Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetCursor
cmp eax, 0xffffff0d
jne 0x401070
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
ret
call sub.kernel32.dll_GetConsoleWindow
cmp eax, 0xfffffee4
jne 0x4010f9
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
ret
call sub.user32.dll_GetCursor
cmp eax, 0xfffffef5
jne 0x40118c
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
ret
call sub.kernel32.dll_GetConsoleWindow
cmp eax, 0xffffff1d
jne 0x4011fc
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
ret
call sub.user32.dll_GetCursor
cmp eax, 0xffffff22
jne 0x401285
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
call sub.user32.dll_GetWindowPlacement
call sub.kernel32.dll_FindFirstVolumeW
ret
jmp 0x475385
add ebx, ecx
xchg edi, esi
xor ebx, 0x854d649c
xchg edi, ecx
and esi, ebx
jmp 0x47603c
call ecx
ror edx, 7
or ebx, esi
rol edi, 5
xor edx, ebx
mov esi, edx
nop
xchg edi, esi
xor esi, ebx
add edi, esi
add edi, edx
xchg ebx, edi
xor edx, 0x89188cdd
jmp 0x476dbf
call fcn.00479175
dec edx
and esi, edx
xor edx, ebx
mov edx, ebx
xchg ebx, edi
sub ebx, edx
xor edx, esi
xor edx, ebx
mov esi, 0x894b1311
and ebx, esi
xchg ebx, edx
xor edx, ebx
sub esi, edx
jmp 0x4757d9
push 0x855bef5c
bswap edx
xor ebx, edi
sub esi, edi
xor esi, ebx
ror edi, 9
add ebx, edx
xor edi, ebx
and ebx, 0x895f6d77
add edx, ebx
mov edi, edx
add ebx, edx
xchg edi, ebx
and edx, edi
add ebx, esi
sub edx, esi
jmp 0x4758b4
call ecx
neg ebx
and edx, esi
inc esi
mov edi, ebx
and edx, esi
or ebx, 0x8992dcf5
or edx, edi
jmp 0x477c21
call ecx
xor ebx, edx
xor esi, ebx
or edi, ebx
xchg esi, edx
mov ebx, edx
bswap edi
mov ebx, edx
add edi, esi
dec ebx
ror esi, 0xd
xor edx, edi
jmp 0x4759ad
mov ecx, 0x2774562b
xchg ebx, edx
neg edx
mov edx, 0x89ad7154
xor esi, edx
mov esi, edx
xor edi, esi
bswap edi
mov ebx, esi
xchg ebx, edx
and ebx, edx
shl edx, 0x11
sub ebx, edi
add edi, 0x89b176f2
jmp 0x477103
pop ecx
xor esi, 0x89c0b9fe
xor esi, 0x89c12253
add edi, edx
xor ebx, edx
mov edi, ebx
shl edx, 0x1e
mov edi, 0x89c32a84
not ebx
or edx, ebx
and ebx, edi
jmp 0x4783af
pop ecx
mov edx, ebx
xchg esi, edi
xchg edi, ebx
add edx, edi
xor edi, edx
xchg edx, ebx
sub esi, ebx
sub ebx, edx
jmp 0x475b33
mov ecx, 0x123b2f04
xchg esi, edi
xor edx, esi
jmp 0x4760d2
jmp loc.0047c000
call ecx
or edx, 0x89f2986c
xor edi, edx
sub esi, 0x89f36889
bswap edx
and edx, esi
neg edi
inc edx
or esi, edx
sub edi, ebx
xchg esi, edi
xor edi, ebx
jmp 0x478f55
pop ecx
not edx
sub edi, esi
sub edi, edx
rol edi, 0x13
add edi, edx
or ebx, esi
xchg esi, ebx
mov ebx, 0x8a000a55
xchg ebx, edx
add edx, edi
or ebx, edi
and edx, esi
sub edi, ebx
sub edi, esi
add edi, ebx
jmp 0x475bd8
push 0x8552609f
xchg edx, ebx
sub ebx, esi
or esi, ebx
xor ebx, edx
sub edx, edi
sub ebx, edx
sub edx, edi
xchg edi, ebx
or ebx, 0x8a1713fc
mov edx, edi
add edi, edx
sub edi, edx
jmp 0x477b7b
push 0x8557bfbb
mov ebx, 0x8a21775b
bswap ebx
xor ebx, edx
bswap edx
add edx, edi
add edx, esi
not edx
or edi, ebx
neg edx
add ebx, esi
add esi, edi
xor edi, ebx
sub edi, ebx
jmp 0x47664a
pop ecx
mov edi, esi
mov esi, ebx
xor ebx, edi
shl ebx, 0x1d
and edi, 0x8a293199
xor esi, edx
shl ebx, 8
sub edx, edi
jmp 0x475636
push 0x85558acc
mov esi, edx
sub edi, ebx
add edx, 0x8a3376d2
not ebx
mov edi, ebx
or ebx, edx
or ebx, edx
and esi, edx
sub edx, 0x8a35c060
dec edi
sub edx, ebx
and edx, ebx
jmp 0x4787c6
push 0x8552b946
add esi, edx
or edi, edx
and edx, ebx
and edx, esi
not esi
inc ebx
xor edi, edx
and edi, edx
and ebx, 0x8a40c6ac
and edx, 0x8a41222b
add edx, 0x8a4187da
rol esi, 0x1b
and esi, edi
or ebx, 0x8a42ac94
xchg ebx, edx
jmp 0x4761d5
push 0x855a74f3
or esi, 0x8a45e30d
mov edx, esi
or edx, ebx
inc esi
xor ebx, esi
xor edx, edi
and esi, ebx
or ebx, 0x8a4895ba
jmp 0x477128
call ecx
or edi, 0x8a4e016c
shr ebx, 0x10
rol edi, 6
sub ebx, esi
sub ebx, edx
shr edx, 0x11
ror ebx, 1
jmp 0x479158
push 0x85579322
mov esi, 0x8a967fa5
dec edx
and edi, esi
xchg edx, esi
add edi, edx
rol edi, 0xb
shr edx, 0x15
jmp 0x475c47
push 0x85512338
or esi, ebx
or esi, ebx
xor esi, edi
dec ebx
neg edx
or ebx, 0x8aa470c8
and esi, 0x8aa4dabf
and ebx, esi
xor ebx, edi
mov esi, edi
and edi, ebx
jmp 0x478af6
call fcn.00479175
inc esi
and edi, ebx
add ebx, esi
neg ebx
sub esi, edx
rol esi, 0xd
neg ebx
and ebx, 0x8ab9df68
xchg edx, edi
jmp 0x475824
push 0x85540ad3
sub ebx, 0x8abfb381
or edx, esi
xor ebx, edi
add edi, ebx
xchg ebx, edx
xchg edx, edi
xchg esi, edi
not edx
sub ebx, 0x8ac309e3
add edi, esi
sub edi, ebx
jmp 0x477ecf
mov ecx, 0x2774562b
and edi, 0x8adcdce4
rol edx, 0x14
and ebx, 0x8addaf59
or esi, edi
xor ebx, edi
xor esi, edi
shr ebx, 0xb
jmp 0x477cb3
call ecx
bswap esi
sub esi, ebx
or esi, ebx
xchg esi, ebx
and edi, esi
sub ebx, edx
add edx, edi
add edi, esi
jmp 0x478ce5
push 0x855561a0
shr edi, 0xb
mov edx, edi
bswap edi
nop
mov edi, edx
add ebx, edi
jmp 0x475ccc
mov ecx, 0x2774562b
add edx, esi
shl ebx, 0x1d
mov edx, ebx
add ebx, 0x8b65f598
bswap esi
or edi, ebx
bswap ebx
and ebx, 0x8b67ccc2
sub edi, esi
mov edx, 0x8b68accd
jmp 0x47783a
push 0x85576613
neg edi
mov edx, esi
xchg edi, ebx
xchg ebx, esi
jmp 0x475fdb
call fcn.00479175
xor edi, esi
or edi, edx
xchg edx, edi
shl ebx, 0x1d
jmp 0x475ae3
pop ecx
sub ebx, edx
xor edi, edx
mov edx, ebx
dec edi
add edx, edi
xchg esi, edi
add esi, 0x8c5068b3
xor esi, 0x8c50cc85
jmp 0x47594b
mov ecx, 0x2774562b
inc edi
add esi, ebx
xchg esi, edx
nop
sub edi, esi
ror esi, 0xd
or edi, esi
mov edi, esi
xor edx, esi
ror ebx, 0xd
xchg edx, edi
and edi, esi
and edi, esi
jmp 0x47746f
pop ecx
and ebx, esi
sub esi, ebx
jmp 0x478fff
push 0x8558ec6c
add edi, edx
sub edx, 0x8cb66cbb
rol esi, 0x1c
mov ebx, edi
xor edi, 0x8cb78e06
sub edi, 0x8cb7f9ce
jmp 0x4786b6
call fcn.00479175
mov edx, ebx
or edx, edi
bswap esi
mov edx, esi
sub esi, ebx
ror edx, 0x11
inc ebx
dec ebx
xchg ebx, edi
add edx, 0x8cbc7645
and esi, ebx
add edi, ebx
jmp 0x479093
mov ecx, 0x123b2f04
or ebx, edx
rol edx, 0xd
and edx, esi
bswap edi
xchg edx, edi
add ebx, edi
xor ebx, esi
shl ebx, 5
jmp 0x47847a
call ecx
dec esi
shl edx, 0x1e
and esi, ebx
shr edi, 0xb
and esi, 0x8d37b0c9
and ebx, edi
sub edi, 0x8d38b955
add edi, 0x8d3928ed
and edi, edx
mov esi, ebx
jmp 0x477491
call fcn.00479175
shl ebx, 0x16
inc edi
neg edx
bswap esi
add edx, ebx
add esi, edi
shl esi, 7
mov esi, edx
and edi, ebx
add edi, esi
inc edx
not esi
jmp 0x4787ed
pop ecx
sub esi, ebx
xor ebx, 0x8d3ff9ee
xchg edi, esi
shl edi, 0x1b
and esi, edi
and edi, edx
xor edi, ebx
dec edx
mov edi, ebx
not edi
jmp 0x476c64
pop ecx
xchg edi, edx
mov ebx, edx
and edx, edi
shl esi, 0x17
mov esi, edi
xor ebx, 0x8d5554ab
or ebx, edx
and edx, 0x8d565d4e
xor edx, esi
add edx, esi
or esi, edi
or edx, ebx
ror edi, 0xa
and edi, 0x8d58d516
xor ebx, edi
jmp 0x478aa2
call fcn.00479175
xor edi, 0x8db56aee
and edx, ebx
jmp 0x475401
pop ecx
mov edi, esi
mov esi, edx
add edi, ebx
nop
sub esi, edi
and edi, esi
inc edi
mov edx, 0x8dc4ea1f
xor ebx, esi
mov edi, esi
jmp 0x477024
pop ecx
sub esi, edx
xor edx, esi
or esi, edx
xor ebx, edi
dec esi
xor esi, edi
jmp 0x477e0e
push 0x85528c35
and ebx, edi
add edi, edx
mov edi, edx
neg edx
and edx, esi
sub ebx, edx
or ebx, 0x8e214034
or esi, 0x8e21bc8f
mov ebx, edi
inc ebx
jmp 0x475d25
pop ecx
dec esi
and ebx, 0x8e33b76f
mov edx, ebx
mov edi, esi
ror edi, 0x16
mov edi, esi
sub esi, edx
or edx, esi
add edx, 0x8e36aa6e
and edi, 0x8e372369
jmp 0x478fa0
call fcn.00479175
xor edx, 0x8e4391db
xchg esi, ebx
add esi, ebx
bswap edi
or edi, 0x8e4570c4
add edx, ebx
sub edi, ebx
sub edx, edi
xchg edi, ebx
sub edi, ebx
jmp 0x475db9
pop ecx
xor esi, ebx
mov esi, ebx
shl ebx, 0x1c
xchg edi, ebx
sub edi, 0x8e635488
or esi, 0x8e63cde0
and edx, edi
xchg edx, ebx
jmp 0x478274
push 0x855a48cc
and edi, edx
and edx, edi
shl edi, 0xd
mov esi, edx
and edi, edx
bswap ebx
or esi, edi
sub edi, ebx
jmp 0x475d71
push 0x855ccc43
sub ebx, esi
and edi, esi
xor edx, 0x8e72bca3
or ebx, esi
xor esi, ebx
xchg ebx, edx
or esi, edi
xor esi, edi
add esi, ebx
jmp 0x478b12
push 0x8553e015
sub esi, ebx
shl ebx, 0x1f
dec edi
sub ebx, esi
sub edi, edx
and edi, esi
add edx, esi
not edx
add edi, ebx
sub ebx, 0x8e79c180
inc esi
add ebx, 0x8e7aa863
jmp 0x476119
push 0x85543438
mov ebx, edx
or edx, edi
xor edi, edx
and esi, edx
and edx, ebx
sub ebx, 0x8e8d8f87
add edx, esi
mov edi, 0x8e8e6b46
xchg edi, edx
neg edi
mov ebx, 0x8e8fbaa5
add ebx, 0x8e903750
shr esi, 0x1e
xor ebx, edi
jmp 0x478039
mov ecx, 0x2774562b
or ebx, edx
and esi, edx
sub edi, ebx
or esi, edx
add esi, edx
sub edx, ebx
or ebx, 0x8ea687c1
sub edi, ebx
and ebx, edx
shr edx, 0xd
and edi, edx
jmp 0x478338
mov ecx, 0x2774562b
xchg esi, ebx
xchg ebx, edi
add edi, esi
add edx, edi
or edi, edx
sub edx, esi
xor ebx, esi
dec ebx
mov esi, edi
xor esi, 0x8ebc8c28
or esi, ebx
xor edx, ebx
xchg edx, esi
jmp 0x476dac
mov ecx, 0x123b2f04
add edi, esi
mov ebx, esi
mov ebx, esi
neg edx
xchg ebx, esi
jmp 0x475a04
push 0x855d253a
sub esi, 0x8ec63686
and esi, edx
add esi, edi
and edi, ebx
xor edx, esi
mov edx, esi
ror edx, 0x17
and esi, edx
xchg ebx, edi
jmp 0x478060
pop ecx
xchg ebx, esi
add ebx, esi
and esi, 0x8f083d18
jmp 0x477e2e
call fcn.00479175
add edx, esi
xchg edi, edx
xchg edx, esi
not ebx
xchg esi, edx
jmp 0x477447
pop ecx
sub edx, ebx
or esi, edx
xor edi, 0x8f34d0ac
xor esi, edx
ror ebx, 0xd
xchg esi, edx
dec ebx
mov esi, ebx
xor ebx, edi
nop
and esi, 0x8f38593c
jmp 0x4770e0
call fcn.00479175
and esi, 0x8f4c5702
not ebx
mov edi, ebx
or edi, 0x8f4d9b83
bswap edi
jmp 0x4762dc
push 0x855918f7
nop
or edx, edi
add esi, 0x8f93da6f
shr edi, 0x19
sub esi, edi
jmp 0x476f1e
mov ecx, 0x123b2f04
mov edx, 0x8fb1c6b1
and ebx, edx
or edi, 0x8fb29926
mov esi, edi
bswap edx
mov edi, edx
bswap edi
sub esi, 0x8fb4c55e
or ebx, edx
jmp 0x475599
call ecx
not edi
dec edx
sub ebx, edx
not edi
add esi, edx
inc esi
neg esi
shr esi, 0x17
jmp 0x477895
pop ecx
xor esi, edi
and ebx, 0x900928a5
mov ebx, 0x9009c0e1
and ebx, 0x900a35b2
and edi, esi
inc esi
or edx, edi
not edx
jmp 0x4764f5
push 0x855159f5
or edx, ebx
and edx, esi
ror ebx, 0x10
xor esi, ebx
xor ebx, esi
or esi, edx
shl edi, 0xe
and ebx, edx
jmp 0x4759c3
push 0x855cf8b1
not edi
xchg edx, ebx
sub esi, 0x901773eb
inc ebx
xor esi, edx
ror edi, 0xe
mov edx, 0x90190658
and edx, 0x90196b71
mov ebx, edx
mov esi, 0x901a5823
or edx, ebx
xor edx, edi
jmp 0x47809c
push 0x85568f84
add edi, ebx
or edi, 0x903284f8
xor edi, edx
jmp 0x477f98
pop ecx
neg edx
or edx, ebx
neg ebx
shr esi, 0x1e
neg ebx
and ebx, 0x905401d8
sub ebx, edx
xchg ebx, esi
bswap ebx
add edi, esi
jmp 0x478d81
pop ecx
mov ebx, edi
inc ebx
neg edx
add edx, edi
xchg edi, esi
xchg ebx, edx
bswap esi
mov edi, ebx
jmp 0x475c6e
pop ecx
ror edx, 6
sub edi, edx
xchg ebx, edi
and edx, 0x90a2af01
bswap edx
add edi, 0x90a3963d
and esi, edx
or edi, 0x90a46475
xor edx, esi
mov edx, esi
jmp 0x477514
pop ecx
sub ebx, edx
xor edx, 0x90aadb40
sub edx, ebx
mov edi, ebx
or edi, edx
bswap edi
xor edi, ebx
add ebx, edx
sub edx, esi
bswap edx
xor edx, 0x90aeb2a9
inc edi
xor esi, edi
and edi, 0x90aff54d
jmp 0x478bdc
push 0x855a1ca5
xchg edi, esi
mov edx, ebx
not esi
or edx, esi
mov ebx, 0x90b868ea
add ebx, edx
jmp 0x477dd3
call ecx
ror edi, 0x12
mov edx, esi
xor edx, 0x90cd7b2e
add edi, 0x90cde1dd
sub esi, 0x90ce4b0e
jmp 0x47799f
pop ecx
xor ebx, esi
add esi, 0x90e5043a
add esi, edx
xor esi, edx
add ebx, edi
rol esi, 0x1d
mov esi, 0x90e71aac
dec edi
jmp 0x477d84