Function at 0x4072f0
Capabilities:
Accept command line arguments
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
cmp byte [eax + str.RtlUnicodeStringCatString_failed___x_], 0
je 0x40731e
inc eax
cmp eax, 0x8fe
jne 0x4072fe
mov eax, dword [0x42948c]
add eax, 0x5c5dd60b
mov dword [0x429450], eax
mov eax, dword [0x429450]
mov edx, eax
or eax, 0xfcb8ef66
or edx, 0x6890ec44
mov dword [0x429450], eax
mov dword [0x42948c], edx
call fcn.0040eb4c
xor eax, eax
cmp byte [eax + str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx], 0
je 0x407370
inc eax
cmp eax, 0x15d
jne 0x407342
mov eax, dword [0x429450]
and eax, 0xf4f7c30e
mov dword [0x42948c], eax
mov dword [esp], 0x17b0
call dword [sym.imp.USER32.dll_OpenIcon]
push ebx
xor dword [0x42948c], 0x508dbae9
add dword [0x429450], 0x302bc05e
call fcn.00411af8
mov edx, str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov ecx, 0x1ad3
movzx eax, byte [edx]
inc edx
test al, al
je 0x4073b9
add ecx, eax
cmp ecx, 0x1ba4
jbe 0x407393
call fcn.00410bb4
mov eax, dword [0x42948c]
or eax, 0xe0f9ec98
mov dword [0x429450], eax
mov eax, dword [0x429450]
lea edi, [ebp - 0x198]
mov esi, 0x42d9c9
mov edx, eax
add eax, 0x2b5025d2
and edx, 0xe227a913
mov dword [0x429450], eax
mov dword [0x42948c], edx
call fcn.0040f658
mov ecx, 0x10
mov ebx, dword [0x42948c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1d7]
mov esi, 0x42da09
mov ecx, 0x3f
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x118], al
inc eax
mov dword [ebp - 0x240], ebx
and ebx, 0xf79cbbe3
cmp eax, 0x100
jne 0x407407
mov dword [0x42948c], ebx
xor esi, esi
xor ecx, ecx
mov edi, 0x3e
mov al, byte [ebp + ecx - 0x118]
xor edx, edx
mov byte [ebp - 0x23c], al
mov eax, ecx
div edi
movzx eax, byte [ebp + edx - 0x1d7]
movzx edx, byte [ebp - 0x23c]
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
mov al, byte [ebp - 0x23c]
inc ecx
mov byte [ebp + esi - 0x118], al
cmp ecx, 0x100
jne 0x407431
mov eax, dword [ebp - 0x240]
and eax, 0x1190b0c2
mov dword [0x429450], eax
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov dword [esp + 8], ebx
mov dword [esp + 4], str.RtlUnicodeStringCatString_failed___x_
mov dword [esp], str.The_request_was_aborted.
call fcn.004122b0
mov edx, dword [0x429450]
mov ecx, str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx
imul eax, edx, 0x801e3940
mov dword [0x429450], eax
mov al, byte [ecx]
test al, al
je 0x4074e2
sub eax, 0x30
cmp al, 9
jbe 0x4074df
imul edx, edx, 0x5c029840
mov dword [0x429450], edx
jmp 0x4074e2
inc ecx
jmp 0x4074c4
mov esi, dword [0x429450]
xor ebx, ebx
xor ecx, ecx
xor edx, edx
lea edi, [esi + 0x35a2b31b]
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x118]
add ecx, eax
mov byte [ebp - 0x23c], al
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov al, byte [ebp - 0x23c]
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x198]
mov byte [ebp + ebx - 0x158], al
inc ebx
cmp ebx, 0x40
jne 0x4074f4
mov dword [0x42948c], edi
mov edx, str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov byte [ebp - 0x118], 0
mov al, byte [edx]
test al, al
je 0x40757a
sub eax, 0x30
cmp al, 9
jbe 0x407577
add esi, 0x5dae5373
mov dword [0x42948c], esi
jmp 0x40757a
inc edx
jmp 0x40755c
mov eax, dword [0x42948c]
xor ebx, ebx
add eax, 0x48f65537
mov dword [0x429450], eax
mov dword [esp], 0x104
call fcn.0040d2a0
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call fcn.0040e6b8
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x240], ecx
mov dword [ebp - 0x244], eax
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x258], eax
mov edi, dword [ebp - 0x258]
cmp dword [ebp - 0x244], edi
je 0x407bdb
cmp byte [str.RtlUnicodeStringCatString_failed___x_], 0
je 0x40761d
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov dword [esp + 8], str.AslRegistryGetUInt32_UStr
mov dword [esp + 4], str.The_request_was_aborted.
mov dword [esp], str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx
call fcn.0040ed88
mov eax, dword [0x42948c]
and eax, 0xb936bdfc
mov dword [0x429450], eax
mov edx, str.RtlUnicodeStringCatString_failed___x_
mov al, byte [edx]
test al, al
je 0x40763e
sub eax, 0x30
cmp al, 9
jbe 0x40763b
xor dword [0x429450], 0x91d180d0
jmp 0x40763e
inc edx
jmp 0x407622
mov eax, dword [0x429450]
and eax, 0x1e7a644e
mov dword [0x42948c], eax
call fcn.00413c0c
mov edx, dword [0x42948c]
mov eax, edx
and eax, 0xf893570b
or eax, 0x60030601
mov dword [0x42948c], eax
mov eax, edx
and eax, 0x78114001
or eax, 0x60010001
mov dword [0x429450], eax
xor eax, eax
cmp eax, 0x40
je 0x4076a5
lea edi, [eax + 1]
mov esi, dword [ebp - 0x244]
mov dword [ebp - 0x23c], edi
mov edi, dword [ebp - 0x248]
mov cl, byte [esi]
cmp byte [edi + eax], cl
je 0x4076a7
mov eax, dword [ebp - 0x23c]
jmp 0x40767c
mov al, 0x40
movzx esi, bl
lea ecx, [ebx + 1]
mov byte [ebp + esi - 0x22c], al
cmp bl, 3
jne 0x407bce
and edx, 0x20004001
or edx, 0x20000001
cmp byte [str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx], 0
mov dword [0x42948c], edx
je 0x4076ec
call fcn.00412f2c
imul eax, dword [0x42948c], 0x9f0e66fa
mov dword [0x429450], eax
imul eax, dword [0x429450], 0x3a38862e
mov dword [0x42948c], eax
mov dword [esp], str.AslRegistryGetUInt32_UStr
call fcn.00411390
xor eax, eax
cmp byte [eax + str.RtlUnicodeStringCatString_failed___x_], 0
je 0x40773f
inc eax
cmp eax, 0x24c0
jne 0x407709
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov eax, dword [0x429450]
mov dword [esp + 4], str.The_request_was_aborted.
mov dword [esp + 8], eax
mov dword [esp], str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx
call fcn.004122b0
mov eax, dword [0x429450]
lea edx, [eax - 0xec97e23]
mov dword [0x42948c], edx
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov dword [esp], str.RtlUnicodeStringCatString_failed___x_
call fcn.004122b0
mov edx, str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov ecx, 0x1ac2
movzx eax, byte [edx]
inc edx
test al, al
je 0x40779b
add ecx, eax
cmp ecx, 0x25c9
jbe 0x40777a
call fcn.00410bb4
xor dword [0x429450], 0x98dbc8b
mov eax, dword [0x429450]
lea edi, [ebp - 0x21c]
mov esi, 0x416070
xor ebx, ebx
mov edx, eax
xor eax, 0xc7c0c571
xor edx, 0xc602cc9d
mov dword [0x429450], eax
mov dword [0x42948c], edx
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov dword [esp + 8], eax
mov dword [esp + 4], str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx
mov dword [esp], str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
call fcn.004122b0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, 0x23
call dword [sym.imp.USER32.dll_GetShellWindow]
add esi, dword [ebp + ebx*4 - 0x21c]
inc ebx
mov dword [ebp - 0x24c], esi
cmp ebx, 4
jne 0x4077f1
mov eax, dword [0x42948c]
xor esi, esi
mov dword [ebp - 0x228], 0x1e
mov edi, 0x3c0
mov dword [ebp - 0x224], 0x5f
mov dword [ebp - 0x220], 0x303
xor eax, 0xb5f12041
imul eax, eax, 0x56849dae
mov dword [0x42948c], eax
sub eax, 0x378f4509
mov dword [0x429450], eax
xor eax, eax
cmp byte [eax + str.LDR:MRDATA:_Process_initialization_failed_with_status_0x_08lx], 0
je 0x407875
inc eax
cmp eax, 0x1b37
jne 0x407850
call fcn.0040f658
mov eax, dword [0x429450]
xor eax, 0x3d0ddae3
mov dword [0x42948c], eax
mov eax, dword [0x42948c]
sub edi, dword [ebp + esi*4 - 0x228]
inc esi
mov ebx, edi
lea edx, [eax + 0x1a6d4895]
mov dword [0x429450], edx
cmp esi, 3
jne 0x40784e
or eax, 0xfa72d358
lea edi, [ebp - 0x1ec]
mov esi, 0x416080
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov dword [0x42948c], eax
xor esi, esi
xor edi, edi
xor eax, eax
cmp word [eax + str.AslRegistryGetUInt32_UStr], 0
je 0x4078df
add eax, 2
cmp eax, 0x1826
jne 0x4078b7
call fcn.0040eb4c
mov eax, dword [0x42948c]
add eax, 0x1568f21f
mov dword [0x429450], eax
mov eax, dword [0x429450]
xor eax, 0x3cb07632
mov dword [0x429450], eax
and eax, 0xd2d04329
mov dword [0x42948c], eax
call fcn.00410bb4
xor eax, eax
cmp byte [eax + str.The_GUID_allocation_server_is__already__enabled_at_the_moment.], 0
je 0x407926
inc eax
cmp eax, 0x22bf
jne 0x4078ff
call fcn.00412f2c
imul eax, dword [0x429450], 0xc8cfdec3
mov dword [0x42948c], eax
jmp 0x40792d
cmp eax, 0x1edd
jle 0x407932
call fcn.00411810
mov eax, dword [0x42948c]
sub edi, dword [ebp + esi*4 - 0x1ec]
inc esi
mov dword [ebp - 0x250], edi
xor eax, 0x5437ae08
mov dword [0x429450], eax
cmp esi, 5
jne 0x4078b5
mov edi, dword [ebp - 0x240]
mov cl, byte [ebp - 0x22b]
mov esi, dword [ebp - 0x240]
inc edi
mov byte [ebp - 0x251], cl
shr cl, 4
mov dword [ebp - 0x23c], edi
mov edi, dword [ebp - 0x24c]
mov dl, byte [ebp + edi - 0x22c]
mov edi, dword [ebp + 8]
lea edx, [ecx + edx*4]
mov byte [edi + esi], dl
movzx edx, byte [ebp - 0x22a]
mov byte [ebp - 0x24c], dl
cmp edx, ebx
je 0x407b36
xor edx, edx
cmp byte [edx + str.RtlUnicodeStringCatString_failed___x_], 0
je 0x4079c3
inc edx
cmp edx, 0x1caa
jne 0x4079a7
sub eax, 0x3ad115a2
mov dword [0x42948c], eax
mov eax, dword [0x42948c]
add eax, 0x2fd28cb3
mov dword [0x429450], eax
mov dword [esp], 0x22ad
call dword [sym.imp.USER32.dll_IsWindow]
push edx
call fcn.004140d8
mov eax, dword [0x42948c]
lea edx, [eax - 0x65dc8ff2]
sub eax, 0x3e6f5f1b
mov dword [0x429450], edx
mov dword [0x42948c], eax
call fcn.00411810
mov edx, str.The_GUID_allocation_server_is__already__enabled_at_the_moment.
mov al, byte [edx]
test al, al
je 0x407a3b
sub eax, 0x30
cmp al, 9
jbe 0x407a38
mov eax, dword [0x42948c]
sub eax, 0x5f3fe12e
mov dword [0x429450], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, 0xb55c04d5
mov dword [0x42948c], eax
jmp 0x407a3b
inc edx
jmp 0x407a0a
lea edi, [ebp - 0x20c]
mov esi, 0x416094
mov ecx, 4
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x14
mov eax, dword [0x42948c]
or eax, 0xa71bdf57
sub eax, 0x4302c4c2
and eax, 0x9ec77616
mov dword [0x429450], eax
xor eax, 0x18d8b30e
mov dword [0x42948c], eax
mov dword [esp + 0xc], str.AslRegistryGetUInt32_UStr
mov dword [esp + 8], str.AslRegistryGetUInt32_UStr
mov dword [esp + 4], str.The_request_was_aborted.
mov dword [esp], str.RtlUnicodeStringCatString_failed___x_
call fcn.0040ed88
sub esi, dword [ebp + ebx*4 - 0x20c]
inc ebx
cmp ebx, 4
jne 0x407a54
mov dword [ebp - 0x25c], esi
mov ecx, ebx
mov esi, 0x4160a4
xor ebx, ebx
lea edi, [ebp - 0x1fc]
rep movsd dword es:[edi], dword [esi]
mov dword [esp], str.The_cluster_node_was_not_found.
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x1c
push eax
mov eax, dword [0x42948c]
mov edx, dword [ebp - 0x25c]
sub ecx, dword [ebp + ebx*4 - 0x1fc]
inc ebx
mov esi, eax
xor eax, 0xf8b495ea
cmp ebx, 4
jne 0x407add
mov dword [0x42948c], eax
movzx eax, byte [ebp + edx - 0x22c]
mov ebx, esi
xor ebx, 0x93cf1ca0
mov edi, dword [ebp + 8]
sar eax, cl
mov dword [0x429450], ebx
mov ebx, dword [ebp - 0x23c]
mov edx, eax
mov al, byte [ebp - 0x251]
shl eax, 4
add eax, edx
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x240]
add eax, 2
mov dword [ebp - 0x23c], eax
mov bl, byte [ebp - 0x229]
cmp bl, 0x40
je 0x407bbc
imul eax, dword [0x42948c], 0xd094daa3
cmp byte [str.RtlUnicodeStringCatString_failed___x_], 0
mov dword [0x429450], eax
je 0x407b63
sub eax, 0x137fbf47
mov dword [0x429450], eax
mov eax, dword [0x429450]
or eax, 0xf0909e2f
mov dword [0x42948c], eax
xor eax, 0x598a37cd
mov dword [0x429450], eax
call fcn.00412f2c
call dword [sym.imp.USER32.dll_GetMessageTime]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [0x42948c]
mov edi, dword [ebp + 8]
sub eax, 0x5b264f84
mov dword [0x429450], eax
mov al, byte [ebp - 0x24c]
shl eax, 6
add eax, ebx
mov ebx, dword [ebp - 0x23c]
mov byte [edi + ebx], al
mov eax, ebx
inc eax
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov cl, byte [ebp - 0x250]
mov dword [ebp - 0x240], eax
inc dword [ebp - 0x244]
mov ebx, ecx
jmp 0x4075cf
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x240]
mov byte [eax + ebx], 0
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call fcn.0040d2e4
mov eax, dword [ebp - 0x240]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret