Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
sub esi, 0x9a851986
sub edi, edx
call sub.kernel32.dll_GetSystemDefaultLCID
shl edi, 6
inc edx
sub edi, edx
xor esi, 0x9a879813
xchg esi, ecx
cmp eax, 0xfffffef0
jne 0x4010a4
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
ret
nop
add esi, edx
sub edi, ecx
call sub.kernel32.dll_GetSystemDefaultLangID
xchg edx, edi
mov esi, edi
cmp eax, 0xffffff0e
jne 0x401127
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
ret
and edx, 0x9a90520c
mov edi, ecx
inc esi
xor edx, esi
xor ecx, edi
add ecx, edi
neg edi
call sub.kernel32.dll_GetSystemDefaultLCID
and ecx, 0x9a93ed21
cmp eax, 0xfffffee7
jne 0x4011b3
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
ret
ror edi, 3
and esi, ecx
call sub.kernel32.dll_GetSystemDefaultLCID
or esi, 0x9a97d761
ror edx, 3
cmp eax, 0xffffff38
jne 0x401263
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.oleaut32.dll_OleLoadPictureFile
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_AddAccessAllowedAceEx
call sub.oleaut32.dll_OleLoadPictureFile
call sub.oleaut32.dll_OleLoadPictureFile
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.ntdll.dll_RtlUpcaseUnicodeToCustomCPN
call sub.oleaut32.dll_OleLoadPictureFile
call sub.advapi32.dll_FreeEncryptionCertificateHashList
ret
jmp 0x49430f
neg esi
neg edx
and esi, 0x9f9640d2
ror edi, 0x1b
jmp 0x49583c
mov ecx, 0x123b2f04
or edx, ebx
shl esi, 0x10
inc esi
add ebx, esi
mov edx, ebx
xchg edi, ebx
and esi, 0xa3208190
xor ebx, esi
dec edi
mov edi, ebx
or edx, 0xa3225718
bswap esi
add ebx, esi
jmp 0x49543d
push 0x9faac284
sub esi, 0xa34f23e2
neg esi
mov edi, 0xa3502613
sub esi, edi
or esi, edx
or edi, 0xa3517cd3
jmp 0x494a8a
pop ecx
add ebx, edx
mov ebx, edx
xchg edx, ebx
or esi, 0xa3574eae
or esi, edx
and esi, 0xa3583931
xor edx, 0xa358acb9
or ebx, edx
or ebx, esi
xor esi, ebx
or esi, edx
jmp 0x4968f2
pop ecx
xor edx, ebx
sub edi, edx
add edx, esi
xchg esi, ebx
and esi, edi
xor edi, 0xa36fc9a1
or esi, ebx
dec esi
bswap esi
xchg edx, esi
xchg edx, ebx
xor edx, esi
sub edi, edx
sub esi, ebx
or ebx, 0xa373dc3c
jmp 0x49775f
push 0x9fa8acbe
dec edi
xchg edi, edx
and esi, edx
inc edx
mov ebx, 0xa39165f4
inc esi
jmp 0x495a9e
push 0x9fb00c86
and edi, 0xa392758f
mov edx, ebx
xor esi, edx
xchg esi, edi
xchg edi, edx
xchg edx, esi
xor edx, edi
and edx, 0xa395b31b
xchg esi, edx
and edi, esi
and edi, ebx
ror edx, 0x1e
or esi, edx
jmp 0x49767f
push 0x9fab6b18
add ebx, esi
shl ebx, 9
add ebx, edi
sub edi, esi
and edx, esi
sub edi, edx
jmp 0x4943db
push 0x9fa4ef90
sub edi, 0xa3c3a39f
not edi
xchg edx, ebx
mov ebx, esi
and edi, esi
add ebx, edx
ror esi, 0xc
sub ebx, edi
shr esi, 9
or esi, edi
add edx, ebx
add edi, ebx
jmp 0x49662e
push 0x9fa16642
and edx, 0xa3d26216
nop
dec edi
and edi, esi
sub edi, 0xa3d45eda
sub edx, 0xa3d4d559
or ebx, edi
mov edi, ebx
sub edx, ebx
mov ebx, edi
jmp 0x4958fd
pop ecx
add ebx, edi
xor ebx, edx
xor edx, ebx
xor ebx, 0xa3ed0203
dec edx
dec ebx
xor esi, 0xa3ee803a
jmp 0x497009
push 0x9fab171d
or ebx, 0xa3fea663
mov ebx, esi
and ebx, edi
and edi, edx
or esi, edx
shr ebx, 0xd
jmp 0x494862
push 0x9fa3e8cd
ror esi, 5
xor ebx, edi
add edx, ebx
shr edx, 3
neg edx
shl edi, 0x10
add ebx, edx
add ebx, 0xa4058675
xchg edx, esi
and ebx, edi
jmp 0x49564c
mov ecx, 0x123b2f04
ror edx, 0x1b
xor edi, 0xa413bf1b
xor edi, edx
and edx, ebx
add edx, 0xa41528ed
xchg esi, ebx
xchg edi, edx
not edx
jmp 0x495d03
push 0x9fa4941e
sub edx, ebx
shl edi, 0xe
xor esi, ebx
add ebx, edx
shr edx, 0x1b
or edi, edx
shl ebx, 0x18
and edi, 0xa41a3f40
not edx
xor edi, edx
xchg esi, ebx
or edx, edi
jmp 0x4948bb
push 0x9fa11165
xchg edx, edi
xor edx, 0xa48fea25
add edi, edx
or edx, ebx
sub esi, ebx
dec esi
mov edi, ebx
xor edx, 0xa491a37f
and edx, ebx
jmp 0x494928
push 0x9f9e1564
neg ebx
xor edx, 0xa4afddfe
xor esi, edx
sub edx, 0xa4b05804
mov esi, edx
bswap ebx
sub edx, ebx
inc ebx
or edi, 0xa4b19ce1
dec esi
xchg esi, edi
dec ebx
mov edx, ebx
jmp 0x4962a7
call fcn.00494a4c
shr esi, 0x11
and esi, edi
sub ebx, 0xa4b9e1e1
inc esi
add edi, edx
add edx, ebx
sub ebx, esi
jmp 0x496d77
call fcn.00494a4c
add ebx, edi
sub edx, edi
or edi, 0xa4bfde79
or ebx, esi
or edx, ebx
not esi
dec esi
and edx, edi
jmp 0x49714b
push 0x9fadc23c
mov esi, edi
sub edx, esi
xchg esi, ebx
inc edi
xor esi, edx
add edi, esi
xor ebx, 0xa4dabe26
add esi, edi
add esi, edx
rol ebx, 0xc
jmp 0x494b1a
push 0x9faf68b1
xchg edi, ebx
xor edx, 0xa4e36e3a
add edx, 0xa4e40c86
and esi, edx
sub ebx, 0xa4e4f055
jmp 0x496473
call ecx
sub ebx, esi
xor esi, edx
and edx, edi
xor esi, edx
or edx, esi
shl ebx, 0x14
xchg edi, edx
sub ebx, edx
ror edi, 0x13
sub esi, ebx
add edi, ebx
mov esi, edx
mov edx, 0xa4f72a62
jmp 0x495e4c
call fcn.00494a4c
xchg edx, edi
xchg ebx, edi
dec edx
mov ebx, esi
sub edx, esi
jmp 0x497b65
pop ecx
and edi, esi
rol esi, 0x16
or edi, edx
and esi, edx
mov esi, ebx
add edx, ebx
and ebx, 0xa510ef43
or esi, ebx
mov edi, esi
jmp 0x494575
pop ecx
xor edi, edx
xor edx, 0xa530f961
add esi, edi
xchg edx, esi
sub edx, esi
sub esi, ebx
xchg edi, edx
xor ebx, esi
neg ebx
and edx, esi
or edi, esi
jmp 0x496bdf
push 0x9fa43cca
sub ebx, 0xa56210be
add ebx, esi
ror esi, 0x1f
bswap edi
xor ebx, edx
add esi, edx
and ebx, edi
jmp 0x494b3d
call ecx
mov edi, esi
and edi, esi
sub ebx, edi
mov esi, edi
dec edi
and esi, edi
sub edx, esi
sub esi, ebx
ror edx, 8
and edx, esi
or edi, edx
jmp 0x49585a
push 0x9f9d5ae1
xor edx, 0xa5a1d1c8
xchg esi, ebx
mov ebx, edx
or edx, esi
dec esi
mov edi, edx
and esi, edi
inc esi
sub esi, edi
jmp 0x495b93
pop ecx
mov ebx, edx
inc edi
or edi, esi
mov edi, edx
xor edi, ebx
shl esi, 0xf
or esi, ebx
add ebx, edi
add ebx, edi
sub esi, edi
or ebx, edi
jmp 0x494645
mov ecx, 0x123b2f04
xchg edi, ebx
mov ebx, 0xa5bb1771
mov edi, 0xa5bb8ddb
mov esi, 0xa5bc12e7
or esi, edi
neg esi
mov edi, ebx
and edx, 0xa5bde5b1
sub edi, esi
neg edx
shr edx, 9
jmp 0x496d41
call fcn.00494a4c
sub edx, ebx
and ebx, edx
neg esi
and ebx, esi
sub edi, esi
sub esi, edx
and esi, edi
ror edx, 0x17
add ebx, 0xa5ca5628
mov esi, edi
neg edx
jmp 0x49536a
mov ecx, 0x123b2f04
add edx, 0xa5f31c10
or ebx, edi
mov edi, ebx
add esi, ebx
sub esi, ebx
shr esi, 0x1b
sub ebx, edi
mov edx, ebx
jmp 0x495171
push 0x9f9dc770
add edi, 0xa6132ae2
rol ebx, 0xd
add edx, edi
xor ebx, esi
xor ebx, edx
add esi, edi
bswap ebx
and esi, 0xa61697e2
mov edi, 0xa617042d
sub ebx, esi
or ebx, esi
add edi, 0xa6184800
sub edx, esi
dec edx
jmp 0x4950a6
pop ecx
sub esi, edi
add esi, edi
sub edi, esi
mov edi, esi
rol esi, 0x16
mov esi, edx
add ebx, edi
add ebx, esi
bswap esi
jmp 0x495291
call fcn.00494a4c
add edi, esi
dec ebx
nop
not edx
inc edi
ror ebx, 7
rol esi, 3
sub edx, edi
shr ebx, 4
jmp 0x49618f
pop ecx
mov ebx, edx
inc edi
xor edi, edx
add edi, edx
dec edi
rol edi, 0xd
xor ebx, edx
ror esi, 0x16
sub esi, edx
xor esi, edi
and ebx, edi
jmp 0x4954e5
push 0x9fb0b2be
mov ebx, edi
shr ebx, 0x1d
and esi, 0xa69a2952
inc edi
xor edx, ebx
jmp 0x496521
jmp loc.0049a636
call ecx
shl edx, 0x1a
or esi, edx
mov edx, esi
ror ebx, 0x10
and edi, 0xa6ea4f63
mov edi, edx
xchg esi, ebx
add edi, edx
and edx, ebx
or edx, ebx
xchg edx, esi
xor ebx, esi
jmp 0x496e65
push 0x9f9e6f01
dec esi
mov edx, edi
and edi, 0xa7132498
xchg ebx, edx
mov esi, ebx
xor esi, edx
sub edi, 0xa715001f
xchg ebx, edi
inc esi
xchg ebx, edi
and ebx, esi
jmp 0x497042
push 0x9fafbcdd
mov edi, edx
sub edx, ebx
add ebx, edx
xchg edi, ebx
or edx, edi
jmp 0x494750
mov ecx, 0x123b2f04
shl ebx, 0xd
sub ebx, esi
xor esi, edi
or esi, edx
shr esi, 7
and edi, esi
add ebx, 0xa76e93a1
add edx, esi
add edi, esi
inc edx
xchg ebx, edi
jmp 0x49602a
mov ecx, 0x123b2f04
neg edx
or edi, 0xa793709e
add esi, 0xa793dc83
mov edx, esi
mov ebx, 0xa794ef3b
or edx, edi
mov ebx, 0xa795ca55
rol edx, 0x15
xchg esi, edi
shr esi, 0x1b
bswap esi
jmp 0x495128
pop ecx
or ebx, 0xa7ec1690
xchg esi, edx
xor edx, ebx
mov ebx, esi
mov edx, edi
xor edi, edx
jmp 0x495bf7
pop ecx
add edi, 0xa84f687a
sub esi, edx
xor edi, esi
sub edx, esi
bswap edx
and ebx, 0xa851af4c
sub edx, 0xa8521fbd
add esi, edi
jmp 0x496f15
call fcn.00494a4c
shr edi, 0x12
sub edi, 0xa87f2b42
shr ebx, 1
mov esi, 0xa8800ca7
mov edx, edi
mov ebx, edx
inc edx
or edi, ebx
jmp 0x4956ca
call ecx
mov ebx, 0xa885e46b
xor edx, edi
neg edx
add esi, edx
or edx, esi
shl edx, 0xa
jmp 0x4970b5
pop ecx
and edx, edi
xor esi, edi
jmp 0x4952e7
pop ecx
add edx, 0xa8c1b8b7
or ebx, esi
add edi, esi
and ebx, edi
mov edi, edx
xchg edx, esi
mov ebx, edx
add esi, edx
or esi, edx
jmp 0x494edd
pop ecx
neg edx
sub edi, edx
ror ebx, 0x10
shr edi, 0x17
jmp 0x4978f2
mov ecx, 0x123b2f04
sub esi, edx
bswap edx
and edx, esi
inc ebx
inc esi
add edi, 0xa8edcfa6
or edx, 0xa8ee3aaa
xor edi, edx
xchg edx, ebx
jmp 0x495963
pop ecx
add edi, ebx
not esi
neg edi
or esi, edi
add edi, ebx
xor ebx, edi
and esi, edx
xor edi, esi
and edi, edx
shl esi, 0x14
and esi, edi
shl edx, 0x11
add esi, ebx
xchg ebx, edx
and ebx, esi
jmp 0x49716d
call ecx
mov esi, 0xa9155e9c
sub esi, ebx
jmp 0x497159
pop ecx
xor esi, edx
or edx, esi
shl edx, 0x14
xchg esi, ebx
and edx, esi
sub ebx, esi
dec esi
jmp 0x495450
pop ecx
sub edx, edi
and ebx, edi
neg edx
add ebx, esi
ror edx, 0xd
xor esi, edi
jmp 0x4949f4
push 0x9fa858fe
xchg edx, esi
or edi, esi
sub esi, ebx
inc edi
xchg ebx, esi
and edi, ebx
jmp 0x49473a
push 0x9fb05fe9
shr ebx, 8
xor edx, edi
xor ebx, edx
or edx, esi
sub esi, edi
mov ebx, edx
mov esi, edx
sub edx, ebx
add ebx, esi
dec edi
shl esi, 0x1b
ror ebx, 0x1e
jmp 0x495f24
push 0x9fa39721
xor esi, 0xaa6c226d
or edi, 0xaa6c9bb0
sub esi, edx
xchg edx, edi
not edx
sub edi, ebx
or edx, 0xaa6efebe
jmp 0x494aa5
pop ecx
mov edx, edi
sub edi, 0xaaa24acb
and ebx, edx
mov esi, ebx
mov edx, edi
not ebx
and edi, edx
add edi, edx
shl edx, 0x1a
mov edx, ebx
jmp 0x49763f
call ecx
sub ebx, 0xaafc16f1
add edi, edx
neg ebx
mov esi, edx
xor esi, ebx
or ebx, edx
add esi, edx
xor ebx, esi
neg edx
and ebx, esi
xchg esi, edx
or esi, 0xab010881
sub esi, edx
sub ebx, edx
jmp 0x4945ad