Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
add esi, ecx
mov ebx, esi
add edi, ecx
xchg ecx, edi
or edi, 0x11597111
call sub.user32.dll_GetShellWindow
xchg ecx, ebx
or esi, edi
xor ebx, 0x115af50e
or ebx, 0x115b7e6d
xor esi, edi
and edi, esi
cmp eax, 0xfffffee9
jne 0x4010ab
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
ret
and esi, ecx
and edi, 0x11699cf3
xchg esi, edi
sub ebx, ecx
bswap ebx
xchg ecx, edi
mov esi, edi
rol edi, 0xa
call sub.user32.dll_GetMenuCheckMarkDimensions
mov ecx, esi
sub esi, edi
or edi, ebx
add edi, ecx
and ecx, 0x116fdfe4
add ebx, 0x11706a06
xchg esi, ebx
and ebx, ecx
cmp eax, 0xfffffed9
jne 0x401148
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
ret
or edi, ebx
or ebx, edi
call sub.user32.dll_GetShellWindow
xchg esi, ebx
shl edi, 6
cmp eax, 0xffffff09
jne 0x4011df
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
ret
sub esi, ecx
call sub.user32.dll_GetMenuCheckMarkDimensions
sub esi, 0x118973ba
rol ecx, 0xc
and ecx, edi
add esi, 0x118ae529
and ecx, 0x118b6b06
xor ebx, esi
cmp eax, 0xffffff14
jne 0x401265
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.kernel32.dll_FindFirstFileExW
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
call sub.ntdll.dll_RtlAcquireResourceShared
ret
jmp 0x505e8b
mov edi, esi
rol esi, 0x1b
inc ebx
jmp 0x508186
call edx
rol ebx, 0xb
xor ecx, edi
xor esi, 0x2235b8f5
add ecx, 0x2235f82a
and edi, ebx
sub esi, ecx
ror esi, 0x16
mov ebx, esi
jmp 0x506686
pop edx
xor ebx, edi
or ecx, edi
and ecx, edi
and ecx, 0x225bf88c
and esi, edi
add ecx, ebx
jmp 0x508802
push 0x13186cff
or ecx, 0x226519ce
or edi, ecx
dec ecx
and ebx, 0x226c2fc0
xor ebx, esi
nop
or edi, ebx
xchg ecx, ebx
jmp 0x508dc2
push 0x13211d4d
mov ecx, ebx
xor edi, ecx
sub esi, ebx
mov ebx, esi
sub esi, ecx
add edi, 0x22ac95e2
bswap ecx
xchg ecx, esi
or ebx, 0x22adc6c7
or ecx, 0x22ae0639
jmp 0x507071
pop edx
and esi, 0x22b023af
shl edi, 0x14
sub edi, esi
jmp 0x50669e
push 0x132737c0
xchg ebx, ecx
neg ebx
xchg ecx, esi
inc ecx
shr ecx, 0xf
neg esi
rol ecx, 0xe
rol esi, 7
and ecx, ebx
and ebx, esi
neg ecx
xchg ecx, ebx
rol esi, 0x14
sub ecx, ebx
jmp 0x509796
push 0x13249229
xchg ebx, ecx
add ebx, edi
xchg edi, ecx
add ecx, ebx
sub ebx, esi
or edi, 0x22e352b6
rol ecx, 0x1f
dec edi
mov edi, ebx
xor edi, ecx
and edi, esi
mov ecx, ebx
jmp 0x506937
push 0x132df1e0
or ebx, edi
rol esi, 9
and ebx, ecx
mov ebx, esi
mov esi, 0x230f66c4
xor edi, 0x230feb4d
jmp 0x507bfe
call edx
dec edi
bswap edi
or ecx, ebx
neg ecx
sub ebx, edi
rol ebx, 0x1f
sub esi, 0x2331156c
and edi, ecx
mov edi, 0x2332430b
mov ebx, esi
mov esi, ecx
xchg ebx, ecx
xchg ecx, esi
xor ebx, ecx
add esi, 0x2337a335
jmp 0x5070f5
pop edx
sub ebx, 0x2351d588
xchg esi, edi
inc ecx
add esi, edi
neg ebx
xor edi, 0x2354565b
or ebx, esi
or edi, ebx
mov esi, ebx
xchg esi, edi
jmp 0x5097b7
pop edx
add esi, edi
or edi, ecx
xor edi, 0x2372235f
neg ecx
sub ecx, esi
xor edi, ecx
xchg ebx, esi
jmp 0x505fad
push 0x132b8c82
shl ebx, 0x12
or ebx, esi
add esi, edi
mov esi, 0x2376588e
ror ecx, 0xa
add edi, ecx
mov esi, ecx
jmp 0x508506
mov edx, 0x123b2f04
and edi, ecx
add edi, esi
add esi, edi
inc esi
jmp 0x50720d
call fcn.005099d7
or ebx, 0x238cf5dc
xchg edi, ecx
xchg edi, ebx
and edi, 0x238e9c84
or edi, 0x238f1777
rol esi, 0x1f
xor edi, 0x23904e46
inc edi
rol ebx, 7
jmp 0x505e96
pop edx
mov ecx, 0x23a9eee4
add ebx, edi
dec edi
mov esi, 0x23ab8d36
sub ecx, edi
mov edi, ebx
shl ecx, 0xd
jmp 0x50635b
pop edx
add ebx, edi
sub edi, esi
and esi, ecx
sub esi, ecx
inc ecx
ror ecx, 0x1d
xor ecx, esi
xor esi, 0x23cc1100
mov ecx, 0x23ccbbf8
shr ecx, 0x17
inc ecx
jmp 0x50680a
mov edx, 0x123b2f04
mov edi, 0x23df7478
xchg ebx, edi
sub ecx, 0x23e06240
or esi, ebx
not ebx
bswap esi
ror ecx, 0x19
sub ecx, edi
sub edi, ebx
xchg edi, ebx
not edi
xchg ecx, ebx
or edi, ecx
jmp 0x507a52
call edx
or edi, ebx
dec esi
xor esi, 0x24942e8a
sub ebx, edi
xchg ebx, edi
sub edi, ebx
shl ecx, 9
bswap ecx
and ebx, 0x24968277
jmp 0x507fdf
pop edx
xchg esi, ecx
shl esi, 0xe
bswap ecx
or ecx, edi
xchg esi, ecx
bswap ebx
inc esi
mov ebx, ecx
sub edi, ebx
mov ebx, 0x24c7a133
jmp 0x5082c8
push 0x13217e3c
or esi, ebx
mov esi, 0x25380693
add esi, ecx
or ebx, 0x253b76e8
shr esi, 0x1e
and edi, 0x253c7f8a
mov ecx, ebx
jmp 0x508f10
pop edx
shr edi, 0xd
bswap ecx
neg esi
bswap ebx
jmp 0x506def
call edx
neg edi
mov ecx, edi
dec edi
xchg ecx, edi
xchg ebx, ecx
ror ecx, 0x1d
mov esi, edi
xchg ecx, edi
add esi, ecx
and ecx, edi
xchg edi, ecx
xor ebx, esi
xor ecx, 0x2565f19f
sub ecx, edi
jmp 0x508cda
call fcn.005099d7
inc esi
mov esi, ebx
xor ebx, edi
xor ebx, ecx
xor ecx, esi
mov ebx, 0x2585caa8
mov ebx, edi
sub esi, 0x2586e5cc
jmp 0x50851b
push 0x13268873
xor edi, ecx
xor esi, 0x25b6b297
shr ecx, 4
or ecx, ebx
xor esi, ecx
jmp 0x507b8b
mov edx, 0x2774562b
and esi, ebx
mov esi, edi
dec esi
dec edi
jmp 0x5088fb
push 0x131dbafe
xor ebx, esi
inc edi
xor edi, 0x26811a25
sub ecx, ebx
neg edi
neg esi
xor edi, ecx
ror edi, 5
add edi, esi
jmp 0x5087d3
call edx
and ecx, esi
sub ebx, edi
mov esi, ebx
and edi, ebx
dec ebx
or edi, ebx
neg ecx
add esi, edi
sub ebx, edi
or esi, edi
jmp 0x508832
call fcn.005099d7
inc ecx
add edi, ebx
sub edi, ebx
and edi, 0x26f6d750
jmp 0x506c94
push 0x1326e3ba
xchg esi, edi
xor edi, 0x272549c9
sub ebx, edi
shr ebx, 4
add esi, ecx
inc esi
shl ebx, 0xa
and esi, 0x2728629a
or edi, 0x2728d278
jmp 0x506332
mov edx, 0x123b2f04
xor ebx, esi
inc ebx
and ecx, esi
sub edi, esi
and esi, 0x273fcf8b
xchg ebx, esi
mov esi, ebx
add ecx, edi
jmp 0x508b27
push 0x13174c2c
inc ebx
xchg edi, ecx
or esi, ebx
or ebx, edi
xor ecx, 0x27a2acbc
xor ebx, ecx
and edi, ebx
or esi, 0x27a45d35
nop
and ecx, edi
mov edi, ecx
add edi, esi
jmp 0x50919b
pop edx
sub edi, ecx
ror ebx, 0x1e
add ebx, esi
xor ecx, edi
xchg ebx, edi
and esi, ebx
rol edi, 0x12
or edi, esi
jmp 0x50847a
push 0x1315ed05
dec ebx
sub ecx, 0x281d23aa
bswap ecx
dec ecx
dec ebx
add esi, edi
and ebx, ecx
sub ecx, esi
and ecx, esi
sub ecx, esi
not ecx
xor esi, edi
and ecx, 0x28224549
xor esi, 0x2822bc98
jmp 0x5081b5
push 0x13162cce
xor ebx, edi
ror esi, 0xc
add ecx, edi
shr esi, 0xd
and esi, edi
sub edi, ebx
shr edi, 4
add ebx, esi
shr ecx, 0x13
mov ecx, 0x28277db1
xor ecx, esi
sub ecx, ebx
jmp 0x506706
call edx
mov ecx, esi
xor ebx, edi
neg ebx
add esi, edi
shr esi, 0xe
add ebx, 0x2851c570
not edi
bswap ecx
sub ecx, esi
add ecx, esi
mov ecx, ebx
jmp 0x509253
pop edx
mov edi, 0x285489d8
and esi, edi
dec edi
and ebx, edi
and ebx, ecx
jmp 0x50854a
push 0x13263bb2
rol edi, 0x1c
mov ebx, esi
xor esi, 0x28925420
mov ebx, ecx
not ecx
xor ecx, esi
sub esi, ebx
add esi, ecx
mov edi, ecx
jmp 0x507320
push 0x132bef8a
dec edi
sub ebx, esi
or esi, ecx
or edi, 0x28a7febf
jmp 0x507813
call edx
sub ecx, esi
neg esi
add ebx, 0x28a98850
jmp 0x505f54
pop edx
shr ebx, 8
xchg esi, ebx
and ebx, edi
xchg ebx, esi
mov esi, ebx
xor edi, 0x28b142e5
mov edi, ebx
sub ecx, 0x28b23775
xor ebx, edi
sub ebx, edi
jmp 0x508c75
call fcn.005099d7
rol ecx, 0x12
mov ebx, ecx
add ebx, 0x28e4d214
mov esi, ebx
or ecx, edi
xor esi, edi
or ebx, ecx
not ecx
jmp 0x507a38
mov edx, 0x123b2f04
and edi, ecx
xchg ebx, esi
sub ebx, ecx
add ecx, 0x28ef5b49
sub ebx, edi
jmp 0x508631
push 0x131e0c7a
xor ebx, 0x290d8d7b
and edi, ecx
add ecx, edi
and ebx, edi
add ebx, esi
jmp 0x50987b
pop edx
and ecx, ebx
bswap ecx
not esi
not ebx
and ebx, esi
sub edi, 0x29156884
jmp 0x507e2f
pop edx
inc esi
sub esi, ebx
sub esi, edi
add esi, ecx
or edi, ecx
shr esi, 0xf
not ecx
or esi, 0x291e2cc4
jmp 0x508a5c
call fcn.005099d7
shl esi, 2
xchg ebx, esi
jmp 0x507116
pop edx
rol edi, 7
add esi, edi
add ebx, esi
shr ebx, 0x1a
rol ecx, 0x1d
jmp 0x5068a4
jmp loc.0050e000
pop edx
add esi, ecx
xchg esi, edi
and ecx, esi
mov edi, esi
ror esi, 0x1c
add ecx, edi
jmp 0x506449
push 0x1320bf02
rol ebx, 0x10
or edi, 0x2a2bbfa9
xchg ecx, esi
and ecx, esi
xor esi, 0x2a2d1769
and edi, 0x2a2d80d6
sub edi, esi
add ecx, 0x2a2e5980
mov esi, 0x2a2ee429
shl ecx, 0xb
or edi, 0x2a2fc746
mov edi, 0x2a30345c
or ebx, esi
inc ebx
jmp 0x506219
pop edx
sub ecx, ebx
not ebx
and ecx, edi
add ecx, ebx
mov ebx, edi
mov ebx, esi
neg esi
xor ecx, 0x2a3df451
sub edi, 0x2a3e6f30
add esi, ebx
xor ecx, esi
jmp 0x508bb0
push 0x1318c63e
or edi, 0x2a67cbe1
not edi
add edi, esi
add edi, ebx
sub edi, ecx
not edi
sub ebx, edi
xchg edi, ebx
mov ecx, esi
xchg esi, ecx
ror ebx, 5
add esi, 0x2a71c898
and edi, ecx
or ebx, esi
jmp 0x507877
push 0x1321daa8
xchg esi, ecx
sub ebx, esi
ror edi, 0x1e
shr ebx, 0x18
dec ebx
not edi
sub edi, 0x2a9ac960
add ebx, esi
xor ebx, edi
bswap edi
and ebx, esi
xor esi, 0x2a9d31ab
shl ecx, 4
sub edi, 0x2a9e32f7
xchg edi, esi
jmp 0x508688
mov edx, 0x2774562b
and ebx, esi
and ecx, ebx
or ebx, ecx
and esi, edi
add edi, 0x2b143948
sub ebx, esi
sub esi, edi
xchg ecx, edi
or esi, ecx
mov edi, ecx
or ecx, esi
or esi, ecx
add esi, 0x2b18027c
jmp 0x506753
pop edx
and edi, ecx
and ecx, edi
or esi, ecx
and edi, 0x2b376765
shr edi, 0x16
or edi, ebx
jmp 0x5065b6
mov edx, 0x2774562b
mov edi, ecx
xchg edi, ebx
rol edi, 0xd
add ecx, 0x2bef91ec
mov edi, ecx
and ebx, 0x2bf0153e
and edi, ecx
jmp 0x509906
pop edx
and ebx, esi
not esi
xor edi, esi
sub ebx, esi
add edi, esi
ror ecx, 0x15
xchg edi, esi
jmp 0x506257
mov edx, 0x2774562b
or ebx, ecx
rol edi, 0x13
mov edi, 0x2c0f6a82
xchg edi, esi
or ebx, esi
sub ebx, esi
ror edi, 0x14
mov ebx, 0x2c11a5e0
jmp 0x509a84
call fcn.005099d7
xchg ebx, ecx
mov edi, ecx
sub ebx, edi
xor esi, 0x2c222543
ror ebx, 0x1d
or ebx, 0x2c232b24
add ecx, esi
jmp 0x5082a6
call fcn.005099d7
sub esi, 0x2c55c4c4
nop
rol edi, 0x1b
rol ebx, 6
rol esi, 0xb
and ebx, esi
jmp 0x5064dd