Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edx, edi
call sub.kernel32.dll_GetCommandLineW
dec ecx
or ecx, 0x4d59d640
or esi, 0x4d5a1609
or esi, ecx
sub ecx, 0x4d5a9760
cmp eax, 0xfffffee9
jne 0x401082
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
ret
or edx, edi
dec edx
xchg edi, ecx
call sub.user32.dll_GetActiveWindow
inc edi
rol ecx, 0x1a
bswap ecx
xor esi, ecx
sub ecx, edx
mov esi, edi
cmp eax, 0xfffffee6
jne 0x4010f9
call main
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
ret
rol edx, 9
neg edi
and esi, edx
shl esi, 6
add ecx, edi
mov edx, esi
ror edx, 2
xor ecx, 0x4d611fd1
call sub.user32.dll_GetActiveWindow
add ecx, edx
xor esi, ecx
xchg esi, ecx
sub ecx, 0x4d622e0f
mov edi, edx
cmp eax, 0xffffff0d
jne 0x40119d
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
ret
xor ecx, edx
add edi, edx
not edx
or ecx, esi
mov edi, ecx
and esi, edx
add esi, 0x4d684cbc
call sub.kernel32.dll_GetCommandLineW
or esi, ecx
ror edi, 0x19
sub edx, esi
cmp eax, 0xfffffedb
jne 0x401253
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
call main
call main
call sub.ntdll.dll_RtlRunEncodeUnicodeString
call main
ret
jmp 0x494682
xchg edx, esi
xor edi, esi
or esi, ecx
and edi, edx
or esi, edx
xchg edx, edi
mov esi, edi
and edx, edi
jmp 0x494db8
mov edx, 0x123b2f04
add edi, ebx
or edi, ebx
add esi, 0x549a3825
mov ebx, esi
add ebx, esi
and edi, esi
add ebx, 0x549b3be0
jmp 0x495de4
push 0x50b55fe6
not ecx
and edi, 0x54c332a7
xchg ecx, ebx
xchg ecx, esi
rol edi, 0x14
jmp 0x49475c
call edx
nop
xchg ecx, edi
sub edi, ebx
xchg ecx, edi
xchg ebx, edi
shl ecx, 5
mov ecx, esi
sub esi, ebx
xchg edi, ecx
and edi, ebx
inc ecx
xchg ecx, edi
jmp 0x49522e
call fcn.004952ba
not ecx
xor ebx, edi
xor edi, ebx
add edi, 0x55093914
xor ecx, edi
xor ebx, esi
sub ebx, ecx
mov ebx, edi
mov edi, ecx
xchg edi, ecx
sub edi, ecx
xor edi, ecx
bswap ebx
jmp 0x496456
push 0x50ad1166
mov ecx, 0x551f06c9
xchg ecx, ebx
mov edi, esi
and ebx, edi
sub esi, 0x551ffc55
add esi, 0x552047c0
jmp 0x496a3c
push 0x50a68e6c
xchg ebx, edi
shr ecx, 0xb
xchg edi, esi
xor edi, 0x55348819
xor ecx, edi
xor edi, ecx
mov ecx, edi
rol esi, 1
xchg edi, ecx
jmp 0x495f9d
pop edx
ror ecx, 0x15
and esi, 0x5618fce4
neg edi
add ebx, ecx
and esi, edi
shr ecx, 0x13
add esi, edi
mov esi, edi
xor esi, 0x561c67d1
and edi, 0x561cd252
or edi, ecx
jmp 0x495c7f
call edx
and ebx, edi
sub ecx, edi
and ebx, edi
dec ebx
or ebx, esi
neg ebx
and esi, ebx
sub ebx, esi
add ecx, esi
xor ecx, ebx
neg edi
jmp 0x4963b4
push 0x50aafcf0
sub ebx, ecx
or edi, 0x56352589
add ecx, edi
or ecx, ebx
sub ecx, 0x5636260a
xchg ebx, ecx
xor edi, ebx
jmp 0x497707
pop edx
dec ebx
mov edi, ebx
shr edi, 0x18
rol ebx, 0x14
and edi, esi
and ebx, ecx
shl ecx, 0xe
sub esi, 0x5652c942
and ecx, esi
and edi, ecx
mov ecx, esi
shl edi, 0xf
neg edi
not ebx
jmp 0x49728a
pop edx
mov ecx, ebx
shl ebx, 0x17
sub ecx, edi
add ebx, edi
mov ebx, edi
ror ebx, 0x15
or ebx, esi
jmp 0x495497
push 0x50a7a079
or edi, ebx
not ebx
xor edi, 0x56bc186f
ror ecx, 0x19
or ebx, ecx
jmp 0x49699e
mov edx, 0x2774562b
xchg esi, ecx
shr edi, 2
rol ebx, 4
add edi, esi
sub esi, 0x56cc8515
mov ecx, esi
jmp 0x496fc6
pop edx
neg edi
xor edi, esi
xor esi, edi
ror ebx, 0x1d
sub edi, 0x571c76c6
xor esi, edi
xchg ebx, esi
sub edi, ecx
shl ebx, 0x19
or esi, ecx
jmp 0x495349
pop edx
ror edi, 0x1e
bswap esi
add esi, 0x572542cf
sub edi, esi
add ebx, esi
rol ebx, 1
bswap ecx
and edi, 0x5727af1f
neg edi
jmp 0x496c8d
jmp loc.0049ac94
call edx
and edi, ecx
sub ecx, edi
ror esi, 7
sub edi, 0x575716e6
and ecx, 0x57575799
add esi, edi
add edi, ebx
mov ecx, ebx
add edi, 0x575853f8
sub esi, 0x575890eb
xor esi, 0x5758ce0b
sub ecx, 0x575911a5
or ecx, esi
jmp 0x497320
push 0x50a6f6b8
shr ecx, 0x1b
ror ecx, 7
or edi, ebx
ror ecx, 0x18
mov esi, 0x576cbcfc
or edi, ebx
dec esi
sub esi, ecx
jmp 0x4968d8
pop edx
add ecx, esi
shr ecx, 7
and ecx, ebx
and ebx, 0x579f7def
sub ecx, 0x579fbacb
shr esi, 0x1b
add esi, edi
not edi
and esi, edi
shl edi, 0xc
mov edi, ebx
or edi, ebx
jmp 0x4972f3
mov edx, 0x2774562b
xchg edi, esi
dec ebx
not ebx
mov ecx, ebx
sub ebx, edi
xor ebx, ecx
or ebx, 0x57bb82e0
xchg edi, ecx
jmp 0x494be4
push 0x50b1b6a5
mov edi, 0x57e4a057
xchg edi, esi
mov esi, ebx
shr edi, 0x19
and edi, ebx
shr edi, 0x10
or ecx, esi
jmp 0x4972a1
pop edx
sub ecx, 0x57f5ccbd
or esi, 0x57f64e70
xchg ebx, esi
ror edi, 0x16
add edi, esi
sub ecx, edi
and ecx, edi
inc ebx
jmp 0x496132
call edx
add esi, edi
neg ecx
or ecx, edi
sub ecx, edi
or ebx, ecx
and esi, ebx
and edi, ecx
and ecx, esi
dec ecx
shr esi, 1
sub ecx, esi
jmp 0x496b42
push 0x50b4643e
or ebx, 0x58239dfd
add ebx, esi
and edi, ebx
inc ecx
sub edi, 0x5825bf58
mov esi, edi
sub esi, 0x582692b1
mov ebx, edi
jmp 0x4969e7
push 0x50a74e89
or ebx, esi
shl esi, 0xc
add ebx, esi
xor ecx, esi
xchg edi, ebx
mov ecx, edi
not esi
and esi, ecx
xchg ebx, esi
add ecx, ebx
jmp 0x4958e3
push 0x50a7fb23
add ebx, ecx
xchg ebx, edi
and ebx, esi
bswap esi
and edi, ecx
sub esi, 0x58db9c15
inc esi
mov ebx, edi
jmp 0x497367
push 0x50b4b656
add edi, ecx
inc ecx
mov edi, ebx
jmp 0x497515
mov edx, 0x2774562b
xor ecx, esi
or ecx, esi
add ecx, ebx
sub esi, 0x58faf1c7
sub esi, 0x58fb7e8c
add edi, ebx
xor edi, ecx
mov ecx, edi
shl edi, 0x16
mov ebx, edi
shr edi, 7
xchg ecx, esi
jmp 0x49776f
pop edx
add esi, ecx
shl ebx, 6
or edi, esi
xor ebx, ecx
inc edi
xor ecx, esi
rol edi, 0xb
shr edi, 0xc
or esi, 0x59251810
add ecx, ebx
xchg ecx, ebx
jmp 0x4977e3
call fcn.004952ba
not esi
mov esi, ebx
rol ebx, 0x1b
xchg ebx, esi
ror edi, 8
xchg esi, edi
jmp 0x495e8f
pop edx
and esi, 0x592f4482
ror edi, 8
add ebx, esi
or esi, ebx
jmp 0x495c14
push 0x50b40ec4
mov ebx, edi
xor ebx, 0x5951e78d
inc esi
inc edi
or ecx, edi
jmp 0x4964d8
call edx
not edi
inc ecx
neg ecx
or ebx, ecx
add edi, ebx
mov edi, ebx
and esi, ecx
mov ecx, edi
and ebx, esi
add edi, ecx
xor ecx, ebx
and ebx, esi
jmp 0x495739
call fcn.004952ba
sub ecx, esi
xchg ecx, ebx
xchg esi, edi
xchg ecx, esi
or ecx, edi
xchg esi, edi
and esi, ebx
add esi, 0x59bda489
xchg ebx, edi
mov ebx, 0x59be9f27
jmp 0x494b9d
call fcn.004952ba
xchg edi, ebx
sub ecx, ebx
shr ecx, 0x1e
sub edi, esi
ror ebx, 0x10
xor esi, ebx
xchg esi, ecx
ror esi, 0x17
or ecx, edi
inc ecx
xchg ecx, ebx
not esi
add esi, ecx
mov esi, ecx
add ebx, ecx
sub ebx, 0x59e7a030
jmp 0x4952ea
push 0x50af18b4
not edi
and esi, edi
xchg ebx, esi
xchg ebx, edi
and ecx, ebx
dec edi
sub ebx, ecx
jmp 0x4974e9
push 0x50b20a2c
bswap edi
xor edi, ecx
rol ebx, 0x18
sub ebx, esi
mov edi, esi
xor edi, ecx
mov ebx, edi
shl esi, 0x1d
mov edi, 0x5a0f3a5f
or edi, esi
xchg ecx, edi
sub ebx, esi
or esi, ebx
xchg edi, ebx
mov ebx, 0x5a11e92f
or edi, esi
jmp 0x4959b5
pop edx
or ebx, 0x5a1764cc
add edi, esi
mov esi, edi
add ecx, esi
dec ebx
jmp 0x496b9f
pop edx
bswap esi
ror edi, 9
ror ebx, 4
ror esi, 0x11
sub esi, 0x5a1e08c1
and ecx, edi
shr esi, 0x18
bswap ebx
mov edi, 0x5a1feb22
or edi, 0x5a2067a3
jmp 0x497724
mov edx, 0x2774562b
add edi, ebx
and ebx, 0x5a25ca35
sub esi, 0x5a265b05
xchg ecx, esi
neg ebx
jmp 0x49715c
push 0x50af6f3c
mov esi, ecx
xor esi, ecx
shl edi, 0xd
xor ebx, esi
jmp 0x49620b
push 0x50b5117a
sub ecx, esi
and esi, edi
not esi
or esi, edi
not ecx
shr ecx, 8
and esi, ecx
xchg edi, ebx
xor edi, ebx
or ebx, esi
or ebx, edi
add ecx, ebx
jmp 0x49496f
mov edx, 0x2774562b
add ebx, ecx
dec esi
or edi, esi
mov esi, ecx
or edi, 0x5aa0b99a
xchg ecx, esi
bswap esi
mov ecx, ebx
jmp 0x496b87
push 0x50acb886
ror esi, 0x10
xchg edi, esi
neg ecx
xchg ecx, esi
xchg esi, edi
mov ebx, 0x5aa50731
inc esi
or ebx, edi
or esi, 0x5aa678d2
jmp 0x494ccc
call fcn.004952ba
neg edi
mov edi, ecx
neg esi
dec ebx
and esi, edi
xor edi, ebx
mov ebx, 0x5aaee021
rol esi, 0xe
bswap esi
shr esi, 0x15
sub esi, ebx
or ecx, edi
xor esi, edi
jmp 0x496da5
pop edx
mov ecx, ebx
shl ecx, 0xf
add esi, ebx
neg esi
and ecx, edi
not esi
sub ebx, edi
xor ecx, ebx
jmp 0x496331