Function at 0x401000
Capabilities:
Encrypt data using chaskey

Disassembly:
call sub.kernel32.dll_GetCurrentProcess
cmp eax, 0xfffffefc
jne 0x4010a2
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
ret
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, 0xfffffede
jne 0x40113a
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
ret
call sub.kernel32.dll_GetCurrentProcessId
cmp eax, 0xffffff2f
jne 0x4011e6
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
ret
call sub.kernel32.dll_GetCurrentProcess
cmp eax, 0xfffffefe
jne 0x40125b
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarFix
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarFix
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
call sub.oleaut32.dll_VarR4FromI4
call sub.advapi32.dll_GetSidSubAuthorityCount
ret
jmp 0x4988a1
mov ecx, edx
ror ebx, 0x19
or edx, 0x1263e741
xor edx, 0x12644227
and edi, edx
and ecx, edi
mov edx, ebx
mov ebx, edi
jmp 0x499792
pop edx
xchg ecx, edi
sub ebx, esi
mov ebx, 0x1844e404
inc ebx
xor ebx, 0x18455200
mov esi, edi
or ecx, esi
xor edi, ebx
jmp 0x49b816
call fcn.0049b889
xchg edi, ebx
mov ecx, 0x1849925c
xor esi, edi
xchg edi, ebx
not edi
inc edi
dec ecx
shl esi, 0xc
sub ecx, edi
mov esi, ecx
xchg esi, ebx
bswap ecx
jmp 0x49b2e6
call fcn.0049b889
shl ecx, 2
and esi, edi
inc edi
sub ecx, esi
xchg ecx, ebx
sub edi, esi
mov ecx, 0x188ff727
sub edi, esi
jmp 0x499ae0
push 0x12b7a323
sub ecx, ebx
add ecx, esi
and ebx, esi
xor esi, ecx
xor esi, ecx
or edi, esi
mov esi, ebx
or ecx, edi
xor edi, esi
dec ecx
or edi, ecx
mov ebx, esi
rol edi, 0xd
jmp 0x49b311
push 0x12b1e54d
add ebx, edi
xor edi, 0x189c7604
xor edi, ebx
and ebx, edi
xor ebx, ecx
add ebx, esi
not esi
not esi
jmp 0x49b8e5
call edx
or ebx, esi
xor ecx, 0x190751a9
sub ecx, 0x19079f97
jmp 0x499072
pop edx
add ebx, esi
add esi, 0x1913be5d
sub ecx, ebx
not ecx
xor esi, ebx
and esi, edi
xor ebx, ecx
mov ecx, ebx
or edi, ecx
and esi, ebx
xchg esi, ecx
xor esi, ecx
sub esi, ecx
xor ecx, 0x1916715b
shl ebx, 0xe
add ebx, ecx
jmp 0x49ae83
pop edx
sub edi, 0x19247aa9
and ebx, esi
shl ecx, 6
sub ecx, ebx
mov ebx, edi
neg ecx
inc esi
ror ecx, 3
add esi, 0x19657b68
jmp 0x499e4c
pop edx
xor edi, 0x197540f4
and ebx, 0x197575aa
inc edi
and ebx, esi
xchg ecx, esi
add edi, esi
mov edi, ecx
jmp 0x498b08
pop edx
dec esi
rol ecx, 0x1c
inc edi
add edi, ecx
rol esi, 0xd
bswap esi
xor ecx, 0x19c50ee4
add edi, ebx
jmp 0x49afb3
push 0x12aded74
xor edi, ebx
shr esi, 0x16
ror ebx, 2
mov esi, edi
ror esi, 0x11
xchg edi, ecx
mov ecx, esi
shr ecx, 0x1f
ror ecx, 5
jmp 0x499d83
push 0x12abdde5
add esi, ecx
inc ebx
add edi, 0x1a3de6ef
sub edi, 0x1a3e1840
mov esi, 0x1a3e58df
or edi, esi
or ecx, 0x1a3ec8ad
or ecx, esi
mov ecx, 0x1a3f31bf
xor ecx, edi
sub edi, ecx
xor ebx, 0x1a3fd333
jmp 0x499c62
pop edx
inc ecx
mov edi, 0x1a405166
xor ecx, edi
sub ecx, esi
xchg edi, ecx
sub esi, ebx
xor ecx, edi
mov ecx, esi
sub edi, ebx
xchg ebx, ecx
shl edi, 6
not ebx
rol ebx, 0xc
shr ebx, 0xb
bswap ebx
jmp 0x49a65c
call fcn.0049b889
and ebx, ecx
bswap ebx
sub edi, 0x1a4af602
mov ebx, edi
or ebx, ecx
or esi, ebx
inc esi
or edi, esi
not ecx
jmp 0x498d25
mov edx, 0x2774562b
xor ebx, edi
sub ecx, 0x1a525932
dec edi
shl esi, 0x1a
ror edi, 0x1c
and ecx, edi
add esi, ebx
or edi, esi
ror ebx, 0x1e
jmp 0x499dda
call edx
add ecx, esi
or esi, ebx
sub ecx, 0x1aac3cf5
sub ebx, 0x1aac71cf
or esi, edi
or ebx, edi
jmp 0x498de4
push 0x12aba5f4
ror edi, 0xf
xor esi, ecx
mov edi, ecx
shr edi, 1
xor esi, 0x1b070858
sub ecx, ebx
or ecx, esi
mov edi, ecx
ror ebx, 0x15
or ecx, esi
and ecx, ebx
xor ecx, edi
xor ecx, 0x1b08b2c5
jmp 0x4992a9
mov edx, 0x2774562b
sub esi, ecx
xor esi, ebx
sub ecx, esi
rol ebx, 0x11
sub edi, esi
xor ecx, 0x1b15e513
mov esi, ebx
bswap ebx
add ecx, edi
xchg ecx, ebx
shr ebx, 0xb
jmp 0x4989e3
jmp loc.004a017c
call edx
shr esi, 0x10
and esi, 0x1b4be785
mov edi, ecx
and ecx, edi
sub edi, esi
add esi, ebx
and edi, ebx
xor ebx, 0x1b4d14b8
or ecx, ebx
add edi, 0x1b4d881e
xchg ebx, esi
xor ecx, edi
xor edi, ebx
and esi, ebx
shr edi, 0xd
jmp 0x49a245
call edx
or esi, ebx
sub ecx, edi
xor esi, ebx
or edi, ebx
add esi, 0x1b762ae9
not edi
and esi, 0x1b769645
not esi
xchg edi, ecx
sub ebx, ecx
jmp 0x49b5c6
call edx
mov edi, 0x1b777ce0
and esi, ecx
bswap edi
and ebx, ecx
not esi
neg edi
xor esi, 0x1b78c47b
ror ecx, 6
jmp 0x49b1c0
push 0x12ac0962
dec esi
xor ecx, edi
mov ebx, ecx
ror esi, 0x16
bswap ecx
xor ecx, esi
dec edi
neg edi
xchg edi, ebx
mov ecx, 0x1bacd60d
shr esi, 0x13
or edi, esi
xor ecx, esi
and ecx, 0x1bada48e
jmp 0x49a939
push 0x12adc651
not ebx
xor ebx, edi
and edi, 0x1bce73f8
bswap ecx
jmp 0x499132
mov edx, 0x2774562b
mov ecx, esi
xor edi, 0x1bd27599
add ebx, esi
and edi, esi
xchg esi, edi
or ecx, esi
shl esi, 5
xor ecx, ebx
xchg esi, edi
add ebx, edi
jmp 0x49993d
mov edx, 0x123b2f04
sub ecx, esi
and ecx, edi
inc esi
bswap esi
inc edi
add edi, esi
shr ecx, 0x10
jmp 0x498a62
call fcn.0049b889
xchg ecx, esi
add esi, ebx
sub ecx, esi
or edi, 0x1be37c51
ror esi, 0x1f
xor edi, ecx
add esi, edi
or esi, edi
jmp 0x49b395
call edx
and edi, esi
dec edi
mov edi, esi
shl esi, 0x1c
jmp 0x49b20e
push 0x12b6bce6
sub ebx, 0x1bf06d23
neg ecx
shl ecx, 0x1c
shr edi, 8
jmp 0x49a6f7
push 0x12b2c4f7
and ebx, ecx
mov esi, edi
xor esi, ecx
and esi, ebx
or edi, ebx
shr edi, 0xe
xchg ebx, ecx
sub ebx, 0x1c9f3fa4
or edi, ecx
jmp 0x49b7c0
pop edx
xchg esi, edi
sub edi, ebx
shr ecx, 0x1e
neg ecx
add ebx, esi
dec edi
or ecx, 0x1ca875ca
and esi, edi
neg ecx
bswap ecx
or ecx, ebx
mov ebx, esi
ror ecx, 6
jmp 0x498ae4
call fcn.0049b889
xor esi, ebx
xor ebx, esi
xor ecx, esi
mov ebx, 0x1ceba6e2
bswap edi
and ebx, edi
and ecx, edi
mov esi, 0x1cec7cac
or edi, ebx
neg ebx
ror esi, 0x16
and ecx, esi
xchg ebx, ecx
ror ebx, 7
xor ebx, edi
jmp 0x499e30
pop edx
rol esi, 6
mov esi, edi
ror edi, 0x1a
mov ebx, 0x1d6f5391
and edi, ebx
xor ecx, esi
mov edi, esi
inc ecx
rol edi, 5
mov ebx, ecx
jmp 0x498e50
mov edx, 0x123b2f04
mov ebx, esi
mov esi, ebx
xchg ecx, edi
add ecx, edi
mov ebx, esi
mov edi, ebx
not esi
or ecx, esi
xor edi, 0x1d7a393b
and esi, ebx
mov esi, ebx
jmp 0x49a8d8
push 0x12b53184
xchg ebx, ecx
xchg esi, ebx
xchg ecx, esi
and ecx, edi
sub esi, edi
sub esi, ecx
xchg ebx, edi
rol ecx, 0x11
or esi, ebx
xor ebx, esi
neg ebx
jmp 0x49a802
push 0x12b56205
add edi, esi
mov esi, ecx
add ebx, ecx
mov ebx, esi
ror edi, 0x19
xchg ecx, edi
sub esi, ebx
and ebx, ecx
bswap esi
sub esi, ecx
ror ebx, 6
or ebx, 0x1dbb355e
xchg ebx, esi
jmp 0x49987f
pop edx
add ebx, 0x1dcd489d
add esi, edi
and ecx, edi
xchg edi, esi
not edi
xor edi, ecx
mov esi, edi
xchg ebx, ecx
xor ecx, 0x1dcef0b2
neg edi
jmp 0x49ad51
call fcn.0049b889
xchg edi, esi
mov edi, ecx
bswap esi
and ebx, 0x1dd01f17
mov edi, 0x1dd053ea
or ecx, esi
neg edi
jmp 0x4999a4
push 0x12ac370d
inc ebx
sub ecx, esi
xor esi, 0x1dd6f737
or esi, ecx
add ebx, 0x1dd75eef
sub ecx, edi
shr esi, 0x16
add edi, esi
and ecx, esi
sub esi, ecx
jmp 0x49b7de
push 0x12b50505
and ebx, 0x1dd8b6c9
mov ebx, esi
shl esi, 0x10
add edi, ecx
and ebx, esi
add ecx, edi
ror ecx, 3
xor ecx, esi
xor esi, 0x1dda58cd
jmp 0x49a7b2
pop edx
mov esi, 0x1ded111a
mov ecx, edi
or esi, ebx
jmp 0x498f1e
call fcn.0049b889
mov esi, ecx
add ecx, 0x1e51ef00
ror ecx, 0xd
bswap ebx
sub esi, ecx
and ebx, edi
mov edi, ebx
and esi, edi
xchg esi, ecx
sub ecx, esi
and ecx, edi
xchg edi, ebx
xchg ecx, esi
jmp 0x499abd
pop edx
or ecx, 0x1e5487c9
or ebx, edi
add ebx, esi
inc esi
mov esi, ebx
mov ecx, ebx
inc esi
sub ebx, 0x1e5f5fbc
or edi, esi
ror edi, 0x16
xor esi, 0x1e60885e
mov ebx, 0x1e60bcc8
jmp 0x49aff5
push 0x12b4d951
sub ecx, esi
sub ebx, ecx
mov edi, esi
and esi, ebx
and ecx, esi
xor edi, esi
xor esi, edi
mov esi, ebx
not ecx
or esi, edi
sub edi, 0x1f63a86a
sub edi, 0x1f641239
jmp 0x49a95f
pop edx
sub ecx, ebx
or ecx, esi
or ebx, ecx
mov esi, 0x1ffe990c
or ebx, esi
xchg esi, edi
sub esi, ecx
and esi, ecx
and esi, ecx
mov ecx, 0x2000f6d0
jmp 0x49afd3
pop edx
bswap ecx
and ecx, 0x2001dc18
or esi, 0x200242a4
and ecx, 0x20041e2c
add esi, 0x2004911c
xor esi, edi
jmp 0x498988
push 0x12b3ff5d
xchg ebx, edi
and esi, ecx
xor ebx, ecx
xor edi, ebx
xor ebx, 0x200701db
xchg esi, ecx
xor ecx, esi
shr edi, 0x16
shl ebx, 6
bswap ecx
jmp 0x49b7a4
call fcn.0049b889
mov ecx, esi
add ebx, ecx
sub esi, 0x201ae76d
xchg esi, ecx
dec ebx
add esi, 0x201c210c
xchg esi, edi
and ecx, edi
shr ecx, 0xb
mov ebx, 0x201db3a7
jmp 0x4995aa
pop edx
xor esi, ebx
add ecx, ebx
xor edi, ebx
sub esi, 0x203e4bca
and ecx, esi
rol ecx, 0x19
add ecx, edi
xor ebx, 0x203fdfdb
jmp 0x49aa3c
pop edx
sub ecx, edi
nop
bswap ecx
xchg ecx, ebx
xchg ecx, ebx
xchg ecx, edi
add ebx, esi
mov ecx, ebx
xchg esi, ebx
add esi, 0x20498ec2
or ebx, ecx
xor edi, 0x204a5771
jmp 0x49a1ab
call edx
add ebx, ecx
and edi, 0x20c3b745
not ecx
mov ebx, 0x20c4901e
jmp 0x49b78d
mov edx, 0x2774562b
add ecx, 0x20c7fa2e
or esi, 0x20c859bc
mov edi, ebx
sub ecx, 0x20c91e39
or esi, ecx
and esi, ecx
and esi, ebx
mov edi, ebx
sub edi, 0x20cb0efa
sub ebx, 0x20cb7141
xor ebx, ecx
or ebx, 0x20cc34c9
and ebx, edi
xor ebx, 0x20ccf8c8
sub esi, ebx
jmp 0x49ad28
call edx
sub ebx, 0x20d556e3
sub ebx, ecx
and ebx, edi
jmp 0x49a8b6
pop edx
xor esi, ecx
xchg esi, edi
rol edi, 0x13
shr esi, 0x18
mov ecx, esi
sub ebx, edi
sub edi, esi
nop
or edi, 0x212dcf4c
xchg edi, ebx
add ebx, edi
xor edi, esi
add esi, edi
jmp 0x49b90e
pop edx
mov edi, ebx
nop
or esi, ebx
or edi, esi
and edi, ebx
xor esi, 0x2199698d
sub esi, ecx
jmp 0x4992e0
mov edx, 0x2774562b
mov ecx, 0x21a72db8
mov ecx, ebx
mov esi, ecx
inc edi
sub edi, ebx
rol ebx, 0x13
dec ecx
sub edi, esi
jmp 0x49b0a2
push 0x12b2f060
xor ebx, 0x21c4d86f
sub edi, 0x21c5516d
or esi, ebx
sub edi, esi
xor edi, ecx
sub esi, ebx
jmp 0x4993f8
mov edx, 0x123b2f04
sub esi, ebx
and ebx, esi
xchg ebx, ecx
xor ebx, esi
mov edi, ebx
or ebx, ecx
add ebx, edi
sub edi, esi
or edi, 0x21caa4f6
or ecx, edi
jmp 0x49936d
push 0x12ad9ae2
and ebx, 0x21f88b26
or ebx, esi
xchg ebx, esi
jmp 0x499cb8
mov edx, 0x123b2f04
xor esi, ecx
or ebx, 0x2216743d
inc ebx
add ecx, ebx
shl ecx, 2
sub edi, esi
shl ebx, 8
xchg ebx, ecx
rol esi, 1
mov edi, ebx
mov ecx, 0x2219fc38
jmp 0x49a2d3
push 0x12b8802b
xor ebx, ecx
sub ebx, 0x221ae56c
inc edi
sub ecx, 0x221bc7be
bswap ecx
mov ecx, 0x221c8c4a
bswap esi
jmp 0x499cff