Function at 0x401000
Capabilities:
Accept command line arguments
Access the windows event log
Encrypt data using chaskey

Disassembly:
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xfffffee0
jne 0x40108e
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.user32.dll_GetWindowModuleFileNameW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
ret
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xfffffee2
jne 0x4010fe
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
ret
call sub.kernel32.dll_GetVersion
cmp eax, 0xffffff04
jne 0x401191
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
ret
call sub.kernel32.dll_GetCommandLineA
cmp eax, 0xfffffeee
jne 0x40121f
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.user32.dll_GetWindowModuleFileNameW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEventLogW
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEventLogW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.ntdll.dll_LdrLoadAlternateResourceModule
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.advapi32.dll_OpenEncryptedFileRawA
call sub.user32.dll_GetWindowModuleFileNameW
call sub.advapi32.dll_OpenEventLogW
call sub.ntdll.dll_LdrLoadAlternateResourceModule
ret
jmp 0x478a89
xor ecx, edx
add edi, edx
dec ecx
mov ecx, 0xe35b4fbd
add ecx, esi
sub edi, ecx
xor ecx, 0xe35c78b0
and edi, esi
jmp 0x479471
pop edi
xchg edx, esi
sub ecx, edx
xchg ebx, ecx
and edx, ebx
bswap esi
neg ebx
add ecx, ebx
xor edx, 0xe8574f6f
or ecx, ebx
mov ebx, edx
xor ecx, esi
jmp 0x479b4a
mov edi, 0x123b2f04
bswap edx
add ebx, 0xe85ea49a
mov ecx, esi
ror edx, 0x1d
xor edx, ecx
xor ebx, ecx
or ecx, esi
mov ecx, edx
mov edx, ecx
inc esi
add ecx, 0xe8605854
mov ecx, 0xe8608b65
jmp 0x479f9f
pop edi
add esi, ecx
and ebx, 0xe86b90c5
mov edx, ebx
mov ebx, 0xe86beeda
sub edx, esi
xchg ecx, ebx
dec ecx
sub ebx, ecx
neg esi
sub ecx, 0xe86d1cb8
shr edx, 0x16
or ebx, 0xe86d7ebb
and ebx, edx
jmp 0x47b601
pop edi
xor edx, ebx
dec ecx
ror esi, 0x1b
and edx, 0xe879c174
mov ecx, 0xe879f0c4
xor esi, edx
sub edx, 0xe87a504d
neg edx
jmp 0x47a16d
pop edi
add edx, 0xe8831bd6
sub edx, ecx
shr esi, 0x1d
and ecx, edx
or ebx, esi
and edx, esi
or ebx, esi
shr ecx, 0x1c
and ebx, edx
xchg esi, edx
inc edx
dec esi
jmp 0x47a88c
call fcn.00478ae5
shl edx, 0xb
xchg ebx, esi
add ecx, edx
sub edx, 0xe88f069f
mov edx, ecx
add ebx, 0xe88f713e
nop
neg ecx
jmp 0x47b324
mov edi, 0x123b2f04
mov ebx, 0xe899252c
dec esi
inc ebx
xor ecx, esi
xor esi, ecx
add edx, esi
dec edx
jmp 0x47a03f
push 0xe36ce8b8
or esi, ecx
xor ebx, edx
mov ecx, ebx
and ecx, esi
xor ecx, ebx
rol ecx, 0x17
and esi, ebx
add ecx, esi
shr ecx, 0x19
xor edx, ebx
sub esi, 0xe8e01dbc
jmp 0x479a4f
push 0xe375e3d4
xchg ecx, edx
neg ecx
xchg esi, edx
xchg esi, ecx
add ecx, esi
shl edx, 0x15
mov esi, edx
sub ebx, ecx
and edx, esi
sub edx, ecx
jmp 0x47b345
push 0xe3764e0d
and edx, 0xe8f7f1d3
sub esi, ecx
mov edx, 0xe8f8ad62
or esi, 0xe8f91e87
neg esi
or ebx, 0xe8f9d5c6
add edx, ecx
dec ebx
jmp 0x478caa
push 0xe36f70b1
shr ecx, 0xf
ror ebx, 0xc
add esi, ebx
dec ecx
or ebx, ecx
xchg ebx, esi
add ebx, esi
or ecx, ebx
jmp 0x479f59
mov edi, 0x123b2f04
mov edx, esi
bswap edx
xchg esi, ebx
jmp 0x47aa73
pop edi
add edx, ecx
mov ecx, esi
sub edx, esi
or ecx, ebx
sub ebx, 0xe9214178
bswap ebx
rol ecx, 0x13
ror ecx, 0x11
mov ebx, esi
ror edx, 0xa
and edx, ebx
xor edx, ebx
add edx, ebx
sub edx, esi
xor esi, 0xe9232879
xor ecx, 0xe9235b9a
jmp 0x478e30
pop edi
ror ecx, 8
or esi, edx
xor ecx, esi
add ecx, ebx
xchg ecx, ebx
add ebx, esi
shr ecx, 0x16
jmp 0x47a5ef
call fcn.00478ae5
xor ebx, edx
or esi, 0xe925b13f
and edx, ebx
sub ecx, 0xe92611ca
sub edx, ecx
shl ebx, 0x1d
add ebx, ecx
xor esi, ecx
xchg ecx, ebx
add esi, ebx
or edx, esi
and esi, edx
neg ebx
jmp 0x479ed8
push 0xe36d3f75
not esi
xchg ebx, ecx
xchg esi, edx
shr edx, 0xe
dec ebx
dec esi
shl ebx, 0x1a
and edx, esi
shl esi, 0x1b
rol ecx, 0x12
jmp 0x47a355
pop edi
add esi, ecx
mov ebx, 0xe9570ce6
mov ebx, ecx
inc edx
sub ebx, 0xe9579a31
sub esi, ebx
ror edx, 5
and ecx, esi
sub esi, 0xe95864d0
add ecx, esi
jmp 0x47985a
push 0xe37a7d8d
mov edx, ecx
mov ebx, 0xe959042a
xchg edx, ecx
shr edx, 0x1c
sub ecx, esi
dec esi
sub edx, ebx
add ecx, edx
add edx, esi
or ebx, edx
not edx
mov esi, ebx
inc esi
add ecx, esi
jmp 0x47a6a5
call edi
ror edx, 0xb
xchg edx, ecx
or esi, 0xe97134a9
sub ebx, edx
add esi, ecx
add edx, ecx
or ebx, edx
jmp 0x47b1b7
push 0xe3799933
add ebx, ecx
not edx
mov edx, ebx
mov ebx, ecx
ror ecx, 9
rol edx, 7
and ebx, esi
sub edx, esi
ror ecx, 0x19
rol edx, 0x14
neg ecx
jmp 0x47aa9f
call edi
mov ebx, edx
xchg esi, edx
neg ebx
mov ebx, ecx
and edx, esi
mov ecx, esi
xor ebx, edx
add esi, ebx
jmp 0x47b679
pop edi
and edx, 0xe9953b15
or esi, ecx
or esi, ebx
rol ebx, 8
sub ebx, ecx
and ecx, edx
jmp 0x479713
mov edi, 0x123b2f04
not ebx
mov ebx, 0xe996b7b9
and ecx, 0xe996f3a8
or ecx, 0xe99725d0
xor ebx, edx
bswap ebx
inc edx
jmp 0x47a6d7
call edi
sub edx, ebx
xor esi, ebx
shr ebx, 0xb
xchg esi, ebx
mov ebx, ecx
dec edx
shr esi, 0x18
or esi, 0xe9995ba6
sub ecx, 0xe9998a99
xor ecx, ebx
jmp 0x478ee1
call fcn.00478ae5
or edx, ecx
xor esi, ecx
add esi, 0xe99a5c14
xor ecx, 0xe99a9185
and esi, 0xe99ac05f
not edx
add edx, esi
sub ecx, 0xe99b5f63
xchg ebx, ecx
jmp 0x47b5b0
jmp loc.00480017
push 0xe37d1531
mov ecx, esi
and ecx, 0xe9b73e55
and edx, ecx
or ecx, ebx
rol esi, 0x14
neg ebx
xchg ecx, edx
jmp 0x47907f
push 0xe37804b7
bswap esi
or esi, edx
mov edx, ecx
or edx, ebx
rol esi, 0x15
sub ebx, edx
and edx, ebx
or edx, esi
xor ebx, 0xe9c0c177
and esi, ecx
and esi, ebx
jmp 0x47978b
mov edi, 0x2774562b
xchg esi, edx
mov ebx, 0xe9d91fdb
xor ecx, esi
and ecx, ebx
or edx, esi
xor esi, ebx
nop
mov ebx, 0xe9da48d8
sub esi, ebx
mov ebx, edx
mov edx, ebx
nop
jmp 0x478fa5
pop edi
xor ecx, esi
or esi, 0xe9ff61ac
bswap ebx
xor ebx, esi
jmp 0x478d6f
mov edi, 0x2774562b
add esi, 0xea089f7e
sub esi, ecx
or ecx, edx
mov ecx, 0xea092ccb
sub esi, edx
dec ecx
sub esi, ebx
dec ebx
xor ecx, edx
mov ebx, 0xea0a59fd
shl ebx, 2
shl esi, 0x10
and ebx, 0xea0aeb38
jmp 0x479870
call fcn.00478ae5
xchg ebx, ecx
neg edx
bswap esi
neg ecx
and ebx, esi
xchg esi, ebx
add ecx, esi
or ecx, ebx
jmp 0x479f7b
push 0xe370f4db
neg ecx
add ebx, edx
and ebx, edx
not esi
add edx, esi
inc edx
or ebx, edx
jmp 0x47a933
pop edi
dec ecx
mov ecx, ebx
or esi, ecx
or ebx, esi
neg ebx
or ebx, ecx
mov esi, edx
and edx, ecx
sub esi, ecx
mov ecx, ebx
shr esi, 4
or ebx, esi
or edx, 0xea32e6f2
jmp 0x47981b
push 0xe3758f84
sub edx, esi
and edx, ecx
mov edx, esi
mov edx, esi
add esi, ecx
and esi, 0xea341c54
jmp 0x479538
call fcn.00478ae5
add ecx, esi
or ecx, ebx
neg ecx
or esi, ecx
add ecx, 0xea463ddd
xor esi, edx
add ecx, edx
mov ecx, 0xea4738be
inc ebx
bswap esi
and ecx, 0xea50aa2a
and ecx, edx
jmp 0x479d19
push 0xe379f162
mov esi, ebx
dec ecx
xor esi, edx
mov esi, edx
or ecx, 0xea52ff64
neg edx
xchg esi, ebx
sub esi, 0xea57e17e
xchg ecx, esi
dec esi
sub ebx, 0xea587453
or esi, ebx
jmp 0x47b652
pop edi
and ecx, ebx
sub edx, ebx
add edx, esi
dec edx
or ecx, edx
xor esi, ebx
or ecx, 0xeab3818b
mov edx, ecx
add ecx, edx
bswap ebx
add edx, 0xeab43f60
and ecx, edx
xchg ecx, edx
jmp 0x479eb4
pop edi
and esi, 0xeabe8003
xor edx, ecx
bswap ecx
or ebx, esi
or esi, 0xeabf43f6
inc ecx
rol esi, 0xa
sub edx, 0xeabfe1f4
ror edx, 0x18
or esi, edx
or ecx, edx
shr esi, 0x1e
and ecx, esi
xor ebx, 0xeac0fea8
jmp 0x47b0f7
call edi
or esi, 0xead1b006
and edx, ebx
add ebx, edx
sub esi, ebx
mov ecx, esi
xchg ebx, ecx
add ebx, esi
jmp 0x47b387
push 0xe376244e
neg ecx
inc ebx
mov edx, 0xead37ba2
ror ebx, 3
or edx, 0xead3dd13
xor edx, esi
mov esi, edx
inc esi
or edx, esi
add esi, edx
sub ecx, ebx
jmp 0x479594
pop edi
not ecx
xor esi, 0xead7141a
or ebx, 0xead7508b
sub ebx, 0xead78361
and ebx, 0xead7b2c8
shr ebx, 6
add ebx, edx
xor ecx, ebx
jmp 0x479f42
call edi
add edx, 0xeaf8d69a
mov ecx, ebx
add ebx, 0xeaf9377d
neg edx
and ecx, ebx
xchg ecx, esi
xor esi, 0xeaf9f8e3
shl edx, 0x15
not ebx
not ebx
jmp 0x478c1a
push 0xe377dafd
mov edx, ecx
dec esi
and esi, edx
mov esi, edx
add ebx, edx
shl ebx, 1
xchg ebx, esi
sub edx, 0xeafdcf71
and ecx, edx
mov ebx, ecx
jmp 0x47a1f0
push 0xe37a343a
xchg esi, ebx
not esi
not ecx
xchg ecx, esi
xor ecx, edx
or esi, ecx
mov ebx, ecx
not ebx
add ecx, ebx
and ebx, 0xeb02585d
nop
mov ecx, edx
xchg ecx, ebx
jmp 0x479b6f
pop edi
xor ebx, esi
mov edx, esi
add esi, 0xeb03867c
shr ecx, 0x1a
dec edx
or edx, ebx
not esi
xor ebx, esi
xor esi, ecx
add ebx, esi
not ecx
add edx, ecx
xchg edx, esi
mov ecx, esi
jmp 0x47a90f