Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Identify system language via api

Disassembly:
xor esi, edi
sub ebx, esi
and ecx, ebx
call sub.user32.dll_GetMenuCheckMarkDimensions
or ecx, esi
cmp eax, 0xffffff0e
jne 0x4010af
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
ret
xchg ebx, edi
call sub.user32.dll_GetMenuCheckMarkDimensions
not ecx
not edi
add ecx, esi
add ecx, ebx
cmp eax, 0xfffffeed
jne 0x401129
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.kernel32.dll_FindActCtxSectionStringW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.ntdll.dll_RtlpApplyLengthFunction
call main
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
ret
inc ecx
add edi, ebx
xor ecx, edi
call sub.user32.dll_GetMenuCheckMarkDimensions
nop
mov edi, 0xc53d7c93
or ecx, ebx
dec esi
or ebx, 0xc53f1a12
mov ebx, 0xc53f8bc3
neg ebx
or ebx, ecx
cmp eax, 0xfffffed7
jne 0x4011d4
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call main
call sub.ntdll.dll_RtlpApplyLengthFunction
call main
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call main
call main
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call main
ret
bswap edi
call sub.kernel32.dll_GetUserDefaultUILanguage
ror edi, 0x15
cmp eax, 0xffffff24
jne 0x40123a
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.ntdll.dll_RtlpApplyLengthFunction
call sub.kernel32.dll_FindActCtxSectionStringW
call sub.ntdll.dll_RtlpApplyLengthFunction
call main
call sub.advapi32.dll_ConvertSDToStringSDRootDomainW
call main
call main
ret
jmp 0x49b483
shr ecx, 0x1b
and edi, ecx
xor edi, esi
shr ebx, 0x13
xchg ecx, esi
jmp 0x49c08f
pop edx
xor edi, 0xce08e4dc
shl ecx, 0x1e
mov ecx, ebx
and ebx, edi
xor esi, edi
jmp 0x49c0b3
call edx
or ecx, 0xce1be31a
xchg esi, ecx
add esi, edi
rol ebx, 3
and ecx, 0xce1db689
sub esi, 0xce1e273d
and ecx, ebx
xor esi, ecx
add ecx, ebx
sub edi, 0xce200c1d
and ebx, esi
jmp 0x49b6f5
pop edx
xor edi, esi
add edi, 0xce39c438
ror ecx, 0x1e
mov ecx, 0xce3a41ad
not ecx
mov esi, edi
xor ebx, esi
or ebx, esi
jmp 0x49d98a
push 0xc62a4897
mov ecx, esi
add ebx, edi
and ebx, edi
and edi, 0xce60f3f6
and ecx, ebx
add ebx, ecx
xor esi, 0xce61d8b6
jmp 0x49d923
call fcn.0049ceb0
or esi, ecx
or ebx, edi
sub ecx, 0xce7449b7
or esi, ebx
xor ebx, ecx
and ecx, edi
mov edi, esi
xor edi, ebx
not ecx
or ebx, esi
jmp 0x49b5b8
jmp loc.004a3000
mov edx, 0x123b2f04
add ebx, esi
xchg ecx, esi
sub esi, ebx
mov esi, ecx
xchg edi, ecx
jmp 0x49bf6d
push 0xc61cfa61
sub ecx, edi
add ecx, ebx
and esi, ecx
mov esi, ecx
bswap esi
or ecx, ebx
shr ebx, 8
jmp 0x49cdab
push 0xc616889d
mov ecx, edi
inc edi
neg esi
not ebx
add ecx, edi
ror edi, 9
sub ecx, ebx
ror esi, 0x1a
mov esi, 0xcee0d0a0
or ecx, 0xcee11395
mov esi, edi
jmp 0x49cf32
pop edx
xchg ebx, edi
xor esi, 0xcee6aa46
and ecx, edi
mov ebx, 0xcee72979
not ecx
neg esi
mov esi, edi
xor ecx, ebx
ror ecx, 4
jmp 0x49d2ed
pop edx
xor ecx, 0xceef98b0
shl ecx, 0x19
sub ecx, 0xcef01a81
and ebx, ecx
or edi, 0xcef0b0d7
jmp 0x49cc4a
pop edx
xor ebx, ecx
or esi, 0xcefb9715
neg edi
mov ecx, ebx
and edi, esi
and ebx, edi
jmp 0x49e186
call fcn.0049ceb0
xor edi, ebx
nop
not esi
xor ecx, esi
mov esi, 0xcf02eb24
or edi, esi
add ebx, 0xcf039050
sub ecx, 0xcf03d3a1
jmp 0x49c677
pop edx
or ebx, 0xcf06b8cd
add edi, esi
mov edi, 0xcf073625
xchg edi, esi
rol esi, 0xc
sub ebx, ecx
mov ecx, esi
or ecx, 0xcf0899da
or esi, ecx
shr ebx, 0x14
rol edi, 8
and esi, ecx
mov esi, 0xcf09f827
jmp 0x49e27b
push 0xc61623a8
or esi, ebx
xor ebx, 0xcf16b297
xor edi, ecx
neg esi
add ecx, 0xcf179500
shr ebx, 0xa
xchg esi, ebx
shr ebx, 0xa
jmp 0x49bd9c
pop edx
and ecx, esi
bswap esi
xor ecx, edi
xchg esi, ecx
mov ecx, 0xcf19f78f
shr ebx, 0x1d
not esi
add edi, ecx
inc edi
xor edi, ebx
jmp 0x49dd1e
pop edx
shl ecx, 0xb
shr ebx, 0x1d
xchg esi, ecx
add edi, ecx
ror ebx, 3
dec edi
not esi
ror esi, 0xa
shr ecx, 0x1e
sub ebx, edi
jmp 0x49be04
mov edx, 0x123b2f04
shl ecx, 2
bswap esi
xor edi, ecx
xchg edi, ebx
rol ebx, 0x1f
xor ecx, ebx
sub ebx, edi
add ebx, esi
sub esi, ebx
add ecx, edi
jmp 0x49d964
call edx
xchg esi, ebx
xor esi, ecx
shl edi, 0x1b
nop
mov ebx, esi
xor esi, edi
xchg ecx, edi
sub ecx, ebx
jmp 0x49e2a0
call fcn.0049ceb0
inc ecx
and ebx, 0xcf971c45
and esi, ebx
sub esi, ecx
add esi, edi
xchg esi, ecx
neg ecx
and edi, 0xcf98977b
add edi, ebx
jmp 0x49daac
call edx
ror ebx, 0xf
add edi, esi
and ebx, esi
ror ecx, 0x17
mov ebx, edi
sub esi, ebx
xchg ecx, esi
jmp 0x49db30
push 0xc623e2be
ror ebx, 0x1d
mov ebx, esi
mov ebx, esi
bswap edi
or ebx, 0xcfc1c35f
or edi, esi
jmp 0x49cbe6
push 0xc62376d5
add ebx, ecx
add edi, esi
xchg esi, ecx
shl esi, 0x17
xor esi, edi
sub ebx, ecx
xor edi, esi
jmp 0x49c77f
call edx
xor esi, 0xcfe06cd7
not edi
and edi, ebx
xor esi, 0xcfe12af5
sub ecx, 0xcfe165ed
shl ebx, 0xc
xchg edi, ebx
bswap ebx
and edi, ecx
mov edi, 0xcfe3d2f6
sub edi, ecx
sub ebx, esi
add ebx, esi
nop
jmp 0x49c1ae
push 0xc62b368b
sub ebx, ecx
or ecx, 0xd00162da
or ecx, edi
sub ebx, ecx
and ecx, edi
add ecx, edi
or ebx, 0xd0029ac1
or ebx, edi
jmp 0x49bc4e
push 0xc62f2962
sub edi, ebx
xor esi, ebx
or edi, ecx
sub ebx, esi
or esi, ecx
inc ebx
add ecx, 0xd00ae1c2
shl ecx, 0x16
or esi, edi
rol edi, 0x1b
jmp 0x49ce6c
push 0xc62450f9
shr esi, 0x13
sub esi, edi
add esi, 0xd01b5011
shr esi, 0x13
shr edi, 0x16
or edi, 0xd01c1b63
xor edi, esi
sub ebx, edi
jmp 0x49d5ee
push 0xc62043ad
or ebx, ecx
xor edi, esi
or ecx, 0xd0228af3
and ebx, ecx
mov edi, ebx
mov ebx, ecx
sub ecx, 0xd0237a97
dec ecx
jmp 0x49d350
pop edx
bswap ecx
neg ebx
not esi
and ebx, esi
mov ecx, edi
or ecx, 0xd02b7179
or esi, ecx
xor esi, edi
rol ebx, 0xd
or ebx, ecx
shr esi, 0xc
jmp 0x49be6d
push 0xc61d4b00
sub esi, 0xd039b83e
and ecx, ebx
or ebx, esi
or esi, ecx
add ebx, esi
sub edi, esi
shr ebx, 0x13
sub ebx, edi
jmp 0x49dd99
push 0xc62f85fd
mov ebx, edi
xor edi, ebx
jmp 0x49da49
push 0xc616eeeb
sub ecx, edi
dec edi
or esi, ebx
add ebx, 0xd06aaa54
neg esi
and edi, ebx
shr esi, 0x15
and ecx, esi
sub ebx, ecx
add ecx, edi
rol ebx, 0x13
jmp 0x49d5d4
pop edx
sub esi, edi
xor edi, ebx
or esi, ebx
xchg esi, ecx
shr edi, 0xe
jmp 0x49da06
push 0xc620a9bf
and esi, edi
add edi, ebx
not ebx
or ebx, 0xd0c8cd70
xor ecx, edi
and ebx, edi
mov ecx, edi
jmp 0x49c449
push 0xc6276a5a
xchg esi, edi
mov edi, 0xd0dc8bdd
mov esi, 0xd0dcc5ce
mov esi, ecx
add edi, 0xd0dd6933
inc ebx
and esi, ecx
sub esi, ebx
mov esi, 0xd0de89d0
jmp 0x49df68
pop edx
sub ecx, edi
bswap ecx
sub ebx, ecx
add edi, 0xd0e95cf8
shr esi, 8
shl ebx, 0x18
mov ebx, esi
xor esi, 0xd0ebb9b8
ror ecx, 0x12
xor ebx, 0xd0ecb1f2
jmp 0x49b4ee
push 0xc61c92d2
xor ebx, esi
and ecx, 0xd0f1ecc2
mov edi, 0xd0f24430
dec ebx
inc esi
inc edi
sub esi, 0xd0f4195d
xor esi, ebx
dec edi
mov ebx, ecx
mov edi, ebx
sub edi, ebx
jmp 0x49bd83
pop edx
and ebx, 0xd0f74d5c
or edi, ebx
sub ebx, edi
add ecx, ebx
xchg ecx, ebx
sub ecx, 0xd0f9c024
jmp 0x49dd4f
pop edx
shl edi, 0x11
or edi, ebx
shl ebx, 0x10
mov esi, ecx
rol ebx, 0x18
not esi
or ecx, ebx
xchg ebx, edi
sub edi, esi
mov edi, ebx
jmp 0x49d449
mov edx, 0x2774562b
dec esi
rol ebx, 0xb
ror edi, 9
and ecx, edi
not ebx
xchg esi, edi
inc esi
and ebx, edi
jmp 0x49e13b
mov edx, 0x2774562b
mov ecx, esi
and ecx, ebx
mov esi, ebx
sub esi, ecx
shr esi, 0x1d
not esi
add edi, 0xd1173a06
or ebx, 0xd1177461
mov ebx, esi
sub esi, ebx
jmp 0x49dc67
push 0xc62ed3bc
add ebx, 0xd130f5fc
mov esi, ecx
neg ebx
mov ebx, edi
shl ebx, 4
and ebx, edi
rol ebx, 0x1f
sub esi, 0xd1330b86
jmp 0x49caf1
call edx
and ecx, edi
add ebx, ecx
and edi, ecx
sub ebx, esi
dec ecx
mov ebx, edi
or esi, 0xd134c43c
add ebx, esi
or ecx, 0xd135629a
or ebx, edi
not edi
add ebx, 0xd1363222
mov esi, ecx
xor esi, 0xd136c5c3
jmp 0x49dd6b
push 0xc62ac944
mov edi, ecx
or ecx, ebx
sub esi, ebx
xor ebx, ecx
mov esi, 0xd1656ff8
xchg esi, ebx
jmp 0x49ca7d
call fcn.0049ceb0
xchg esi, edi
mov ecx, 0xd16cf0a6
add edi, 0xd16d7de2
xor ebx, ecx
sub edi, ebx
xchg esi, edi
sub esi, ecx
ror ecx, 0xc
rol ecx, 5
inc ebx
jmp 0x49c4bb
push 0xc6297e43
add ecx, ebx
rol ebx, 0x1a
mov esi, ecx
xchg edi, esi
xor esi, 0xd173a261
and ebx, ecx
or ecx, edi
and ebx, edi
and ecx, 0xd175c231
jmp 0x49db15
push 0xc61c383e
xor ecx, edi
not edi
ror ebx, 2
inc esi
ror esi, 0x10
xor ebx, 0xd1848738
neg ecx
jmp 0x49d4fe
mov edx, 0x2774562b
xchg ebx, edi
xor ebx, esi
shr esi, 0xa
shl esi, 0x1d
sub ebx, esi
nop
xchg edi, ebx
shr esi, 0xc
ror edi, 0x1e
xor esi, 0xd1922f3a
and edi, esi
jmp 0x49ba1e
call edx
xchg ecx, edi
and ecx, edi
or esi, edi
add ebx, esi
xor ebx, 0xd19cfee6
jmp 0x49bfad
push 0xc629f3de
dec ecx
xchg edi, ebx
sub ebx, esi
not ebx
and esi, ebx
sub esi, 0xd1ad1857
add esi, ecx
jmp 0x49b855
pop edx
mov ebx, ecx
add ecx, ebx
add ecx, esi
or ebx, ecx
xchg edi, ebx
rol ecx, 0x13
or edi, ebx
xor esi, ebx
add ebx, ecx
dec esi
add ecx, esi
or ebx, esi
xchg ecx, edi
ror ecx, 0xf
jmp 0x49d4ba
call fcn.0049ceb0
shl ecx, 6
or esi, 0xd1d7f3d0
rol esi, 1
xchg esi, ecx
mov ecx, edi
sub ebx, edi
and ecx, edi
inc ebx
add esi, ecx
add edi, esi
xor edi, ebx
jmp 0x49d787
pop edx
shl ecx, 4
and ecx, ebx
xor ebx, ecx
neg esi
bswap ecx
jmp 0x49d763
pop edx
add esi, ecx
xor esi, ebx
not esi
mov edi, ebx
and esi, ecx
or edi, 0xd1e9c615
sub ebx, 0xd1ea01eb
jmp 0x49d541
pop edx
mov esi, ebx
and esi, 0xd1eaa1eb
sub edi, esi
add esi, 0xd1eb1da7
xchg ebx, esi
add ebx, edi
inc ebx
inc ebx
add ebx, ecx
shr ecx, 0xd
sub edi, 0xd1ed3a5c
sub ebx, edi
mov esi, 0xd1edcfce
jmp 0x49d527
mov edx, 0x123b2f04
add edi, ebx
sub ecx, edi
inc edi
and esi, ebx
add ecx, esi
ror edi, 0x12
mov ecx, edi
or ebx, edi
or ebx, ecx
sub esi, 0xd1f07aaf
and esi, edi
add ecx, 0xd1f0f18b
add edi, 0xd1f15113
jmp 0x49c5ad
mov edx, 0x2774562b
mov esi, 0xd2113970
ror ebx, 2
neg ebx
mov ebx, edi
bswap ecx
mov ecx, ebx
nop
and ebx, edi
or ecx, edi
and esi, ebx
xchg ecx, esi
xchg edi, ecx
xor ecx, esi
jmp 0x49b956
call fcn.0049ceb0
xor esi, 0xd2359060
or edi, 0xd235e4ef
neg ebx
xor esi, edi
ror esi, 6
add ecx, ebx
jmp 0x49c8fd
push 0xc622f0ca
sub edi, 0xd23b9dac
add ebx, ecx
xchg ebx, esi
mov edi, ebx
dec ecx
xchg esi, ebx
rol esi, 0xc
neg ebx
xor ecx, 0xd23dca9e
or edi, 0xd23e1e10
sub ecx, edi
rol ecx, 0x15
jmp 0x49c89c
pop edx
mov ecx, ebx
shl edi, 0xf
xor ecx, edi
not esi
dec edi
mov ebx, ecx
xor esi, edi
mov ecx, 0xd24de819
and esi, ebx
and edi, 0xd24e6d03
and esi, ecx
mov esi, edi
jmp 0x49ccce
pop edx
xor ebx, 0xd24f6610
inc ebx
mov edi, ebx
or esi, edi
xor esi, ebx
and ecx, 0xd250a3ae
shl edi, 0x13
or ecx, edi
jmp 0x49bf21