Function at 0x40dfcf
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x435510]
push esi
push edi
mov esi, 0x42ec68
mov dword [ebp - 0xcc], edx
lea edi, [ebp - 0xe8]
mov dword [ebp - 0xd0], ecx
xor eax, 0xc87e485e
mov dword [ebp - 0x18], 0x352f0888
mov dword [ebp - 0x1c], eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0x956f41d4
mov dword [ebp - 0x10], 0x56b7754b
mov dword [ebp - 0xc], 0xf5196e68
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x96a2314f
mov dword [ebp - 4], 0x5af72ffd
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x360], al
inc eax
cmp eax, 0x100
jb 0x40e030
push 0xc
pop ecx
xor esi, esi
push ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x360]
mov eax, esi
div ecx
movzx ecx, bl
push 0xc
movzx eax, byte [ebp + edx - 0xe8]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x360]
mov byte [ebp + esi - 0x360], al
inc esi
mov byte [ebp + edi - 0x360], bl
cmp esi, 0x100
jb 0x40e045
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x360]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x360]
mov byte [ebp + edi - 0x360], al
mov byte [ebp + ebx - 0x360], cl
movzx eax, byte [ebp + edi - 0x360]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x360]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x228], al
inc esi
cmp esi, 0x18
jb 0x40e08b
push 7
pop eax
push 0x13
mov byte [ebp - 0x86], al
lea edi, [ebp - 0x39c]
pop eax
mov byte [ebp - 0x6c], al
mov esi, 0x42f6e0
push 0xe
pop eax
mov ecx, eax
mov dword [ebp - 0xc8], 0x485d480b
rep movsd dword es:[edi], dword [esi]
xor edx, edx
mov dword [ebp - 0xc4], 0xa25b40cc
mov byte [ebp - 0x210], dl
mov eax, edx
mov dword [ebp - 0xc0], 0x102ba13f
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xbc], 0x65039340
mov edi, edx
mov dword [ebp - 0xb8], 0xc0ab1ddb
mov dword [ebp - 0xb4], 0x274e8c5c
mov dword [ebp - 0xb0], 0x54db9922
mov dword [ebp - 0xac], 0xba99963
mov dword [ebp - 0xa8], 0x4a99d979
mov dword [ebp - 0xa4], 0x4381af42
mov dword [ebp - 0xa0], 0x2a616f3d
mov dword [ebp - 0x9c], 0xef9440cf
mov dword [ebp - 0x98], 0x7363be12
mov dword [ebp - 0x94], 0x69cd00c3
mov dword [ebp - 0x90], 0xb063d40
mov dword [ebp - 0x8c], 0x24f4ce1
mov word [ebp - 0x88], 0xe053
mov dword [ebp - 0x85], 0xc20b33db
mov dword [ebp - 0x81], 0x9489dbee
mov dword [ebp - 0x7d], 0x714a1f86
mov dword [ebp - 0x79], 0xa54de48
mov dword [ebp - 0x75], 0x2c726c36
mov dword [ebp - 0x71], 0x83bb3916
mov byte [ebp - 0x6d], 0xa5
mov dword [ebp - 0x6b], 0xbe3447ce
mov dword [ebp - 0x67], 0x6c18c62b
mov dword [ebp - 0x63], 0xb2e26c9c
mov dword [ebp - 0x5f], 0xb2c32b75
mov dword [ebp - 0x5b], 0x48159f2a
mov dword [ebp - 0x57], 0x3c6be504
mov dword [ebp - 0x53], 0xc8d7cb8
mov dword [ebp - 0x4f], 0x9630cfca
mov dword [ebp - 0x4b], 0x39407160
mov dword [ebp - 0x47], 0x472ae6c0
mov dword [ebp - 0x43], 0x142867d3
mov dword [ebp - 0x3f], 0x36e3c351
mov dword [ebp - 0x3b], 0x93838441
mov dword [ebp - 0x37], 0x6fa9a678
mov dword [ebp - 0x33], 0x80e61478
mov dword [ebp - 0x2f], 0xb01074de
mov dword [ebp - 0x2b], 0xa7f8b355
mov dword [ebp - 0x27], 0x2dc8ec83
mov dword [ebp - 0x23], 0x110c3000
mov word [ebp - 0x1f], 0xc1bf
mov byte [ebp - 0x1d], 0x87
mov byte [ebp + eax - 0x20c], al
inc eax
cmp eax, 0x100
jb 0x40e275
mov esi, edx
xor edx, edx
mov bl, byte [ebp + esi - 0x20c]
push 0x38
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x39c]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + esi - 0x20c], al
inc esi
mov byte [ebp + edi - 0x20c], bl
cmp esi, 0x100
jb 0x40e286
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x20c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x20c]
mov byte [ebp + edi - 0x20c], al
mov byte [ebp + ebx - 0x20c], cl
movzx eax, byte [ebp + edi - 0x20c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x20c]
xor al, byte [ebp + esi - 0xc8]
mov byte [ebp + esi - 0x310], al
inc esi
cmp esi, 0xac
jb 0x40e2cc
mov eax, dword [ebp - 0x1c]
lea edi, [ebp - 0xec]
push 5
xor eax, 0x149a7a33
mov byte [ebp - 0x264], 0
pop ecx
mov esi, 0x42d66c
mov dword [ebp - 0x18], 0xd0d4fa5f
add eax, 0x7f804b27
mov dword [ebp - 0x14], 0xd4644900
rep movsd dword es:[edi], dword [esi]
mov dword [0x435510], eax
xor edi, edi
mov dword [ebp - 0x10], 0x3c2b6b4b
xor eax, eax
mov dword [ebp - 0xc], 0x2403a734
mov dword [ebp - 8], 0x20f42176
mov dword [ebp - 4], 0x20f5fd50
mov byte [ebp + eax - 0x20c], al
inc eax
cmp eax, 0x100
jb 0x40e379
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x20c]
push 0x13
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0xec]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + esi - 0x20c], al
inc esi
mov byte [ebp + edi - 0x20c], bl
cmp esi, 0x100
jb 0x40e38a
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x20c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x20c]
mov byte [ebp + edi - 0x20c], al
mov byte [ebp + ebx - 0x20c], cl
movzx eax, byte [ebp + edi - 0x20c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x20c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x244], al
inc esi
cmp esi, 0x18
jb 0x40e3d0
mov esi, 0x42dd18
mov byte [ebp - 0x22c], 0
lea edi, [ebp - 0xe8]
mov dword [ebp - 0x18], 0x18c31c63
mov dword [ebp - 0x14], 0x2e95fb7e
mov dword [ebp - 0x10], 0x21708e99
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0xd934a381
mov dword [ebp - 8], 0x60cab1af
mov dword [ebp - 4], 0xded171b6
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x20c], al
inc eax
cmp eax, 0x100
jb 0x40e466
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x20c]
push 0xe
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0xe8]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + esi - 0x20c], al
inc esi
mov byte [ebp + edi - 0x20c], bl
cmp esi, 0x100
jb 0x40e477
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x20c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x20c]
mov byte [ebp + edi - 0x20c], al
mov byte [ebp + ebx - 0x20c], cl
movzx eax, byte [ebp + edi - 0x20c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x20c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x260], al
inc esi
cmp esi, 0x18
jb 0x40e4bd
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x228]
mov byte [ebp - 0x248], 0
call fcn.0040b5df
lea ecx, [ebp - 0x310]
mov ebx, eax
call fcn.0040b5df
lea ecx, [ebp - 0x244]
mov edi, eax
call fcn.0040b5df
mov esi, eax
call fcn.0040dce6
push esi
push edi
push ebx
push dword [ebp + 0x10]
lea edx, [ebp - 0x260]
push 2
pop ecx
call fcn.0040a2e6
call eax
mov ecx, ebx
call fcn.0040b8e6
push eax
push 0
push ebx
call fcn.0040b587
mov ecx, edi
call fcn.0040b8e6
push eax
push 0
push edi
call fcn.0040b587
mov ecx, esi
call fcn.0040b8e6
push eax
push 0
push esi
call fcn.0040b587
add esp, 0x34
mov ecx, ebx
call fcn.0040a2d2
mov ecx, edi
call fcn.0040a2d2
mov ecx, esi
call fcn.0040a2d2
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
call fcn.0040ba5f
cmp dword [ebp + 0x14], 0
je 0x40e73f
mov esi, 0x42d658
mov dword [ebp - 0x18], 0x35f9d062
lea edi, [ebp - 0xec]
mov dword [ebp - 0x14], 0x55904491
push 0xe
pop eax
movsd dword es:[edi], dword [esi]
mov ebx, 0x100
mov byte [ebp - 3], al
mov dword [ebp - 0x10], 0xd542997a
mov dword [ebp - 0xc], 0x2f75bb
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0xae25d761
mov byte [ebp - 4], 0xc5
mov word [ebp - 2], 0xa37d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x20c], al
inc eax
cmp eax, ebx
jb 0x40e603
xor esi, esi
mov dl, byte [ebp + esi - 0x20c]
mov eax, esi
and eax, 0xf
movzx ecx, dl
movzx eax, byte [ebp + eax - 0xec]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + esi - 0x20c], al
inc esi
mov byte [ebp + edi - 0x20c], dl
cmp esi, ebx
jb 0x40e611
mov esi, 0x42f71c
lea edi, [ebp - 0xe8]
xor ecx, ecx
and dword [ebp + 0x14], ecx
xor ebx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0x14]
mov edx, dword [0x435510]
lea eax, [edi + 1]
movzx edi, al
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + 0x17], al
movzx eax, al
mov dword [ebp - 0xd4], eax
add eax, ecx
movzx eax, al
mov ecx, str.SoftwareMicrosoftWindows_SearchTracingEventThrottleState
mov dword [ebp - 0xf0], eax
mov al, byte [ebp + eax - 0x20c]
mov byte [ebp + edi - 0x20c], al
call fcn.0040d278
cmp byte [ebp - 0xe8], 0x77
jne 0x40e6d4
mov al, 0x77
xor esi, esi
test al, al
je 0x40e6d4
cmp byte [ebp + esi - 0xe8], 0
je 0x40e6d4
call fcn.0040cce9
mov al, byte [esi + 0x42fdbd]
inc esi
cmp al, byte [ebp + esi - 0xe8]
je 0x40e6b1
mov ecx, dword [ebp - 0xf0]
mov al, byte [ebp + 0x17]
mov byte [ebp + ecx - 0x20c], al
movzx eax, byte [ebp + edi - 0x20c]
add eax, dword [ebp - 0xd4]
movzx eax, al
mov al, byte [ebp + eax - 0x20c]
xor al, byte [ebp + ebx - 0x18]
mov byte [ebp + ebx - 0x10c], al
inc ebx
cmp ebx, 0x18
jb 0x40e662
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xd0]
lea edx, [ebp - 0x10c]
push esi
push eax
push dword [ebp + 0x10]
mov byte [ebp - 0xf4], 0
push dword [ebp - 0xcc]
call fcn.00412443
jmp 0x40e851
xor edi, edi
mov dword [ebp - 0x18], 0x84300a5e
mov dword [ebp - 0x14], 0x60d64f6d
xor eax, eax
mov dword [ebp - 0x10], 0xd015707b
mov dword [ebp - 0xc], 0xd73b2fff
mov dword [ebp - 8], 0x68cde402
mov dword [ebp - 4], 0x8b8ba81e
mov dword [ebp - 0xd8], 0x6e6b6e75
mov dword [ebp - 0xd4], 0x6e776f
mov byte [ebp + eax - 0x20c], al
inc eax
cmp eax, 0x100
jb 0x40e781
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x20c]
push 7
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0xd8]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x20c]
mov byte [ebp + esi - 0x20c], al
inc esi
mov byte [ebp + edi - 0x20c], bl
cmp esi, 0x100
jb 0x40e792
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x20c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x20c]
mov byte [ebp + edi - 0x20c], al
mov byte [ebp + ebx - 0x20c], cl
movzx eax, byte [ebp + edi - 0x20c]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x20c]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x10c], al
inc esi
cmp esi, 0x18
jb 0x40e7d8
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0xd0]
lea edx, [ebp - 0x10c]
push esi
push eax
push dword [ebp + 0x10]
mov byte [ebp - 0xf4], 0
push dword [ebp - 0xcc]
call fcn.0040ff63
add esp, 0x10
mov edi, eax
pop ebx
test edi, edi
jne 0x40e86e
mov edx, dword [ebp - 0x1c]
cmp edx, 0x28
jbe 0x40e86e
test esi, esi
je 0x40e86e
mov ecx, esi
call fcn.00408b63
mov eax, edi
pop edi
pop esi
leave
ret