Function at 0x416a4a
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 0x16
pop eax
push 5
pop ecx
mov esi, 0x42ccc4
mov byte [ebp - 0x33], al
lea edi, [ebp - 0x80]
mov dword [ebp - 0x3c], 0xabab95e7
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dword [ebp - 0x38], 0x2779d932
mov byte [ebp - 0x34], 0xe0
mov ebx, ecx
mov dword [ebp - 0x32], 0xb817b33c
mov eax, ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x2e], 0xe99c8a9b
mov dword [ebp - 0x2a], 0x91e53952
mov dword [ebp - 0x26], 0xe2f77fb6
mov dword [ebp - 0x22], 0xfc368d70
mov dword [ebp - 0x1e], 0xdd39ab84
mov dword [ebp - 0x1a], 0x9ae1879d
mov dword [ebp - 0x16], 0x9e49f455
mov word [ebp - 0x12], 0x31cb
movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0x416ac2
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0xc], ecx
mov al, byte [ebp + ecx - 0x180]
xor edx, edx
mov byte [ebp - 1], al
mov eax, ecx
push 0x16
pop ecx
div ecx
movzx ecx, byte [ebp - 1]
mov esi, dword [0x4356b8]
movzx eax, byte [ebp + edx - 0x80]
add eax, ebx
add ecx, eax
movzx eax, cl
mov dword [ebp - 8], eax
xor eax, eax
xor esi, 0x210c5337
mov ebx, eax
mov dword [0x435650], esi
inc ebx
cmp word [ebx*2 + str.FilterDaemonMsToIdle], ax
jne 0x416b13
call fcn.004148e3
cmp edi, ebx
jae 0x416b5b
mov eax, dword [0x4356b8]
cmp edi, 0x6bd
jne 0x416b4c
add esi, 0x52e20b90
mov ecx, eax
mov dword [0x435650], esi
call fcn.00414f8a
mov eax, dword [0x4356b8]
add eax, 0x22de8185
inc edi
mov dword [0x4356b8], eax
cmp edi, ebx
jb 0x416b2c
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + ecx - 0x180], al
inc ecx
mov al, byte [ebp - 1]
mov byte [ebp + ebx - 0x180], al
mov dword [ebp - 0xc], ecx
cmp ecx, 0x100
jb 0x416ad7
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ebx
mov eax, 0x430b80
push esi
mov edx, eax
call fcn.00414ef8
pop ecx
push 8
pop ecx
push 0x46
mov esi, 0x42e814
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0x64]
pop eax
rep movsd dword es:[edi], dword [esi]
cmp ax, word [ebp - 0x64]
jne 0x416bf4
xor edx, edx
mov ecx, eax
mov eax, edx
test cx, cx
je 0x416bf1
cmp word [ebp + eax - 0x64], dx
je 0x416bf1
mov edx, str.FilterProcessBackoff
mov ecx, str.FilterDaemonMsToIdle
call fcn.004151f9
inc ebx
push 0
pop edx
lea eax, [ebx + ebx]
movzx ecx, word [eax + str.FilterDaemonMsToIdle]
cmp cx, word [ebp + eax - 0x64]
je 0x416bc1
mov dword [ebp - 0xc], ebx
call fcn.00414797
mov esi, dword [ebp - 0x40]
cmp esi, ebx
mov ebx, dword [0x4356b8]
jae 0x416c43
mov edi, dword [ebp - 0xc]
cmp esi, 0x20fc
jne 0x416c28
xor ebx, 0xb24d2f65
mov dword [0x435650], ebx
call fcn.004153f9
mov ebx, dword [0x4356b8]
or ebx, 0xe6c25b5d
mov ecx, ebx
mov dword [0x4356b8], ebx
call fcn.00414f8a
inc esi
cmp esi, edi
jb 0x416c09
mov dword [ebp - 0x40], esi
mov eax, dword [ebp - 0x44]
inc eax
movzx esi, al
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44], esi
mov cl, byte [ebp + esi - 0x180]
movzx edx, cl
add eax, edx
movzx edi, al
mov dword [ebp - 0x10], edi
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
mov byte [ebp + edi - 0x180], cl
movzx eax, byte [ebp + esi - 0x180]
mov ecx, dword [ebp - 8]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + ecx - 0x3c]
mov byte [ebp + ecx - 0x1e8], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x2c
jae 0x416caf
mov esi, dword [0x435650]
xor ebx, ebx
jmp 0x416b94
mov esi, 0x42c2e0
mov dword [ebp - 0x5c], 0x8b3a47c8
lea edi, [ebp - 0x74]
mov dword [ebp - 0x58], 0x1b93759b
xor ecx, ecx
mov dword [ebp - 0x54], 0x6b732cf2
mov byte [ebp - 0x1bc], cl
mov eax, ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x50], 0x34b1dae9
mov dword [ebp - 0x4c], 0x1aedabd0
mov dword [ebp - 0x48], 0x47d66e3e
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, ecx
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0x416cf0
mov esi, ecx
mov dl, byte [ebp + esi - 0x180]
mov eax, esi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x74]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], dl
cmp esi, 0x100
jb 0x416d01
xor eax, eax
sub ebx, 0x22d7bded
mov edx, eax
mov dword [ebp - 0xc], ebx
mov ecx, eax
mov dword [0x4356b8], ebx
mov dword [ebp - 8], eax
lea eax, [ecx + 1]
mov edi, str.FilterDaemonMsToIdle
movzx eax, al
mov dword [ebp - 0x10], eax
mov al, byte [ebp + eax - 0x180]
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 0x44], eax
add eax, edx
movzx eax, al
xor esi, esi
mov dword [ebp - 0x40], eax
mov ecx, ebx
call fcn.004149fd
lea edi, [edi + 2]
cmp word [edi], si
jne 0x416d7a
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov al, byte [ebp + edx - 0x180]
mov byte [ebp + ecx - 0x180], al
mov al, byte [ebp - 1]
mov byte [ebp + edx - 0x180], al
movzx eax, byte [ebp + ecx - 0x180]
add eax, dword [ebp - 0x44]
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x5c]
mov byte [ebp + esi - 0x19c], al
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x18
jb 0x416d52
push 5
pop ecx
mov esi, str.ext_ms_win_imm_l1_1_1
mov dword [ebp - 0x5c], 0xd168e20f
lea edi, [ebp - 0x80]
mov dword [ebp - 0x58], 0x9f41eeaf
rep movsd dword es:[edi], dword [esi]
xor edx, edx
mov dword [ebp - 0x54], 0xf42aa754
mov byte [ebp - 0x184], dl
mov eax, edx
mov dword [ebp - 0x50], 0xe6ca1c48
movsw word es:[edi], word [esi]
mov dword [ebp - 0x4c], 0x5384b821
mov edi, edx
mov dword [ebp - 0x48], 0x579b88f2
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0x416e1c
push 0x15
mov esi, edx
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
mov eax, esi
div ecx
movzx ecx, bl
push 0x15
movzx eax, byte [ebp + edx - 0x80]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0x416e30
mov esi, dword [ebp - 0xc]
xor eax, eax
mov edx, eax
mov dword [ebp - 8], eax
mov ecx, eax
lea eax, [ecx + 1]
mov ecx, str.FilterDaemonMsToIdle
movzx eax, al
mov dword [ebp - 0x44], eax
mov al, byte [ebp + eax - 0x180]
mov byte [ebp - 1], al
movzx eax, al
mov dword [ebp - 0x68], eax
add eax, edx
movzx eax, al
mov edx, str.S_1_15_3_1024_724741592_1210917904_489960769_637019204_3345707629_3097053430_1727148295_85063603
mov dword [ebp - 0x10], eax
call fcn.004151f9
xor ebx, ebx
mov eax, esi
xor eax, 0x1f8a8bbd
mov edi, ebx
mov dword [ebp - 0x40], eax
mov dword [0x435650], eax
mov edx, 0x42f6e0
mov ecx, 0x430b80
call fcn.004151f9
inc edi
cmp word [edi*2 + str.FilterDaemonMsToIdle], bx
jne 0x416ebc
call fcn.004148e3
mov esi, dword [ebp - 0xc]
cmp edi, 0x1bae
jne 0x416f05
push dword [ebp - 0x40]
and esi, 0xe42f8e76
mov edx, 0x430b80
mov dword [ebp - 0xc], esi
mov dword [0x4356b8], esi
call fcn.00414ef8
pop ecx
jmp 0x416f10
imul eax, esi, 0xfcb8a300
mov dword [0x435650], eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x44]
mov ebx, dword [ebp - 8]
mov al, byte [ebp + edx - 0x180]
mov byte [ebp + ecx - 0x180], al
mov al, byte [ebp - 1]
mov byte [ebp + edx - 0x180], al
movzx eax, byte [ebp + ecx - 0x180]
add eax, dword [ebp - 0x68]
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + ebx - 0x5c]
mov byte [ebp + ebx - 0x1b8], al
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, 0x18
jb 0x416e79
mov esi, 0x42cd58
mov dword [ebp - 0x3c], 0xbbd74d97
lea edi, [ebp - 0x78]
mov dword [ebp - 0x38], 0x3fc4f98d
push 0x16
xor ecx, ecx
mov dword [ebp - 0x34], 0x812f25a7
movsd dword es:[edi], dword [esi]
pop eax
mov byte [ebp - 0x1d], al
mov eax, ecx
mov byte [ebp - 0x1a0], cl
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x30], 0xea5cbd22
mov dword [ebp - 0x2c], 0x93d43749
mov dword [ebp - 0x28], 0xf541c8fd
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x24], 0x4807fde
mov word [ebp - 0x20], 0x9915
mov byte [ebp - 0x1e], 0x47
movsw word es:[edi], word [esi]
mov dword [ebp - 0x1c], 0xfeabcafa
mov dword [ebp - 0x18], 0x2542f405
mov dword [ebp - 0x14], 0x1d5bfc2e
movsb byte es:[edi], byte [esi]
mov edi, ecx
mov byte [ebp + eax - 0x180], al
inc eax
cmp eax, 0x100
jb 0x416fce
mov esi, ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x180]
push 0xe
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x78]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x180]
mov byte [ebp + esi - 0x180], al
inc esi
mov byte [ebp + edi - 0x180], bl
cmp esi, 0x100
jb 0x416fdf
xor eax, eax
mov ebx, eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x180]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x180]
mov byte [ebp + edi - 0x180], al
mov byte [ebp + ebx - 0x180], cl
movzx eax, byte [ebp + edi - 0x180]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x180]
xor al, byte [ebp + esi - 0x3c]
mov byte [ebp + esi - 0x218], al
inc esi
cmp esi, 0x2c
jb 0x417024
xor eax, eax
mov ebx, 0x800
mov ecx, ebx
mov byte [ebp - 0x1ec], al
call fcn.0040a2a8
mov ecx, ebx
mov dword [ebp - 0x40], eax
call fcn.0040a2a8
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x10], eax
call fcn.0040b628
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x68], eax
call fcn.0040b628
mov dword [ebp - 8], eax
mov edi, 0x430b80
xor ebx, ebx
call fcn.00414797
imul ecx, dword [0x435650], 0x1edb390b
lea edi, [edi + 2]
mov dword [0x4356b8], ecx
cmp word [edi], bx
jne 0x4170b8
lea ecx, [ebp - 0x1b8]
call fcn.0040b628
mov ebx, dword [ebp - 0x68]
mov esi, eax
mov edi, dword [ebp - 0x40]
mov edx, ebx
mov ecx, edi
call fcn.0040ba7a
mov edx, dword [ebp - 8]
call fcn.0040ba7a
mov edx, esi
call fcn.0040ba7a
push 0x400
push dword [ebp - 0x10]
xor ecx, ecx
lea edx, [ebp - 0x218]
push edi
inc ecx
call fcn.0040a2e6
call eax
push 0x800
xor eax, eax
push eax
push edi
call fcn.0040b587
mov ecx, edi
call fcn.0040a2d2
mov ecx, ebx
call fcn.0040b8f4
push eax
xor eax, eax
push eax
push ebx
call fcn.0040b587
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.0040b8f4
push eax
xor eax, eax
push eax
push edi
call fcn.0040b587
mov ecx, esi
call fcn.0040b8f4
push eax
xor eax, eax
push eax
push esi
call fcn.0040b587
add esp, 0x30
mov ecx, ebx
call fcn.0040a2d2
mov ecx, edi
call fcn.0040a2d2
mov ecx, esi
call fcn.0040a2d2
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret