Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api

Disassembly:
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp eax, 0xfffffedf
jne 0x40107f
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
ret
call sub.kernel32.dll_GetUserDefaultUILanguage
cmp eax, 0xffffff12
jne 0x40110d
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
ret
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp eax, 0xffffff1a
jne 0x40118c
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
ret
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp eax, 0xffffff26
jne 0x4011fc
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
ret
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp eax, 0xfffffef9
jne 0x40126c
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
call sub.advapi32.dll_LsaSetForestTrustInformation
ret
jmp 0x49857b
shr esi, 0x16
mov esi, 0xd5dd7181
xchg ecx, edx
shr esi, 0x1e
inc ecx
jmp 0x49aab0
push 0xd5ee481f
neg ecx
sub ecx, edi
jmp 0x4999c7
call fcn.0049aecf
bswap ebx
or edi, ecx
xchg esi, edi
jmp 0x49981e
call edx
ror ecx, 0x15
xor ecx, ebx
sub edi, ebx
inc esi
not edi
or esi, 0xdacd8078
add ebx, edi
and esi, ebx
xor ebx, ecx
xor ebx, esi
sub ecx, ebx
rol esi, 0xd
xchg ecx, esi
jmp 0x4992a8
push 0xd5e14721
sub ecx, ebx
sub ecx, ebx
xchg ecx, ebx
not ecx
xchg edi, ecx
sub ebx, esi
add ecx, esi
xchg ecx, esi
jmp 0x4997f6
push 0xd5eb047f
rol ebx, 0x1e
mov esi, 0xdaed5f58
sub esi, 0xdaed93ec
or edi, esi
add edi, ecx
sub ecx, ebx
or ecx, 0xdaee5fe1
xchg ecx, edi
mov ebx, ecx
jmp 0x498e32
call edx
bswap esi
xor ebx, esi
xor esi, ecx
add edi, ebx
or ecx, edi
xchg ecx, esi
or ecx, 0xdaf1097d
not esi
add ebx, edi
xchg ebx, esi
and ebx, ecx
or ecx, esi
xor ebx, esi
jmp 0x499a2c
push 0xd5eecf4c
sub esi, ecx
shl ebx, 0x10
mov esi, ecx
shr edi, 0x12
or ecx, esi
xor edi, 0xdaf8fabb
sub edi, 0xdaf92f6d
mov ebx, edi
dec esi
jmp 0x49aded
push 0xd5ec9241
neg esi
not ebx
dec ebx
add ecx, esi
not esi
jmp 0x499552
pop edx
add edi, esi
shl ebx, 0x1b
mov edi, ecx
bswap ecx
add esi, ebx
mov edi, esi
and edi, 0xdb150931
xor edi, ecx
sub ebx, edi
sub edi, ebx
not esi
or esi, 0xdb161ae2
xchg edi, esi
jmp 0x49a242
pop edx
ror edi, 0xd
inc ebx
or ecx, edi
xor ecx, 0xdb357512
xor ecx, 0xdb35a978
sub esi, edi
rol edi, 5
shr edi, 0x1d
jmp 0x49a227
mov edx, 0x123b2f04
mov esi, ebx
bswap edi
or esi, ecx
jmp 0x4986c2
pop edx
shl ecx, 0x1c
rol esi, 0xd
xor edi, esi
not ebx
xor esi, ecx
xor esi, ebx
and ebx, edi
and edi, 0xdb46c6f8
inc edi
sub ebx, edi
sub ecx, edi
or ecx, esi
jmp 0x49aade
push 0xd5ea5be6
add esi, ebx
sub ecx, 0xdb4aecb5
xor ebx, 0xdb4b2170
xor ecx, ebx
xchg ebx, ecx
xchg esi, ebx
xchg ebx, esi
and edi, esi
rol edi, 0x14
and ecx, edi
xchg esi, ecx
jmp 0x499700
mov edx, 0x123b2f04
shr edi, 0x13
dec ecx
xor ecx, esi
or ebx, esi
ror esi, 2
or ecx, 0xdb5916ab
shr edi, 0xe
and ebx, ecx
sub edi, 0xdb5a57fe
xchg edi, ecx
sub ecx, edi
jmp 0x49ad59
mov edx, 0x2774562b
and ebx, edi
not ebx
rol ecx, 0xd
sub edi, 0xdb61c3e7
add esi, 0xdb622356
jmp 0x49ac69
pop edx
xchg ebx, edi
shr esi, 0xc
sub esi, ebx
mov ebx, ecx
inc edi
xor esi, ecx
xchg edi, ebx
mov edi, esi
bswap ecx
add ebx, 0xdb994c99
jmp 0x49950d
pop edx
and esi, edi
xor ebx, ecx
dec ecx
mov ebx, 0xdba31c2a
add esi, 0xdba38193
or ecx, edi
and ebx, ecx
xor ebx, edi
or ecx, edi
xchg ecx, ebx
jmp 0x49a519
jmp loc.0049f8be
push 0xd5e8d4ae
not ecx
mov ebx, esi
sub ebx, 0xdc3043f6
xor ecx, esi
bswap ecx
add edi, 0xdc31650f
mov esi, ebx
xchg ebx, ecx
sub edi, esi
shl ebx, 0x14
rol ebx, 0x1e
or edi, ecx
jmp 0x4998bf
push 0xd5ecbe97
neg ecx
sub ecx, 0xdc38a316
mov ecx, ebx
xchg ebx, edi
xchg ebx, edi
or esi, ebx
mov ebx, esi
xchg ebx, ecx
mov esi, edi
xchg edi, esi
jmp 0x4996d6
push 0xd5eea376
mov ecx, ebx
xor esi, ecx
shr edi, 0x11
xor edi, ebx
mov esi, ebx
or edi, ebx
xor esi, ebx
shl ebx, 9
jmp 0x4989b0
pop edx
add ebx, ecx
xor ebx, 0xdc5f61c1
not ebx
add edi, ecx
xor esi, ebx
mov ebx, edi
xchg ebx, ecx
xor edi, ecx
or edi, ecx
or ecx, esi
ror ebx, 0x17
xchg edi, ebx
jmp 0x49a06d
push 0xd5eab26e
add esi, 0xdc6790f3
add ebx, esi
shr edi, 0x10
xchg edi, esi
mov ecx, ebx
or edi, esi
xor edi, ecx
sub esi, edi
add edi, ecx
or esi, ebx
and ecx, esi
jmp 0x49a7d1
push 0xd5ecea09
ror edi, 0x18
and ebx, ecx
add esi, 0xdc6f2058
shl ecx, 0xf
and ebx, esi
mov ecx, 0xdc6fcab2
xchg edi, esi
neg edi
xor esi, ecx
rol ecx, 0x10
and esi, ecx
jmp 0x499008
push 0xd5ea8738
xor ecx, edi
add ecx, ebx
ror ecx, 2
inc esi
neg edi
or edi, esi
xor ecx, esi
add esi, ebx
add esi, ecx
xor ecx, edi
mov edi, 0xdc73257d
mov esi, edi
or ecx, edi
jmp 0x499674
push 0xd5e173cb
dec ebx
sub ebx, 0xdc888156
xor edi, 0xdc88ba5e
mov edi, ecx
xor ebx, ecx
inc ebx
or edi, 0xdc8aab7d
not ecx
mov ecx, esi
sub esi, ebx
jmp 0x49a972
call edx
not ebx
mov ecx, ebx
mov edi, 0xdc8bf64d
and ecx, 0xdc8c31fc
jmp 0x49a497
call fcn.0049aecf
xor ebx, 0xdc8f6d09
xchg ecx, esi
add ecx, ebx
shl esi, 0xf
inc ebx
xor esi, edi
add esi, ebx
and edi, ecx
sub edi, ecx
mov ecx, edi
mov ebx, esi
not ebx
dec edi
jmp 0x49aa64
push 0xd5e90080
add ecx, 0xdc9af7f2
sub esi, ecx
or ebx, ecx
dec edi
xor esi, edi
ror esi, 0x13
and esi, ebx
and ebx, ecx
sub edi, esi
jmp 0x49a3e7
push 0xd5ee77e6
or ebx, 0xdcb247ae
xchg ebx, esi
ror edi, 0xb
sub esi, 0xdcb2e787
inc ecx
xor esi, ecx
add edi, 0xdcb38136
and ecx, ebx
or ebx, edi
xchg esi, ebx
or ebx, esi
jmp 0x4995c0
pop edx
or esi, edi
mov esi, ebx
add ecx, esi
neg edi
xor esi, ecx
xor ecx, 0xdcb8b9c8
inc esi
jmp 0x499641
pop edx
add ecx, esi
shl esi, 5
rol ecx, 0x18
ror esi, 0x10
inc esi
add ecx, 0xdcfccaaf
or ecx, ebx
or edi, ecx
inc esi
not ebx
shr ebx, 0x10
jmp 0x498f27
mov edx, 0x123b2f04
xchg ecx, esi
xor ecx, ebx
xor edi, 0xdd59eca5
rol esi, 0x10
and esi, ebx
and ebx, esi
xor esi, edi
jmp 0x49a4b8
pop edx
add ecx, edi
bswap edi
mov esi, 0xdd7c49d5
rol esi, 0x18
xor ecx, esi
xor edi, ecx
mov ebx, edi
rol ecx, 6
jmp 0x498ecb
pop edx
sub ebx, edi
xchg edi, ebx
sub edi, ecx
add ebx, ecx
sub ecx, edi
xchg esi, ebx
xor esi, edi
dec edi
mov ebx, esi
bswap ecx
jmp 0x49a771
pop edx
rol ecx, 0x19
sub esi, 0xdd9747f6
xor ecx, 0xdd979e21
sub ecx, ebx
sub edi, esi
or ecx, edi
jmp 0x498bb1
push 0xd5e2a4ce
or ebx, ecx
xor edi, esi
neg edi
and ecx, edi
sub edi, esi
sub ebx, edi
or edi, esi
and ebx, edi
xchg ebx, edi
jmp 0x499053
push 0xd5e92e4b
mov ebx, esi
xor ebx, 0xddb47ff7
rol esi, 1
jmp 0x499ec2
pop edx
ror ecx, 0x19
shl edi, 6
ror ebx, 0x1a
sub ebx, ecx
sub edi, esi
mov ebx, ecx
xchg edi, ebx
xor ebx, edi
or ebx, esi
add ebx, 0xddbee740
jmp 0x49a583
call fcn.0049aecf
bswap ebx
or esi, 0xddbf666a
and esi, 0xddbf9b0a
or ecx, ebx
add edi, esi
and esi, 0xddc03eb4
add ebx, ecx
neg edi
bswap ebx
add ecx, edi
not esi
mov esi, ebx
jmp 0x498725
pop edx
add ebx, 0xddc51efc
mov esi, edi
xor ecx, ebx
not edi
bswap edi
jmp 0x499c4b
pop edx
mov ecx, edi
neg ebx
dec edi
neg ebx
or ecx, esi
xor esi, edi
bswap edi
or esi, 0xddcccdb2
jmp 0x49a052
push 0xd5ee1c9a
and ecx, edi
add edi, ebx
sub esi, ecx
not esi
sub ecx, ebx
or edi, esi
sub edi, ecx
or ecx, edi
and edi, 0xddfad81c
xchg ebx, ecx
or edi, ebx
or edi, ecx
xor edi, ecx
mov ebx, esi
bswap ecx
jmp 0x49858e
push 0xd5eade62
bswap edi
xchg ebx, ecx
add edi, ebx
add ecx, edi
jmp 0x4988fe
mov edx, 0x123b2f04
xor esi, ebx
xchg ebx, ecx
xchg ecx, edi
xchg edi, ecx
dec ecx
mov ecx, ebx
xor ecx, esi
xchg edi, ebx
xchg edi, ebx
inc ecx
and ebx, ecx
xchg ebx, ecx
or edi, ecx
jmp 0x49985f
call edx
xor ebx, 0xde40c82b
add ecx, 0xde40fdd4
xchg esi, ebx
shr ebx, 0xb
neg ebx
xor edi, ebx
jmp 0x499240
call edx
add ebx, ecx
inc ecx
bswap ebx
add esi, ecx
xchg esi, ebx
or esi, ebx
add esi, ebx
not ecx
or edi, esi
xor edi, esi
xchg ebx, ecx
shl ecx, 1
and ebx, 0xde44a2c3
jmp 0x498da5
push 0xd5e1153c
or esi, ecx
mov edi, esi
or ebx, 0xde492de5
or esi, ebx
mov edi, esi
xor edi, 0xde4a5099
add esi, ecx
not edi
or esi, 0xde4b92de
shl edi, 0x1b
mov ecx, edi
dec esi
jmp 0x49874b
pop edx
mov esi, ebx
xor edi, ebx
xor edi, 0xde4d03cc
add edi, 0xde4d34a6
jmp 0x498b9e
call fcn.0049aecf
shr ecx, 0x10
add edi, 0xde63b661
and ebx, ecx
mov ebx, esi
or esi, edi
xchg ebx, esi
neg ebx
and esi, 0xde64e944
or esi, 0xde65290d
mov ecx, 0xde655dea
add edi, ebx
and esi, ecx
neg edi
add esi, 0xde6757d2
neg edi
xchg ebx, ecx
jmp 0x49aa48
call fcn.0049aecf
add ecx, edi
sub ecx, edi
xor esi, ebx
rol ebx, 9
shl ecx, 0x1f
sub ebx, 0xde784e8b
or ebx, 0xde78c658
nop
add ebx, ecx
rol esi, 0x1c
sub ecx, edi
xchg ebx, esi
inc ecx
xor ecx, ebx
jmp 0x498931
mov edx, 0x123b2f04
add edi, ecx
shr ecx, 0x10
mov esi, ecx
shr ecx, 0x10
or esi, 0xde82d778
xchg ebx, edi
sub esi, ebx
and esi, 0xde837fa4
mov edi, ecx
xchg ebx, edi
add esi, ebx
xor esi, ebx
jmp 0x4994a0