Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xffffff2f
jne 0x401061
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
ret
call sub.kernel32.dll_GetCommandLineW
cmp eax, 0xffffff15
jne 0x4010d6
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
ret
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xffffff11
jne 0x401173
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
ret
call sub.kernel32.dll_GetCommandLineW
cmp eax, 0xfffffed6
jne 0x4011de
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
ret
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xfffffeec
jne 0x401244
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
call sub.advapi32.dll_RegCreateKeyA
ret
jmp 0x494fb7
and esi, 0xaa6a8152
jmp 0x497879
call fcn.00498418
inc ecx
xor edi, edx
shl edx, 0xd
jmp 0x49673c
pop esi
xchg ebx, edi
shr ecx, 5
and edx, 0xacf3702e
not ebx
or edx, ecx
and ebx, 0xacf40305
or edi, 0xacf43f08
shl edx, 9
xor ecx, edx
mov ebx, ecx
xor ebx, ecx
jmp 0x496886
push 0xaa754aec
inc ecx
or ebx, 0xad0865ba
mov ebx, edx
jmp 0x495b06
pop esi
or edx, ebx
inc edx
shl edi, 0x15
xor ebx, edi
or edi, edx
mov edx, 0xad1013d1
jmp 0x4984f5
push 0xaa759b01
and edx, ebx
xor edx, ecx
xchg edi, ebx
jmp 0x497536
pop esi
sub edi, 0xad18b1b3
sub ecx, edi
xor ebx, edx
mov edx, edi
add edi, edx
sub ecx, edx
add ecx, edx
bswap edx
xchg ecx, edx
sub ebx, edi
xchg ecx, ebx
add edi, 0xad1acbcb
xor ebx, edx
xchg ebx, edx
jmp 0x4978c0
mov esi, 0x183c2e20
mov ebx, ecx
mov ebx, ecx
or edi, 0xad2eac2e
add edx, ecx
or ecx, edi
mov ebx, edi
xor edx, 0xad2f6fb6
xchg ebx, edx
xor ecx, ebx
sub ebx, ecx
xor ecx, edi
jmp 0x49531d
call fcn.00498418
and edx, ebx
bswap edi
mov ecx, edi
add ebx, edi
rol edi, 0x17
mov ecx, edx
mov ebx, edi
and ebx, edi
mov edx, ecx
jmp 0x49745c
push 0xaa72b5f4
and edx, ecx
mov ebx, edx
shl ebx, 0x1a
xor edi, edx
or ebx, 0xad3304b9
xor ebx, edx
or ebx, edx
sub ecx, ebx
and ecx, 0xad33d0a7
mov ebx, ecx
and edx, 0xad342e02
inc edx
add edi, ebx
jmp 0x497ddd
call esi
xchg edi, ecx
and ebx, edi
and edi, edx
mov edi, ecx
rol ebx, 0x1f
jmp 0x49559f
push 0xaa6f5f6e
and ebx, edi
bswap ebx
ror edx, 0x1e
mov edx, edi
xchg ebx, ecx
nop
mov edi, ebx
or ecx, edi
shr ecx, 0x18
jmp 0x4974fd
call fcn.00498418
sub ecx, edx
xchg edx, ecx
xor ebx, edi
bswap edx
add edi, ebx
dec ebx
and ebx, edx
jmp 0x496dec
push 0xaa757321
xor ecx, ebx
add edx, ebx
and ecx, edi
xor ecx, 0xad60ab30
sub ebx, 0xad60ddad
sub ecx, 0xad610ef1
nop
xchg ebx, edx
jmp 0x4955b4
mov esi, 0x183c2e20
or ebx, edx
xchg ebx, edi
and edi, edx
add ecx, edi
xor edx, ebx
inc edi
bswap edx
or ecx, 0xad71ad2e
mov edi, ebx
jmp 0x4981d3
pop esi
sub edi, ebx
and edx, ecx
add edi, ecx
xor ecx, ebx
inc edx
or edi, edx
jmp 0x498085
push 0xaa7112ca
xchg ebx, ecx
add ecx, edx
xor ecx, edx
bswap ebx
add ebx, ecx
or edx, ebx
shr ecx, 0x14
ror ebx, 0xf
jmp 0x497bca
call fcn.00498418
xor edi, edx
xor edx, ecx
mov edx, 0xada39604
shr edx, 0x17
add ecx, ebx
jmp 0x4977bc
pop esi
and edx, ecx
bswap ebx
and edi, ecx
mov ebx, ecx
and edx, 0xadc3cb5e
mov ecx, edi
neg edx
not ebx
bswap edx
mov edi, 0xadc4cc86
xchg edx, ebx
neg ebx
add edi, edx
jmp 0x497b07
pop esi
add edx, edi
sub ecx, 0xaddb172d
sub ebx, 0xaddb49d4
mov edi, ebx
mov ecx, edi
add ebx, ecx
or edx, ebx
xchg edi, ecx
jmp 0x4965f0
push 0xaa7424d3
ror edx, 0x1c
shl edx, 4
xor ecx, edx
xchg ebx, edx
and edx, edi
and edi, ebx
mov edi, 0xadf1d131
mov edi, edx
add edi, ebx
jmp 0x4957ad
pop esi
rol ecx, 0x1f
or ebx, ecx
inc edx
or edx, edi
mov ebx, 0xadfe50cb
or ebx, edx
add edx, ecx
sub edx, 0xadfee9ca
jmp 0x4953c6
push 0xaa6f37b8
xchg edx, ebx
xor ebx, ecx
xchg edi, ecx
not ebx
shl edi, 0xb
xchg edx, ebx
xor edx, ebx
xchg ebx, ecx
xor ebx, edx
xchg ebx, ecx
jmp 0x495ab2
call esi
xchg edi, ecx
xor ecx, ebx
xchg edx, edi
sub edx, edi
mov edx, ecx
xor edi, edx
inc ecx
mov edx, ecx
jmp 0x4964f2
mov esi, 0x183c2e20
xor ebx, ecx
shr edi, 0x18
shl ecx, 6
mov ebx, edx
mov ebx, 0xae2b0525
sub ecx, edi
or ebx, edx
shl edx, 7
jmp 0x4957d5
push 0xaa751f57
xchg edi, edx
or edx, 0xae3419d2
or edi, edx
inc edi
and edx, 0xae34ac2a
nop
mov edi, ebx
sub edi, ebx
or ebx, ecx
and edx, 0xae35a8a4
or ebx, edx
jmp 0x49550c
pop esi
neg edi
xchg ebx, edi
add ecx, edx
and ebx, ecx
add ecx, ebx
mov ecx, ebx
sub ecx, edx
mov edx, ecx
neg ecx
jmp 0x4977ec
call esi
xchg edi, edx
xor edi, edx
and ecx, edi
xor edi, edx
xor edx, ebx
mov ecx, ebx
mov ecx, edx
inc ecx
xchg edx, edi
and ebx, edi
jmp 0x495c47
push 0xaa73fbf2
and edi, 0xae94869e
and edi, edx
nop
xchg ebx, ecx
sub ecx, edi
xor edx, 0xae95794d
add edx, 0xae95b5c3
or edi, ecx
not edi
and edi, ecx
xchg ecx, edx
not ebx
mov ecx, 0xae96e240
bswap edi
jmp 0x496419
push 0xaa72386c
mov ecx, ebx
not ecx
xor ebx, edx
add edi, ecx
neg ecx
or edi, edx
not ecx
and edi, 0xaec9c524
not edi
xchg edi, ebx
jmp 0x4975b9
call esi
xchg edi, edx
xor ebx, 0xaee1a9f5
or edx, 0xaee1dac4
xchg ebx, edx
rol edx, 5
ror ecx, 7
rol edi, 0xd
inc edx
neg ecx
and ecx, edi
jmp 0x49564b
call fcn.00498418
and ebx, 0xaee8159a
xor ebx, edx
not ebx
mov edi, 0xaee8b36a
mov edi, ebx
shl edx, 0x1b
rol ecx, 0xe
not ecx
mov ecx, ebx
jmp 0x4979e5
mov esi, 0x183c2e20
add ebx, edx
add edx, ecx
sub ebx, ecx
rol ecx, 0xf
xor ebx, ecx
and ecx, edx
xchg edx, ecx
add ecx, edi
and edi, edx
dec edx
jmp 0x4974d8
push 0xaa75c59e
xchg ebx, edx
xchg edi, ebx
and ebx, edx
jmp 0x495c28
push 0xaa70e843
sub edi, 0xaef1a16b
neg edx
shl edi, 0x1f
and edx, 0xaef23795
and edi, ebx
add ecx, edi
ror ebx, 0x12
or edi, 0xaef32052
mov ebx, ecx
mov edi, ecx
or edx, ebx
jmp 0x495eab
push 0xaa72615c
add edx, ecx
sub ecx, edi
and ecx, edi
or edi, ebx
xchg ebx, ecx
inc edi
sub edx, 0xaef518c9
sub ecx, edx
shr edx, 0x17
mov ecx, edi
xchg ecx, edx
dec edx
and ebx, edi
shr edi, 0xf
inc ecx
add edi, ebx
jmp 0x497d03
call fcn.00498418
xor ecx, edx
and ecx, 0xaefc1c80
and edi, ebx
xor ecx, edi
or edi, ecx
or ebx, 0xaefce7a0
xchg edx, ebx
mov edi, ebx
sub edi, ecx
jmp 0x495983
call esi
mov ebx, 0xaf135617
xchg edx, ecx
or edi, ecx
or ebx, 0xaf13e701
or edx, ecx
ror edi, 0x1b
add edi, ecx
sub ecx, 0xaf14a9de
ror edx, 7
sub edx, 0xaf151795
xor edx, ecx
add ecx, edx
jmp 0x496298
pop esi
and edi, ecx
add edi, 0xaf160aae
or edx, ebx
shl edi, 0x10
rol edi, 0x18
xchg ecx, edx
or ecx, edx
mov edx, edi
or ecx, edi
bswap ebx
not edx
xchg ecx, ebx
and edx, 0xaf182ed9
sub ebx, edi
jmp 0x496f26
push 0xaa6d85dc
mov ecx, edi
sub ecx, ebx
and edi, 0xaf1f3ad2
add ecx, edi
add ebx, ecx
add edx, ecx
mov ebx, 0xaf1ff6f5
dec ecx
add ebx, edi
jmp 0x4967da
push 0xaa6e6827
dec edi
mov ecx, 0xaf231f0d
inc ebx
or ebx, edx
jmp 0x4978d3
mov esi, 0x43370267
mov ecx, edx
sub edx, edi
mov ebx, edi
add edx, edi
add edx, ecx
xchg edx, ecx
mov edi, 0xaf250a15
mov ecx, edi
and ecx, edx
xor ebx, ecx
and edi, 0xaf25d5f6
neg ecx
and ecx, ebx
xchg edx, ebx
not edx
and ebx, ecx
jmp 0x495f58
call esi
mov ecx, edx
and edx, edi
neg edx
xchg edx, edi
or ecx, ebx
and ecx, 0xaf35c9e5
rol ebx, 0x17
ror ecx, 0x1d
mov edi, ecx
sub ecx, edx
add edx, edi
or edx, ecx
jmp 0x497a8c
pop esi
mov ebx, ecx
ror edi, 0x17
and edi, ebx
rol ebx, 0x1c
mov ebx, 0xaf407746
add edi, edx
add edx, edi
xchg ebx, edx
mov ecx, edi
add ebx, ecx
sub edx, edi
add edi, 0xaf42e6b0
mov edi, edx
add edi, edx
or ecx, edx
jmp 0x496186
push 0xaa70bec3
sub edi, 0xaf48a91a
or edx, ecx
xor edi, 0xaf490a53
shr ebx, 0xb
xor ebx, 0xaf49783b
and edx, ecx
jmp 0x49758b
mov esi, 0x183c2e20
mov edi, ecx
and ecx, ebx
or edi, ecx
shl edx, 0x18
mov ebx, edi
jmp 0x495aef
pop esi
bswap edi
add ebx, edi
xor edi, ebx
sub ebx, 0xaf63af56
inc edx
shr ecx, 0x19
inc edi
xchg ecx, edx
xchg edx, edi
sub edi, ecx
jmp 0x4972a0
push 0xaa728b64
and edx, ebx
add ebx, 0xaf67227a
xchg edx, ebx
jmp 0x4957f2
mov esi, 0x183c2e20
sub ebx, ecx
and edi, ebx
ror ebx, 0x1f
add edi, 0xaf730b72
and edi, ebx
xor edi, 0xaf73774d
shr ebx, 0x1c
jmp 0x497635
pop esi
add ebx, edi
or ebx, ecx
sub edx, ebx
xor ebx, 0xaf98886e
add edx, 0xaf98ba87
and edi, edx
jmp 0x497cc5
jmp loc.0049d025
pop esi
add edx, ebx
or ecx, ebx
add ecx, ebx
or edx, ecx
not edx
rol ebx, 0xb
and edi, 0xafda7104
ror ecx, 9
and ecx, edi
and edx, edi
xor ebx, 0xafdb3dc2
xchg edx, edi
neg edx
sub edi, ebx
and ebx, edi
jmp 0x496d39