Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Receive data
Receive data on socket

Disassembly:
mov edi, 0x42b16dfd
xchg esi, ecx
sub esi, 0x42b25844
nop
call sub.kernel32.dll_GetCurrentProcess
xor edi, esi
xchg esi, ecx
mov ecx, esi
ror edi, 0x16
shl edx, 0xc
xchg esi, ecx
shl edx, 0xb
xchg ecx, esi
cmp eax, 0xffffff22
jne 0x401087
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
ret
shr edi, 0x1f
dec ecx
shl edi, 0x1e
xchg esi, ecx
or edi, ecx
mov ecx, edi
sub esi, edi
call sub.kernel32.dll_GetCurrentProcess
sub edx, ecx
cmp eax, 0xffffff14
jne 0x40112b
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
ret
and edi, 0x42e563de
dec esi
dec esi
or edi, esi
call sub.kernel32.dll_GetCurrentProcess
sub edx, ecx
or edi, ecx
sub edx, edi
mov ecx, esi
or edi, 0x42f95ec8
and edx, ecx
cmp eax, 0xfffffed5
jne 0x4011d3
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
ret
or edi, esi
or ecx, edi
sub edx, 0x4300d06b
xor ecx, edx
sub esi, edx
sub edi, edx
sub edi, ecx
call sub.kernel32.dll_GetCurrentProcess
add edx, esi
mov edx, edi
ror edx, 3
bswap esi
xor edi, esi
cmp eax, 0xffffff06
jne 0x401283
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_RtlAppendAsciizToString
call sub.ws2_32.dll_WSARecv
call sub.ntdll.dll_ZwInitiatePowerAction
call sub.ntdll.dll_ZwInitiatePowerAction
ret
jmp 0x494365
xor esi, 0x46b73536
sub edx, edi
shl esi, 0x17
rol esi, 0x18
and esi, 0x46b83502
xor ecx, esi
sub edx, ecx
shl esi, 1
jmp 0x494744
jmp loc.0049a000
push 0x46bc892b
not edi
or edi, esi
ror esi, 0xa
shr ebx, 1
mov ecx, edi
dec ecx
ror ebx, 0x1e
jmp 0x496505
push 0x46bee406
sub esi, ebx
bswap esi
xchg ecx, esi
mov ecx, edi
add ebx, 0x4f27c2c2
mov ecx, edi
shr ebx, 9
and esi, ecx
xchg esi, ebx
and ecx, 0x4f28fc7c
jmp 0x4965a7
call edx
and edi, 0x4f2f546e
or esi, 0x4f2f92bf
add esi, ecx
mov esi, ebx
dec ecx
add edi, ecx
sub esi, edi
jmp 0x496bb1
call fcn.00495cbc
neg esi
mov esi, edi
sub esi, ebx
or ecx, ebx
sub ecx, 0x50526c89
shr ebx, 4
add ebx, ecx
xor ecx, 0x50532211
xor ebx, ecx
mov ebx, edi
xchg esi, edi
and ecx, ebx
jmp 0x49494c
push 0x46bdac85
inc edi
shr ebx, 0x1b
or edi, ecx
bswap esi
shl edi, 0x1b
jmp 0x496a8f
pop edx
not edi
mov esi, edi
xor ebx, edi
or ebx, 0x52d812c4
and edi, 0x52d8865d
xchg ebx, edi
or ebx, 0x52d97e92
jmp 0x496f1e
mov edx, 0x2774562b
xor esi, ebx
xchg ecx, esi
dec ebx
add esi, edi
and edi, ebx
add edi, esi
add esi, edi
xor esi, ecx
xor ecx, esi
sub edi, ebx
xchg ebx, esi
dec edi
rol edi, 0xe
jmp 0x496918
push 0x46beb9ae
mov ecx, esi
mov edi, 0x53bdd872
sub ebx, 0x53be5288
dec edi
shr ecx, 0x17
sub esi, ebx
ror esi, 2
sub esi, ecx
sub ebx, edi
add edi, 0x53c18c64
jmp 0x4948d5
mov edx, 0x123b2f04
and edi, ecx
sub ecx, edi
xchg ebx, esi
shl ecx, 5
or edi, ecx
neg ebx
neg esi
inc ecx
or ebx, ecx
sub ebx, edi
mov ebx, 0x53cd4c5c
not edi
jmp 0x494491
call edx
ror ecx, 5
shr edi, 0xb
neg edi
xor ebx, ecx
xor edi, esi
sub ebx, 0x53d4038a
mov edi, 0x53d479fd
and ebx, ecx
neg ebx
inc edi
jmp 0x4960e5
call fcn.00495cbc
or ebx, esi
shr ebx, 0x14
or edi, 0x544e6427
sub ebx, ecx
xchg esi, edi
mov ebx, ecx
jmp 0x4965e1
mov edx, 0x123b2f04
sub edi, esi
xor ecx, edi
xchg edi, ebx
dec esi
not edi
sub edi, ecx
xchg edi, esi
sub edi, ebx
neg esi
jmp 0x494e74
pop edx
and ecx, ebx
or esi, edi
and esi, ebx
and edi, ebx
xchg esi, ecx
and ebx, 0x54ad1b48
mov ebx, esi
add esi, edi
or ecx, ebx
or ebx, ecx
jmp 0x496c02
pop edx
add edi, ebx
xor ecx, 0x54b59b64
xor edi, ecx
shl esi, 0x18
and edi, ebx
jmp 0x49654d
push 0x46bd808f
and ecx, edi
or edi, ecx
sub edi, ecx
xchg esi, ecx
add ecx, esi
mov ebx, 0x552a9d08
and ebx, edi
or ebx, 0x552b8dbe
ror esi, 7
add esi, ebx
or ebx, edi
mov ecx, ebx
add ecx, ebx
jmp 0x495c22