Function at 0x40c094
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3cc
mov eax, dword [0x4294fc]
or dword [0x429630], 0x6b3fe0e7
or eax, 0x5218bb32
xor eax, 0x9e1a0588
cmp byte [str.The_encryption_type_requested_is_not_supported_by_the_KDC.], 0
mov dword [0x4294fc], eax
je 0x40c0db
call fcn.004139cc
mov eax, dword [0x429630]
xor eax, 0x6637f56e
mov dword [0x4294fc], eax
mov eax, dword [0x4294fc]
add eax, 0x5d369ab3
mov dword [0x429630], eax
and eax, 0xbd195639
mov dword [0x4294fc], eax
mov dword [esp + 8], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
mov dword [esp + 4], str.Unknown_file_encoding
mov dword [esp], str.The_policy_object_does_not_exist_when_it_should
call fcn.0040fa60
mov eax, dword [0x429630]
or eax, 0x941ffa9f
mov dword [0x4294fc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
cmp byte [eax + str.The_encryption_type_requested_is_not_supported_by_the_KDC.], 0
je 0x40c142
inc eax
cmp eax, 0x188
jne 0x40c127
and dword [0x429630], 0x8ec3a536
mov eax, dword [0x429630]
lea edi, [ebp - 0x3a0]
mov esi, 0x416160
xor eax, 0x4c01b724
mov dword [0x4294fc], eax
mov dword [esp + 8], str.The_policy_object_does_not_exist_when_it_should
mov dword [esp + 4], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
mov dword [esp], eax
call fcn.00414540
mov eax, dword [0x429630]
mov ecx, 4
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x5f
add ecx, dword [ebp + edx*4 - 0x3a0]
inc edx
xor eax, 0x90040eb6
mov dword [ebp - 0x3c4], ecx
cmp edx, 4
jne 0x40c187
sub eax, 0x4d468e8
mov esi, 0x416170
imul edx, eax, 0x10cdf7b4
mov dword [0x4294fc], eax
mov dword [0x429630], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_OpenIcon]
mov ecx, 5
push edi
lea edi, [ebp - 0x244]
imul eax, dword [0x4294fc], 0x73f1dc0b
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov dword [0x4294fc], eax
xor eax, eax
cmp byte [eax + str.The_encryption_type_requested_is_not_supported_by_the_KDC.], 0
je 0x40c219
inc eax
cmp eax, 0x669
jne 0x40c1e6
mov eax, dword [0x4294fc]
mov dword [esp + 8], str.Unknown_file_encoding
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov eax, dword [0x429630]
mov dword [esp], eax
call fcn.00413e44
mov eax, dword [0x429630]
mov ebx, edi
sub ebx, dword [ebp + esi*4 - 0x244]
inc esi
mov edi, ebx
add eax, 0x11eb2311
mov dword [0x4294fc], eax
and eax, 0xd7919f27
mov dword [0x429630], eax
cmp esi, 5
jne 0x40c1e4
xor edx, edx
cmp byte [edx + str.The_policy_object_does_not_exist_when_it_should], 0
je 0x40c279
inc edx
cmp edx, 0x17b5
jne 0x40c245
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Unknown_file_encoding
mov dword [esp + 4], eax
mov dword [esp], eax
call fcn.00413e44
or dword [0x4294fc], 0x62043bd1
mov eax, dword [0x4294fc]
lea edi, [ebp - 0x344]
mov esi, 0x416184
xor eax, 0xa432d919
mov dword [0x429630], eax
call fcn.00410550
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x61
mov eax, dword [0x429630]
lea edx, [eax + 0x6b00d7da]
mov dword [0x4294fc], edx
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [esp + 8], str.Unknown_file_encoding
call fcn.00413e44
mov eax, dword [0x4294fc]
and eax, 0x91c0e40f
imul eax, eax, 0x1df27879
lea edx, [eax + 0x495c6e31]
mov dword [0x4294fc], eax
mov dword [0x429630], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
mov dword [esp], eax
call fcn.00413b84
add edi, dword [ebp + esi*4 - 0x344]
inc esi
cmp esi, 4
jne 0x40c2a6
imul eax, dword [0x429630], 0x8703fe67
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x370], ebx
xor ebx, ebx
mov dword [ebp - 0x368], edi
mov dword [ebp - 0x378], 0x18
mov edx, eax
mov dword [ebp - 0x364], ebx
and edx, 0x39343222
mov dword [0x4294fc], eax
mov dword [ebp - 0x3b4], esi
mov dword [ebp - 0x3b0], esi
mov dword [ebp - 0x244], 0x22c
mov dword [0x429630], edx
mov dword [ebp - 0x374], ecx
mov dword [ebp - 0x36c], ecx
mov ecx, str.The_encryption_type_requested_is_not_supported_by_the_KDC.
mov dl, byte [ecx]
test dl, dl
je 0x40c398
sub edx, 0x30
cmp dl, 9
jbe 0x40c395
and eax, 0x140202
mov dword [0x4294fc], eax
jmp 0x40c398
inc ecx
jmp 0x40c37b
or dword [0x4294fc], 0x147893a9
xor esi, esi
mov dword [esp + 4], esi
mov dword [esp], 2
mov eax, dword [0x41611c]
call dword [eax + 0x34]
push edi
push edi
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [0x41611c]
call dword [eax + 0x38]
dec eax
push edx
push edx
je 0x40c3fa
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
call fcn.00401065
mov eax, dword [ebp - 0x3c4]
neg eax
jmp 0x40c81e
mov edx, dword [0x4294fc]
mov eax, edx
xor eax, 0x89d4ccdf
cmp byte [str.The_encryption_type_requested_is_not_supported_by_the_KDC.], 0
mov dword [0x429630], eax
je 0x40c43c
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
call fcn.00413b84
mov eax, dword [0x429630]
or eax, 0xa3f4b31
mov dword [0x4294fc], eax
add dword [0x429630], 0x273a3f9e
sub dword [0x4294fc], 0x47d69cb5
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
mov eax, dword [0x41611c]
call dword [eax + 0x3c]
dec eax
push edx
push edx
jne 0x40c3df
lea edi, [ebp - 0x3ab]
mov esi, 0x42e214
mov ecx, 0xb
mov edx, str.The_encryption_type_requested_is_not_supported_by_the_KDC.
rep movsb byte es:[edi], byte [esi]
mov ecx, 0xb98
movzx eax, byte [edx]
inc edx
test al, al
je 0x40c4b6
add ecx, eax
cmp ecx, 0xee9
jbe 0x40c490
call fcn.004139cc
sub dword [0x4294fc], 0x57caf054
call fcn.00413240
imul eax, dword [0x4294fc], 0x9cd05d5a
lea edi, [ebp - 0x35f]
mov esi, str.Debugger_will_reply_later.
mov dword [0x429630], eax
mov dword [esp], str.The_policy_object_does_not_exist_when_it_should
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
mov eax, dword [0x429630]
add eax, 0x3a61e2f8
mov dword [0x4294fc], eax
call fcn.00410550
mov eax, dword [0x4294fc]
mov ecx, 0x1b
xor edx, edx
rep movsb byte es:[edi], byte [esi]
and eax, 0x27760c31
mov dword [0x4294fc], eax
cmp byte [edx + str.The_policy_object_does_not_exist_when_it_should], 0
je 0x40c549
inc edx
cmp edx, 0x2043
jne 0x40c50a
mov edx, dword [0x429630]
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
call fcn.00413b84
mov eax, dword [0x429630]
sub eax, 0x26c01daf
mov dword [0x4294fc], eax
mov eax, dword [0x4294fc]
xor ebx, ebx
add eax, 0xf15f0e6
mov dword [0x429630], eax
imul eax, eax, 0x43cd643b
mov dword [0x4294fc], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, str.The_encryption_type_requested_is_not_supported_by_the_KDC.
mov al, byte [edx]
test al, al
je 0x40c591
sub eax, 0x30
cmp al, 9
jbe 0x40c58e
mov eax, dword [0x429630]
add eax, 0x3bbb4a65
mov dword [0x4294fc], eax
jmp 0x40c591
inc edx
jmp 0x40c570
imul eax, dword [0x4294fc], 0x70f4f7c6
mov dword [0x429630], eax
call fcn.004139cc
mov eax, dword [0x429630]
mov byte [ebp + ebx - 0x344], bl
inc ebx
imul edi, eax, 0xe2ffd754
mov dword [ebp - 0x3c8], eax
mov dword [0x4294fc], edi
cmp ebx, 0x100
jne 0x40c56b
xor esi, esi
xor ecx, ecx
mov al, byte [ebp + ecx - 0x344]
mov ebx, 0x1a
xor edx, edx
mov byte [ebp - 0x3bd], al
mov eax, ecx
div ebx
movzx eax, byte [ebp + edx - 0x35f]
movzx edx, byte [ebp - 0x3bd]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x344]
mov byte [ebp + ecx - 0x344], al
mov al, byte [ebp - 0x3bd]
inc ecx
mov byte [ebp + esi - 0x344], al
cmp ecx, 0x100
jne 0x40c5d0
xor ebx, ebx
xor ecx, ecx
lea esi, [ebp - 0x38e]
xor edx, edx
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x344]
add ecx, eax
mov byte [ebp - 0x3bd], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x344]
mov byte [ebp + edx - 0x344], al
mov al, byte [ebp - 0x3bd]
mov byte [ebp + ecx - 0x344], al
add al, byte [ebp + edx - 0x344]
movzx eax, al
mov al, byte [ebp + eax - 0x344]
xor al, byte [ebp + ebx - 0x3ab]
movzx eax, al
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, 0xb
jne 0x40c62e
mov edx, str.Unknown_file_encoding
mov ecx, 0xf41
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40c6cb
add ecx, eax
cmp ecx, 0x2682
jbe 0x40c68e
mov dword [esp + 0xc], edi
mov dword [esp + 8], str.Unknown_file_encoding
mov eax, dword [ebp - 0x3c8]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00413e44
or dword [0x429630], 0x561f3c7f
imul eax, dword [0x429630], 0x6cfaf88c
xor dword [0x4294fc], 0x76e29f00
mov word [ebp - 0x378], 0
mov dword [0x429630], eax
lea eax, [ebp - 0x220]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040e5c4
test eax, eax
jne 0x40c450
mov eax, dword [0x4294fc]
or eax, 0xb40ca388
mov dword [0x429630], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x429630]
sub eax, 0x548874b9
mov dword [0x4294fc], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push ecx
cmp byte [str.The_encryption_type_requested_is_not_supported_by_the_KDC.], 0
je 0x40c74d
call fcn.004139cc
add dword [0x4294fc], 0x5f8d3eca
mov eax, dword [0x4294fc]
sub eax, 0x46f3eb8e
and eax, 0xbfc6f744
mov dword [0x429630], eax
call fcn.00414f1c
mov eax, dword [0x429630]
lea edx, [eax - 0x3ae0a6e0]
add eax, 0x13222f18
mov dword [0x4294fc], edx
mov edx, dword [ebp - 0x23c]
mov dword [0x429630], eax
mov dword [ebp - 0x3b4], edx
call fcn.00414f1c
mov eax, dword [0x4294fc]
mov edx, eax
sub eax, 0x134998be
xor edx, 0xc20ec7dc
mov dword [0x4294fc], eax
mov dword [0x429630], edx
mov dword [esp + 8], str.The_policy_object_does_not_exist_when_it_should
mov dword [esp + 4], str.Unknown_file_encoding
mov dword [esp], str.The_encryption_type_requested_is_not_supported_by_the_KDC.
call fcn.0040fa60
lea eax, [ebp - 0x3b4]
mov dword [esp + 4], 0x1fffff
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x378]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3b8]
mov dword [esp], eax
call fcn.0040108d
test eax, eax
js 0x40c450
cmp dword [ebp - 0x3b8], 0
je 0x40c450
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
call fcn.00401065
mov eax, dword [ebp - 0x3b8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret