Function at 0x401000
Capabilities:
Accept command line arguments
Encrypt data using chaskey

Disassembly:
sub ebx, edx
call sub.kernel32.dll_GetCommandLineA
ror edi, 9
shl edx, 0xd
cmp eax, 0xffffff0c
jne 0x4010b4
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
ret
xor esi, edx
xor ebx, esi
and ebx, esi
add esi, 0xb3489ae8
call sub.kernel32.dll_GetCommandLineA
mov esi, edx
cmp eax, 0xffffff31
jne 0x401169
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
ret
xor edx, esi
call sub.user32.dll_GetClipboardOwner
sub esi, edi
or esi, 0xb34b640b
xor ebx, esi
cmp eax, 0xfffffeeb
jne 0x401212
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.user32.dll_CharPrevW
call sub.user32.dll_CharPrevW
call sub.advapi32.dll_AccessCheckByTypeResultListAndAuditAlarmA
call sub.ole32.dll_CoUnmarshalInterface
call sub.ole32.dll_CoUnmarshalInterface
ret
jmp 0x494425
shr esi, 4
sub edx, esi
mov edx, 0xb4691a38
add edx, esi
shr esi, 0x13
sub esi, edx
xchg edi, edx
jmp 0x497478
call edx
and edi, esi
or ecx, ebx
xchg ecx, edi
neg edi
sub edi, esi
xchg esi, ebx
and esi, edi
add ebx, 0xb775d6b3
mov ebx, ecx
rol esi, 8
jmp 0x494904
call fcn.0049504a
inc edi
bswap ecx
add esi, 0xb7c3d3ac
and esi, 0xb7c5919b
xchg ecx, esi
or ebx, esi
sub edi, ecx
shr ecx, 0x1f
rol ecx, 0xb
jmp 0x494ce2
pop edx
add esi, ecx
shl edi, 0x1e
add ecx, ebx
and ebx, ecx
dec ecx
jmp 0x495d93
pop edx
inc ebx
xchg ecx, esi
bswap esi
mov ecx, ebx
and esi, edi
or ecx, ebx
jmp 0x4961a3
call edx
or ebx, edi
mov edi, ebx
and ebx, ecx
nop
mov edi, ecx
or ecx, ebx
or ebx, esi
not ebx
xor esi, ebx
jmp 0x4958e2
push 0xb471a2ce
xor ecx, esi
mov ecx, esi
jmp 0x495fb4
mov edx, 0x2774562b
and edi, esi
inc esi
mov esi, ebx
xchg esi, ecx
neg ecx
jmp 0x497bad
pop edx
ror esi, 1
xor esi, edi
rol ebx, 0x1e
bswap ebx
inc esi
add ecx, ebx
xchg esi, edi
dec ecx
jmp 0x494cd1
pop edx
and ecx, esi
sub ecx, 0xb8ee62b7
xchg esi, edi
or esi, ebx
not ebx
sub esi, edi
jmp 0x495dd7
push 0xb47178ce
xchg ecx, edi
add esi, edi
bswap edi
add edi, esi
jmp 0x49544d
pop edx
and ebx, ecx
xor esi, ecx
and edi, ebx
add edi, 0xb9321dc8
and edi, 0xb9325441
jmp 0x49598d
pop edx
and ecx, edi
xchg ecx, edi
not ecx
and ebx, 0xb938e898
sub ebx, 0xb93922af
or edi, 0xb93969e5
xchg esi, ebx
sub esi, ebx
shl ebx, 0x1d
xchg ebx, ecx
jmp 0x496cfb
push 0xb471cb2a
sub esi, ecx
xor esi, 0xb957f40a
neg esi
or ebx, esi
xor ecx, ebx
rol edi, 0x16
and ebx, esi
xchg esi, edi
sub ebx, 0xb9598a08
add ecx, ebx
and esi, edi
mov ebx, esi
jmp 0x496c50
push 0xb471252f
or esi, ebx
mov esi, ebx
or ecx, 0xb97d278e
ror edi, 0x13
xor edi, 0xb97d9bf4
sub ecx, ebx
add ebx, edi
add edi, ecx
jmp 0x4975ee
mov edx, 0x123b2f04
xor esi, ebx
shr ebx, 0x14
jmp 0x4948df
mov edx, 0x123b2f04
add esi, ebx
mov esi, 0xba3ad29c
jmp 0x4979dc
pop edx
or ebx, ecx
xor edi, 0xba45b862
not edi
add esi, ebx
xchg ebx, ecx
xor ebx, ecx
add esi, ebx
shl ebx, 3
and esi, ecx
neg edi
jmp 0x497a07
push 0xb46fe60a
inc edi
ror edi, 0x1e
xor ebx, 0xbac880cf
ror esi, 0x19
xchg ecx, esi
xor esi, ebx
mov ecx, 0xbac97189
or ecx, esi
jmp 0x49783b
push 0xb4714eda
nop
dec ecx
sub esi, 0xbadd2f74
sub ebx, edi
shl esi, 0x19
mov edi, 0xbaddd6ca
and ecx, ebx
xor ecx, ebx
jmp 0x495d53
push 0xb4702007
rol ecx, 0x10
and esi, edi
or ecx, esi
not esi
and edi, ecx
not esi
and edi, esi
jmp 0x496a8d
push 0xb47370e9
add esi, ebx
add edi, 0xbb22baed
xor ecx, 0xbb22f553
add esi, ebx
add edi, ecx
sub esi, 0xbb23a2b2
inc esi
add esi, 0xbb24142b
sub ecx, ebx
jmp 0x495660
call fcn.0049504a
xor edi, 0xbb24940c
not ecx
sub edi, ecx
ror edi, 0x17
mov ebx, ecx
neg ecx
add esi, edi
xchg ecx, esi
mov ecx, 0xbb268fc5
mov ebx, edi
inc ecx
not esi
sub ebx, edi
jmp 0x49443d
push 0xb4734731
shr ebx, 0x19
ror ebx, 0x11
mov esi, edi
add ecx, 0xbb286037
or edi, ecx
sub esi, 0xbb28d09e
shr edi, 0x17
inc ecx
mov ecx, edi
shl ecx, 0x1d
add ecx, 0xbb29f435
and esi, 0xbb2a2eab
jmp 0x4979b1
jmp loc.0049aa92