Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api

Disassembly:
call sub.user32.dll_GetClipboardViewer
cmp eax, 0xffffff0f
jne 0x401089
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
ret
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp eax, 0xffffff06
jne 0x4010ea
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xfffffeea
jne 0x401173
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xfffffef1
jne 0x4011e3
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xffffff1c
jne 0x401244
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.ntdll.dll_RtlIsActivationContextActive
call sub.kernel32.dll_SetCriticalSectionSpinCount
call sub.kernel32.dll_GetProcessShutdownParameters
call sub.kernel32.dll_SetCriticalSectionSpinCount
ret
jmp 0x49512e
sub ecx, edx
and edi, ebx
dec edx
sub ebx, ecx
bswap ecx
jmp 0x49563a
call fcn.004960c6
add esi, ecx
bswap ecx
and edi, esi
and edi, edx
and esi, 0x93597cd3
add edx, ecx
and edx, esi
and esi, edi
inc ecx
jmp 0x4970f3
mov ebx, 0x2774562b
or esi, edi
not edi
or ecx, edi
neg ecx
shr esi, 0x17
neg edi
dec ecx
xor esi, edx
and ecx, 0x93625341
xchg edx, ecx
jmp 0x495169
push 0x901d35f7
xor esi, ecx
xor ecx, esi
shr edx, 0xd
mov edx, esi
and edx, edi
sub esi, ecx
and edi, esi
not edx
mov ecx, 0x93aeaf6a
add esi, ecx
add edi, 0x93af1639
not esi
jmp 0x496ff6
jmp loc.0049d000
pop ebx
bswap edx
add esi, 0x94324dc0
and edx, edi
or ecx, edx
or esi, ecx
dec edx
and edx, 0x94335eb3
sub edx, ecx
sub ecx, edx
shl edx, 4
jmp 0x4964b6
push 0x90201998
and edx, esi
or esi, edx
and edx, ecx
mov edx, edi
dec ecx
xchg esi, ecx
add edi, esi
and edi, 0x9499506a
sub esi, 0x9499b453
sub edx, edi
and esi, ecx
dec ecx
sub edx, 0x949b37e4
or esi, edx
jmp 0x496254
push 0x90204432
neg ecx
xor edx, esi
jmp 0x496e16
pop ebx
not esi
ror ecx, 0x12
inc edx
xor ecx, edi
add esi, edi
mov ecx, 0x9528458b
jmp 0x495fee
pop ebx
sub esi, edx
mov ecx, esi
mov edx, edi
add esi, 0x953ac1e2
and ecx, esi
and ecx, 0x953b28c7
sub esi, 0x953b5d8a
and esi, edi
jmp 0x4963ca
pop ebx
sub esi, 0x957fca12
or ecx, esi
mov esi, edx
dec edx
bswap esi
nop
sub edi, ecx
neg esi
add edi, 0x95830b40
xor edi, edx
and edx, ecx
mov edi, 0x95842679
jmp 0x495bf2
push 0x902072b0
sub edi, esi
mov esi, ecx
xor ecx, esi
xchg esi, edi
mov ecx, edi
add edx, 0x9629477e
neg edi
sub esi, edx
jmp 0x4980f3
push 0x901d9501
xor esi, edi
xor esi, ecx
or edx, esi
shl esi, 0x14
xor esi, ecx
shl edi, 0x18
rol edi, 0x1c
and edi, edx
mov edx, ecx
mov ecx, edx
add esi, 0x964d8eb9
sub ecx, edi
jmp 0x497466
call ebx
sub ecx, edi
xor edi, 0x9661dedf
neg edi
and edi, edx
mov edx, 0x96627bdf
rol esi, 0xa
bswap esi
or edx, esi
xchg edi, ecx
xor edx, esi
jmp 0x49668e
push 0x901de62a
ror esi, 0x11
rol edi, 8
sub esi, 0x96dc8f1e
xor edi, edx
or esi, ecx
xor edi, 0x96ddc81d
mov edi, edx
add edx, ecx
and edi, 0x96dee806
not ecx
xchg ecx, esi
neg esi
and edx, ecx
jmp 0x4981c3
mov ebx, 0x2774562b
xor edx, 0x983ccd3f
xchg edx, ecx
bswap edi
and ecx, esi
or ecx, edi
xchg ecx, edi
or ecx, 0x983e07f8
add ecx, esi
and edi, ecx
xor esi, 0x983eab65
sub edi, 0x983edff1
xchg edx, ecx
or edi, ecx
add edx, edi
and edx, 0x983fd06f
jmp 0x495ab6
push 0x901e3443
and edi, edx
mov edx, 0x984ac747
rol ecx, 0xc
or ecx, 0x984b2d57
or edi, esi
xor esi, 0x984b9470
nop
xchg edx, ecx
sub esi, edx
and edx, edi
sub ecx, edi
mov esi, 0x984ed454
xchg esi, edi
jmp 0x4951f9