Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetMessagePos
cmp eax, 0xffffff09
jne 0x4010a7
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
ret
call sub.user32.dll_GetMessageExtraInfo
cmp eax, 0xffffff0c
jne 0x401112
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
ret
call sub.user32.dll_GetMessagePos
cmp eax, 0xfffffed7
jne 0x401173
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xffffff1c
jne 0x4011ed
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xfffffeed
jne 0x401253
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.advapi32.dll_ConvertSecurityDescriptorToAccessNamedW
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
call sub.kernel32.dll_GetExitCodeThread
ret
jmp 0x47519c
bswap edi
mov edx, esi
and edx, ecx
jmp 0x477a51
jmp loc.0047b000
push 0x8fedaec7
not edi
sub esi, 0x987c55db
or esi, edi
add esi, edx
add ecx, 0x987d9672
xor edi, esi
sub edx, esi
sub edx, edi
add edx, ecx
jmp 0x477d65
mov ebx, 0x2774562b
or edx, edi
shr edx, 0x16
shl ecx, 0x15
add edx, esi
xchg edx, edi
or esi, edx
xor edi, esi
shl esi, 6
add esi, ecx
jmp 0x47664a