Function at 0x401000
Capabilities:
Encrypt data using chaskey

Disassembly:
or edx, edi
xchg esi, ebx
or edx, ebx
neg edi
shl esi, 0x18
xchg ebx, esi
ror esi, 8
call sub.kernel32.dll_GetCurrentThreadId
mov edx, esi
cmp eax, 0xfffffedb
jne 0x4010aa
call main
call main
call main
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
call main
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
ret
or edi, ebx
sub edx, esi
add ebx, edi
and esi, 0x375e675b
shr edx, 0x13
ror esi, 9
and esi, ebx
sub esi, edi
call sub.user32.dll_GetMenuCheckMarkDimensions
sub edx, edi
and edi, edx
or edi, edx
xchg edx, esi
xor ebx, 0x37627cd1
add ebx, edx
cmp eax, 0xfffffee9
jne 0x40114a
call main
call sub.advapi32.dll_GetTrusteeTypeW
call main
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
call main
call main
call main
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
ret
or edi, esi
neg ebx
call sub.user32.dll_GetMenuCheckMarkDimensions
xor edi, edx
xor edx, edi
mov edx, 0x3767c355
or edx, 0x376830ae
and edx, edi
cmp eax, 0xffffff2f
jne 0x4011ca
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
ret
mov edx, edi
rol edi, 0xa
sub esi, edi
nop
call sub.kernel32.dll_GetCurrentThreadId
and edi, edx
xor esi, 0x376d64a9
xor edx, 0x376dd6ec
cmp eax, 0xfffffeda
jne 0x401273
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
call main
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call main
call main
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_GetTrusteeTypeW
call sub.advapi32.dll_ConvertAccessToSecurityDescriptorW
call sub.advapi32.dll_GetTrusteeTypeW
ret
jmp 0x4946f8
not edi
add esi, 0x3895a5cc
jmp 0x49473e
push 0x3899d76d
and ecx, esi
and ecx, ebx
inc ebx
mov esi, ecx
ror edi, 2
inc ebx
jmp 0x494a11
pop edx
shl ecx, 0x1f
mov ecx, edi
add edi, esi
xor edi, ecx
ror ecx, 0xd
neg ebx
shl ebx, 9
and ebx, edi
and edi, ebx
or esi, ecx
xor ebx, ecx
xor ebx, ecx
or esi, 0x3e7ed5b9
xor ebx, edi
jmp 0x495d52
push 0x389db9a5
sub ebx, 0x3eeaa627
xchg esi, ebx
xchg esi, ecx
jmp 0x494c8b
push 0x389a11db
mov ecx, esi
mov ecx, 0x3eed50d0
xor edi, ecx
or ecx, esi
sub ecx, edi
and edi, esi
neg ebx
xchg edi, ebx
and edi, 0x3eef0f7f
xor ecx, 0x3eef4fd8
add ebx, esi
jmp 0x495070
mov edx, 0x2774562b
xchg ebx, esi
ror ecx, 0x1e
jmp 0x4963d4
push 0x389b23b1
ror ebx, 0x1a
add edi, ecx
add ebx, ecx
inc ecx
bswap ecx
inc edi
inc edi
jmp 0x495483
mov edx, 0x2774562b
xor edi, 0x3ffdb339
xchg ecx, edi
xchg edi, esi
xchg ecx, esi
or edi, 0x3fffb416
rol ecx, 4
sub ebx, esi
and esi, 0x4001140e
jmp 0x4956a8
pop edx
or ebx, edi
and edi, esi
xchg ebx, edi
xor esi, ebx
inc ecx
mov ebx, 0x40d3c4de
mov edi, ecx
xchg ecx, edi
and ebx, ecx
sub ebx, 0x40d58e12
shl ebx, 8
jmp 0x4955ff
push 0x389b4c8b
neg ebx
xchg edi, ecx
rol ecx, 0xe
xor ecx, ebx
bswap esi
mov ebx, esi
or ebx, ecx
xchg ecx, edi
neg ecx
jmp 0x49599f
pop edx
shl edi, 0x16
sub ecx, edi
sub edi, ebx
mov esi, ebx
and esi, ecx
neg edi
and edi, ecx
xchg esi, ecx
or edi, esi
sub edi, esi
and ebx, 0x412806b7
and ecx, esi
add ebx, ecx
xchg edi, esi
jmp 0x494846
call fcn.0049604c
xor esi, 0x413a63f4
or ebx, ecx
add edi, 0x413f3938
xor esi, 0x413facd1
xchg ecx, esi
add ecx, 0x414091a3
ror edi, 0x1e
jmp 0x4964c7
push 0x389b7994
shl edi, 8
and esi, 0x41aa7f13
and ebx, esi
xchg esi, ebx
add ecx, 0x41abd989
and esi, edi
jmp 0x496c2e
call fcn.0049604c
xchg ebx, esi
not ecx
xor ecx, 0x41f97721
bswap ebx
sub edi, ecx
or ebx, esi
or edi, ecx
and esi, ecx
add esi, 0x41fc2ab5
shr edi, 0x11
xor edi, ebx
and esi, edi
jmp 0x496b8c
pop edx
dec esi
sub ebx, esi
mov esi, ecx
neg ebx
mov edi, 0x423520b1
or esi, ecx
xor ecx, 0x42360948
rol edi, 0x11
sub esi, edi
sub esi, 0x42377604
neg edi
bswap ecx
ror edi, 2
neg esi
xchg ecx, edi
jmp 0x4971d5
push 0x389bc80d
add edi, 0x426b3061
or esi, ecx
or esi, edi
or ebx, edi
mov ebx, 0x426c26b7
add ecx, esi
add ebx, ecx
mov ecx, esi
shl esi, 1
dec edi
add edi, ecx
sub ecx, ebx
sub esi, edi
jmp 0x496d8a
jmp loc.0049a000
call edx
or ebx, 0x4330aafc
bswap ecx
nop
shl esi, 0x13
add edi, esi
add ecx, 0x433333dd
mov esi, ebx
sub ecx, ebx
or edi, esi
shr ebx, 0x10
sub ecx, edi
jmp 0x496beb
pop edx
add edi, ebx
xchg ecx, esi
bswap edi
sub esi, 0x434fd9cd
xchg esi, edi
sub esi, edi
xchg esi, edi
add ecx, edi
rol ebx, 1
xor ecx, ebx
add esi, ecx
mov esi, ebx
rol ecx, 0x1e
xor ecx, esi
and edi, 0x43529696
jmp 0x494f26
push 0x389d4fe5
mov ebx, ecx
rol esi, 0xd
xor ebx, ecx
xor ebx, edi
and ebx, edi
or esi, ecx
and esi, edi
or edi, ecx
jmp 0x496e73
call edx
add ecx, esi
dec ebx
xchg ecx, ebx
or edi, esi
sub edi, ebx
jmp 0x495403
pop edx
not esi
xor ecx, 0x446a09ca
add ebx, 0x446a905f
xor edi, ebx
not esi
mov ecx, 0x446be6b5
add ebx, esi
xchg esi, ecx
shl edi, 0x12
jmp 0x496584
push 0x389ba0c6
xor ecx, edi
xchg ebx, ecx
or edi, ebx
mov ecx, esi
or esi, ecx
mov ebx, ecx
not esi
rol esi, 3
jmp 0x495f4c
mov edx, 0x123b2f04
bswap ebx
nop
sub ecx, esi
and esi, ebx
add esi, ebx
dec esi
or edi, ebx
and esi, edi
jmp 0x495be0
push 0x389d788b
mov ebx, 0x45c8b499
mov edi, esi
mov ebx, edi
sub ecx, esi
rol esi, 9
add edi, 0x45caffc3
and edi, ecx
xchg esi, edi
dec edi
ror ecx, 0x1b
jmp 0x4949e0
pop edx
xor edi, esi
bswap ecx
add ecx, edi
xor ebx, ecx
and esi, ecx
and esi, ebx
mov ebx, 0x462fc134
xchg ecx, edi
mov esi, ebx
bswap ecx
or esi, ebx
shl esi, 0x10
jmp 0x49679b