi, ecx
nop
sub ecx, edi
xor edi, 0xf0334678
jmp 0x496c2c
mov esi, 0x123b2f04
xor ebx, edi
xor ebx, edx
and edx, ecx
mov ecx, 0xf059eaec
add edx, ebx
sub ebx, edi
or ebx, edi
ror edi, 0x1e
mov edx, edi
add ecx, 0xf05fc616
xor ebx, edi
jmp 0x495423
push 0xe6f81e6b
bswap ecx
xor edx, ebx
xchg ecx, edx
sub ecx, ebx
and edi, ebx
jmp 0x4954d3
pop esi
or edx, edi
xor edx, edi
mov ebx, ecx
rol ecx, 3
shl ebx, 0x1b
mov ebx, 0xf0f381b7
jmp 0x495572
call esi
or ebx, edi
sub ecx, edi
neg edx
mov edx, 0xf115cd7e
add ecx, edi
xor edx, ebx
xor edx, 0xf11914ea
sub ebx, 0xf1198793
or edi, 0xf11a14f1
rol edi, 0x17
ror ebx, 0xf
xchg edx, edi
and edi, ecx
neg edx
xor edx, ecx
jmp 0x496786
push 0xe6f7b839
inc ebx
and edx, ecx
bswap ebx
neg ecx
xor edx, edi
rol ecx, 0x1b
or edx, ebx
and edx, edi
xchg ebx, edi
xchg ebx, edx
or ebx, edx
xor edx, 0xf1283599
and ebx, 0xf128c0d6
jmp 0x495cac
call esi
or edx, edi
xchg ebx, edi
mov ecx, edi
sub ecx, 0xf1519634
inc edi
bswap edx
xor edx, edi
mov edx, ecx
sub edx, 0xf1542414
ror edx, 0x1d
or edi, edx
or ebx, edi
neg edx
jmp 0x495fee
pop esi
or edi, edx
or edi, ebx
and edx, ebx
xor edi, ecx
xchg ecx, edi
mov edi, 0xf16110a2
ror edi, 0x18
jmp 0x496a8d
pop esi
add ebx, ecx
nop
neg ebx
xor ebx, edi
bswap ebx
xchg edi, ecx
jmp 0x496a75
pop esi
xor edx, 0xf171e649
and edi, 0xf1726c59
and ecx, edi
and ecx, edi
add edi, edx
neg edx
and ebx, 0xf1787e0e
ror ebx, 0x12
jmp 0x494750
push 0xe6e21a84
dec edi
add edi, edx
sub edi, ebx
add ecx, 0xf17b030f
sub edi, 0xf17b7be1
and edx, edi
sub ecx, 0xf17c782a
inc edx
mov edx, 0xf17d90bc
and edx, edi
jmp 0x49448f
pop esi
inc ebx
xchg ebx, ecx
or edi, ebx
add ebx, edx
shl ebx, 0x12
add ebx, edx
or edi, edx
nop
mov ebx, ecx
xchg ebx, edx
or ebx, edx
jmp 0x494dad
mov esi, 0x2774562b
inc ebx
ror edi, 0x16
add edx, edi
ror edi, 0x1c
and ecx, 0xf2ea5572
and ebx, ecx
xchg ebx, ecx
jmp 0x4969a9
pop esi
xchg edx, edi
add edi, 0xf2ec2c00
mov edx, 0xf2ecca18
jmp 0x495f8f
push 0xe6e1bad6
and ecx, edx
dec ebx
xor ecx, edi
xor ebx, edi
and ebx, 0xf350a3e7
mov ebx, edi
or edx, ebx
mov edi, ebx
jmp 0x496011
push 0xe7077ca5
bswap ebx
mov edx, 0xf352f181
bswap edx
add edi, edx
add edi, 0xf35435c6
dec ecx
add ecx, ebx
jmp 0x495929
jmp loc.00499000
pop esi
shr edi, 0x1d
mov edx, 0xf39b73bd
shl edx, 0x1a
xor ecx, edi
mov ecx, edi
xor edx, edi
dec edx
or edx, ebx
and edx, edi
shl ebx, 0xd
ror edi, 0x11
add ebx, edi
jmp 0x494a17
mov esi, 0x2774562b
neg ecx
bswap edi
or edi, edx
xchg edi, ebx
and edx, ecx
or edi, edx
neg edx
xchg edx, edi
or edi, ecx
or edi, ecx
and edx, edi
or ebx, edi
dec edx
jmp 0x496ab5
push 0xe6e9cd6d
sub edx, 0xf3cf3404
shl ecx, 0xe
xor edi, 0xf3d039a9
shl edi, 0x12
ror ecx, 0xe
mov ebx, 0xf3d1c599
sub ebx, edi
neg ecx
xor ecx, 0xf3d34851
inc ecx
xor edx, ecx
jmp 0x494fbd
call fcn.00496d18
and edx, ecx
sub edx, ebx
and ebx, edx
dec ebx
add ebx, edx
sub edi, ecx
and edx, edi
sub edx, edi
mov edi, 0xf446b3f7
jmp 0x49571d
pop esi
sub ecx, edi
xor edx, ebx
xor ecx, ebx
add ecx, 0xf470e85f
sub edi, 0xf4716db1
jmp 0x4958be
push 0xe6e9666f
add ecx, 0xf472017e
xor ebx, edx
shr edi, 7
rol ebx, 0x1e
or ecx, 0xf4743205
add edx, ecx
xchg ecx, edi
bswap edi
or edi, ebx
xchg ebx, edx
jmp 0x4968a1
call fcn.00496d18
mov ebx, 0xf4776177
xchg edx, ecx
or edi, 0xf4b5f12c
rol edi, 0xd
mov ecx, edx
bswap ecx
shl edx, 9
mov edi, ebx
xchg edx, edi
jmp 0x494d44
pop esi
sub ecx, edi
sub edx, ecx
add ebx, edi
bswap edx
or edx, ebx
add edx, ebx
not edx
or edi, edx
not edi
xor ecx, edi
or edi, ecx
xor ecx, 0xf54a6e6f
sub edx, 0xf54ae4b8
jmp 0x4955c5
push 0xe6e15501
xor edx, edi
or ebx, edx
sub edi, ecx
not edi
ror ecx, 3
or edi, 0xf5638981
add edx, ebx
add edx, edi
add edx, ebx
or edx, 0xf565a2df
mov ecx, edx
xor edx, edi
jmp 0x49652c
call fcn.00496d18
inc ebx
and edi, 0xf567c64a
mov edx, 0xf56858c9
dec ecx
add edi, ebx
xor edx, edi
and ebx, 0xf56a58c4
jmp 0x495f4b
mov esi, 0x123b2f04
and ecx, ebx
xor edx, edi
mov ebx, ecx
and ecx, edx
not edi
nop
not edi
mov ecx, 0xf573c239
mov edx, edi
xchg ecx, ebx
shr ecx, 6
mov ebx, edx
add edi, 0xf576253c
sub ecx, edx
rol ecx, 0xc
jmp 0x4965c1