Function at 0x401000
Capabilities:
Decompress data using ucl
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
shr ecx, 0x1b
and edi, 0xee36b71e
add esi, edi
xor edx, esi
sub esi, edi
sub edx, ecx
call sub.user32.dll_GetDesktopWindow
add ecx, esi
add ecx, edx
sub esi, edx
xor esi, 0xee472743
cmp eax, 0xffffff07
jne 0x401097
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
ret
or esi, 0xee4a2215
inc edx
sub edi, 0xee4b0869
rol edi, 2
xchg edx, esi
call sub.kernel32.dll_GetCurrentProcess
mov edi, 0xee4c99c2
or edi, ecx
cmp eax, 0xfffffee2
jne 0x401120
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
ret
add ecx, edx
or edi, 0xee574eeb
call sub.user32.dll_GetDesktopWindow
sub edx, 0xee57f32d
bswap edx
xor edi, ecx
and ecx, edi
xor edi, esi
inc edi
ror edi, 0x1b
add esi, 0xee5b3b3c
cmp eax, 0xffffff36
jne 0x4011ab
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
ret
xor edx, edi
bswap edx
rol esi, 0x16
ror esi, 3
sub esi, edx
rol ecx, 3
add ecx, edi
call sub.kernel32.dll_GetCurrentProcess
add ecx, edi
mov ecx, edi
xor ecx, esi
shr edx, 0x1a
dec esi
shl edx, 0x1e
and ecx, edi
cmp eax, 0xffffff34
jne 0x401263
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
call sub.advapi32.dll_BuildImpersonateExplicitAccessWithNameA
ret
jmp 0x5a0b31
xor ecx, 0xf2c2bd0b
xor esi, 0xf2c3027d
rol ecx, 0xa
ror edx, 4
and edi, ecx
xchg edi, esi
sub ecx, edx
jmp 0x5a2b88
call esi
mov edi, ecx
mov ebx, edx
sub edi, 0xc677623
mov ecx, edx
xchg ebx, edi
add ebx, ecx
xor edx, ecx
add ebx, edx
xor edi, ebx
jmp 0x5a3cae
mov esi, 0x2774562b
bswap ebx
shr edi, 0xe
or ecx, 0xec3453e
rol edx, 0x1f
ror edx, 0x14
sub ebx, 0xec4d744
xchg edi, ecx
jmp 0x5a3273
push 0xf2d33540
not ecx
and ecx, edx
xor edx, ecx
xor edx, 0x1078ea77
or ecx, 0x10795e9c
and ecx, edi
xor ecx, edi
ror edi, 0x15
mov edi, ebx
add edi, ecx
add edi, ecx
shr edx, 0x19
jmp 0x5a19db
push 0xf2d546d6
xor ecx, 0x1089bb2e
xchg edi, ebx
and ebx, 0x108a9820
inc edi
jmp 0x5a41a1
push 0xf2d3844a
or ebx, ecx
neg ebx
not edi
and edx, ecx
and edx, ecx
neg edi
shl ecx, 0x18
jmp 0x5a1a0a
push 0xf2d3d079
add ebx, ecx
or edx, ebx
shl edi, 1
mov edi, ebx
xor edx, 0x110c579e
jmp 0x5a265d
mov esi, 0x2774562b
shl edx, 0x1b
dec edi
xchg ecx, edi
mov ecx, ebx
xor ecx, edi
xchg edx, edi
and ecx, edi
mov ebx, ecx
shr edi, 0x1c
and edx, edi
and edi, edx
inc edi
jmp 0x5a3c67
push 0xf2d5f535
mov edi, ecx
xor edx, ebx
or edi, ebx
neg edx
xor edx, ebx
jmp 0x5a1144
push 0xf2d2d6f3
inc edx
and ecx, edx
sub edx, edi
dec ecx
mov ecx, edx
and ecx, 0x167512b2
or ebx, 0x1675813a
add ebx, 0x167600b9
jmp 0x5a18a2
pop esi
and edx, ebx
and ebx, edx
or edx, ebx
mov ebx, edx
xchg edi, ecx
sub edx, ecx
mov ecx, edx
add ebx, ecx
add edi, edx
and edi, ecx
dec ecx
jmp 0x5a33ad
push 0xf2d5c8bc
shr edi, 0x19
or ecx, ebx
xchg ecx, ebx
mov edi, ebx
xor ebx, ecx
shl ecx, 0x12
jmp 0x5a2696
jmp loc.005a9000
pop esi
or edi, ebx
and edi, ebx
xchg ecx, edx
bswap edi
xor edx, ecx
not edx
xor edi, ecx
not edi
dec edi
and ebx, edi
add edi, ecx
mov ecx, ebx
xchg edi, ecx
add ecx, edi
jmp 0x5a2bd3
pop esi
sub ecx, edx
add ebx, ecx
mov edi, ecx
or ebx, edi
not ebx
shl edi, 2
mov edi, ecx
add ecx, edx
jmp 0x5a18f3
push 0xf2d59e00
shl ecx, 4
xchg ebx, ecx
bswap edi
mov ebx, 0x1a25f517
sub edi, ecx
dec ecx
jmp 0x5a2f64
call fcn.005a0bfc
add edx, 0x1a5ce7e8
mov ecx, edx
sub ecx, edi
not edi
sub edi, 0x1a5ec13c
or edi, ecx
and edx, edi
xor edi, ecx
neg edx
jmp 0x5a0b9c
pop esi
and ebx, edx
and ecx, 0x1a65514a
mov ecx, 0x1a65bea3
xor ecx, edi
shl edx, 0x1d
sub edi, 0x1a671eda
add ebx, edx
jmp 0x5a32e4
push 0xf2d57540
and ecx, edx
or ecx, ebx
xor edx, edi
or edi, ebx
add edi, edx
add edx, edi
mov edx, ebx
not edi
dec ecx
or edi, edx
and ecx, edi
mov ebx, ecx
shr ebx, 0x15
jmp 0x5a3b83