Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetOpenClipboardWindow
cmp eax, 0xffffff16
jne 0x401061
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xffffff1e
jne 0x4010ef
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xffffff35
jne 0x401173
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xfffffef6
jne 0x4011f2
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xffffff08
jne 0x401258
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.ntdll.dll_NtOpenFile
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
call sub.kernel32.dll_WriteProfileStringA
ret
jmp 0x478823
and edx, edi
jmp 0x478a86
call fcn.0047a202
and edx, 0x5e02a63f
inc edx
add ecx, 0x5e03191d
inc edx
or esi, ecx
add ecx, edx
dec ecx
xor esi, ebx
add edx, ebx
jmp 0x479101
push 0x59b4d6c4
inc esi
shr ecx, 0x14
and ecx, edx
sub edx, 0x5e1d4aa4
or ebx, esi
ror esi, 0x1d
sub edx, 0x5e1de9d2
or esi, ecx
mov ecx, 0x5e1e582f
xor ebx, 0x5e1e8fcf
sub edx, 0x5e1ec361
shl ecx, 7
add ebx, ecx
shl ecx, 0xd
and ecx, edx
jmp 0x478b04
pop edi
or esi, edx
sub esi, edx
or esi, 0x5e24a452
jmp 0x478a5a
pop edi
mov ebx, 0x5e2f4ee8
xchg ecx, ebx
rol ebx, 8
dec ebx
or esi, ecx
sub esi, edx
rol ecx, 0x17
or ecx, 0x5e30c683
not esi
sub esi, ebx
xchg esi, edx
add ecx, 0x5e319948
not ecx
jmp 0x47b16c
push 0x59b076cc
xor esi, 0x5e32145f
sub ebx, esi
shr ebx, 0xd
add ecx, 0x5e32b2d1
shr esi, 8
and edx, 0x5e331d48
xor edx, ebx
and edx, ecx
jmp 0x4799f9
pop edi
neg edx
and ebx, esi
xor ebx, ecx
and ecx, edx
bswap esi
mov ebx, edx
neg ebx
add ebx, 0x5e37c452
and edx, esi
dec esi
jmp 0x47b30f
mov edi, 0x2774562b
sub ebx, 0x5e39a793
bswap edx
or ecx, esi
dec ebx
dec esi
neg ecx
sub ebx, esi
and ecx, ebx
xor esi, ecx
or esi, ebx
sub esi, 0x5e3bb862
or ebx, 0x5e3c156a
jmp 0x47b736
push 0x59bd9623
or ebx, esi
and edx, 0x5e4bdadf
inc ebx
and ecx, ebx
or esi, ecx
sub esi, 0x5e4cabc5
rol ebx, 0x16
jmp 0x479385
pop edi
ror esi, 0x1c
xchg esi, ecx
or esi, ebx
and ecx, esi
neg ecx
or ebx, 0x5e6c6ab5
shl ebx, 0xc
xchg ebx, edx
mov ebx, edx
neg esi
and esi, ecx
mov ebx, edx
xor ebx, edx
xchg edx, esi
and edx, ecx
xor ecx, ebx
jmp 0x47ab9a
push 0x59b0ff82
shl esi, 0xc
mov edx, ebx
sub edx, 0x5e7550a3
rol edx, 0x14
xchg esi, edx
mov ecx, edx
ror ecx, 0x1d
mov ecx, 0x5e7660df
and ecx, edx
sub edx, ebx
mov ebx, edx
not ebx
xchg esi, ebx
jmp 0x47ad28
push 0x59bb8f12
add ebx, edx
and ebx, ecx
sub edx, 0x5e94e4f2
rol esi, 0xe
sub esi, 0x5e954f5c
xchg esi, edx
add esi, edx
add edx, ebx
mov ecx, esi
inc esi
rol edx, 5
xor edx, esi
add edx, ecx
or ebx, esi
ror esi, 0x1d
jmp 0x479fb2
call edi
sub ebx, esi
mov ebx, ecx
and esi, ecx
mov ebx, esi
or esi, 0x5ea994d2
jmp 0x4797d7
pop edi
mov edx, ecx
sub esi, ebx
sub ecx, esi
sub esi, ebx
mov ecx, 0x5ebca8b8
or ebx, edx
or edx, ebx
sub esi, edx
sub esi, edx
jmp 0x47abc2
call fcn.0047a202
dec ecx
xchg ecx, ebx
add esi, 0x5ebe47b0
and ecx, 0x5ebe7b49
mov edx, esi
sub edx, ebx
xchg ecx, edx
mov esi, ecx
or esi, ecx
xchg edx, ecx
or edx, esi
add edx, 0x5ec01d62
not edx
and ecx, 0x5ec08738
bswap ecx
and edx, ecx
jmp 0x47c7b8
call fcn.0047a202
mov ecx, ebx
xor ecx, edx
mov esi, 0x5ec63281
xor ecx, edx
and edx, ebx
xchg edx, esi
sub esi, ecx
jmp 0x47bfc7
pop edi
add esi, edx
mov ebx, ecx
or ebx, 0x5ecfa298
or ecx, esi
and edx, 0x5ed00b48
bswap esi
xor ebx, ecx
add ecx, ebx
mov edx, ebx
xor esi, ecx
xor esi, 0x5ed1484c
mov esi, 0x5ed17f92
or ebx, ecx
or ebx, 0x5ed1e4da
jmp 0x47c70a
mov edi, 0x2774562b
mov edx, esi
and ebx, esi
xchg ebx, esi
ror ecx, 4
sub ecx, edx
nop
inc edx
sub edx, 0x5eeb9308
and ebx, esi
xor edx, 0x5eebf85f
xor ecx, esi
and edx, ebx
sub ebx, edx
jmp 0x479608
mov edi, 0x123b2f04
and edx, ebx
sub ecx, esi
ror ecx, 0x13
mov esi, 0x5ef46358
and ecx, ebx
jmp 0x47b261
call fcn.0047a202
add edx, 0x5f1106de
mov esi, edx
mov esi, 0x5f116d7e
sub edx, ebx
jmp 0x47c362
pop edi
not esi
xchg ebx, ecx
xor esi, ecx
mov esi, ecx
xchg ebx, ecx
xor ecx, esi
jmp 0x478ad4
mov edi, 0x2774562b
mov edx, 0x5f550706
add esi, 0x5f553ac2
bswap edx
mov esi, edx
xor edx, ebx
and edx, esi
and ecx, edx
jmp 0x479c4a
push 0x59bf1b38
add edx, ebx
mov ecx, edx
mov esi, ebx
and esi, ebx
bswap ecx
sub edx, esi
shr edx, 0x17
jmp 0x47b0f0
push 0x59b62c67
shr edx, 6
add ecx, ebx
mov ecx, ebx
sub ebx, 0x5f5b8164
and ecx, edx
xor esi, ecx
mov esi, ecx
ror ecx, 2
add esi, edx
mov ebx, esi
or esi, ebx
sub edx, ecx
xor ecx, 0x5f5d52d6
jmp 0x47b1de
push 0x59b0a786
rol ebx, 0x1e
sub ecx, 0x5f6cc38d
mov edx, ebx
bswap ebx
xor ebx, esi
xor ebx, esi
xor esi, edx
not ebx
sub esi, 0x5f6e39f2
not esi
ror edx, 0xf
xchg edx, ecx
sub edx, ecx
jmp 0x47c870
jmp loc.0048139a
push 0x59b2808d
xchg ebx, esi
sub esi, ecx
and esi, 0x5f8418ce
xchg edx, ebx
jmp 0x479434
push 0x59b256a9
xchg edx, ecx
and edx, 0x5f8a2a1d
add esi, ebx
or ecx, ebx
or esi, 0x5f8ac267
and edx, esi
xor ecx, edx
xor ebx, ecx
add ecx, esi
and ebx, ecx
inc ecx
sub esi, 0x5f8c35e8
rol ecx, 0x15
jmp 0x479b70
call fcn.0047a202
mov edx, esi
xor esi, 0x5f9087d0
xchg edx, ebx
and ecx, esi
add ebx, edx
add esi, ecx
and esi, ebx
mov edx, ebx
add esi, ebx
mov ebx, ecx
xchg esi, edx
sub ebx, esi
jmp 0x47beff
pop edi
mov ecx, 0x5f9fcdec
and ebx, 0x5fa001c8
xor esi, edx
shl esi, 0x10
and ebx, esi
xchg edx, ecx
xor edx, esi
and ebx, ecx
sub esi, edx
shr ebx, 0xa
jmp 0x47ad0f
push 0x59c04e24
xchg edx, esi
and ebx, esi
xor ecx, ebx
sub ecx, edx
and ebx, edx
jmp 0x47ac7d
mov edi, 0x123b2f04
xchg ecx, edx
xor ecx, ebx
bswap ecx
or ecx, ebx
mov ecx, 0x5fdbe577
rol ecx, 7
mov esi, ecx
and ebx, 0x5fdc7f37
or ebx, edx
jmp 0x4791a8
push 0x59b682b7
sub ecx, edx
or ebx, 0x5feb062f
or ecx, ebx
xor edx, ecx
mov ebx, ecx
and edx, ebx
mov ebx, 0x5ff0c3a8
jmp 0x478fcd
pop edi
add ecx, ebx
or esi, edx
xor ecx, esi
shl esi, 0x14
and ecx, 0x5ffad238
inc ebx
xor ebx, esi
xor ebx, esi
jmp 0x47c226
push 0x59bd6c61
inc esi
neg ebx
xchg ecx, edx
add ebx, ecx
and ebx, esi
or ebx, esi
mov esi, 0x60138646
neg ebx
jmp 0x478bdf
pop edi
or ecx, esi
rol ecx, 6
or esi, 0x60b1f13d
add edx, 0x60b2315b
mov ebx, edx
not ebx
shr edx, 0x17
add esi, ecx
not esi
jmp 0x47c744
pop edi
or ecx, 0x60b87b96
dec edx
shr ebx, 0x17
mov esi, ecx
mov ebx, 0x60b94be4
xchg edx, esi
add esi, ebx
jmp 0x47aa7d
pop edi
xchg esi, ebx
or esi, ebx
or esi, ecx
xor ebx, 0x60d68c66
neg esi
sub edx, esi
or esi, 0x60d7391d
xor edx, 0x60d76c94
or esi, 0x60d7a038
ror edx, 0x10
sub ebx, 0x60d80a32
mov ecx, esi
and ecx, 0x60d87173
jmp 0x47beba
pop edi
sub ecx, edx
not ebx
rol ecx, 6
mov ecx, 0x60f37d94
xor ebx, ecx
mov ecx, 0x60fa090d
sub edx, esi
xor ebx, 0x60fa77ed
and edx, esi
add ecx, edx
add esi, edx
inc ebx
jmp 0x47a9ab
pop edi
ror edx, 0x1d
add ebx, esi
not ecx
and ecx, edx
mov esi, ebx
mov ecx, 0x60fc9976
sub ecx, 0x60fccd16
shl esi, 0xa
and ebx, edx
or esi, ebx
jmp 0x47bf5e
push 0x59c0780b
or ebx, ecx
ror ecx, 5
neg edx
shr esi, 4
shl ebx, 4
sub edx, ebx
sub edx, 0x610c7495
or edx, 0x610cab89
mov ebx, ecx
jmp 0x47c27a
pop edi
not esi
xor edx, ecx
and edx, ecx
add ecx, esi
ror ecx, 0x15
and esi, 0x611520c8
xchg ecx, esi
jmp 0x47b6f2
mov edi, 0x123b2f04
add ebx, edx
sub ecx, edx
inc ecx
neg esi
xor edx, esi
not ebx
jmp 0x4791e1
pop edi
and esi, edx
or esi, edx
ror edx, 0x10
xchg ebx, ecx
xchg ebx, ecx
add ecx, 0x6158cfd5
add ecx, edx
jmp 0x47a0fe
pop edi
and edx, esi
mov ebx, esi
mov edx, esi
mov ebx, 0x6187fc8a
xchg edx, ebx
dec ebx
dec esi
bswap ecx
xchg ecx, edx
jmp 0x479bd9
mov edi, 0x123b2f04
sub ebx, esi
dec edx
rol ecx, 0xe
xchg esi, ecx
xchg ebx, esi
or ebx, esi
mov ebx, edx
mov edx, esi
sub edx, esi
sub edx, esi
rol ebx, 0xf
jmp 0x47882a
push 0x59b4ad4b
or esi, 0x6195f93a
and ecx, edx
neg edx
and ebx, 0x61982bf5
or edx, ebx
xchg edx, esi
jmp 0x47890f
push 0x59b65954
ror esi, 1
and ebx, edx
sub esi, 0x61a5e6b9
and ebx, 0x61a61ab0
xor ebx, ecx
add esi, ebx
dec ecx
mov edx, 0x61a6f450
jmp 0x47a092
push 0x59bd43dc
xchg esi, edx
sub esi, edx
dec esi
xchg ebx, esi
or esi, edx
jmp 0x47a1e6
call fcn.0047a202
add ebx, esi
sub ebx, edx
and edx, ecx
ror edx, 0x1f
xor esi, edx
add esi, edx
add edx, ebx
and esi, ecx
or ebx, ecx
mov ebx, esi
mov ebx, esi
mov ecx, edx
jmp 0x47c55d
push 0x59c02596
xor esi, ecx
and ecx, 0x61ba87a8
bswap edx
and edx, ebx
add esi, edx
add ebx, ecx
jmp 0x479f32
push 0x59b37e12
ror ecx, 0x13
or ecx, esi
sub ecx, 0x61feb1ef
ror edx, 0x14
sub ecx, ebx
add ecx, esi
or edx, ebx
xor esi, 0x620a2c85
xchg esi, ebx
jmp 0x47c332
call fcn.0047a202
bswap edx
shr ebx, 0x1d
add edx, esi
or ebx, 0x620e9f24
bswap edx
shr edx, 0x1f
xchg ecx, esi
neg ecx
add edx, esi
sub esi, 0x620fe76a
rol ecx, 7
xor edx, 0x6210514f
jmp 0x47b9a5
call edi
nop
ror ecx, 6
shr edx, 5
or ebx, ecx
or ebx, ecx
shr esi, 5
sub ecx, edx
add esi, 0x6248b2ad
shr ebx, 0xb
jmp 0x479183
pop edi
and ebx, ecx
sub ecx, edx
xor edx, ebx
xchg esi, edx
not ecx
add ebx, ecx
bswap ecx
and ebx, esi
sub edx, ebx
xchg esi, ebx
jmp 0x47af86
push 0x59beee4b
and edx, ecx
ror ecx, 0x19
add esi, 0x62c32426
rol esi, 0x11
shl ebx, 0xe
mov ecx, ebx
ror esi, 0x18
dec edx
mov edx, ebx
inc ecx
jmp 0x47988d
call edi
sub ebx, esi
not esi
sub esi, ebx
sub esi, 0x62c7e121
shl edx, 0xc
mov edx, ecx
mov esi, ebx
dec ecx
ror ecx, 0x15
and esi, ecx
ror esi, 0x14
and ecx, esi
jmp 0x47898f
push 0x59b60356
sub esi, 0x62ce30aa
and ebx, 0x62ce6461
inc edx
jmp 0x4798ca
call edi
shr ecx, 0xa
dec esi
shr ebx, 0x1e
shl ebx, 0x1b
or ecx, esi
jmp 0x47a931
push 0x59bd1753
shl esi, 0x15
or edx, 0x6300f982
xor ecx, 0x63012cef
xor esi, ecx
xor edx, 0x6301a1aa
and esi, 0x6301d56f
mov ebx, ecx
or ecx, 0x6302385b
jmp 0x47b203
mov edi, 0x2774562b
and edx, 0x63047ad9
sub ecx, ebx
shl edx, 0x19
or esi, 0x63052598
or ecx, ebx
add edx, esi
mov ebx, ecx
or ebx, 0x6305ec92
shr ebx, 0x10
jmp 0x479a27
push 0x59b3abc4
and edx, ebx
and edx, ebx
mov edx, 0x631f4118
mov edx, ebx
add ebx, ecx
or esi, edx
and esi, edx
dec edx
jmp 0x47986e
call edi
ror esi, 0x1a
xor edx, esi
not ebx
shr ebx, 6
shr esi, 0xf
ror edx, 1
mov ecx, esi
mov ebx, 0x6326d3fd
sub edx, esi
jmp 0x478d68
call edi
or ebx, ecx
sub esi, 0x634b86e7
or ebx, edx
bswap ecx
sub esi, ecx
add edx, 0x634c604d
jmp 0x479d52
pop edi
sub edx, ecx
sub ecx, esi
and ebx, 0x6369ab6b
inc esi
shl esi, 7
or edx, ebx
and edx, ecx
sub edx, ebx
mov esi, edx
or esi, edx
shr esi, 0x19
and ebx, 0x636c2429
jmp 0x47b9c5
pop edi
xor esi, 0x6373d534
sub edx, ebx
xor ecx, edx
neg ecx
mov esi, 0x6374a7d4
sub ecx, esi
xchg edx, esi
ror ecx, 0x12
jmp 0x47c78e
pop edi
and ebx, edx
or esi, ebx
or ecx, 0x6379d999
shl edx, 0xe
xchg ecx, esi
add ecx, esi
mov esi, edx
or ecx, edx
mov ecx, ebx
or edx, ebx
add ebx, ecx
add esi, edx
dec ecx
add edx, 0x6382be70
jmp 0x47b0d7
call edi
and esi, edx
not ebx
inc edx
shr edx, 0x1e
mov esi, edx
and edx, 0x63841627
jmp 0x47923f
push 0x59b0d5c3
sub edx, 0x63913d26
or ebx, esi
nop
xor esi, edx
rol ebx, 0x19
and ebx, ecx
mov ecx, 0x6392e8e5
rol esi, 0x10
neg esi
or ecx, edx
xchg esi, ecx
shl esi, 0x10
jmp 0x478dae