Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
or edi, ecx
and esi, ecx
call sub.user32.dll_GetProcessWindowStation
or edi, esi
sub ebx, 0x95195f32
add edi, esi
neg edi
cmp eax, 0xffffff18
jne 0x40108f
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
ret
add esi, ecx
sub ebx, edi
or ebx, 0x951e1ff7
and esi, ebx
dec ebx
neg esi
call sub.user32.dll_GetMessagePos
dec ebx
cmp eax, 0xffffff30
jne 0x401132
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
ret
and esi, edi
xor esi, ecx
call sub.user32.dll_GetMessagePos
shl ebx, 0xc
xchg edi, ebx
or edi, ecx
bswap ebx
inc esi
xor ecx, ebx
xor ecx, 0x952744ee
or ebx, 0x9527b07c
cmp eax, 0xffffff11
jne 0x4011e1
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
ret
xor edi, ecx
inc ecx
xchg ebx, edi
call sub.user32.dll_GetMessagePos
xchg ebx, esi
inc edi
and ebx, edi
and edi, ecx
nop
sub ecx, ebx
and ebx, edi
cmp eax, 0xfffffed6
jne 0x40129e
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_NtLockProductActivationKeys
call sub.ntdll.dll_ZwOpenTimer
call sub.ole32.dll_ReadClassStg
call sub.ole32.dll_ReadClassStg
call sub.ntdll.dll_ZwOpenTimer
call sub.ntdll.dll_NtLockProductActivationKeys
ret
jmp 0x5a0d5b
or ecx, 0x96d45a90
or esi, ecx
jmp 0x5a1dd9
pop ebx
xor edx, edi
xor esi, edi
xchg edx, ecx
sub ecx, edx
or edi, esi
add edi, esi
sub ecx, edi
sub edi, 0xa04e7157
and esi, edi
jmp 0x5a36c6
call ebx
shr ecx, 0x1c
mov esi, edi
and edi, esi
shr edx, 3
xor ecx, esi
bswap esi
xor edx, 0xa05cdb39
not ecx
bswap ecx
nop
jmp 0x5a1be8
push 0x96e246b6
xor ecx, edx
shr esi, 0x1d
sub edi, edx
mov esi, edx
mov esi, ecx
or ecx, edx
jmp 0x5a16ad
call ebx
xor esi, edi
mov edx, ecx
neg edx
xor edx, ecx
mov ecx, edi
add edi, edx
jmp 0x5a31b7
call fcn.005a4294
nop
xchg edx, ecx
or edi, 0xa081e149
add ecx, esi
mov edi, ecx
mov ecx, edx
and edx, 0xa082d809
jmp 0x5a1200
pop ebx
not edi
xor ecx, edx
add esi, 0xa08e2bf0
and edx, esi
xchg ecx, esi
dec edi
xor edi, 0xa08f3d24
xchg edx, esi
jmp 0x5a2728
push 0x96e26de5
or esi, edi
add edx, 0xa0ef060d
mov ecx, 0xa0ef6d4d
add ecx, edx
mov ecx, edx
shr edx, 0xe
bswap ecx
jmp 0x5a386e
mov ebx, 0x123b2f04
sub esi, ecx
mov edi, edx
add ecx, edx
xor ecx, esi
neg ecx
or edx, ecx
xor esi, 0xa1278e28
sub edx, 0xa127ca62
xchg esi, edi
jmp 0x5a2974
push 0x96dc6866
and esi, ecx
or ecx, edx
inc esi
mov edx, esi
xor ecx, esi
xor esi, ecx
mov esi, 0xa13b367b
and esi, edi
and esi, edi
sub edx, esi
mov edx, esi
or edx, edi
jmp 0x5a36ef
mov ebx, 0x123b2f04
add esi, edx
xor edi, 0xa1430d38
add ecx, edi
or ecx, edi
xor edi, edx
mov edx, ecx
rol esi, 0xd
and edi, 0xa14481e6
not edi
jmp 0x5a251d
pop ebx
push 0x96da20c3
and edx, esi
mov edi, ecx
neg edx
nop
jmp 0x5a2b6c
push 0x96d97424
inc edx
xor ecx, esi
xor edi, ecx
and edx, 0xa18623ee
and edx, 0xa1865dbd
inc edx
xchg edi, esi
not edi
or esi, edi
shl ecx, 6
shl ecx, 0x19
xchg esi, ecx
and ecx, edx
jmp 0x5a2df3
mov ebx, 0x2774562b
xor ecx, edx
dec edi
xor edi, esi
or esi, edx
inc edx
neg edi
mov edx, edi
jmp 0x5a1232
call fcn.005a4294
add edi, ecx
add esi, edi
and edx, ecx
add ecx, edx
sub esi, ecx
add ecx, 0xa22699e9
dec ecx
and edi, ecx
add edx, 0xa227f8ca
and edx, esi
bswap edi
add edi, esi
jmp 0x5a362c
pop ebx
mov ecx, esi
mov esi, ecx
xchg edi, ecx
mov ecx, edx
xchg esi, edi
jmp 0x5a0f80
pop ebx
sub edx, 0xa252d6ab
xchg esi, ecx
sub edi, 0xa2535b25
or edi, ecx
sub esi, edx
nop
ror edi, 0x18
jmp 0x5a4146
pop ebx
or edx, ecx
and edi, esi
ror edi, 0x1f
sub ecx, edx
xchg edi, ecx
not esi
and esi, 0xa25a2166
and edi, 0xa25a6368
and edx, 0xa25aab4f
jmp 0x5a1177
pop ebx
and esi, 0xa2601491
mov ecx, edi
and ecx, 0xa2609a0a
jmp 0x5a257f
push 0x96de209f
xor edx, 0xa2666811
mov esi, edx
add edi, ecx
ror ecx, 0xf
add esi, edi
xor esi, edi
sub esi, 0xa267dec8
add edx, 0xa26818f1
xchg ecx, esi
xchg edi, ecx
jmp 0x5a3dd1
call fcn.005a4294
rol ecx, 0x18
ror edx, 0xa
xchg ecx, edx
inc ecx
xor ecx, edi
add ecx, edi
xchg edi, edx
inc esi
mov esi, edx
xor edi, ecx
or ecx, edi
shl edi, 8
mov ecx, 0xa2898c3f
or esi, 0xa289fa70
jmp 0x5a2b51
call ebx
or ecx, edi
mov ecx, edx
mov edi, esi
not edx
add ecx, edx
add edi, edx
add edx, 0xa2bc39ef
not ecx
jmp 0x5a4065
push 0x96da7307
xor esi, edx
sub esi, 0xa2bd100b
inc edi
or edi, edx
sub edi, 0xa2bdc9e9
and edi, ecx
add edx, ecx
sub esi, 0xa2be82e8
mov esi, 0xa2bebc79
jmp 0x5a2bb3
push 0x96dab8fe
inc esi
neg ecx
or edi, ecx
xor ecx, esi
shr esi, 0x15
mov esi, edx
add ecx, 0xa2c23137
add ecx, edi
not esi
and ecx, 0xa2c2f453
jmp 0x5a23b3
push 0x96e2c6a6
add edx, edi
or edi, ecx
xor esi, edi
and esi, ecx
xchg edx, ecx
add esi, ecx
mov edx, edi
shr esi, 4
add esi, edx
xchg edx, esi
jmp 0x5a2e3a
push 0x96d9d439
sub esi, edi
mov edx, esi
mov edi, edx
sub edi, 0xa2e9c4f6
or esi, edx
mov edi, ecx
and ecx, edx
or ecx, 0xa2eac239
xor edx, ecx
xor edi, ecx
or edx, ecx
mov ecx, esi
ror esi, 8
jmp 0x5a1d29
push 0x96e2ec6e
xchg esi, edi
add ecx, esi
and edx, esi
or esi, 0xa2f23c6a
xor esi, ecx
xor edx, 0xa2f2db88
and ecx, 0xa2f32e42
or esi, edi
neg ecx
bswap ecx
and edx, 0xa2f42692
jmp 0x5a334f
call ebx
inc edx
sub edi, edx
xchg edi, edx
inc esi
shr ecx, 5
inc edx
dec esi
rol edi, 0x12
and edi, esi
jmp 0x5a3d40
push 0x96df13d1
and esi, edi
mov edi, ecx
and ecx, edi
neg ecx
and edx, ecx
or edi, 0xa329ca73
or ecx, esi
shl edi, 0x1d
shl ecx, 7
or ecx, edx
sub edx, 0xa32c6703
add ecx, edx
or ecx, 0xa32d4591
xor esi, edx
and edi, edx
jmp 0x5a1a49
pop ebx
add edx, 0xa347c929
sub edx, edi
or esi, 0xa348a951
sub edx, 0xa3491f7d
or edx, esi
xor edi, edx
xor esi, edi
or esi, edi
mov edx, 0xa34b5415
shr esi, 0x1c
mov ecx, edi
add esi, edx
sub esi, ecx
jmp 0x5a12e1
pop ebx
add edi, 0xa34dc8f6
xor esi, 0xa34e42f0
mov ecx, 0xa34eb22e
not ecx
add esi, edi
or esi, ecx
add edi, esi
sub edx, 0xa350e9f8
xchg ecx, edx
not ecx
jmp 0x5a27c1
mov ebx, 0x2774562b
and edx, esi
or edi, 0xa382fd94
not ecx
sub edi, edx
xor edx, esi
add esi, edx
xchg edx, edi
dec ecx
xchg ecx, edi
jmp 0x5a3a9c
call ebx
sub edx, ecx
dec edx
and edx, 0xa3e56faa
and ecx, 0xa3e5df81
and ecx, 0xa3e65d74
add edi, edx
ror esi, 8
and ecx, edx
add edx, esi
mov edi, esi
and edx, esi
add ecx, esi
jmp 0x5a3187
mov ebx, 0x2774562b
bswap esi
or edi, 0xa3ea65dd
mov ecx, edi
xor ecx, esi
xchg edi, ecx
or edx, esi
jmp 0x5a3b36
pop ebx
and edx, edi
or ecx, edx
mov esi, 0xa3f84045
sub ecx, edx
and edx, 0xa3f919a0
or esi, ecx
xor edi, 0xa3fa05cc
mov esi, edx
shr edx, 0xd
inc edx
sub esi, ecx
and edx, esi
jmp 0x5a19d0
push 0x96dc91b5
shl edx, 1
not edi
sub ecx, edi
xchg edx, esi
mov edi, edx
or edx, esi
xchg edx, edi
xchg edx, edi
xor edi, esi
add edi, edx
not edx
add esi, 0xa401d644
jmp 0x5a18c5
pop ebx
or edi, ecx
mov edx, edi
or esi, 0xa4142d85
add edx, 0xa4149dee
dec edx
and ecx, edx
add edi, esi
or edi, ecx
shl edi, 0x16
and esi, ecx
mov edi, esi
sub ecx, esi
rol ecx, 6
jmp 0x5a2810
push 0x96e29bd2
sub ecx, edx
mov ecx, edx
sub edx, 0xa43023e7
add esi, edx
inc edx
and ecx, esi
and edx, edi
inc esi
ror esi, 0x15
mov edx, esi
or edi, 0xa433a062
and ecx, edx
add esi, 0xa4348276
not edi
inc edi
jmp 0x5a2ca7
push 0x96e1156c
xchg esi, edi
add esi, 0xa44ecaa6
and ecx, 0xa44f521f
jmp 0x5a41b4
call fcn.005a4294
mov edx, edi
or edi, edx
xchg ecx, esi
and edi, 0xa48199df
ror esi, 0x16
inc ecx
sub edx, edi
shr ecx, 0x14
mov esi, ecx
mov ecx, 0xa4847ec1
inc ecx
add edx, ecx
xchg edi, edx
ror esi, 0x15
jmp 0x5a0fed
call fcn.005a4294
dec edx
xchg esi, edx
or ecx, edx
mov esi, edi
add edi, edx
sub esi, edi
xor edi, esi
xor ecx, esi
neg edi
sub esi, edi
ror esi, 0x16
mov edx, ecx
or esi, edi
jmp 0x5a2f2c
pop ebx
add esi, 0xa4cd6c28
xchg edx, ecx
or esi, edx
sub esi, ecx
xchg ecx, edi
ror edi, 0xe
ror edx, 0x10
bswap ecx
or edx, esi
and ecx, edx
xor edi, 0xa4d1092a
dec esi
mov ecx, edx
jmp 0x5a2763
push 0x96de7194
or esi, 0xa4d8b7b4
xor ecx, 0xa4d93700
jmp 0x5a40ef
pop ebx
shr edi, 0x1c
add edi, esi
dec edx
mov esi, edx
mov ecx, edx
add ecx, edx
or edx, 0xa521f2b0
add ecx, edx
inc esi
sub esi, 0xa52351d5
shr edx, 0xa
sub edi, esi
and edx, ecx
add esi, ecx
xchg esi, edi
jmp 0x5a37a8
push 0x96dec4e4
or ecx, edx
or ecx, 0xa52ae158
sub esi, ecx
add edx, 0xa52b5e6a
xor ecx, edx
mov esi, 0xa52bd437
xor edi, esi
not edi
or esi, edx
jmp 0x5a30ae
pop ebx
xor edi, ecx
add edx, edi
add edi, 0xa5337690
and edi, ecx
sub edi, 0xa5343a5d
or ecx, edx
or edi, ecx
or edx, esi
jmp 0x5a3964
push 0x96e140ac
and esi, 0xa53e5dfd
sub edi, esi
or ecx, edx
dec esi
mov esi, edi
add esi, edi
shl edx, 0x1f
sub esi, edx
shr edi, 0x1f
jmp 0x5a3657