Function at 0x401000
Capabilities:
Encrypt data using chaskey
Query or enumerate registry value

Disassembly:
mov ebx, edi
call sub.user32.dll_GetMessageTime
xchg esi, edi
inc edi
or edx, 0x917d9554
dec esi
and edi, edx
cmp eax, 0xfffffedb
jne 0x4010b0
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_GetAce
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_RegQueryMultipleValuesA
ret
mov esi, edx
sub edi, edx
or edi, 0x9180c5dd
xchg edx, edi
mov ebx, edi
add esi, edx
mov edx, ebx
call sub.user32.dll_GetMessageTime
add edx, 0x918204a0
cmp eax, 0xffffff29
jne 0x40116f
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_GetAce
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_GetAce
ret
xor esi, 0x918479e2
xchg ebx, esi
or edx, 0x9184f281
xor ebx, 0x918530b2
not edx
mov edi, ebx
and edi, edx
and edi, 0x918653f5
call sub.user32.dll_GetMessageTime
inc edx
add edx, esi
bswap esi
cmp eax, 0xffffff1d
jne 0x40121d
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.oleaut32.dll_OleCreatePropertyFrameIndirect
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_LsaSetInformationTrustedDomain
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_RegQueryMultipleValuesA
call sub.advapi32.dll_GetAce
call sub.advapi32.dll_RegQueryMultipleValuesA
ret
jmp 0x494178
xor edx, 0x9277e083
jmp 0x4961eb
push 0x928d5a17
xor edx, esi
add ecx, edx
or ebx, esi
and ecx, esi
inc ecx
rol edx, 0xb
neg ebx
or ebx, esi
mov esi, 0x991f4bb6
xor ecx, ebx
jmp 0x496eb4
mov edi, 0x2774562b
ror ecx, 1
and edx, ebx
ror ebx, 0x1b
xor edx, ebx
not ecx
xchg ebx, edx
add ebx, esi
sub edx, 0x99490575
mov edx, ebx
dec edx
neg ebx
mov ebx, esi
xor ecx, 0x994a5f88
sub ebx, 0x994a9dda
jmp 0x495b5c
push 0x92842868
and esi, edx
xchg edx, ebx
mov edx, ebx
ror ebx, 5
xchg ecx, ebx
or esi, 0x9973a471
rol esi, 0x11
jmp 0x495480
push 0x928f7d11
rol edx, 0x1d
ror ecx, 0xb
or ecx, ebx
xchg edx, esi
mov edx, ecx
and ebx, ecx
mov ebx, edx
jmp 0x49611e
pop edi
mov edx, ecx
add ecx, ebx
xchg ecx, edx
jmp 0x496980
push 0x928b6409
not edx
ror esi, 0xd
add esi, ecx
sub ebx, 0x99a3a528
neg edx
mov ecx, edx
and edx, esi
neg esi
add ebx, ecx
xchg edx, esi
jmp 0x49528f
push 0x9283fff3
sub ebx, ecx
xor esi, ebx
sub esi, ecx
and esi, 0x99da17ea
add esi, edx
sub edx, ecx
shl esi, 0x18
neg edx
sub edx, esi
xor ecx, edx
and esi, edx
jmp 0x49444a
push 0x9281139a
sub ebx, esi
xor edx, esi
or ecx, ebx
or ecx, esi
sub esi, ecx
jmp 0x4942bb
call fcn.004952f3
not edx
xor ecx, 0x99f413e4
sub esi, ecx
and edx, ecx
rol ebx, 0xc
and ebx, ecx
inc edx
sub esi, edx
jmp 0x495eff
pop edi
add ecx, esi
or esi, 0x9a1463d5
and edx, ebx
and ebx, 0x9a14ed96
sub ebx, 0x9a152bbc
mov ecx, ebx
xchg esi, ebx
xchg ecx, edx
add esi, ecx
not esi
jmp 0x495ba7
pop edi
xchg ecx, esi
add ebx, esi
mov edx, 0x9a1737f0
jmp 0x4965a8
pop edi
sub ecx, edx
xor esi, ecx
xor edx, 0x9a40aa26
mov ebx, esi
sub edx, 0x9a4182ff
shl ecx, 5
and esi, ebx
or edx, ebx
sub edx, esi
xor ebx, ecx
jmp 0x4962df
pop edi
dec ebx
shl ecx, 7
mov esi, edx
ror ebx, 0x1a
shl edx, 1
ror esi, 0x1d
shr ebx, 2
jmp 0x4964a7
push 0x92821f93
or ecx, edx
xor edx, ecx
sub edx, ebx
xor ebx, edx
add edx, esi
ror ebx, 0x14
xor esi, ecx
and ecx, esi
jmp 0x495bbe
call fcn.004952f3
rol esi, 3
add ebx, edx
sub ebx, ecx
or ebx, esi
and edx, ecx
xor ebx, esi
mov edx, esi
add ecx, 0x9a5922bf
or edx, ebx
dec ebx
mov edx, esi
jmp 0x495173
jmp loc.0049a000
pop edi
ror edx, 0x19
and ebx, ecx
ror edx, 0x15
add edx, ebx
xor esi, edx
add edx, esi
and ecx, edx
jmp 0x496384
push 0x928ee748
not edx
xchg esi, ecx
shr edx, 7
and edx, esi
sub esi, 0x9a8028a9
neg ebx
add edx, esi
add esi, ecx
or edx, ebx
xchg ebx, edx
add ebx, esi
jmp 0x495e52
pop edi
add esi, 0x9a81ecef
or edx, ebx
add edx, 0x9a82650b
sub edx, esi
add esi, ebx
and ebx, esi
rol ecx, 0x10
sub esi, ecx
sub esi, edx
shl ebx, 0x1e
add ebx, edx
add ebx, 0x9a848f47
jmp 0x4958e4
mov edi, 0x2774562b
add ebx, ecx
and esi, ebx
ror ecx, 9
add ebx, esi
sub esi, ecx
sub ecx, esi
dec ecx
ror ecx, 0x11
xor ecx, ebx
and esi, 0x9a88c8ab
mov ebx, esi
jmp 0x49620e
call fcn.004952f3
xor ecx, edx
shl edx, 9
not ecx
neg ebx
dec esi
and ebx, ecx
shr esi, 5
xchg ebx, ecx
jmp 0x49592a
call edi
not ebx
and esi, ecx
or edx, ebx
add ecx, edx
and esi, edx
dec ebx
mov ecx, 0x9a9521cb
or edx, ebx
bswap ecx
add esi, ecx
nop
jmp 0x495444
push 0x928b9015
ror ebx, 7
dec ebx
nop
dec edx
mov ebx, edx
xchg ecx, ebx
jmp 0x497165
pop edi
add ecx, edx
dec ebx
mov esi, 0x9abc2927
shr ebx, 0x17
xor edx, 0x9abd2353
jmp 0x496f60
push 0x928288c0
mov ecx, ebx
mov ecx, ebx
or ecx, edx
and ecx, esi
bswap ecx
neg esi
jmp 0x495a0c
pop edi
xor esi, ebx
sub esi, 0x9adaa36a
and edx, ebx
xchg esi, ecx
mov edx, esi
mov ebx, 0x9adb9d3c
not edx
rol edx, 0x1d
or ebx, edx
mov ecx, esi
xor esi, ebx
neg ebx
jmp 0x495cf8
pop edi
rol esi, 0x1f
neg esi
mov edx, ebx
add edx, ecx
and edx, ecx
mov ecx, edx
jmp 0x494b05
call edi
sub esi, ebx
add ecx, edx
shr esi, 0x19
add edx, ecx
or esi, 0x9adfd33b
sub ecx, 0x9ae01b7c
xchg edx, ecx
or edx, ecx
sub ecx, 0x9ae0d010
xchg ecx, esi
inc ecx
jmp 0x49541e
push 0x92845685
not edx
dec esi
sub ebx, ecx
xor ecx, ebx
or ebx, ecx
xchg esi, ecx
jmp 0x497115
mov edi, 0x2774562b
not ecx
and ebx, esi
shr esi, 0x19
mov ecx, ebx
or ebx, 0x9ae9ee9d
add ebx, edx
add ebx, ecx
jmp 0x49512f
pop edi
mov ecx, 0x9aee5745
or edx, ecx
sub esi, edx
dec ecx
rol ecx, 0x18
sub ecx, 0x9aefbd29
mov ebx, 0x9aeff927
and edx, 0x9af036e0
and edx, esi
sub ecx, 0x9af0bd1f
jmp 0x496b07
push 0x92863d17
or esi, edx
or ebx, esi
neg esi
and ebx, edx
or ebx, edx
mov ecx, edx
add edx, esi
xor ecx, esi
xchg edx, esi
xchg ecx, edx
sub edx, esi
jmp 0x495c54
mov edi, 0x123b2f04
not esi
xor ecx, edx
shr ebx, 7
xchg ebx, edx
or edx, ecx
add ecx, ebx
and ebx, 0x9b0494c1
jmp 0x494a63
push 0x927def07
add esi, ecx
xchg edx, ebx
neg edx
or edx, 0x9b0ebe6a
xor ecx, edx
xor ecx, 0x9b0f3bc3
sub edx, 0x9b0f79ce
or ecx, esi
bswap ecx
xchg esi, ecx
sub edx, ecx
xor esi, edx
or ecx, ebx
shr esi, 0xf
jmp 0x495c89
pop edi
ror esi, 0xd
or ebx, ecx
nop
and esi, ebx
and ebx, esi
and esi, ebx
jmp 0x494183
push 0x9285d7d9
xor esi, ecx
ror ebx, 0x15
sub esi, 0x9b4598a2
shl ebx, 0xb
ror edx, 5
and esi, edx
jmp 0x4955ea
call edi
and esi, edx
and ecx, edx
xchg ebx, edx
shl edx, 0xa
xchg esi, ebx
and ecx, ebx
jmp 0x496d72
mov edi, 0x2774562b
add ebx, 0x9b5a2267
xor ebx, ecx
inc esi
or edx, esi
mov edx, ebx
xor ebx, esi
sub esi, 0x9b5b9697
inc esi
mov esi, edx
jmp 0x496a80
call fcn.004952f3
mov esi, ecx
or edx, ebx
neg esi
add ebx, esi
ror edx, 0x16
sub esi, edx
mov esi, ebx
or esi, 0x9b7b9d95
mov esi, ebx
or esi, 0x9b7c17fd
jmp 0x496745
pop edi
sub ecx, esi
not ecx
not ecx
sub edx, ecx
add ebx, edx
or ecx, esi
mov edx, 0x9b805dc7
jmp 0x496dfe
push 0x9282487e
mov ecx, ebx
add ebx, esi
or edx, 0x9b8122ea
nop
or ebx, 0x9b819ed0
or ebx, 0x9b81dc35
sub edx, ecx
shl esi, 0x16
xchg ebx, ecx
mov ebx, 0x9b82dc9a
nop
ror edx, 4
sub ecx, 0x9b839814
add edx, ecx
jmp 0x4952ba
push 0x9286a4ef
xor edx, ebx
xor ecx, esi
sub ecx, ebx
not edx
ror ebx, 0x1d
shl ebx, 0xc
jmp 0x496ddb
push 0x927e1a9d
add ecx, ebx
xor esi, ecx
or edx, 0x9b9018c8
add ecx, edx
add esi, edx
and ecx, edx
add ebx, 0x9b91108f
ror edx, 1
and esi, edx
xor edx, ebx
jmp 0x496016
pop edi
add ebx, esi
or edx, ebx
xor edx, ecx
xchg ebx, esi
xchg ebx, esi
xchg ebx, ecx
mov edx, ecx
and edx, ecx
jmp 0x4968d4
pop edi
sub esi, 0x9ba61cae
mov ecx, 0x9ba65b23
and edx, 0x9ba696f9
bswap esi
shr ebx, 0xd
sub ecx, edx
rol edx, 6
sub ebx, ecx
jmp 0x494b2b
push 0x928f128b
shl ecx, 0xa
inc ecx
or edx, ecx
xchg esi, ebx
add ebx, ecx
sub edx, ecx
add edx, esi
jmp 0x494586
call edi
mov ecx, esi
and ebx, edx
xor esi, ecx
inc esi
or edx, ecx
xor ebx, edx
xor ecx, edx
and ecx, 0x9bbf0936
sub edx, 0x9bbf4701
xchg ebx, esi
add ebx, ecx
xor esi, ecx
jmp 0x496813
push 0x927e4552
and edx, esi
mov ecx, ebx
jmp 0x496e1f
mov edi, 0x2774562b
and ecx, ebx
add edx, esi
dec ecx
dec ecx
add ebx, 0x9be76176
jmp 0x494fed
push 0x927db2a5
mov ecx, esi
add ebx, 0x9bf9db46
mov edx, esi
bswap edx
shl ecx, 2
mov edx, 0x9bfadd45
sub ecx, edx
shl ecx, 0x18
jmp 0x4956c0
call fcn.004952f3
add esi, 0x9bfbace0
neg esi
rol ecx, 0xb
add esi, ecx
or esi, ebx
mov edx, ebx
ror edx, 0x17
jmp 0x496d29
pop edi
add ebx, 0x9c024a6c
rol edx, 0x13
xor edx, ecx
neg ecx
sub edx, 0x9c034494
xor edx, ebx
or edx, 0x9c03c117
xor esi, 0x9c0408fd
add ebx, esi
bswap edx
or edx, ebx
jmp 0x4965cf
push 0x928eb9e2
dec esi
or ecx, esi
xchg edx, ecx
sub ecx, esi
add ebx, ecx
rol esi, 3
add esi, ebx
and ecx, esi
add ebx, edx
or ecx, 0x9c1180d5
xchg ebx, ecx
or edx, ebx
jmp 0x495075
mov edi, 0x123b2f04
sub ebx, edx
xchg edx, ecx
or ecx, edx
xor edx, ecx
xor esi, 0x9c1b3311
rol edx, 7
mov edx, ebx
add esi, edx
inc esi
xchg esi, ecx
mov esi, 0x9c1caa7c
sub ebx, ecx
or edx, 0x9c1d2690
add ecx, 0x9c1d676c
jmp 0x4971b3
push 0x9281f351
xor ebx, edx
sub ecx, edx
sub ebx, edx
mov edx, ecx
or esi, ecx
jmp 0x494e26
mov edi, 0x2774562b
shr edx, 0xa
and edx, esi
mov edx, ecx
or ebx, esi
mov ecx, edx
jmp 0x494e98
pop edi
and ecx, 0x9c363a31
mov ebx, edx
xor ecx, ebx
and edx, esi
shl ecx, 0xf
shr ebx, 0x12
rol esi, 0x17
mov ebx, edx
jmp 0x494966
call edi
sub ecx, 0x9c42ff14
shr esi, 5
xor esi, 0x9c438668
and ecx, ebx
and ecx, esi
xchg esi, edx
neg ecx
or ecx, edx
and edx, ecx
or esi, edx
jmp 0x4945ce
push 0x928b3617
xor ecx, 0x9c495318
add ecx, ebx
shl esi, 2
sub esi, ebx
mov edx, 0x9c4a4557
or edx, 0x9c4a835b
or esi, ecx
dec ecx
xchg ebx, esi
jmp 0x4946d0
push 0x928004e9
xchg edx, ecx
not ebx
or ecx, ebx
mov ebx, 0x9c4c487c
bswap ecx
xor edx, esi
or esi, ebx
xor edx, ecx
xor esi, ebx
dec edx
jmp 0x4954e1
call edi
or ecx, ebx
xchg esi, edx
mov edx, 0x9c6aeecd
sub ebx, esi
and edx, esi
add ebx, esi
rol ebx, 9
add esi, 0x9c6c1a59
xchg ebx, esi
and ecx, edx
or esi, edx
add ebx, ecx
jmp 0x495019
pop edi
or esi, ecx
sub edx, 0x9c7a0091
bswap ebx
xor edx, 0x9c7a8075
and ecx, ebx
add esi, ecx
bswap ebx
xchg ecx, esi
sub edx, 0x9c7bbcb6
and ebx, 0x9c7bfda1
jmp 0x495522
push 0x9287516c
xor ebx, ecx
mov ecx, 0x9c7fdf36
and esi, ebx
or esi, edx
mov ebx, esi
jmp 0x49634f
pop edi
sub edx, ebx
and ebx, 0x9c87719a
xor esi, 0x9c87af3a
and edx, 0x9c87ed0b
xchg edx, ecx
jmp 0x495dcf
call fcn.004952f3
not ebx
xchg ebx, ecx
bswap esi
and esi, edx
or edx, 0x9c897baf
sub ebx, esi
shr edx, 8
sub edx, ebx
xor ecx, edx
jmp 0x4972b7
pop edi
inc ebx
and ebx, ecx
xor edx, 0x9c923fc3
inc ecx
mov edx, esi
xor esi, 0x9c93352b
jmp 0x494df6
call fcn.004952f3
xor esi, ecx
mov esi, edx
rol esi, 0x17
xor esi, edx
and ecx, ebx
sub edx, esi
add edx, ebx
jmp 0x496540
pop edi
ror esi, 4
or ebx, 0x9cb1382e
xchg edx, ecx
sub ebx, 0x9cb1bf27
sub edx, ecx
or ecx, ebx
jmp 0x49575e
pop edi
xor ebx, esi
ror edx, 6
inc ecx
xchg ebx, ecx
xchg ecx, ebx
sub esi, edx
sub ebx, edx
add ecx, 0x9cc796a3
xchg esi, ecx
inc ebx
jmp 0x494d77
call edi
or ebx, ecx
sub edx, 0x9cd8b6b7
shl ecx, 0xc
sub esi, edx
xchg ecx, ebx
shr ecx, 5
neg edx
nop
mov ecx, esi
and ecx, 0x9cdb2b05
not ebx
jmp 0x496c20
pop edi
mov edx, esi
sub ebx, ecx
sub edx, 0x9cdeefc5
xor ebx, ecx
or ebx, 0x9cdf68b9
dec ebx
add edx, ecx
shr ebx, 8
add ebx, ecx
jmp 0x4949e6
push 0x9286f869
or edx, esi
sub edx, esi
xchg edx, ebx
xor edx, ecx
mov edx, esi
sub ebx, 0x9ce63c39
mov ebx, 0x9ce67b14
neg esi
add esi, edx
jmp 0x496869
pop edi
and ecx, ebx
inc esi
mov ebx, edx
or ebx, 0x9ce7f841
and esi, edx
xor ecx, esi
add esi, edx
jmp 0x49626c
push 0x927e6c67
or edx, ebx
or edx, esi
bswap ecx
xchg ecx, esi
dec ecx
and edx, ecx
xor ecx, edx
shl esi, 8
xor ecx, 0x9ceb0777
mov esi, ebx
jmp 0x496466
push 0x928d89ed
sub ebx, edx
or edx, esi
and ecx, ebx
xchg edx, ecx
or ecx, 0x9cf408b3
and esi, ebx
bswap ebx
jmp 0x4950e1
pop edi
and edx, esi
or ecx, 0x9cff441d
and edx, 0x9cff85d8
neg ecx
or ecx, edx
jmp 0x49509a
mov edi, 0x2774562b
and ecx, ebx
and edx, ebx
and edx, 0x9d1fd318
mov esi, ecx
xchg edx, ecx
xor ecx, edx
and edx, 0x9d20eded
or ebx, esi
jmp 0x4968f0
push 0x928bbcdf
shl esi, 0x1e
or esi, edx
ror edx, 4
neg edx
or edx, esi
mov esi, ecx
and esi, 0x9d262f16
inc ecx
add esi, edx
sub esi, edx
xor ecx, edx
dec edx
jmp 0x495650
call fcn.004952f3
or edx, esi
inc esi
bswap esi
and esi, ecx
inc edx
mov ebx, edx
xchg esi, ecx
add edx, ecx
xchg esi, edx
and edx, esi
and ecx, edx
jmp 0x495457
call edi
xor ecx, 0x9d3c8dc5
and esi, edx
neg edx
shr ecx, 3
xor esi, ecx
or esi, ecx
ror esi, 0x13
sub esi, ebx
add edx, ecx
mov ebx, esi
inc ecx
ror ebx, 9
ror ebx, 0x15
xchg esi, ecx
or ebx, 0x9d3feedc
jmp 0x4952a3