Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetMessageExtraInfo
cmp eax, 0xffffff15
jne 0x4010ac
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
ret
call sub.user32.dll_GetMessageExtraInfo
cmp eax, 0xffffff0b
jne 0x40113f
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
ret
call sub.user32.dll_GetMessageExtraInfo
cmp eax, 0xffffff30
jne 0x4011e6
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.oleaut32.dll_VarBoolFromCy
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
ret
call sub.user32.dll_GetMessageExtraInfo
cmp eax, 0xffffff13
jne 0x401279
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.advapi32.dll_InitializeAcl
call sub.oleaut32.dll_VarBoolFromCy
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.oleaut32.dll_VarBoolFromCy
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.advapi32.dll_InitializeAcl
call sub.ole32.dll_CoInvalidateRemoteMachineBindings
call sub.advapi32.dll_InitializeAcl
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.ntdll.dll_RtlInitializeGenericTable
call sub.oleaut32.dll_VarBoolFromCy
ret
jmp 0x4986cc
xchg ebx, edi
add esi, ebx
or ebx, esi
jmp 0x4998c7
pop ebx
xchg edx, esi
sub edx, edi
and ecx, edx
xor ecx, 0xf23ef61b
or edi, 0xf23f2dd2
shr esi, 0x11
xor esi, 0xf23fa134
jmp 0x49bb0c
push 0xee91a14e
and edx, 0xf26bed8e
add esi, ecx
add edx, 0xf26c538e
or edi, edx
or edx, edi
and esi, edi
xor ecx, edi
rol esi, 0x12
jmp 0x49946f
pop ebx
shl edi, 0x1e
xor edx, ecx
mov edx, edi
sub esi, 0xf26e3c04
xor ecx, 0xf26e735b
and edx, ecx
add esi, 0xf26ee5a3
bswap edi
jmp 0x49b01d
call fcn.0049b89f
sub esi, ecx
mov edx, ecx
mov edx, edi
mov edx, 0xf2799cc3
sub esi, edi
or edi, ecx
dec esi
not ecx
and edi, edx
and edi, esi
jmp 0x499edc
jmp loc.004a0000
push 0xee89969e
and edx, edi
add edi, esi
sub esi, edx
mov edi, ecx
sub ecx, edx
sub edi, 0xf29f2fcc
or esi, edi
shl edi, 5
inc edi
or esi, edx
sub ecx, esi
or ecx, 0xf2a07088
add esi, 0xf2a0a42f
not ecx
jmp 0x49b73f
call fcn.0049b89f
mov ecx, edi
and edx, edi
shl edx, 2
mov ecx, 0xf2aac2ef
xor edi, 0xf2ab0268
and edi, esi
or edx, esi
and esi, edi
jmp 0x4998a7
push 0xee9509c1
mov edx, edi
and edi, ecx
xor esi, edi
inc esi
xchg esi, ecx
mov edx, esi
and edi, esi
not esi
xchg edi, edx
and edi, ecx
neg ecx
mov edi, esi
sub edx, edi
jmp 0x499327
call ebx
rol edi, 0x1d
xchg edx, esi
rol edi, 0xd
add esi, 0xf2bc993e
and edi, ecx
neg edx
xchg edi, ecx
or esi, edx
and ecx, edi
add edi, esi
ror edx, 5
and edx, esi
jmp 0x4989cf
pop ebx
bswap esi
add ecx, edi
and edi, edx
dec edi
add ecx, 0xf2c7a1ea
inc edx
or edx, ecx
or edi, edx
jmp 0x499fb8
mov ebx, 0x2774562b
bswap edi
mov esi, ecx
mov esi, edi
mov esi, edx
jmp 0x498d31
pop ebx
mov ecx, edi
sub edx, esi
xchg ecx, esi
add edi, esi
xchg edi, edx
and edx, ecx
jmp 0x49bb33
push 0xee955857
xchg ecx, esi
and ecx, edi
or edx, ecx
or esi, ecx
or edi, edx
not ecx
xchg edi, esi
and edx, ecx
xchg edi, ecx
and edx, esi
jmp 0x49b504
push 0xee8b8faa
add esi, edx
add edx, ecx
add esi, ecx
mov edx, esi
and esi, edx
and ecx, 0xf3395321
jmp 0x4991f2
push 0xee91ebbf
neg edx
rol edi, 0x19
add edx, edi
xor ecx, 0xf342db66
mov ecx, edi
jmp 0x49aabd
push 0xee8ed61b
or ecx, esi
not edi
inc edi
add edi, 0xf36b8b5e
shr ecx, 0x11
bswap esi
and esi, ecx
add edx, 0xf36c66a5
bswap edi
bswap esi
add edx, esi
add ecx, esi
sub edi, 0xf36d97c3
xchg ecx, edi
sub edi, edx
jmp 0x49b8fb
mov ebx, 0x2774562b
and ecx, esi
xor esi, edi
add ecx, esi
xor esi, ecx
mov edi, esi
rol ecx, 0x14
and ecx, esi
or esi, 0xf3921d48
xor esi, ecx
jmp 0x499b84
push 0xee879337
nop
shl edx, 0xb
xchg edx, ecx
or esi, edx
and esi, edi
shl edx, 0xa
jmp 0x49a08e
pop ebx
ror ecx, 8
xor edi, 0xf3bb8992
and edi, esi
xor esi, ecx
mov ecx, 0xf3bc227d
add edx, 0xf3bc567a
xchg edi, ecx
sub edi, edx
jmp 0x49b13d
call ebx
or ecx, 0xf3c2f125
xor edx, esi
xchg edi, edx
and edi, edx
sub ecx, esi
or esi, ecx
mov edx, 0xf3c57982
bswap edi
mov esi, edx
jmp 0x49bc1b
push 0xee875adc
add ecx, edi
or edi, ecx
and ecx, 0xf3c791a2
add esi, edi
sub edi, 0xf3c848c1
add esi, edx
mov esi, edx
bswap esi
and ecx, edi
jmp 0x4997f3
pop ebx
sub edx, edi
xor esi, edi
or ecx, edx
and edi, esi
sub edx, ecx
bswap edi
mov edx, 0xf3ebbfbd
not edi
mov ecx, 0xf3ec3462
or edi, ecx
jmp 0x49b5c9
call fcn.0049b89f
mov esi, edx
nop
inc ecx
or ecx, 0xf3fa810b
bswap edx
and edx, esi
and ecx, 0xf3fc8c0f
xor esi, edx
jmp 0x49a946
pop ebx
xor edx, esi
or ecx, esi
and edx, esi
add ecx, 0xf400d8c9
xor esi, 0xf4013dcb
sub edi, edx
shl ecx, 0x1f
neg edx
neg esi
jmp 0x499aa6
call ebx
xchg edi, edx
xor ecx, edx
and ecx, edx
rol ecx, 0x16
sub edi, 0xf411cf76
xor ecx, edx
not ecx
mov esi, 0xf4126a0e
or edi, edx
add esi, edx
jmp 0x498732
call ebx
shr esi, 9
shl edi, 0xc
xor esi, edx
sub edi, esi
shl ecx, 0xb
and edx, 0xf44143fd
sub esi, ecx
add ecx, edx
mov ecx, edi
add ecx, edx
inc esi
add esi, 0xf4427cbf
add ecx, edi
jmp 0x49b8b3
mov ebx, 0x123b2f04
add esi, ecx
or ecx, 0xf44f5889
xor edi, ecx
and edx, ecx
and ecx, 0xf44ff53b
neg esi
dec esi
not edx
neg esi
xor esi, edx
mov esi, edx
jmp 0x49aa23
pop ebx
sub ecx, edi
not edi
xor ecx, 0xf454e58b
xchg ecx, edi
xchg ecx, edi
xor edi, 0xf45606e3
add esi, edx
or ecx, edx
or esi, edi
jmp 0x49b550
pop ebx
sub esi, 0xf4598596
ror ecx, 0x1f
and edx, edi
jmp 0x49b3fa
mov ebx, 0x123b2f04
inc edx
ror esi, 0x13
and ecx, esi
xchg edx, edi
xor ecx, edi
jmp 0x498a74
push 0xee8b659d
add edx, ecx
mov esi, ecx
sub edx, esi
mov ecx, esi
xchg edx, edi
and edx, 0xf478403c
shr esi, 0xf
xor edi, 0xf478aa3c
mov edx, ecx
or edi, ecx
jmp 0x499420
push 0xee8e5bfd
or edi, ecx
dec edi
shl esi, 0xf
sub esi, edi
xchg edi, ecx
mov ecx, edx
and edi, 0xf47de24c
jmp 0x49b568
push 0xee8e2e24
or edx, ecx
and ecx, esi
or ecx, edx
jmp 0x49a1d1
pop ebx
add esi, ecx
or edx, esi
or edi, 0xf4db30f0
xor esi, ecx
or edx, esi
sub edx, 0xf4dc52cd
neg edx
sub esi, edx
xchg edx, ecx
neg edi
mov esi, 0xf4de7d02
neg edi
jmp 0x49984e
call ebx
xchg edx, esi
xor ecx, 0xf5104948
add ecx, 0xf5107c80
add ecx, edx
mov ecx, 0xf510ef3d
xchg esi, ecx
xchg edx, ecx
sub ecx, edi
sub esi, 0xf511bf2b
xchg ecx, edx
or edi, edx
sub edi, ecx
jmp 0x499fd8
call fcn.0049b89f
neg ecx
xor edi, ecx
sub esi, edi
shr edi, 9
xor ecx, 0xf522e044
xchg edi, esi
sub edi, ecx
and ecx, edi
neg edi
jmp 0x49b44c
push 0xee923785
sub edx, esi
xor ecx, 0xf52d203a
ror ecx, 0xf
sub ecx, esi
not ecx
or edx, edi
mov edx, edi
or esi, edx
sub ecx, edx
or esi, ecx
and ecx, edx
ror edx, 0xd
add edx, 0xf530722f
xor edi, edx
sub edx, esi
jmp 0x4996f0
call fcn.0049b89f
mov edx, edi
mov edi, ecx
or edi, edx
not ecx
xor edx, edi
mov esi, edi
shr esi, 0x1d
sub esi, edi
jmp 0x498e2e
push 0xee8b3b66
or esi, edi
add edx, ecx
neg edx
rol esi, 0x17
bswap edx
xor edi, esi
and esi, edi
not edi
add edx, esi
not ecx
jmp 0x49a185
push 0xee896c54
mov edx, esi
or ecx, 0xf5908e97
or ecx, edi
sub edx, edi
add edi, esi
inc esi
rol edi, 6
inc edx
add edi, esi
jmp 0x498c6e
pop ebx
add edx, ecx
add edi, esi
ror edi, 0xe
or ecx, edx
sub esi, ecx
mov esi, 0xf5972fcd
jmp 0x49b0cc
pop ebx
add edi, ecx
add esi, edi
mov esi, ecx
xchg edi, edx
shl edi, 0xf
or edx, esi
dec esi
not ecx
jmp 0x49a546
push 0xee915506
add esi, ecx
xor edx, edi
rol ecx, 0x15
mov esi, edx
and esi, ecx
or esi, edx
ror edi, 2
neg ecx
sub edi, ecx
jmp 0x4989ac
pop ebx
and edx, 0xf5dcfd90
add edi, ecx
or edx, edi
add edi, ecx
xor edi, edx
shr esi, 4
or esi, 0xf5de2e8c
and esi, edi
xor edx, edi
sub ecx, edi
sub edx, esi
mov edi, 0xf5df3a15
add ecx, 0xf5df7171
shl ecx, 0xf
and edx, edi
jmp 0x499bc0
call ebx
and edx, esi
dec edi
add esi, 0xf5e21a98
xor esi, ecx
add edi, edx
xchg edx, edi
add edi, 0xf5e2e8d8
and ecx, edi
not edx
jmp 0x49b6fd
mov ebx, 0x2774562b
sub esi, edi
xor ecx, 0xf5ef4974
xchg edx, esi
bswap edx
and esi, edi
inc ecx
mov edi, ecx
add esi, ecx
shr edi, 4
rol esi, 0x1d
or esi, edx
and esi, edi
jmp 0x498b37
pop ebx
and edx, ecx
or edx, edi
or ecx, edi
ror edi, 0x13
or ecx, esi
dec edx
sub edi, ecx
xchg edx, esi
xchg esi, ecx
jmp 0x49af2c
push 0xee8e85c8
xchg edx, esi
xchg esi, edi
ror ecx, 0xe
shl esi, 9
or edx, 0xf5f804f9
sub ecx, edi
inc ecx
xchg esi, ecx
sub edi, 0xf5f92108
rol esi, 0x10
xchg edi, edx
sub edx, ecx
or ecx, esi
and edi, esi
jmp 0x4995d6
push 0xee89e8b1
or edx, 0xf5fb91cf
or edx, 0xf5fbfdf9
and ecx, edx
add esi, edi
ror esi, 0xe
not ecx
or edi, esi
mov edx, esi
add edi, 0xf5fee9f2
sub ecx, 0xf5ff4572
or edx, ecx
jmp 0x499f6d
push 0xee94bff5
sub edx, ecx
add esi, ecx
xchg edx, esi
xor edx, ecx
shr esi, 0x16
sub ecx, edx
not edi
xor esi, ecx
add ecx, edi
inc edi
or esi, 0xf6022211
xchg ecx, edi
mov ecx, 0xf6028cd3
jmp 0x498da2
call fcn.0049b89f
shr edx, 3
not esi
sub ecx, edi
xor edx, ecx
mov edx, esi
or ecx, esi
or ecx, edx
add ecx, 0xf608d2e0
jmp 0x499cb1
pop ebx
sub edx, 0xf613f3e4
sub edx, esi
shl edi, 0xa
mov ecx, 0xf6148ed6
or edi, edx
add ecx, edi
xor edi, esi
and ecx, 0xf615847c
add ecx, 0xf615b848
sub ecx, edi
jmp 0x498eba
push 0xee89c1b4
xchg esi, edx
and ecx, 0xf617ec61
or edi, ecx
rol ecx, 0x16
dec esi
sub edi, edx
xor ecx, esi
dec esi
xor esi, ecx
jmp 0x49b598
pop ebx
add edx, esi
neg esi
sub esi, edx
shr esi, 0x1c
xor edi, ecx
xchg esi, edx
inc esi
add esi, edi
add ecx, 0xf63b8384
rol edi, 0x1d
xchg edx, edi
mov edi, edx
jmp 0x4992ec
mov ebx, 0x2774562b
or esi, edi
xor edx, edi
add edi, edx
xchg esi, edi
or edi, ecx
and esi, edi
and edx, edi
sub edi, ecx
add edi, ecx
shr esi, 3
sub ecx, 0xf640bd31
or ecx, edx
xchg edi, edx
jmp 0x49b648
pop ebx
mov ecx, 0xf67dea36
sub edx, edi
xor ecx, edx
add edi, 0xf67ea42a
not ecx
sub edx, esi
dec edx
add ecx, 0xf67f836f
or ecx, esi
rol esi, 0xd
mov esi, ecx
jmp 0x49a671
push 0xee889a86
mov ecx, 0xf680600a
add edi, esi
or edx, edi
add edi, edx
or ecx, edx
sub edx, 0xf6816bcd
or edx, esi
jmp 0x49bc8a
pop ebx
and esi, edi
and edx, 0xf6947338
mov edi, ecx
inc esi
add ecx, edi
xor edx, 0xf6953eb9
sub edi, 0xf69575e4
or edx, esi
add ecx, esi
xor ecx, 0xf696190c
or esi, edx
xor esi, edx
jmp 0x49b05f
mov ebx, 0x123b2f04
and esi, ecx
rol esi, 5
add ecx, edx
xor ecx, 0xf69b77c3
xchg edx, esi
not edi
jmp 0x49aea4