Function at 0x401000
Capabilities:
Encrypt data using chaskey

Disassembly:
mov edx, esi
shl ebx, 0xf
sub edx, 0x578ca896
shr esi, 0x14
add ebx, 0x578d279a
inc edx
mov ecx, esi
mov ebx, 0x578ddc7a
call sub.user32.dll_GetDoubleClickTime
ror esi, 0x13
add ecx, 0x578e7aec
mov edx, ecx
or ebx, esi
mov ecx, 0x578f2e9d
xor ebx, esi
mov ecx, edx
cmp eax, 0xffffff14
jne 0x4010cf
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
ret
xchg edx, esi
mov ecx, edx
xchg ecx, esi
xor ecx, 0x5794c01d
and esi, ecx
and ecx, edx
call sub.user32.dll_GetDoubleClickTime
rol edx, 1
add edx, ebx
or esi, 0x57975704
mov esi, 0x5797c032
xchg ebx, edx
rol esi, 5
sub ecx, 0x57996aa2
cmp eax, 0xfffffeef
jne 0x401160
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
ret
and edx, esi
and ecx, esi
add edx, 0x579cc775
xchg edx, ebx
ror ebx, 8
call main
xor edx, ebx
xor ebx, edx
or ebx, ecx
ror ecx, 9
cmp eax, 0xfffffee0
jne 0x401215
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
call sub.kernel32.dll_FindVolumeClose
call sub.ntdll.dll_ZwSetVolumeInformationFile
call sub.kernel32.dll_FindVolumeClose
ret
jmp 0x4940dd
xor esi, edx
xor ecx, edx
jmp 0x495661
push 0x58ad9bcf
rol edi, 0x19
mov esi, edx
add edx, ecx
and edi, esi
ror edx, 0x1f
xor edx, esi
neg ecx
or esi, ecx
mov edx, esi
jmp 0x4954b3
push 0x58ad70bb
inc edi
xor edi, esi
xor edi, edx
shl ecx, 4
or edx, esi
or edx, edi
add ecx, edi
xchg edi, edx
and edx, esi
neg edx
neg ecx
jmp 0x494c4b
push 0x58adc309
or esi, edi
mov edx, edi
not edi
not edi
xor ecx, edi
neg edx
or edi, edx
jmp 0x496d9f
push 0x58ad105f
or ecx, edx
add edi, esi
xor esi, edi
sub edi, esi
add ecx, edi
and esi, ecx
or esi, 0x5db37a9b
mov edi, esi
or edx, 0x5db3f511
jmp 0x496985
push 0x58ad4699
and edx, esi
or edi, edx
xchg esi, edi
mov edi, 0x5f2e4a52
or ecx, 0x5f2ed936
xchg edx, edi
dec ecx
shl edx, 3
mov edi, 0x5f323615
jmp 0x495427
jmp loc.0049a000
mov ebx, 0x123b2f04
add edx, edi
xchg esi, ecx
not ecx
add ecx, esi
mov edi, edx
inc edx
xchg edi, esi
xchg esi, edi
add edi, ecx
jmp 0x496c25