Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetInputDesktop
cmp eax, 0xfffffee3
jne 0x4010ac
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
ret
call sub.kernel32.dll_GetSystemDefaultLangID
cmp eax, 0xfffffedf
jne 0x401112
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
ret
call sub.user32.dll_GetActiveWindow
cmp eax, 0xffffff18
jne 0x401196
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
ret
call sub.user32.dll_GetInputDesktop
cmp eax, 0xffffff26
jne 0x40120b
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_NtOpenSymbolicLinkObject
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlUnicodeStringToOemSize
call sub.ntdll.dll_RtlInitializeBitMap
call sub.ntdll.dll_NtOpenSymbolicLinkObject
ret
jmp 0x4985e9
and ecx, 0x8e3a1ac7
and ebx, 0x8e3a9adc
bswap ebx
or ebx, edi
not ebx
xchg edi, esi
or edi, ecx
jmp 0x49aee0
mov esi, 0x2774562b
ror ebx, 0x1e
sub edi, 0x95f402df
shl ecx, 5
xor edi, ebx
add edx, ecx
or ebx, edx
shl ebx, 0x1e
add ecx, edi
ror ecx, 0x1a
inc edi
xchg ecx, edx
jmp 0x498a57
call esi
xor edi, edx
and ecx, edi
xchg ecx, edx
and ebx, 0x961c694e
neg edi
sub ebx, edi
or edi, 0x961dcbec
or ebx, edi
add edx, ebx
mov ecx, 0x961eff04
or edx, ebx
sub edx, ecx
xchg ecx, edi
bswap ecx
jmp 0x49a64e
push 0x8e4fe4d3
mov edi, ecx
dec edx
jmp 0x49b2e9
push 0x8e43d390
mov edi, edx
dec edi
xchg edi, ecx
or edi, 0x965f0199
or ecx, 0x965f9475
shl edx, 0x18
add ecx, 0x9660745a
mov ebx, edi
jmp 0x498e52
push 0x8e448b03
sub ebx, edx
xor ecx, ebx
sub edx, edi
dec ecx
add ecx, ebx
and edx, edi
and edx, ecx
or edx, ecx
shl ecx, 0x13
and edx, edi
sub edx, 0x969ae359
not edx
xor edi, 0x969bcc9e
or edx, ecx
or edi, 0x969cf151
jmp 0x49b8de
pop esi
not edx
mov ecx, edx
add ecx, ebx
add ecx, edi
rol edi, 7
add ebx, edx
xor edx, 0x96afd606
dec edx
sub ecx, ebx
and edi, edx
jmp 0x499e81
jmp loc.004a0000
call fcn.004994e7
mov ebx, ecx
sub ebx, 0x96fc2e29
xor ecx, edi
mov edx, ecx
shl edi, 2
jmp 0x49af8e
pop esi
sub edx, ebx
dec ecx
add edx, edi
sub edi, edx
xor edx, ebx
xor ebx, ecx
mov ecx, edi
or edi, edx
mov edi, ebx
neg ebx
xchg edi, ebx
add edx, ecx
and edx, edi
not edi
jmp 0x49b935
pop esi
or ebx, edi
bswap ecx
sub edi, edx
neg ebx
bswap edx
bswap edi
rol ebx, 4
jmp 0x498a1d
push 0x8e44221b
mov edi, 0x97efcf27
add edi, ecx
and edi, 0x97f03178
xor edi, ebx
mov edx, ebx
xor edx, edi
or ebx, 0x97f108c9
sub edi, 0x97f13d9a
xchg ecx, edi
add edx, ebx
mov ecx, ebx
mov ecx, edx
add edx, edi
jmp 0x4989c9
pop esi
mov edi, ebx
sub ebx, edi
mov ebx, 0x97f2e1c4
add ebx, edi
bswap edi
or ecx, edx
mov ecx, edi
or ebx, edx
rol edx, 0x17
add ebx, edi
shr edi, 0x10
mov edi, 0x97fc6b68
xchg edi, ebx
jmp 0x498c96
mov esi, 0x2774562b
or ecx, ebx
xchg edi, ecx
add ecx, edi
xor ecx, edi
xor ebx, 0x981a6aed
rol edi, 0xf
xor edx, ecx
xchg edi, edx
xor ecx, edx
sub edx, edi
ror ebx, 0xc
bswap edi
or ecx, 0x981c42bf
rol edx, 0x1c
jmp 0x4999aa
push 0x8e49ebbc
xchg ecx, edx
add edx, ebx
xchg edi, ecx
dec ebx
mov edx, 0x98239856
inc edi
sub ebx, 0x98240d27
add ecx, 0x982463a2
add edi, ebx
or edi, ebx
or ecx, edx
mov ecx, ebx
mov ecx, ebx
or edi, edx
jmp 0x49b27b
push 0x8e49a0a9
shr ecx, 0x1d
mov edx, edi
mov edi, edx
xor ebx, edx
shl edi, 0xd
xchg edx, ebx
and edx, ebx
xor ebx, ecx
xchg edx, edi
and ecx, edi
neg edi
sub ebx, ecx
xor ecx, edi
jmp 0x499102
mov esi, 0x2774562b
bswap edi
mov edx, ebx
xchg ebx, ecx
add ebx, 0x9880314c
xchg edi, ecx
shr edi, 0xe
or ebx, 0x9880de34
sub edx, 0x9881131d
ror edx, 0x10
and edi, edx
mov ecx, ebx
jmp 0x498c26
pop esi
shl ebx, 0x13
add edx, ebx
xchg ebx, ecx
bswap edi
sub edx, ebx
shl edi, 0x14
or edi, ecx
xor edi, edx
nop
ror ecx, 0x14
xchg ecx, edx
or ebx, edx
xchg edx, ebx
xchg edx, ebx
add ebx, ecx
inc edx
jmp 0x498d19
pop esi
neg ebx
xchg edx, edi
bswap edi
bswap edx
and edx, ebx
add ebx, edi
xchg edi, edx
xor ecx, 0x9926a4df
xor ebx, 0x9926e560
mov edi, 0x992733fc
jmp 0x49b510
call fcn.004994e7
and ecx, 0x992793ac
add edx, 0x9927c4f0
mov ebx, ecx
add ecx, 0x99282ea2
xor ecx, ebx
jmp 0x498767
push 0x8e47bc7d
and edx, ebx
or ebx, 0x993be8e2
and ebx, ecx
and ecx, 0x993c5f72
or ebx, 0x993ca7e4
rol ecx, 0x1e
jmp 0x499078
push 0x8e437c22
sub ebx, edx
xor ebx, edx
and edi, ebx
xchg edi, edx
dec edi
or ebx, edx
xor edx, ecx
mov edi, 0x99815e05
xchg ebx, edi
not ebx
and edx, ecx
or edx, edi
not ebx
jmp 0x4988c2
pop esi
add edx, ebx
add edx, 0x9984b50a
add ecx, edi
xchg ecx, edi
mov ecx, edi
mov edx, ebx
add ebx, edx
or edi, ecx
jmp 0x4987e5
push 0x8e510549
xor edi, 0x99ce6c26
and ecx, ebx
sub ecx, ebx
or ebx, ecx
sub ebx, edi
ror edi, 0x1a
and edi, ecx
dec ebx
inc edx
sub edx, ebx
jmp 0x498672
call fcn.004994e7
ror edi, 0xe
and edi, edx
mov edi, edx
rol edx, 0x19
or ebx, edx
sub ecx, 0x9a627dd7
and ecx, edx
ror ebx, 0x10
xchg ecx, ebx
jmp 0x49ba4d
pop esi
add edx, 0x9a6dcd6f
inc ecx
and ebx, 0x9a6e3bed
xor ecx, 0x9a6e6d06
mov edi, 0x9a6eadbd
xchg ebx, edx
xor edx, ebx
xor ebx, edx
xor edi, ebx
and edi, ecx
add ebx, 0x9a718380
add edx, ebx
jmp 0x49b854
push 0x8e508baa
or edi, edx
xchg edx, edi
sub edx, ecx
or ebx, ecx
xor edx, 0x9b07a944
mov ecx, edx
add ecx, ebx
mov edx, ebx
and ebx, edi
xchg edx, ecx
shl ecx, 0x18
shl ebx, 0x16
and ebx, edi
jmp 0x49a02f
push 0x8e431de9
add edi, edx
sub edi, ebx
or edi, ebx
xchg edi, ebx
bswap ecx
xchg edx, ebx
add ebx, 0x9b483550
sub ecx, 0x9b486e42
not ebx
sub edx, ecx
add ebx, edx
jmp 0x499e5b
call esi
and edi, ebx
xchg edi, ebx
mov ecx, 0x9b518a50
add ebx, 0x9b51bfaf
xchg ebx, edi
sub edi, ebx
mov ebx, edx
and ebx, edx
add edx, ebx
inc ecx
or edi, 0x9b535348
jmp 0x499684
push 0x8e4a361c
xor ebx, edx
not ebx
sub ecx, edx
not ebx
bswap ebx
dec ebx
jmp 0x4993f3
push 0x8e503467
add ebx, ecx
not edi
and edi, ebx
xor ecx, ebx
add ebx, edi
neg edi
add ebx, edx
sub edi, 0x9b9a2c97
neg edx
or ecx, edi
add edi, 0x9b9ae020
dec edi
jmp 0x49ad05
pop esi
xchg edx, ebx
bswap ebx
add ebx, edx
shl ecx, 0x18
dec edi
xor edx, ebx
jmp 0x498e85
push 0x8e495a2b
dec ebx
xor ecx, edi
and edx, ebx
dec ebx
add ebx, ecx
dec ecx
sub edi, edx
dec edi
xor ebx, edx
and edi, 0x9c01b0d2
jmp 0x4992ec
mov esi, 0x123b2f04
mov edi, edx
or ecx, ebx
sub edx, ebx
sub ebx, 0x9c0b777b
sub ebx, ecx
not edi
mov ebx, ecx
xor ecx, edi
jmp 0x49a5b5
pop esi
add ebx, ecx
xor edi, edx
sub ebx, 0x9c1c1d55
xchg ecx, edx
xor edx, ebx
xchg ebx, edi
xchg edi, edx
add edi, ecx
or edx, ebx
sub ecx, 0x9c1d95e6
xor ecx, ebx
jmp 0x499ab3
call esi
and edx, ecx
xchg edx, edi
and ebx, edx
shl edx, 0x1b
xor ebx, 0x9c4315e2
mov edx, ebx
xchg ecx, edi
xor ebx, ecx
xor edi, ebx
and edi, ebx
jmp 0x499985