Function at 0x401000
Capabilities:
Create process on windows
Encrypt data using chaskey

Disassembly:
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xfffffee2
jne 0x401066
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
ret
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, 0xffffff09
jne 0x4010d6
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call main
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xffffff11
jne 0x40113c
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.shell32.dll_ShellExecuteExA
call main
call sub.shell32.dll_ShellExecuteExA
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xfffffeed
jne 0x4011c5
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call main
call sub.shell32.dll_ShellExecuteExA
call main
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.shell32.dll_ShellExecuteExA
call main
call main
ret
call sub.user32.dll_GetClipboardSequenceNumber
cmp eax, 0xffffff14
jne 0x401258
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.shell32.dll_ShellExecuteExA
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call sub.shell32.dll_ShellExecuteExA
call main
call main
call sub.shell32.dll_ShellExecuteExA
call main
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call sub.ntdll.dll_RtlLookupElementGenericTable
call main
call main
call main
ret
jmp 0x581f37
add edx, edi
add esi, ecx
jmp 0x582091
pop ecx
and ebx, 0xece46e9a
sub ebx, edx
xor esi, ebx
add esi, ebx
mov edi, ebx
ror esi, 0x1c
sub edi, edx
or edx, edi
and esi, 0xece63abf
xchg esi, edx
jmp 0x583559
push 0xdee95c2d
ror esi, 0x13
shr ebx, 0x16
mov edx, ebx
jmp 0x58405f
mov ecx, 0x123b2f04
xor esi, edx
sub ebx, edx
xchg edi, edx
and ebx, 0xecf004e0
sub esi, edi
rol esi, 0xe
jmp 0x582647
push 0xdeec8a67
sub esi, 0xecf8f003
xchg edx, esi
shr esi, 1
add esi, edi
sub edx, edi
bswap ebx
jmp 0x583754
push 0xdef71c7d
bswap edx
not edi
xor esi, ebx
mov ebx, edi
add esi, edi
xor edx, esi
not edi
rol edx, 9
or esi, ebx
bswap esi
jmp 0x584047
push 0xdf0c437e
ror esi, 0x11
xor edi, esi
xor edi, ebx
or ebx, esi
shr edx, 4
bswap esi
neg esi
and ebx, 0xed0bc9c2
jmp 0x5836d2
push 0xdf059efd
add ebx, edi
add edi, ebx
not edi
or edi, edx
mov edi, ebx
xor edi, esi
add ebx, 0xed30c925
jmp 0x5823c6
pop ecx
bswap ebx
xor esi, edx
mov edi, edx
sub edi, 0xed47dbe6
xor edx, ebx
or edi, esi
xor edi, ebx
mov edi, edx
and ebx, edi
mov ebx, edx
dec esi
jmp 0x584505
push 0xdf05ee6e
sub ebx, 0xed4b1bde
dec edx
add edx, esi
mov ebx, edx
and edi, ebx
xor edx, esi
or ebx, edi
inc edi
rol esi, 0x1c
bswap ebx
jmp 0x583209
call fcn.00584e3d
bswap ebx
bswap ebx
xchg ebx, edi
mov edx, ebx
xchg esi, edx
not esi
add ebx, esi
add ebx, esi
nop
jmp 0x58462b
push 0xdefa26b6
or edi, edx
shl edx, 0x1e
xor edx, esi
rol edx, 3
bswap esi
mov ebx, 0xed9c987f
and edx, esi
not ebx
neg esi
xchg ebx, esi
jmp 0x584c32
push 0xdf0bd93f
xor edi, esi
add esi, ebx
not edi
add edx, edi
mov edi, ebx
shr ebx, 0x19
mov esi, ebx
or ebx, esi
add edx, edi
and edi, esi
jmp 0x582231
call fcn.00584e3d
xchg esi, edx
xchg edi, edx
dec edi
and esi, edi
mov esi, edi
ror edx, 6
mov esi, 0xedf1b15e
and esi, ebx
jmp 0x5829c5
pop ecx
bswap esi
sub ebx, edx
and edx, 0xedf391d8
add edi, ebx
mov esi, 0xedf453c6
or ebx, edx
jmp 0x5838a7
push 0xdeea0b7f
and edx, edi
shl esi, 5
mov ebx, edi
sub esi, edi
xor esi, ebx
jmp 0x582692
mov ecx, 0x123b2f04
mov edx, esi
sub ebx, 0xedff43d3
xchg ebx, edi
sub edi, esi
shr ebx, 2
mov esi, edx
shl edi, 0x19
shl esi, 0x13
xchg ebx, edi
jmp 0x5833ab
push 0xdeec39dd
xchg esi, edi
and ebx, edi
shl edi, 7
bswap ebx
shr edx, 5
or esi, edx
jmp 0x58214a
call ecx
xchg esi, ebx
sub edx, ebx
and edi, esi
xchg ebx, esi
mov edx, edi
xchg esi, edx
not edi
add edi, edx
jmp 0x58454a
push 0xdf02d55c
add edx, ebx
add ebx, esi
add edx, ebx
add edi, 0xee74f8db
jmp 0x58325b
call ecx
ror edx, 9
bswap esi
neg ebx
dec edx
xor ebx, esi
add edi, esi
sub edi, 0xee8674fd
shr ebx, 0xc
neg edx
mov esi, 0xee87a525
jmp 0x582c66
jmp loc.00589a46
push 0xdf0b6c1f
mov esi, edx
xchg esi, ebx
xor ebx, edi
rol edx, 4
sub edi, 0xeeeead04
jmp 0x582599
pop ecx
inc edx
xor ebx, edi
mov edi, esi
xchg edx, ebx
jmp 0x58341c
call ecx
neg ebx
and esi, 0xeef707a3
and edx, 0xeef778b7
or ebx, edi
jmp 0x5841b1
pop ecx
sub edx, 0xef05bff4
shl edi, 0x1c
mov ebx, esi
ror edx, 0x13
shr esi, 6
shr esi, 7
neg edx
dec edx
and edx, ebx
sub edi, 0xef09753d
mov edx, ebx
mov esi, 0xef0a36c5
jmp 0x583c9c
push 0xdf0b1ed4
or ebx, edi
or esi, ebx
xor ebx, edx
or edx, 0xef5e16e6
mov edx, edi
add edi, ebx
xor edx, 0xef5f3d9c
and ebx, 0xef5fba9d
xor edx, 0xef601d82
and esi, ebx
add ebx, 0xef60ebb2
shl edi, 0x1d
jmp 0x582c4d
push 0xdf0230cf
mov edi, 0xf096486d
xchg ebx, esi
and edi, 0xf0970fb5
mov ebx, 0xf09775ce
xchg edx, esi
add ebx, edx
xor edx, ebx
and esi, ebx
rol esi, 0x19
jmp 0x58426e
mov ecx, 0x2774562b
mov edx, 0xf0c0ac03
or edi, edx
add edx, 0xf0c173b4
xchg edx, ebx
add ebx, edi
jmp 0x58250b
mov ecx, 0x123b2f04
and ebx, 0xf0c8544e
sub esi, edx
mov edi, 0xf0c95dc5
xor edx, esi
ror edi, 0x18
dec ebx
jmp 0x583606
call fcn.00584e3d
dec edx
xor ebx, edi
not esi
and ebx, 0xf11ff7fc
shl edi, 0x1a
shl edi, 8
or edi, edx
jmp 0x583542
mov ecx, 0x2774562b
add ebx, edx
or edx, esi
mov ebx, esi
ror edi, 0x12
mov edx, edi
not esi
nop
add esi, edx
add edi, esi
jmp 0x582a07
call fcn.00584e3d
add edx, edi
sub edx, 0xf187314f
mov edi, 0xf18791a1
xor esi, edi
sub edx, esi
and ebx, edi
jmp 0x582ca7
pop ecx
or edi, ebx
nop
neg esi
bswap esi
or esi, edi
xor edi, esi
and edx, edi
add ebx, 0xf1988ef6
add edi, 0xf198e98f
jmp 0x584200
pop ecx
xor ebx, 0xf199750a
or edi, 0xf199da75
xor esi, edx
dec edi
add edi, 0xf19af933
xor ebx, edi
xor ebx, 0xf19bd72c
add esi, edi
or edx, esi
jmp 0x582043
call ecx
shr ebx, 7
or edi, 0xf1b043a6
and ebx, esi
shr esi, 4
or edx, esi
jmp 0x584185
push 0xdf083567
ror ebx, 0x1d
add edi, 0xf1b28f1c
or edx, 0xf1b2e8bf
not esi
sub edi, 0xf1b3f2de
and edx, ebx
add ebx, esi
or esi, edi
dec edx
jmp 0x584a77
call fcn.00584e3d
or edi, edx
and esi, edi
mov edi, edx
jmp 0x582916
push 0xdf0c8cd9
mov edx, edi
sub edi, esi
or edi, edx
sub edi, ebx
xchg esi, ebx
add edx, edi
xchg esi, ebx
and edx, ebx
add esi, ebx
or esi, edx
sub ebx, esi
jmp 0x583350
push 0xdeece451
xor ebx, edx
mov edx, 0xf1dd7967
sub edx, 0xf1ddb20a
jmp 0x583dce
pop ecx
rol esi, 0x15
or ebx, 0xf2257806
and edi, ebx
and esi, ebx
mov edx, edi
sub ebx, esi
shr esi, 0xc
add edx, 0xf227d1cc
xchg esi, ebx
xchg esi, ebx
or edx, esi
jmp 0x583efa
push 0xdef7b6f9
not edx
xchg edx, edi
shr edi, 0xb
bswap esi
xchg esi, edx
jmp 0x584348
pop ecx
inc edx
add ebx, esi
xchg esi, edx
sub edi, ebx
shl ebx, 0x13
and edi, esi
xor edi, edx
ror edi, 1
sub ebx, edi
xor esi, edi
jmp 0x5827cd
push 0xdf0529a1
bswap edi
shl edi, 0x1e
or edx, 0xf2d4b6db
and ebx, edi
mov edi, edx
xchg esi, edi
sub esi, edx
mov esi, ebx
dec edi
and edi, edx
add ebx, 0xf2daab71
jmp 0x58232a
pop ecx
sub esi, edi
and ebx, edx
inc edi
or esi, 0xf2e17000
or ebx, edi
or edx, 0xf2e2414e
mov edi, edx
not edi
and esi, 0xf2e3792a
jmp 0x58343b
push 0xdeed3573
and ebx, esi
xor ebx, edi
neg ebx
and esi, edi
add esi, edx
ror edi, 0x10
or edi, ebx
xchg edx, ebx
sub edx, 0xf302e614
xchg esi, edi
jmp 0x5820e9
pop ecx
xchg ebx, edx
add esi, edi
jmp 0x582f38
push 0xdf08d7b2
and ebx, 0xf354482e
and edi, ebx
ror ebx, 0x16
xor edi, esi
sub edx, 0xf3565260
shr edi, 0x1c
or esi, ebx
sub edi, ebx
xchg edx, edi
and edi, ebx
neg esi
or ebx, edi
and ebx, 0xf3599c69
jmp 0x5840ef
push 0xdef76bf6
add esi, edx
shl esi, 9
mov edi, ebx
add ebx, edi
and edi, ebx
inc ebx
xor edx, esi
jmp 0x583917
push 0xdee9bfdd
xor edi, esi
sub edi, 0xf3844a57
and esi, edi
xor esi, edi
rol edx, 0x1a
add ebx, edx
xchg ebx, edi
add edi, 0xf386d6c7
bswap esi
mov esi, edi
jmp 0x58267d
mov ecx, 0x123b2f04
add edx, 0xf3afe464
sub esi, edi
xchg edx, ebx
and edx, 0xf3dda381
xor edi, edx
ror edx, 4
mov edx, edi
xchg edx, ebx
xchg ebx, esi
jmp 0x584114
call fcn.00584e3d
shr edx, 0x1d
dec esi
mov edx, 0xf3e114e0
xchg edx, esi
not edx
or esi, ebx
mov ebx, edi
add edx, esi
jmp 0x584d56
pop ecx
shr edx, 0x1e
add esi, edx
or esi, edi
add edi, edx
ror ebx, 0xb
or edx, 0xf408664b
add edi, 0xf408c3bf
xchg esi, edx
and esi, ebx
xor edi, esi
add ebx, 0xf40a4d44
xor esi, ebx
jmp 0x5823a7
pop ecx
and edx, edi
xor edi, ebx
add edx, edi
xchg ebx, edx
xor esi, 0xf40cce58
jmp 0x582d29
pop ecx
add edx, ebx
xchg esi, edi
neg esi
bswap edi
shr edx, 6
xor esi, edx
jmp 0x5843df
push 0xdf028592
nop
bswap edx
xor edx, 0xf42b7338
and esi, edx
inc ebx
sub edi, 0xf42cd402
xchg edi, esi
sub edi, ebx
and edx, ebx
or edi, esi
or esi, edi
add edx, 0xf4380077
jmp 0x58294c
mov ecx, 0x123b2f04
xor edx, 0xf46a0b5c
not edi
xor ebx, edx
add edx, esi
neg edx
mov edx, 0xf46c0827
mov ebx, 0xf46c6ab2
jmp 0x583303
pop ecx
xor edi, ebx
or esi, edi
xchg ebx, esi
or esi, edi
add edx, esi
xchg esi, ebx
add ebx, edx
xor esi, edx
sub edx, edi
jmp 0x5821f5
pop ecx
or edx, esi
add edi, esi
sub esi, edi
inc edi
bswap edx
xor edi, 0xf4c22e64
mov ebx, edi
jmp 0x582547
pop ecx
and edi, 0xf53a425c
ror edx, 0x1c
xor edi, ebx
shr esi, 0x17
and edi, esi
or esi, ebx
or edi, edx
xchg edi, edx
xchg esi, ebx
add edx, edi
jmp 0x584cd2
call ecx
mov edi, 0xf55ea34c
nop
sub ebx, edi
add ebx, edx
add edi, esi
shr esi, 0x17
dec edi
xchg ebx, edx
or esi, ebx
shr ebx, 1
or edx, esi
or ebx, 0xf562e7b3
sub edi, edx
jmp 0x583d00
pop ecx
mov edx, edi
not edi
not edi
mov esi, edx
jmp 0x583cb7
call fcn.00584e3d
neg ebx
sub edx, edi
or edx, 0xf5adff21
and ebx, edx
xor ebx, esi
or esi, edx
and edi, esi
or edi, esi
or esi, ebx
mov edx, edi
jmp 0x584deb
push 0xdf0885a0
inc ebx
or ebx, edi
mov esi, edx
xor edx, edi
xchg ebx, edi
shr edx, 0xd
xchg esi, edx
xchg ebx, edx
xchg edx, ebx
xchg esi, ebx
mov esi, edx
xor edx, esi
rol edi, 0x13
and edx, edi
jmp 0x583f1e
mov ecx, 0x2774562b
and esi, edx
dec esi
shr esi, 0x11
sub esi, ebx
mov ebx, 0xf69fdebc
dec esi
rol edi, 0x14
mov esi, 0xf6a10ecd
mov esi, 0xf6a1863f
mov esi, edi
mov ebx, esi
mov esi, edx
jmp 0x58489a
pop ecx
sub ebx, esi
shl ebx, 0x18
sub edi, esi
dec esi
dec edx
inc esi
sub edi, 0xf6ae2dfb
jmp 0x58315a
pop ecx
sub esi, 0xf6b0b5a9
mov esi, 0xf6b11ccc
not edx
or ebx, edi
and edx, edi
xor edi, esi
jmp 0x5846d7
call ecx
xchg ebx, esi
xor esi, 0xf6c42e0e
dec edx
not esi
sub ebx, 0xf6c5a330
mov edi, esi
xchg edi, esi
jmp 0x582664
call ecx
and esi, edi
mov ebx, esi
add edx, 0xf6de20d9
xor ebx, esi
not esi
xor edi, 0xf6e22488
or ebx, edx
rol esi, 5
rol ebx, 0x1a
mov edi, 0xf6e3e330
xor edx, esi
mov edx, esi
mov edx, ebx
ror edi, 0x18
jmp 0x584cab