Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetProcessWindowStation
cmp eax, 0xfffffeef
jne 0x40108e
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.shell32.dll_ExtractIconExA
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
ret
call sub.user32.dll_GetMenuCheckMarkDimensions
cmp eax, 0xffffff21
jne 0x401112
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
ret
call sub.user32.dll_GetClipboardOwner
cmp eax, 0xffffff02
jne 0x401187
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
ret
call sub.user32.dll_GetClipboardOwner
cmp eax, 0xffffff1e
jne 0x401206
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.shell32.dll_ExtractIconExA
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
call sub.kernel32.dll_GetNumberOfConsoleInputEvents
call sub.ntdll.dll_RtlQueryProcessBackTraceInformation
ret
jmp 0x475641
mov esi, 0xd49269e2
jmp 0x4781bb
push 0xd49eda89
mov ebx, edx
mov esi, 0xdac92f1a
xchg esi, ebx
not esi
xchg ebx, edi
jmp 0x4779b2
push 0xd4aa0e7f
xor esi, 0xdada4062
nop
mov edx, 0xdadaaa30
shr ebx, 0x15
add edi, edx
mov edx, esi
neg edi
dec edx
add edi, ebx
dec ebx
add esi, ebx
jmp 0x476279
push 0xd4aa3ae4
sub edi, ebx
sub edi, 0xdb0017df
mov edx, edi
mov esi, edi
and esi, 0xdb014d53
add edx, 0xdb01b0df
xor ebx, edx
sub edx, edi
mov ebx, edx
jmp 0x477280
mov ecx, 0x123b2f04
mov esi, edi
xchg edi, edx
shr edi, 7
add edx, edi
or esi, edx
xor ebx, esi
jmp 0x476950
push 0xd49da6df
and edx, 0xdb5ddaf6
sub edi, 0xdb5e0e48
xchg esi, edi
dec edi
xor esi, edi
bswap esi
inc edx
and ebx, edx
add esi, edi
jmp 0x4762e0
call ecx
and edi, esi
or edi, esi
sub edi, esi
xchg edi, edx
jmp 0x478233
call fcn.00476a89
not edx
shr edx, 0x11
and edi, esi
sub edx, edi
jmp 0x477d76
pop ecx
sub edx, ebx
rol edx, 3
mov esi, edx
add edi, 0xdbc45d43
or edi, edx
sub ebx, esi
rol edx, 2
jmp 0x476a29
pop ecx
add edx, 0xdbc5538b
add edx, esi
and ebx, esi
xor ebx, edx
xor edi, edx
xchg ebx, edi
sub edx, esi
xor ebx, 0xdbc6c2f4
add edi, 0xdbc6f71c
jmp 0x477c45
mov ecx, 0x123b2f04
mov edx, esi
xchg ebx, edx
or edx, 0xdc8edc2d
xchg ebx, edi
dec esi
neg edi
sub ebx, edi
jmp 0x477474
jmp loc.0047b59a
push 0xd49d7c65
sub ebx, esi
add esi, ebx
dec edx
add edx, esi
sub edi, esi
xchg ebx, edi
and edx, esi
and ebx, edx
or edi, 0xdcdaa209
jmp 0x4765e4
call fcn.00476a89
xor ebx, edx
or ebx, edx
sub esi, edi
xor ebx, edi
shr edx, 0xc
mov ebx, edx
inc esi
mov edx, ebx
and esi, 0xdd34c067
mov esi, edx
and esi, edi
add esi, ebx
rol edi, 0x1b
inc esi
jmp 0x476892
mov ecx, 0x2774562b
sub edi, ebx
sub ebx, esi
bswap edx
neg edx
and esi, edx
jmp 0x47789d
pop ecx
not esi
sub edx, ebx
bswap ebx
xor edx, 0xdd845085
xor edx, esi
sub ebx, edx
or edx, ebx
ror edi, 2
shr ebx, 0xa
mov edx, ebx
mov edi, esi
xchg esi, ebx
dec edx
and edi, 0xdd865c32
and edi, ebx
jmp 0x476037
call ecx
shr edi, 0xa
mov edx, ebx
add esi, 0xdda431d1
or edx, esi
sub edx, edi
mov ebx, edi
ror ebx, 0xe
ror edi, 0x11
jmp 0x476a0f
push 0xd49d477b
or edx, ebx
sub edi, esi
and edx, edi
and ebx, esi
xor edi, esi
inc edx
neg ebx
or esi, edx
rol edx, 5
mov ebx, edi
sub edx, 0xde1117fa
xchg esi, edi
jmp 0x477523
pop ecx
mov esi, 0xde1b8d15
inc edx
xor esi, 0xde1bf6c1
xor edx, 0xde1c2de6
add edx, esi
sub edx, edi
xor edx, ebx
shr edi, 0x14
mov edi, 0xde1d3a91
sub esi, edi
jmp 0x4760d7