Function at 0x401000
Capabilities:
Encrypt data using chaskey

Disassembly:
xor ebx, edx
rol edx, 0x1e
inc edx
and ebx, esi
neg edx
xchg esi, ecx
xchg ebx, esi
call sub.kernel32.dll_GetCurrentProcess
shl ebx, 0xf
add edx, ecx
cmp eax, 0xffffff12
jne 0x40108d
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call main
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
ret
sub ebx, ecx
neg ebx
rol esi, 7
not edx
dec edx
add edx, ecx
call sub.kernel32.dll_GetUserDefaultLCID
rol ebx, 0x17
cmp eax, 0xfffffed7
jne 0x40111b
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
ret
or ecx, esi
shr ecx, 0x19
neg esi
call sub.kernel32.dll_GetUserDefaultLCID
and edx, 0x22b6e850
cmp eax, 0xffffff2b
jne 0x4011c5
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
ret
or ecx, edx
add esi, ebx
ror esi, 0x1a
mov ecx, edx
inc esi
call sub.kernel32.dll_GetUserDefaultLCID
and edx, ebx
add esi, 0x22c3340b
cmp eax, 0xffffff2b
jne 0x401256
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call main
call main
call main
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
ret
jmp 0x505c65
nop
mov edx, esi
bswap edx
ror ebx, 5
add edx, esi
mov ebx, ecx
jmp 0x506766
pop ecx
or edi, esi
add ebx, edi
add ebx, 0x3135af40
xchg esi, edx
add ebx, edx
mov esi, edi
not edi
or edi, edx
sub edi, edx
add edx, 0x3138d0bc
jmp 0x50637a
mov ecx, 0x123b2f04
mov ebx, edx
and ebx, edi
sub edi, ebx
neg edx
and ebx, edi
and edi, 0x314505cc
jmp 0x507de0
push 0x24433c5f
xchg edx, edi
ror edi, 8
or edi, ebx
and edi, edx
or ebx, edx
mov edx, esi
or edx, esi
jmp 0x506793
pop ecx
xchg edx, ebx
xor ebx, edx
add edi, 0x31e93514
xor edi, esi
or edx, edi
xchg edi, ebx
jmp 0x508d05
push 0x243f8cf4
sub edx, esi
mov edi, esi
sub edx, 0x327eb10e
bswap edx
add edx, ebx
add esi, 0x327f69ab
mov ebx, edi
xor ebx, edx
neg edx
add edi, esi
and edi, esi
mov ebx, 0x3280da61
jmp 0x5089ea
push 0x24438fff
rol ebx, 0x15
shr edi, 0x12
ror edi, 3
ror esi, 9
and edi, edx
jmp 0x506077
mov ecx, 0x123b2f04
and edx, edi
or ebx, esi
bswap esi
bswap esi
jmp 0x507c09
pop ecx
xchg ebx, esi
xor esi, 0x3294d1ae
and edx, 0x32950f75
and edi, 0x32954d88
sub edx, esi
rol edi, 6
shl esi, 0x17
shr edi, 0x15
shl edx, 0x19
jmp 0x507e9a
push 0x2447170a
rol edx, 0x19
sub ebx, edi
and edi, edx
add edx, ebx
xchg edi, esi
jmp 0x508562
jmp loc.0050d000
mov ecx, 0x123b2f04
xor ebx, 0x3360198c
add esi, edx
shr edx, 0x15
add edi, esi
or edi, ebx
xor edi, edx
bswap ebx
mov esi, edi
xchg edx, ebx
and edx, edi
jmp 0x506ce8
call ecx
xor esi, edx
shr edx, 0x10
xor edi, edx
sub edi, ebx
xchg edx, esi
and esi, 0x3369cdbd
mov esi, edx
rol edx, 0x1a
not edx
jmp 0x5078e8
pop ecx
shl edi, 0xd
add esi, edx
shr esi, 6
jmp 0x5078b1
push 0x244b4336
xor edi, ebx
xor edi, 0x34c05c10
xchg edi, esi
xor esi, edx
xchg edi, esi
nop
or edi, edx
shl esi, 0x11
dec esi
jmp 0x5081da
push 0x244293ee
or edi, edx
xor edi, esi
mov ebx, edi
mov edi, edx
not edi
jmp 0x508cbf
pop ecx
or esi, edx
not ebx
sub edi, edx
neg esi
or edi, edx
rol edx, 8
nop
add ebx, edx
xor esi, edx
add edi, 0x35122051
sub ebx, edi
jmp 0x5087d7
pop ecx
sub edi, esi
sub ebx, edx
neg edi
sub edi, ebx
and edx, esi
or esi, ebx
or esi, edi
or esi, edi
and ebx, edx
xchg edx, esi
mov esi, edi
or ebx, edx
neg esi
and edx, 0x3540bcaf
not edi
jmp 0x508619
call fcn.00505e45
ror ebx, 0x15
mov ebx, edx
add esi, 0x35649c48
or ebx, 0x356951ba
and edx, ebx
or edx, esi
xchg edx, edi
jmp 0x507fda
push 0x24403fd1
xchg edx, esi
add edx, 0x358900b5
xchg edx, esi
xor ebx, edx
or edi, edx
xchg edi, ebx
sub esi, edi
not esi
add edx, edi
nop
jmp 0x50682f
call fcn.00505e45
not ebx
add ebx, 0x358dac52
xchg ebx, esi
inc edx
add ebx, edx
mov ebx, edx
not ebx
xor edx, esi
or edi, edx
or ebx, esi
bswap esi
jmp 0x506ee8
call fcn.00505e45
xchg edi, ebx
or esi, ebx
mov edx, ebx
sub esi, ebx
not edx
and edi, esi
mov edi, 0x35e3acd5
xor edx, esi
mov edx, esi
add edx, esi
mov ebx, edx
or edi, esi
mov esi, 0x35e64f32
mov ebx, esi
sub esi, edx
jmp 0x508580
pop ecx
add edx, ebx
add esi, edi
neg ebx
or ebx, esi
mov esi, edi
xchg esi, edx
mov edx, edi
jmp 0x507a49
call ecx
bswap ebx
shl edi, 0xb
inc edx
add edi, edx
ror edi, 3
shr edi, 7
not ebx
and edi, ebx
jmp 0x505fff
push 0x2446bdfc
shr edx, 0x13
shr edx, 3
not esi
nop
jmp 0x506b14
push 0x244b9877
xchg edx, ebx
xchg edx, esi
sub ebx, esi
xchg edx, ebx
sub esi, 0x36836343
sub ebx, edx
jmp 0x508253
push 0x244beced
or esi, edi
xor edi, edx
xchg ebx, esi
mov ebx, edi
not edx
xor edx, esi
mov esi, edi
sub edi, ebx
xchg edx, esi
xor edi, 0x368d1efb
add ebx, esi
jmp 0x508b26
mov ecx, 0x123b2f04
xchg edi, esi
dec ebx
xchg esi, ebx
mov esi, edi
sub ebx, esi
xor esi, edx
mov edx, ebx
add edi, esi
and ebx, esi
dec edx
xchg edx, edi
jmp 0x507abd
call ecx
ror esi, 5
mov edx, esi
add edx, 0x378da51c
add edi, ebx
dec edi
xchg ebx, esi
add ebx, edx
add ebx, edx
add edi, 0x3790678d
or ebx, edi
xchg edx, edi
jmp 0x506841
pop ecx
or edx, esi
and esi, edx
sub edx, ebx
or ebx, edi
ror edx, 0xa
add edx, esi
jmp 0x508abf
pop ecx
or edx, 0x380bfdaf
neg esi
and edi, ebx
sub edi, esi
xor edi, 0x380dce14
jmp 0x507002
push 0x243fef68
xchg edi, esi
rol ebx, 0x17
sub edx, edi
bswap edi
or edx, 0x38b0a826
xchg ebx, esi
xor ebx, edx
and esi, 0x38b20e68
not esi
sub esi, edx
xchg esi, edx
xor ebx, esi
or edx, ebx
jmp 0x507be8
push 0x24464734
sub esi, edx
add ebx, esi
xor esi, edx
ror edx, 0x14
bswap edi
shr ebx, 7
sub edi, ebx
xor esi, 0x38dc7843
add edi, 0x38dcecfc
shr edx, 0x13
shr esi, 0x1f
xor edx, esi
add edx, edi
sub esi, ebx
jmp 0x50807f
push 0x244c3e2f
neg esi
xchg edi, esi
not edi
xchg edx, ebx
xor esi, edi
sub edi, edx
xchg edi, esi
xor edi, esi
add ebx, edi
jmp 0x506ec5
push 0x2442e40c
neg esi
shl esi, 0x1f
mov edi, 0x3938f523
shl esi, 5
xor edx, 0x3939e7ae
and esi, edx
mov ebx, esi
mov esi, edx
and esi, edi
jmp 0x506207
pop ecx
or edi, esi
add ebx, 0x39420947
neg edx
and ebx, edx
shr edi, 9
xchg ebx, edi
and esi, edi
dec ebx
jmp 0x507765