Function at 0x401000
Capabilities:
Access the windows event log
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0xfffffef4
jne 0x401084
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
ret
call sub.user32.dll_GetMessageTime
cmp eax, 0xfffffef9
jne 0x4010f9
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
ret
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0xffffff28
jne 0x40117d
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
ret
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0xffffff05
jne 0x401206
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_NtQueueApcThread
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
call sub.advapi32.dll_ObjectDeleteAuditAlarmA
ret
jmp 0x494f92
or edx, 0xb0ff415b
and ebx, 0xb0ff7acb
neg edx
or esi, 0xb0ffe0a0
sub ebx, edx
xor edi, ebx
add edi, edx
xchg esi, edi
jmp 0x49598f
mov ebx, 0x183c2e20
and ecx, 0xb5213da7
xor edi, ecx
xor edi, ecx
and ecx, esi
not ecx
add ecx, 0xb52a0a01
and edi, esi
and edx, ecx
add ecx, 0xb52a9b93
jmp 0x496d3a
mov ebx, 0x43370267
sub edi, ecx
shr esi, 0xa
and esi, 0xb52b4075
and edi, 0xb52b720a
sub edx, 0xb52ba557
shr edi, 0x1d
xor esi, edx
and ecx, 0xb52c3ba8
and edi, ecx
mov ecx, edi
and edx, esi
xor edi, 0xb52d040c
xor edx, 0xb52d3684
jmp 0x49527d
call ebx
mov edx, ecx
shl ecx, 0x16
xor edx, esi
or edx, edi
jmp 0x495719
call ebx
sub esi, edx
sub edi, esi
sub esi, edi
or esi, edi
xor esi, 0xb530d758
xor edx, 0xb531092c
add edi, edx
jmp 0x4982b3
pop ebx
xchg esi, edx
or esi, edx
and ecx, edi
sub edx, ecx
and edi, esi
mov ecx, esi
neg edx
and esi, 0xb53db1c1
sub edx, ecx
xchg edx, edi
jmp 0x496fc5
call fcn.0049547a
bswap esi
mov ecx, edi
mov esi, ecx
or esi, edx
or esi, ecx
xor edx, 0xb5412498
jmp 0x496bfd
call fcn.0049547a
and edx, edi
rol esi, 0xa
mov esi, edi
or edi, ecx
or esi, edi
xchg esi, edx
bswap edx
and esi, 0xb558b2e9
or edi, edx
and ecx, 0xb5591333
xchg ecx, esi
jmp 0x496fed
push 0xb105522c
xor edx, esi
and ecx, edx
xchg esi, edx
dec edx
add esi, 0xb56d670d
xor esi, 0xb56d99e2
add esi, edx
jmp 0x495dfa
push 0xb109e9d5
and edi, edx
shl ecx, 8
add ecx, esi
inc esi
shr esi, 0x17
and edx, esi
dec edx
add edx, esi
shr esi, 0xf
mov ecx, 0xb5914b7c
and esi, edx
add edx, 0xb591ab07
jmp 0x494fde
push 0xb10adeec
or ecx, edx
add ecx, esi
dec ecx
and ecx, 0xb594230c
jmp 0x497948
pop ebx
and ecx, esi
and esi, 0xb5960cbb
sub edi, 0xb5963d21
xor edi, edx
or edi, esi
ror esi, 0x13
not ecx
neg edi
and edi, esi
mov edx, esi
or ecx, edi
bswap edi
rol edx, 4
jmp 0x495fc0
call ebx
not edx
inc esi
sub edi, esi
xchg ecx, edx
jmp 0x49611c
mov ebx, 0x43370267
mov edi, 0xb5adb592
xor edi, ecx
dec edi
rol ecx, 0x16
xor ecx, edi
dec edi
or ecx, edx
or esi, 0xb5af18c7
mov edx, esi
or ecx, edi
add ecx, esi
jmp 0x4971fc
push 0xb10423aa
and edi, ecx
mov edx, edi
and edi, esi
and esi, 0xb5bb60ae
inc edi
sub edx, 0xb5bbc417
dec edi
and edx, 0xb5bc48e2
dec esi
add edi, edx
or edx, edi
sub ecx, 0xb5bd1551
xchg edx, esi
jmp 0x4974ce
mov ebx, 0x183c2e20
mov edi, esi
and edi, edx
xor ecx, esi
mov edi, ecx
or esi, edx
and ecx, 0xb5dae8f2
or edx, 0xb5db190c
bswap esi
jmp 0x4964ef
push 0xb106e376
xchg ecx, edx
sub edi, esi
sub esi, edx
and esi, edi
or edi, 0xb5de2f1b
add ecx, edi
mov esi, ecx
or esi, edx
shr esi, 0x13
not edi
or ecx, edx
mov ecx, esi
add ecx, edx
add edi, ecx
xchg edi, esi
jmp 0x495c6a
push 0xb1070b32
sub edx, 0xb5e61ce8
neg esi
sub edx, 0xb5e68aee
xor edx, edi
and edx, 0xb5e6ec9c
xchg esi, ecx
dec esi
jmp 0x497db1
push 0xb1057a4f
xor ecx, edi
xor edi, 0xb5fb9dd8
or ecx, esi
jmp 0x497f6b
push 0xb109c1f7
rol ecx, 0x1d
add edx, edi
mov ecx, edi
sub edi, edx
and ecx, edx
or ecx, edi
and edi, 0xb6173015
mov esi, ecx
dec ecx
jmp 0x49568d
call fcn.0049547a
and ecx, 0xb61aca3b
sub edx, esi
add edx, edi
shr esi, 0x1e
sub esi, edi
not edx
sub edx, 0xb61bf981
add edx, edi
or edx, 0xb61c599f
jmp 0x49808e
pop ebx
sub edx, esi
or edx, 0xb629ee51
add edi, 0xb62a2090
add edi, 0xb62a51e9
or edx, edi
add edx, edi
xor ecx, edx
xor edx, esi
neg ecx
or ecx, 0xb62b7e01
and esi, edi
add ecx, 0xb62bde2a
jmp 0x49837f
call ebx
xor ecx, edx
sub edx, esi
sub edx, edi
and ecx, edi
dec edi
ror edi, 0x1a
ror edx, 0x1b
jmp 0x4984e7
jmp loc.0049c000
push 0xb10bd361
rol esi, 0x1b
bswap edi
add esi, edi
xor ecx, esi
sub esi, edx
mov edi, 0xb66a61b2
not ecx
sub edx, ecx
shr ecx, 0xd
xor edi, ecx
or edx, 0xb66b615e
rol ecx, 0x1e
or esi, 0xb66be4de
nop
inc edx
xor edi, ecx
jmp 0x495b9d
mov ebx, 0x183c2e20
and edx, 0xb6720664
inc edx
or ecx, edi
and edx, ecx
xchg edx, edi
xor edx, edi
xchg edi, ecx
xchg edi, esi
xor esi, ecx
jmp 0x49792d
pop ebx
sub ecx, esi
sub edx, edi
or esi, ecx
sub edi, esi
or edi, 0xb6905d92
sub esi, 0xb6908eca
mov esi, ecx
shl esi, 0x15
rol edi, 8
and ecx, edi
mov esi, ecx
sub edi, ecx
sub esi, edx
jmp 0x498110
push 0xb10bab37
and esi, edx
sub edx, esi
mov esi, ecx
and edx, ecx
add edi, 0xb6986196
mov edi, ecx
mov esi, 0xb698c07a
mov edx, esi
jmp 0x49656c
pop ebx
mov ecx, edi
shl ecx, 0xd
or ecx, esi
xor edi, 0xb69c6658
mov ecx, edx
xor ecx, 0xb69cc8e4
shl ecx, 0x19
dec ecx
sub esi, ecx
add edx, edi
jmp 0x4950cd
call ebx
add edx, ecx
xor edx, ecx
and ecx, 0xb6c8fb88
ror edi, 5
and ecx, edi
ror ecx, 0x15
mov esi, ecx
nop
mov edx, ecx
jmp 0x49776a
call fcn.0049547a
and ecx, 0xb6dcbc40
or ecx, 0xb6dcee09
or ecx, 0xb6dd2089
xchg esi, edx
not edx
mov edi, ecx
sub esi, ecx
add edi, ecx
jmp 0x495075
pop ebx
shl esi, 0xc
shr edi, 0x1c
xor edx, 0xb6dec45d
sub ecx, esi
mov edx, edi
mov edi, edx
or ecx, 0xb6df8c66
add ecx, 0xb6dfbeb8
rol esi, 8
xor esi, 0xb6e02174
or ecx, 0xb6e053ed
jmp 0x49843b
push 0xb106bc98
xchg esi, edx
xor esi, edi
sub ecx, esi
xchg ecx, edi
mov ecx, esi
nop
inc esi
or ecx, esi
jmp 0x495bdb
push 0xb1082764
ror esi, 0x12
xchg ecx, edi
add edi, esi
or ecx, edi
xchg ecx, edi
mov edi, edx
inc edx
or edx, ecx
sub edi, esi
mov edx, esi
or esi, edx
or esi, ecx
sub ecx, 0xb705d6eb
jmp 0x495006
call ebx
mov edx, edi
neg esi
xor edx, 0xb70679c3
sub edx, edi
mov esi, edi
or ecx, edx
xchg esi, edx
or ecx, edx
shr esi, 0x17
jmp 0x496816
call fcn.0049547a
not ecx
add esi, 0xb726afe5
mov ecx, edi
add esi, edx
xchg esi, edi
or edx, 0xb7276e19
and edx, ecx
inc esi
shr edx, 0x1f
or edi, ecx
jmp 0x495065
push 0xb104589c
or edx, edi
xor edi, 0xb75bd8a6
xor ecx, 0xb75c74fb
or edx, ecx
mov ecx, edi
inc edx
neg esi
not esi
sub edi, 0xb75d9d21
jmp 0x4965f9
call fcn.0049547a
add edx, edi
sub edx, esi
mov esi, 0xb768f3ee
jmp 0x496494
pop ebx
xchg edx, ecx
xor esi, edx
shl ecx, 0xf
or edi, esi
xor ecx, edi
xchg edi, ecx
neg esi
or edx, esi
add edi, edx
sub ecx, 0xb783005e
add edx, esi
add esi, edi
jmp 0x496d60
pop ebx
and esi, edi
xor ecx, 0xb797f9c8
dec edi
xor ecx, edi
jmp 0x4968ed
call fcn.0049547a
shr ecx, 5
mov ecx, edi
sub ecx, esi
bswap esi
jmp 0x495778
mov ebx, 0x43370267
or esi, ecx
or ecx, 0xb7ad9943
sub esi, edx
nop
add ecx, edx
jmp 0x4975a7
mov ebx, 0x183c2e20
add esi, 0xb8052f4d
or edi, ecx
xchg ecx, edx
add edx, esi
mov edx, esi
xor esi, edx
mov edi, ecx
xor edi, 0xb8067963
neg esi
xchg esi, edx
and ecx, esi
xchg edx, ecx
add esi, edx
dec edi
rol edx, 0x1e
shl edi, 0x1c
jmp 0x49510a
mov ebx, 0x43370267
not esi
rol edx, 0x1a
mov edi, 0xb80aa289
ror edx, 0xe
mov edx, ecx
add edx, ecx
xchg edx, edi
neg esi
xor esi, ecx
and edx, esi
mov ecx, edi
jmp 0x49600a
push 0xb105a220
shr esi, 0x12
sub edx, esi
and edi, edx
neg esi
not esi
jmp 0x497d61
call ebx
inc esi
bswap edi
xor edx, 0xb83a9cdb
shr edx, 0x19
or edx, ecx
xchg edx, edi
jmp 0x4978c9
push 0xb108f3c9
mov edx, ecx
add edi, 0xb8420615
xchg ecx, esi
or ecx, edx
xchg esi, edi
and ecx, 0xb842f589
add edx, esi
mov edx, 0xb8435458
jmp 0x49589c
pop ebx
sub edi, edx
add edx, ecx
and esi, edi
sub ecx, edx
jmp 0x4956e3
pop ebx
xor esi, edx
xchg ecx, edx
xchg edx, esi
add esi, 0xb859f87d
xchg edi, ecx
xchg edi, esi
shl esi, 4
and edx, ecx
add edi, edx
neg edi
and esi, 0xb85b535f
xchg ecx, edi
not edx
or edi, ecx
jmp 0x4981e5
pop ebx
and ecx, esi
mov edx, edi
and edi, ecx
mov ecx, edi
add edi, 0xb8660e95
sub ecx, edx
mov edi, edx
shr edi, 0x19
mov esi, ecx
add edx, edi
and edi, edx
xor ecx, 0xb86765e8
sub edi, esi
inc esi
jmp 0x495418
pop ebx
or edx, ecx
sub edi, edx
neg edi
or esi, ecx
sub ecx, 0xb871c08b
sub esi, edx
xchg esi, edx
shr edi, 0x18
inc esi
neg edx
add esi, edx
not esi
jmp 0x496ec7
pop ebx
dec esi
and edi, esi
sub esi, edi
dec edx
sub edi, ecx
and ecx, 0xb87cf719
or esi, 0xb87d282d
and esi, edi
and ecx, edi
jmp 0x49689c