Function at 0x401000
Capabilities:
Encrypt data using chaskey
Get common file path
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetKBCodePage
cmp eax, 0xfffffefd
jne 0x401070
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
ret
call sub.user32.dll_GetKBCodePage
cmp eax, 0xfffffeea
jne 0x401117
call sub.ntdll.dll_RtlInitializeSid
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
ret
call sub.user32.dll_GetDoubleClickTime
cmp eax, 0xfffffef5
jne 0x40118c
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
ret
call sub.user32.dll_GetDoubleClickTime
cmp eax, 0xfffffedd
jne 0x4011ed
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
ret
call sub.user32.dll_GetDoubleClickTime
cmp eax, 0xffffff35
jne 0x401276
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.ntdll.dll_RtlInitializeSid
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.shell32.dll_SHGetSpecialFolderPathA
call sub.advapi32.dll_GetServiceDisplayNameW
call sub.ntdll.dll_RtlInitializeSid
call sub.ntdll.dll_RtlInitializeSid
ret
jmp 0x498663
inc ecx
sub esi, edi
jmp 0x499930
call fcn.004986da
sub ecx, edi
sub edi, 0x711f8c80
inc esi
mov esi, edx
add ecx, edx
shl ecx, 1
shr ecx, 0x10
bswap ecx
jmp 0x49b4f9
call ebx
xchg edx, esi
or ecx, 0x71230094
sub esi, edi
dec edi
neg edx
neg esi
add edx, 0x712469d1
ror esi, 4
jmp 0x49a042
push 0x6c65a318
xor esi, ecx
and edi, ecx
inc edi
xchg ecx, edi
xchg edx, ecx
and ecx, 0x712f0f5d
mov edx, 0x712f407c
jmp 0x49adaa
push 0x6c6aeedc
mov ecx, 0x71329ab5
and edi, edx
neg edx
xchg edx, esi
shl edx, 0x19
add edx, ecx
bswap ecx
dec esi
not esi
mov edx, ecx
jmp 0x498b95
pop ebx
xor ecx, esi
sub edx, esi
xor edi, esi
mov edi, 0x7156252e
jmp 0x49a168
mov ebx, 0x123b2f04
sub edi, 0x7167ebab
xchg ecx, edx
add esi, edi
mov esi, edi
sub ecx, esi
jmp 0x499d4e
mov ebx, 0x2774562b
or edi, esi
add ecx, 0x716af61a
mov edi, edx
or edi, esi
xchg ecx, edx
mov edx, ecx
add edx, 0x716bf0cb
xor edx, esi
inc edi
add esi, edi
mov ecx, 0x716cd2a1
xor edx, ecx
and ecx, edi
xor edi, edx
bswap ecx
mov edx, ecx
jmp 0x49b5c0
mov ebx, 0x2774562b
bswap esi
mov esi, edi
sub esi, ecx
mov edx, 0x71922f45
add edi, esi
neg edi
jmp 0x4996c8
call ebx
xor ecx, esi
ror esi, 0x1f
inc ecx
rol ecx, 0x17
dec edx
or esi, ecx
xchg ecx, esi
and edi, ecx
not edx
jmp 0x49ad43
push 0x6c556914
add esi, ecx
mov ecx, edx
sub ecx, 0x71aa3366
and ecx, edi
rol edi, 4
mov ecx, edx
dec edi
or esi, edx
and ecx, edi
or edx, esi
jmp 0x49a6c0
pop ebx
and edx, ecx
rol ecx, 0x14
add ecx, esi
xor edi, 0x71b2b211
xchg edi, edx
dec ecx
not esi
ror edx, 0x1d
and esi, edx
add edx, esi
xor edi, esi
dec esi
jmp 0x499389
call ebx
xor ecx, edx
shr esi, 0x1c
or edi, esi
or edi, 0x71ba7ef2
xor ecx, edi
jmp 0x49b88f
pop ebx
shr edi, 8
xchg edx, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 0x15
xchg edi, ecx
shr edx, 0xe
and edx, 0x71fd8184
jmp 0x49880f
push 0x6c594934
sub edx, ecx
sub esi, ecx
or edi, ecx
xor edx, esi
sub edi, esi
and edx, ecx
or ecx, 0x72086267
xchg esi, edx
jmp 0x49b6e6
call fcn.004986da
not edx
add esi, ecx
dec edi
not esi
and esi, 0x72334da4
xchg esi, edx
sub ecx, 0x7233e2d8
add edi, ecx
sub edi, 0x723445ab
jmp 0x499e82
pop ebx
shr edx, 5
sub ecx, 0x723ee91b
sub esi, 0x723f2289
xor esi, edx
bswap esi
sub esi, 0x723fbd2c
xor edx, ecx
inc ecx
jmp 0x49b24a
call ebx
xor edx, ecx
add edi, esi
xor esi, 0x724f41fd
add edx, esi
or edx, esi
and esi, ecx
inc esi
dec edx
jmp 0x49a38d
push 0x6c58a442
or edx, ecx
add edi, ecx
or edx, 0x7250f74e
xor esi, ecx
or esi, edi
add ecx, edx
neg esi
xor edx, 0x725207f5
neg esi
jmp 0x499ab4
push 0x6c550d39
and esi, ecx
shr esi, 0x1e
xchg edx, ecx
bswap esi
and edi, ecx
mov esi, edx
bswap edi
or esi, ecx
xchg edx, esi
xchg ecx, edx
shl edx, 7
xchg ecx, edx
add ecx, edi
xor edi, edx
inc edi
or ecx, esi
jmp 0x498efe
mov ebx, 0x2774562b
mov edi, 0x72660860
add edx, 0x72663d59
or esi, 0x72667601
ror edx, 0x1a
ror ecx, 0x11
and esi, edi
inc ecx
ror edi, 0x15
xor esi, 0x7267bdd7
mov esi, edx
rol ecx, 8
sub ecx, esi
bswap ecx
jmp 0x49a015
push 0x6c58facc
add edx, 0x72752dde
and esi, ecx
add esi, ecx
add esi, edx
or ecx, esi
or edx, 0x72771a81
mov edi, esi
xor edx, ecx
mov edx, 0x72783990
rol esi, 0x12
jmp 0x49943c
call fcn.004986da
sub ecx, edx
mov edx, 0x72835474
add ecx, 0x728388e9
add edi, 0x7283bdca
sub edi, esi
mov esi, 0x72842a19
bswap edx
xchg ecx, edx
sub esi, edx
add ecx, 0x72852ccb
or esi, 0x72856650
xor edx, edi
jmp 0x499894
pop ebx
rol esi, 9
sub edx, ecx
shr ecx, 1
xchg edx, ecx
add edi, edx
mov edi, edx
shr edi, 0x15
sub edi, esi
ror ecx, 0x19
sub edx, edi
jmp 0x49979c
pop ebx
sub esi, 0x728de5b7
sub ecx, edi
or ecx, edi
xor esi, edx
sub edx, edi
or edx, ecx
or ecx, edi
xchg ecx, edi
xor edx, edi
ror ecx, 0x15
and edi, 0x728ff931
add esi, ecx
ror edi, 9
mov esi, 0x729095d2
add edi, 0x7290ce70
jmp 0x49afa9
jmp loc.004a0000
call ebx
dec ecx
inc edx
not edi
shl esi, 0x1f
add esi, 0x72b614b7
xor esi, edi
add edx, esi
or edx, 0x72b6beca
inc edi
shl esi, 2
xor edx, esi
and ecx, edi
add ecx, esi
and esi, ecx
jmp 0x498a72
call fcn.004986da
mov edi, 0x72d00c44
or esi, ecx
mov edx, edi
add edx, 0x72d0b8fd
mov edi, edx
bswap esi
neg edi
mov ecx, edx
shl ecx, 0x13
dec edx
sub ecx, esi
rol edi, 0x16
or edx, ecx
inc edi
jmp 0x49b7dc
pop ebx
sub esi, ecx
sub esi, ecx
nop
add ecx, 0x72d3f073
shl edi, 0x16
add ecx, edi
or ecx, edx
jmp 0x49ad8a
push 0x6c631c34
mov edx, ecx
xor esi, ecx
add esi, ecx
sub esi, 0x72e72274
rol edx, 0x18
xor ecx, 0x72e79557
shl edx, 0x1c
or esi, ecx
and esi, ecx
sub edx, esi
sub edi, edx
xor esi, edx
and edi, edx
jmp 0x49a1c0
push 0x6c636c5d
mov edx, 0x72ec2531
ror edi, 0x1a
and edx, esi
and edx, 0x72ecc42a
and esi, edi
or edx, 0x72ed2ffc
or esi, edx
neg esi
add edi, ecx
sub edi, esi
jmp 0x4999e8
pop ebx
shl esi, 0x1e
sub edx, ecx
rol edi, 0x14
sub esi, edx
xor esi, edi
jmp 0x499c31
pop ebx
add esi, ecx
mov esi, edx
or edi, 0x73106d69
xor esi, edi
jmp 0x49b6c2
call fcn.004986da
sub edx, 0x7330d930
sub edi, edx
neg edi
and ecx, esi
rol edi, 0xe
or esi, 0x7331e146
xchg edx, edi
and edi, edx
jmp 0x498e6b
push 0x6c55be77
xchg esi, ecx
not esi
xor edx, 0x73447289
shr esi, 0xf
or esi, ecx
xor esi, edi
xchg ecx, edx
or edx, ecx
mov ecx, 0x7345e51c
mov edx, ecx
xor esi, edx
jmp 0x49acbb
mov ebx, 0x2774562b
mov esi, edi
sub edx, edi
mov edi, 0x7351a2fb
xor edi, esi
rol edx, 6
and ecx, esi
not edi
xchg ecx, edx
xor edx, esi
ror edx, 0x10
ror edi, 7
sub edx, esi
add esi, edx
jmp 0x498741
push 0x6c6155ed
xchg edi, esi
or edi, esi
sub esi, edx
and esi, edx
shl edx, 0x17
dec ecx
add edx, edi
bswap esi
ror edx, 0x1a
jmp 0x498d8e
mov ebx, 0x2774562b
neg edi
mov esi, 0x73ad3a3b
inc edi
xor esi, edx
add esi, edi
mov ecx, edi
xor edx, esi
add edi, ecx
add edi, edx
mov ecx, edi
or esi, edx
sub ecx, 0x73b1b392
nop
mov esi, 0x73b21c7a
jmp 0x49ae23
push 0x6c680507
xor esi, 0x73b268e1
sub ecx, 0x73b2a22e
add edi, 0x73b2e240
add edi, 0x73b31737
jmp 0x49ac2d
push 0x6c5609f5
sub ecx, esi
add edx, ecx
sub edx, 0x73bb6e58
sub edx, esi
add ecx, esi
xor edx, ecx
or edi, edx
or edi, esi
bswap edx
and edx, ecx
jmp 0x498bcb
pop ebx
shr edi, 0xf
or edx, esi
or ecx, edx
or edi, 0x73c9cc4a
bswap edx
ror edx, 0xe
sub esi, edi
sub edx, edi
xchg edi, esi
xor esi, edi
jmp 0x49b311
pop ebx
nop
mov ecx, 0x73d18f0b
and ecx, edx
xor esi, edx
or edi, ecx
and ecx, 0x73d32cd9
inc ecx
or ecx, edx
ror edx, 0x10
neg edi
jmp 0x49a3dd
mov ebx, 0x2774562b
sub edx, esi
sub ecx, edi
dec esi
or esi, 0x73d65f1c
or edx, esi
or esi, 0x73d6cd49
xor edi, edx
xor ecx, edi
bswap esi
sub esi, 0x73d89eae
and edi, 0x73d9001b
and ecx, edi
sub esi, edx
and ecx, 0x73da4312
jmp 0x49a5aa
push 0x6c5bbfc2
dec edi
bswap ecx
and edi, edx
add edi, 0x73e00c85
sub esi, ecx
xchg ecx, edi
nop
jmp 0x49a78e
call fcn.004986da
inc edi
inc esi
and edi, ecx
or esi, edi
inc edi
rol edx, 4
xor edx, 0x73e41734
or edx, esi
bswap edx
mov ecx, edi
xchg ecx, esi
xor ecx, edi
shr edi, 1
jmp 0x498fd0
pop ebx
and edi, esi
sub esi, 0x73ff848e
and esi, ecx
and edx, edi
jmp 0x49ae09
pop ebx
or ecx, edi
bswap ecx
neg edx
and edi, esi
nop
xchg esi, edx
shl esi, 0x1e
sub ecx, esi
sub ecx, esi
or esi, edi
jmp 0x49a9a6
push 0x6c6a8ba9
xchg esi, ecx
not esi
dec edx
jmp 0x498854
push 0x6c676fa1
add edi, esi
add ecx, 0x7437f1ad
mov ecx, 0x74382aeb
sub edx, ecx
xor edi, 0x743890ce
sub esi, edx
jmp 0x49b7fc
call ebx
or edx, ecx
not edx
add esi, 0x7458cd22
or edx, esi
shr ecx, 0x12
mov edi, esi
xchg edi, esi
xchg esi, edi
or edx, edi
xchg esi, edi
jmp 0x49b211
call fcn.004986da
add ecx, 0x7466bebf
xchg edx, edi
jmp 0x498775
pop ebx
mov esi, edx
sub edi, edx
mov ecx, 0x747bb86f
or esi, edi
shl edx, 0xc
xchg ecx, esi
add esi, 0x747c8ebc
xor edx, esi
or esi, edi
neg ecx
add edx, ecx
jmp 0x4998ad
mov ebx, 0x123b2f04
xor edi, edx
inc esi
or ecx, edx
and edx, 0x747e920d
sub edi, edx
inc esi
and edi, esi
and ecx, esi
add ecx, edx
sub edx, edi
or ecx, edx
sub edx, 0x74817295
jmp 0x499b76
call ebx
add esi, ecx
xchg esi, ecx
ror edx, 0x11
add edi, 0x74944dcd
add esi, 0x7494b666
xchg edi, ecx
and esi, edx
xchg esi, edi
jmp 0x498f5e
push 0x6c67bea1
not edx
neg edx
mov esi, ecx
sub edi, ecx
sub edx, edi
or ecx, edx
bswap esi
mov esi, 0x7498ea49
mov esi, 0x74991f2d
or esi, edi
shr ecx, 0x12
jmp 0x49ac5b
pop ebx
xchg edx, edi
or edi, ecx
and edi, 0x74a3fb5b
neg esi
or esi, ecx
sub esi, edx
dec ecx
xchg ecx, edi
dec edx
xor edi, edx
or edi, ecx
or ecx, 0x74a6e5d4
add edx, edi
or esi, edx
add ecx, edi
shr ecx, 0x17
jmp 0x499bae