Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetClipboardViewer
cmp eax, 0xffffff30
jne 0x40107f
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
ret
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, 0xfffffeff
jne 0x4010ef
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
ret
call sub.user32.dll_GetMessagePos
cmp eax, 0xffffff1e
jne 0x401191
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
ret
call sub.user32.dll_GetClipboardViewer
cmp eax, 0xfffffeff
jne 0x40121f
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.user32.dll_GetSystemMetrics
call sub.user32.dll_GetSystemMetrics
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_SaferIdentifyLevel
call sub.advapi32.dll_MakeSelfRelativeSD
call sub.advapi32.dll_MakeSelfRelativeSD
ret
jmp 0x475872
add ebx, 0xb101f692
shl edx, 0x17
jmp 0x478499
pop edx
and ebx, edi
bswap ecx
xchg ebx, ecx
add edi, esi
and esi, 0xb4acbd33
dec edi
shr ecx, 0x19
inc esi
xchg edi, esi
xchg esi, ebx
xchg esi, ebx
jmp 0x477048
call edx
or ecx, ebx
sub ecx, 0xb4cd852e
xor esi, edi
and esi, 0xb4ce4c82
add esi, edi
add ecx, edi
and ebx, 0xb4cf7adf
xor ecx, 0xb4cfda10
sub esi, ebx
and ecx, 0xb4d0982a
mov esi, ecx
shl ebx, 8
add esi, edi
jmp 0x47781c
push 0xb126d730
and edi, 0xb51f3fe9
ror edi, 0x1b
xor edi, 0xb51fa867
sub ebx, ecx
or ecx, 0xb524adc9
bswap edi
and edi, 0xb5257746
mov ebx, ecx
or esi, 0xb527bb59
jmp 0x476bb4
mov edx, 0x123b2f04
xor ecx, ebx
xchg ebx, edi
xor ebx, edi
or esi, ecx
and edi, ecx
jmp 0x476c12
push 0xb1268582
or esi, edi
sub edi, ebx
jmp 0x475b9c
push 0xb11b36d4
and ecx, ebx
add ecx, 0xb580388a
or edi, ebx
shl esi, 0x1f
mov edi, 0xb580d6bf
and ebx, ecx
jmp 0x4777af
pop edx
neg esi
mov ebx, edi
add esi, 0xb584e177
and ebx, esi
mov edi, 0xb5854981
xchg edi, ecx
sub esi, edi
not esi
or ecx, edi
and esi, ebx
not edi
sub edi, 0xb586ecd1
shl esi, 0x19
ror ebx, 5
ror ebx, 0x13
jmp 0x478ac3
pop edx
xchg ebx, esi
add ebx, 0xb5911301
xor ecx, edi
not esi
inc ecx
add ebx, esi
not ecx
not esi
sub ecx, edi
add ecx, 0xb59576f0
xor ecx, 0xb595ad39
ror ecx, 1
shl ebx, 0x1d
jmp 0x4786f8
push 0xb1159197
shr ecx, 0xf
or edi, 0xb596981e
inc edi
xor esi, edi
xor esi, ebx
inc ebx
xchg edi, ebx
mov esi, 0xb597e340
xchg ecx, esi
xchg esi, ebx
add ecx, edi
and ecx, edi
jmp 0x477923
push 0xb10ff9a7
mov esi, 0xb5a4f872
add edi, esi
jmp 0x478a4d
pop edx
add edi, ebx
add ecx, ebx
or edi, ebx
sub ecx, 0xb5b7967c
sub ecx, 0xb5b7cd12
jmp 0x477bcb
pop edx
xor esi, 0xb5b81686
add esi, ebx
sub ecx, esi
neg ecx
xor esi, ebx
and edi, ecx
shr esi, 0x16
mov esi, edi
jmp 0x477aa1
push 0xb11a5f50
and ecx, ebx
inc ebx
add edi, esi
mov edi, 0xb5c62a78
sub esi, edi
sub ebx, edi
add ecx, 0xb5c75b7e
add ebx, ecx
sub ebx, esi
xor ebx, ecx
add esi, ecx
mov esi, edi
sub ecx, esi
and ebx, ecx
jmp 0x4764a6
push 0xb1235a32
or ebx, ecx
and ecx, ebx
xchg esi, edi
and esi, 0xb5faacd4
or ecx, 0xb5fae03e
sub esi, ebx
shl ecx, 0xa
mov esi, 0xb5fb8193
add ecx, esi
dec edi
sub ecx, ebx
and esi, ebx
and edi, ecx
inc ebx
add edi, esi
jmp 0x478e5d
push 0xb11ae55f
bswap esi
xor edi, esi
bswap ebx
rol edi, 0xd
jmp 0x475f2d
push 0xb112c9f2
or ebx, edi
xchg ebx, esi
sub edi, esi
shr ebx, 0x1b
and ecx, esi
not edi
inc ebx
mov ebx, 0xb664e702
mov edi, esi
add esi, ecx
xchg esi, edi
mov ebx, esi
xor ecx, esi
jmp 0x4785f9
pop edx
xchg ecx, esi
add ecx, 0xb685f7d8
mov ebx, ecx
or ebx, 0xb686bed5
xchg esi, edi
dec ecx
add edi, ebx
jmp 0x478251
call edx
neg edi
rol edi, 0x16
xchg esi, edi
add ecx, esi
sub edi, esi
neg ecx
shr ebx, 0x17
or ebx, edi
jmp 0x47699b
pop edx
or ebx, ecx
and ebx, ecx
mov ebx, edi
and esi, edi
shr ecx, 2
ror edi, 0xe
ror ecx, 0x1a
add ecx, edi
and ebx, ecx
xchg ebx, ecx
dec ebx
or ebx, ecx
add ecx, ebx
mov ebx, esi
jmp 0x4772ee
jmp loc.0047c000
push 0xb12728a0
xchg esi, ebx
sub esi, ecx
xor esi, 0xb72d1244
mov ebx, ecx
mov edi, ebx
xchg edi, ecx
xchg ecx, ebx
sub esi, edi
xchg ebx, esi
jmp 0x475cdc
pop edx
inc ecx
add edi, ebx
mov ebx, esi
sub ecx, esi
or edi, 0xb7330d36
sub edi, ecx
dec ebx
add ebx, edi
or ebx, 0xb738b8ad
jmp 0x478750
call fcn.00478dbb
xchg ecx, esi
add ecx, edi
add edi, ecx
sub esi, 0xb73c10dc
mov ebx, ecx
xchg edi, ecx
neg ebx
and edi, esi
jmp 0x478274
call edx
xchg esi, edi
sub ebx, 0xb74df818
dec ebx
and ecx, ebx
or ebx, ecx
add ecx, ebx
sub edi, esi
jmp 0x4761ca
call edx
and esi, edi
sub edi, ecx
add ecx, ebx
jmp 0x478d5e
push 0xb10f5839
xor ecx, esi
sub esi, ecx
and ecx, 0xb7a004f5
and ebx, 0xb7a293bd
xor ebx, 0xb7a2f49b
and ecx, esi
mov ecx, ebx
or ebx, 0xb7a41d46
xchg esi, ebx
ror ecx, 0x19
mov edi, 0xb7a55f91
and esi, ecx
shl edi, 7
xor edi, 0xb7a6a089
neg ebx
shr esi, 0x1c
jmp 0x478b5b
pop edx
mov ebx, esi
or edi, ebx
xor ebx, 0xb949b3ad
add ebx, ecx
ror esi, 0xd
mov edi, ecx
add edi, ebx
jmp 0x476798
pop edx
xor ebx, ecx
rol ecx, 7
shl edi, 0x1a
rol ebx, 0x13
mov esi, 0xb9b4a371
dec ecx
xchg ebx, esi
xchg ecx, ebx
mov esi, 0xb9bd8eec
mov ebx, 0xb9bdfb47
and edi, 0xb9be5c3b
bswap esi
jmp 0x477b42
pop edx
or edi, ebx
ror ecx, 4
add edi, 0xba392ec9
add ebx, edi
mov esi, 0xba39f06b
not edi
sub edi, esi
neg esi
or ecx, 0xba3f6140
shl ebx, 0x16
or ebx, 0xba402a88
add ebx, edi
jmp 0x478346
call edx
xor ecx, 0xba91c9cc
and esi, 0xba922fd1
sub ecx, 0xba929056
and esi, edi
xor ebx, edi
xor edi, ebx
mov edi, ebx
shl ecx, 0x1f
add esi, ecx
ror ecx, 0x19
mov edi, ecx
jmp 0x478597
push 0xb11b84e0
rol edi, 0xb
mov ebx, ecx
xor ebx, esi
or ecx, edi
mov ecx, ebx
or esi, edi
and esi, ebx
jmp 0x4782fd
pop edx
neg ebx
and ebx, esi
dec edi
and edi, esi
xchg ebx, edi
rol ecx, 7
not esi
or ebx, ecx
xchg ecx, esi
and edi, esi
and edi, ebx
mov ebx, 0xbabf778a
inc ecx
jmp 0x475f7c
mov edx, 0x123b2f04
rol ebx, 0xc
mov esi, 0xbaf08d18
not ebx
and ecx, 0xbaf16502
shr edi, 0x1e
jmp 0x478fcb
pop edx
or ecx, 0xbb34d1a6
xor edi, ebx
or ebx, ecx
xor ecx, edi
and ecx, edi
xchg edi, esi
and ebx, 0xbb371251
xchg esi, ebx
ror edi, 0xd
and ecx, ebx
xchg ebx, ecx
or ecx, esi
jmp 0x475880
pop edx
xchg ecx, esi
xor ebx, ecx
or ebx, edi
bswap ebx
and esi, edi
sub ecx, edi
or edi, 0xbb4f0e64
mov esi, ebx
nop
or ebx, ecx
jmp 0x4786b8
pop edx
and edi, esi
and esi, ebx
and ecx, edi
sub ebx, edi
mov esi, 0xbbc48fad
add esi, ebx
or edi, 0xbbc576f4
sub ebx, edi
rol ecx, 0xb
jmp 0x478808
pop edx
xor ecx, 0xbbd1b821
sub edi, esi
neg ecx
inc esi
neg esi
xchg ebx, edi
and ecx, 0xbbd427f9
shr ecx, 4
jmp 0x476bd4
call fcn.00478dbb
xchg esi, ebx
or edi, 0xbc0d9188
neg ebx
sub ebx, edi
shr edi, 0x10
xchg edi, ecx
xor esi, ebx
mov ecx, edi
not ebx
jmp 0x476982
mov edx, 0x2774562b
or ebx, ecx
mov ecx, 0xbc514baf
xor edi, 0xbc51aff4
add ecx, 0xbc520e8e
rol ecx, 0x19
neg edi
and edi, esi
xchg ecx, esi
xor edi, esi
jmp 0x477d9b
push 0xb12c64bc
or ebx, esi
and ebx, esi
add esi, 0xbc59515a
add edi, ebx
shl esi, 0xa
xchg esi, ebx
xor ecx, ebx
mov esi, ecx
or esi, edi
or edi, ecx
ror esi, 1
jmp 0x4788bd
call edx
xor ebx, 0xbc65069b
dec ecx
xchg ebx, ecx
mov ebx, esi
not ebx
xor ecx, esi
bswap edi
and esi, ebx
shr ebx, 0xd
or ecx, ebx
xor ecx, ebx
xor edi, ecx
jmp 0x475feb
pop edx
mov esi, edi
sub ecx, esi
xor esi, ebx
add ecx, 0xbc746bef
rol edi, 4
xor ebx, ecx
and esi, ebx
mov esi, ecx
xor edi, ecx
sub esi, edi
xor ecx, ebx
xor edi, 0xbc779d8f
xchg ecx, edi
nop
xchg ebx, esi
jmp 0x4761b2
push 0xb1230b3d
sub ebx, esi
shl ecx, 0x1a
xchg ecx, ebx
add ebx, 0xbca2b12a
xor ecx, ebx
and edi, ebx
xor ebx, esi
or esi, 0xbca3812c
jmp 0x476474
call edx
xor edi, ebx
mov ecx, edi
or ebx, 0xbca6e75a
xchg edi, ecx
add ebx, esi
mov esi, ebx
ror edi, 0xd
add ebx, edi
inc esi
jmp 0x478070
push 0xb11bd22b
not ebx
add ecx, edi
and ecx, esi
sub edi, 0xbcb1761c
nop
neg esi
xor ebx, esi
xchg ebx, ecx
sub ebx, 0xbcb28caa
jmp 0x47911f
pop edx
shr esi, 0x17
add ebx, 0xbcb63d31
sub ecx, ebx
shl edi, 0x12
or ecx, esi
xor ecx, edi
jmp 0x478eb5
call fcn.00478dbb
add ebx, edi
mov esi, ecx
sub ebx, esi
add esi, ecx
xchg esi, ecx
dec edi
add edi, ecx
shl ebx, 0x15
shr edi, 0x1e
or ecx, esi
sub ecx, ebx
jmp 0x478015
pop edx
xchg esi, ecx
xchg edi, ebx
or edi, ecx
add edi, ebx
xchg ebx, edi
shl esi, 3
jmp 0x477562
call fcn.00478dbb
xor ebx, edi
or ecx, ebx
not ebx
and esi, ebx
mov edi, esi
jmp 0x475957
push 0xb10d74ac
or ecx, ebx
xor esi, ebx
and edi, 0xbce524ca
or ecx, 0xbce55bfe
or ecx, 0xbce58ecf
shl ecx, 0x10
add ecx, edi
xchg ecx, esi
dec edi
xchg edi, ebx
xor ebx, edi
shr edi, 4
xchg ebx, edi
and ebx, esi
ror ebx, 0xd
jmp 0x4787ac
call fcn.00478dbb
add ebx, 0xbd004b45
dec ecx
shr ecx, 0x1c
xor esi, edi
sub ecx, esi
sub edi, ebx
xchg ecx, ebx
neg ebx
xchg ebx, edi
sub edi, 0xbd0230cf
ror esi, 6
dec ecx
shl ecx, 0xc
jmp 0x477752
pop edx
xchg ebx, edi
rol ecx, 0x15
not edi
mov esi, edi
or ebx, edi
xchg ebx, edi
neg esi
xchg ecx, esi
jmp 0x47837f
mov edx, 0x2774562b
shl esi, 0x18
dec edi
sub ebx, ecx
xor ebx, esi
xchg ecx, ebx
xor ebx, 0xbd147c5e
or edi, ecx
shr esi, 0x10
add esi, 0xbd15b35d
and esi, ecx
or ebx, esi
add edi, 0xbd16cbbc
jmp 0x478463
call fcn.00478dbb
sub ebx, edi
xor edi, ecx
rol edi, 0x15
add ecx, edi
add edi, ecx
xchg esi, edi
sub ecx, 0xbd1c5bc7
and esi, ebx
mov edi, ecx
jmp 0x476d75
pop edx
xor ebx, edi
or esi, ecx
rol ecx, 0x14
and ecx, ebx
jmp 0x476277
push 0xb1153c52
xor ebx, ecx
xor ebx, 0xbd334702
inc esi
xor ebx, edi
sub edi, 0xbd34b793
xchg esi, ecx
jmp 0x476018
push 0xb10f0daa
or ecx, esi
xor ecx, ebx
mov esi, ebx
mov esi, edi
dec esi
sub esi, ebx
sub ebx, 0xbd37d816
jmp 0x476e73
push 0xb12be73f
and ebx, ecx
mov ebx, esi
add esi, edi
or ebx, ecx
or edi, esi
xor esi, ebx
sub esi, ecx
rol ebx, 0xf
xchg ecx, edi
ror ecx, 5
jmp 0x477fef
mov edx, 0x2774562b
mov edi, ecx
not esi
jmp 0x47835e
push 0xb1263129
xor esi, 0xbd4f902b
add edi, ecx
mov ecx, 0xbd501ba9
shr edi, 0x1a
sub ebx, edi
mov ecx, esi
or ecx, esi
add ecx, esi
mov edi, esi
xor edi, ecx
and edi, ecx
jmp 0x475ea0
mov edx, 0x2774562b
xor ecx, ebx
mov edi, 0xbd68c3a0
not esi
xor ecx, edi
add edi, 0xbd6f00c1
shr esi, 9
or esi, edi
add edi, 0xbd76bd2d
xor ecx, 0xbd76f05f
or esi, edi
jmp 0x476a85
mov edx, 0x2774562b
add edi, 0xbda22ed3
mov esi, edi
or esi, ebx
not esi
sub ecx, ebx
shl ecx, 0xc
or esi, 0xbda373f0
jmp 0x47856a
push 0xb114ee7a
or edi, ebx
and ecx, edi
xchg ebx, esi
inc ebx
not ebx
rol edi, 0x17
mov ebx, ecx
sub edi, esi
mov ebx, ecx
jmp 0x4786db
push 0xb10fa663
add ecx, 0xbdbf1eb5
and esi, ebx
and ebx, 0xbdbf8999
or edi, ecx
ror ebx, 6
shr ecx, 0x17
and esi, ebx
shl esi, 0xa
and esi, 0xbdc0fa7b
xor edi, esi
mov ecx, esi
jmp 0x4760c4
pop edx
inc esi
add esi, ecx
add esi, ebx
shl esi, 0x1e
and edi, 0xbdf53b18
add esi, 0xbdfa9fa5
jmp 0x477a52
push 0xb123e91e
or edi, ecx
xchg ebx, edi
mov ebx, esi
ror ebx, 0x1b
ror edi, 0x18
and ecx, edi
or ebx, 0xbe11cd94
or edi, ebx
xchg ebx, edi
and ebx, edi
sub esi, ebx
add ebx, ecx
and edi, 0xbe130b50
shl edi, 3
not edi
jmp 0x477faf
push 0xb112791d
shl esi, 3
xor esi, edi
or esi, ecx
or edi, 0xbe1a148b
sub edi, ebx
xor ecx, edi
dec ecx
xor ecx, edi
add esi, ecx
jmp 0x4766e0
call fcn.00478dbb
sub esi, edi
or ecx, 0xbe3b2bbc
xor edi, ecx
mov ebx, 0xbe3b92b2
sub edi, ebx
and ebx, ecx
xchg ecx, esi
add ebx, ecx
or edi, 0xbe3c9c24
sub ecx, edi
xor ecx, ebx
xor ecx, ebx
or ebx, edi
and ecx, esi
jmp 0x476c71
mov edx, 0x123b2f04
shr edi, 7
xor edi, 0xbe663f6c
xchg ebx, ecx
add ebx, esi
mov ebx, esi
or ebx, edi
dec esi
and esi, ecx
sub ecx, edi
rol esi, 0x15
jmp 0x478628