Function at 0x401000
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call sub.user32.dll_GetInputState
cmp eax, 0xffffff04
jne 0x4010a7
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
ret
call sub.user32.dll_GetInputState
cmp eax, 0xffffff0c
jne 0x40114e
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
ret
call sub.user32.dll_GetInputState
cmp eax, 0xffffff20
jne 0x4011f5
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
ret
call sub.user32.dll_GetInputState
cmp eax, 0xfffffee0
jne 0x40126a
call sub.user32.dll_SetCursorPos
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.user32.dll_SetCursorPos
call sub.user32.dll_SetCursorPos
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
call sub.oleaut32.dll_VarDecCmp
call sub.oleaut32.dll_VarDecCmp
call sub.advapi32.dll_LookupPrivilegeDisplayNameW
ret
jmp 0x470134
or ebx, esi
xor ecx, ebx
xchg edx, esi
and ecx, edx
xchg edx, ebx
mov ecx, ebx
neg ebx
jmp 0x470444
mov esi, 0x4132136a
add edx, ebx
mov edx, ebx
mov ecx, 0xa3c8e9a
neg ebx
jmp 0x471d36
pop esi
xchg edx, ecx
sub ebx, 0xa409b82
jmp 0x471857
mov esi, 0x2774562b
xor ecx, ebx
bswap ebx
sub ebx, 0xa47ab22
mov edi, edx
sub edx, edi
nop
xor edx, ebx
mov edx, ecx
jmp 0x47091e
push 0x9c0d2c4
xor edx, ebx
and edx, ebx
xor ebx, ecx
inc edi
and ebx, ecx
or ebx, edx
add edi, edx
and edi, 0xa4a155c
jmp 0x4712e3
pop esi
mov ecx, ebx
xchg ecx, edx
add ecx, edx
xchg edx, ebx
xor edi, edx
or edx, ecx
and edi, 0xa4cda3c
inc ecx
sub ecx, 0xa4d132a
and edi, edx
jmp 0x470356
push 0x40
add edx, 0xa539c9e
sub ebx, edi
neg ebx
inc edi
xor edx, ecx
not edx
or ecx, edx
sub ebx, 0xa545e2a
sub edx, 0xa547aee
sub edx, ecx
and ecx, edi
shl edx, 0x16
or edx, ebx
ror ecx, 0x1b
jmp 0x471c8e
call fcn.00470c80
mov edi, ecx
mov edx, edi
shl ecx, 9
xor ebx, 0xa6d79e4
inc ebx
mov ebx, edx
nop
not edi
shl edi, 0x15
ror ecx, 0x10
jmp 0x470d41
call fcn.00470c80
add ebx, 0xa6e46e8
not edx
inc ecx
and edx, ebx
add ecx, edx
xor edi, 0xa6ed0be
jmp 0x471ea6
call fcn.00470c80
sub ebx, edx
or edx, ebx
xor edi, edx
neg edx
nop
add ebx, edx
shr ecx, 0x1c
or ebx, edi
jmp 0x471a4f
push 0x9c465c6
bswap edi
add edi, 0xa72e114
and ecx, ebx
and edx, ebx
sub edx, 0xa732fae
or ecx, 0xa734862
jmp 0x47159b
call esi
sub ebx, 0xa7722c6
add ecx, edi
inc ecx
xor ecx, edi
or edi, edx
mov ecx, edx
jmp 0x472553
pop esi
and edx, ecx
sub edx, 0xa7ea122
xor ebx, edx
dec ebx
jmp 0x472572
pop esi
add edx, ebx
or edi, 0xa859878
sub edi, edx
not edi
add edi, edx
and edi, 0xa86054e
or edx, 0xa8621de
add ecx, ebx
and ecx, edx
add edi, edx
jmp 0x472880
push esp
sub edi, edx
inc edx
or ecx, ebx
or edi, 0xa8cb744
and edx, 0xa8cd078
sub edx, ebx
jmp 0x47058a
call esi
xor ebx, edi
neg ebx
shr edi, 0x16
xor edx, 0xa8ebfae
jmp 0x4704a3
pop esi
shl ecx, 0x1e
mov edx, ecx
sub edx, edi
neg edi
and ecx, edx
sub ebx, 0xab8a7b2
shl edi, 0xf
neg edx
jmp 0x4702d9
mov esi, 0x2774562b
ror edx, 0x1a
mov ecx, edx
or ebx, 0xac229ee
mov edx, ecx
or edi, 0xac25a40
sub ecx, ebx
neg edx
dec ecx
xor ecx, ebx
mov ecx, edx
mov ebx, edi
mov edi, ecx
jmp 0x4708fb
pop esi
mov ebx, 0xacbaf88
add ecx, 0xacbc8ce
not edi
mov esi, 0x2774562b
shl edx, 0x1d
mov edx, 0xad48fa2
inc ecx
add ebx, edx
neg ecx
or edx, ebx
xor ebx, edi
xor edi, ecx
xor ebx, ecx
xor edx, edi
not edi
and edi, ebx
jmp 0x470982
push 0x9c4870e
shr ebx, 0x1a
add ebx, 0xae9ba6a
rol edx, 7
and edx, 0xae9f360
mov ecx, edx
mov ebx, edi
jmp 0x472260
push 0x9c280c6
mov edx, 0xafda818
mov ecx, edi
mov ecx, ebx
mov edi, 0xafdf4ba
bswap edx
bswap ebx
jmp 0x4719c6
push 0x9c4407c
ror ecx, 0x1b
sub ecx, edi
neg edi
or ecx, edi
sub ecx, ebx
neg ecx
and ebx, 0xb0499f6
inc edi
jmp 0x4709b9
mov esi, 0x2774562b
or edi, ebx
bswap ecx
or ebx, 0xb0942d4
add ebx, edx
jmp 0x472149
push 0x9c41c0e
or ecx, edi
neg ecx
dec ebx
add ecx, edx
xchg edi, ebx
add edx, ecx
sub ebx, 0xb0c8886
and ebx, edx
and edx, ebx
mov ecx, 0xb0cdb08
jmp 0x471920
call esi
shl ecx, 0x18
xchg edi, ecx
add edi, ecx
neg ecx
and ebx, 0xb0d6dec
xor ebx, edx
and edi, ecx
ror ecx, 0x1e
mov ecx, ebx
xor edx, edi
and edx, edi
dec ebx
jmp 0x47271d
push 0x6ed34
xchg edx, edi
dec ecx
sub ecx, edi
or edx, edi
or ebx, 0xb1f648e
or ecx, edx
and edi, ebx
dec ecx
jmp 0x4727b3
push esp
xor edx, ecx
xchg ecx, ebx
xor edx, edi
shl ebx, 0x1f
xchg ebx, ecx
add edi, ebx
not edi
xchg edx, ecx
neg edi
xchg ebx, edx
jmp 0x470cf6
call fcn.00470c80
add ebx, edi
and ecx, edx
mov ecx, edi
xchg ecx, edx
ror ebx, 1
shl ecx, 6
jmp 0x471d1b
call esi
and ebx, edi
inc ebx
mov edx, edi
mov edx, edi
add edi, ebx
xor edx, 0xb317e20
bswap ebx
add edx, edi
mov ebx, 0xb31e780
mov edi, edx
sub edx, 0xb321bd8
dec edx
jmp 0x470b3d
pop esi
dec edi
or ebx, edx
xchg edx, ebx
mov edi, edx
rol edx, 0xf
sub ebx, edi
jmp 0x4724d6
push 0x9c3444a
neg ecx
shl ecx, 1
rol edi, 0x1d
xchg edx, ecx
jmp 0x47040f
call fcn.00470c80
xor edi, ebx
sub edi, ecx
xchg ebx, edx
or ecx, edx
and edi, 0xb46c09e
sub ebx, 0xb46dd86
jmp 0x47251d
push 0x9c189e4
and edx, edi
xor ebx, edx
and edi, edx
xor edi, 0xb4c0ee6
sub edi, ecx
or edi, 0xb4c497c
mov edi, 0xb4c620e
inc ecx
jmp 0x47259b
mov esi, 0x2774562b
or edi, ecx
bswap edx
xchg ecx, edi
add edx, ecx
jmp 0x472272
call fcn.00470c80
sub ebx, edi
xor edx, edi
jmp 0x470a52
call esi
sub edx, edi
xor ecx, edx
xchg edi, edx
and ebx, edi
jmp 0x4711ad
push 0x9c322de
sub edi, edx
mov edi, ebx
xor ecx, edx
shr edi, 2
xor ecx, edi
add ebx, ecx
add ecx, edx
add edi, 0xb6148f2
jmp 0x47200d
call esi
add edi, 0xb62ca2c
ror ecx, 0x1f
add edx, ecx
rol edi, 0x1e
add ecx, edi
inc ebx
not edx
xor edx, 0xb638cc6
sub edi, edx
xor edx, ecx
jmp 0x471f29
pop esi
and edi, ebx
xchg ebx, edx
mov edx, ecx
xchg ecx, ebx
or edi, ebx
xchg edi, edx
neg ecx
and edi, ebx
xor ebx, edi
xchg ebx, edx
shl edx, 0xd
and ecx, ebx
jmp 0x470c0a
pop esi
inc ecx
sub ecx, 0xb659450
and ebx, edi
add edx, 0xb65c804
neg ecx
or edx, ebx
xchg ebx, edx
add ecx, edx
ror edi, 0xe
xchg ecx, ebx
mov edi, 0xb66897c
not edx
jmp 0x471a2b
push 0x9c1ab7a
mov ecx, 0xb66cbc0
add edx, 0xb66e528
xor edi, ebx
sub edi, ecx
nop
sub edi, ecx
and edx, edi
mov edi, 0xb678612
jmp 0x471083
pop esi
or ecx, edx
mov ecx, 0xb73d4ea
add edi, ecx
and ecx, ebx
jmp 0x4721ff
push 0x401400
and ebx, edi
mov ecx, edx
shr ebx, 0xe
add edx, edi
xchg ebx, ecx
xor edx, edi
and edi, edx
shl ecx, 0x1e
jmp 0x472317
pop esi
xor ebx, ecx
xor ebx, ecx
and edi, ecx
bswap ebx
xor ebx, 0xb7ea670
add ebx, 0xb7ec69a
xor edx, ecx
mov ebx, 0xb7efd98
jmp 0x470f64