Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api

Disassembly:
and ebx, 0x817a5290
call sub.kernel32.dll_GetUserDefaultLangID
and edx, ecx
mov edx, 0x817ae977
xchg ebx, esi
not ebx
cmp eax, 0xfffffed5
jne 0x40109a
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.user32.dll_TranslateAcceleratorW
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
ret
xor esi, ecx
xor ecx, esi
dec ecx
mov esi, ebx
sub esi, ebx
xor ebx, edx
or edx, 0x81841ff0
call sub.kernel32.dll_GetUserDefaultLangID
mov edx, esi
or ebx, ecx
mov esi, ebx
or ebx, edx
shl ecx, 6
cmp eax, 0xfffffee9
jne 0x40115d
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.kernel32.dll_GetProcessTimes
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
ret
xchg ebx, edx
or ebx, 0x8187ad66
xor ecx, edx
xor ebx, 0x818821d2
not ecx
xor ebx, esi
call sub.kernel32.dll_GetCommandLineW
xor ecx, 0x8188e65d
mov ecx, ebx
nop
shr esi, 0xc
or esi, 0x8189ce9f
mov edx, ebx
sub ebx, 0x818f23ed
cmp eax, 0xffffff06
jne 0x401237
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.user32.dll_TranslateAcceleratorW
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.user32.dll_TranslateAcceleratorW
call sub.kernel32.dll_GetProcessTimes
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.ntdll.dll_RtlIpv4AddressToStringA
call sub.kernel32.dll_GetProcessTimes
call sub.shell32.dll_SHChangeNotifyDeregister
call sub.kernel32.dll_GetProcessTimes
call sub.user32.dll_TranslateAcceleratorW
ret
jmp 0x49ff38
and edx, ebx
add ebx, 0x820ed47b
jmp 0x4a0411
push 0x82194b03
xchg ecx, edi
not ecx
and edi, esi
neg ecx
ror ecx, 0xe
sub edx, esi
sub edi, 0x85138515
jmp 0x4a14e1
push 0x82125c37
inc edi
bswap edi
xor esi, 0x852e0c0f
sub edi, esi
xor edx, esi
xchg esi, ecx
sub esi, edx
rol ecx, 0x19
jmp 0x4a180b
call fcn.004a1f5e
sub edi, esi
bswap esi
mov edx, esi
or esi, 0x85671c74
xor edx, ecx
mov ecx, edi
mov edi, 0x8567f386
shr edi, 9
rol edi, 0x17
or edi, ecx
and edi, 0x8568d278
or esi, ecx
jmp 0x4a1b77
mov ebx, 0x2774562b
sub edx, edi
or edi, edx
not edx
and esi, edi
xchg ecx, edx
xchg esi, edi
mov esi, 0x85bc68fc
ror ecx, 1
add edi, esi
ror edx, 9
sub esi, edi
add ecx, edi
and edi, edx
jmp 0x4a2444
push 0x821977b3
sub esi, edx
bswap esi
and edi, edx
add esi, edi
xchg ecx, edi
mov esi, edx
xor edi, 0x86790064
inc edi
rol ecx, 0x16
jmp 0x4a0b5a
push 0x8212948c
xchg edi, ecx
or esi, edx
add edx, edi
ror ecx, 0xa
xchg ecx, edx
xor esi, edi
jmp 0x4a1d75
call ebx
xchg edx, edi
and ecx, esi
and edx, esi
xchg ecx, edx
shr esi, 0x1f
xchg edi, edx
jmp 0x4a1d1d
pop ebx
add edi, edx
sub esi, ecx
mov esi, edi
sub edx, ecx
sub edx, ecx
or ecx, 0x872dab2b
not esi
sub edx, esi
or edi, esi
or edx, 0x872e95b6
xor edi, esi
sub esi, edi
jmp 0x4a24d1
mov ebx, 0x2774562b
sub esi, 0x8732ac2f
ror esi, 0x19
or esi, ecx
add edi, 0x87335e4e
xchg edx, ecx
or ecx, edi
neg edi
jmp 0x4a0710
jmp loc.004a771a
pop ebx
xchg esi, edx
add esi, ecx
add ecx, esi
or edi, 0x87bcdeb2
shl ecx, 0x11
xor edx, esi
xchg ecx, edi
sub esi, ecx
shl ecx, 5
xchg edi, ecx
rol edi, 0x11
sub esi, edx
or ecx, edi
mov edx, edi
jmp 0x4a0292