Function at 0x40b5a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov edx, str.The_create_operation_stopped_after_reaching_a_symbolic_link.
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3fc
mov al, byte [edx]
test al, al
je 0x40b5cd
sub eax, 0x30
cmp al, 9
jbe 0x40b5ca
sub dword [0x42922c], 0x5c58623
jmp 0x40b5cd
inc edx
jmp 0x40b5b1
mov eax, dword [0x42922c]
sub eax, 0x5c3a222a
mov dword [0x429028], eax
call fcn.00413c50
imul eax, dword [0x42922c], 0xc65f9448
mov edx, eax
mov dword [0x42922c], eax
and edx, 0x16cb52b
mov dword [str.W__b], edx
mov dword [esp], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_manager_type_is_unknown.
call fcn.00413018
mov eax, dword [0x42922c]
or eax, 0x5371b6ed
mov dword [0x42922c], eax
sub eax, 0x5fd576eb
mov dword [str.W__b], eax
call fcn.0041205c
mov eax, dword [str.W__b]
mov edx, eax
and eax, 0xc6ee3cf8
or edx, 0x6a8876ab
mov dword [0x42922c], eax
mov dword [0x429028], edx
call fcn.00410fb0
mov eax, dword [0x42922c]
mov ecx, str.The_create_operation_stopped_after_reaching_a_symbolic_link.
sub eax, 0x56d9577b
mov dword [0x42922c], eax
mov bl, byte [ecx]
lea edx, [ebx - 0x30]
cmp dl, 9
ja 0x40b677
inc ecx
jmp 0x40b66a
mov edx, eax
or eax, 0xf6bb6e55
or edx, 0xc6996655
mov dword [str.W__b], eax
mov dword [0x429028], edx
mov dword [esp + 4], str.The_manager_type_is_unknown.
mov dword [esp], str.A_file_snapshot_operation_received_an_invalid_parameter.
call fcn.004147d0
cmp byte [str.The_create_operation_stopped_after_reaching_a_symbolic_link.], 0
je 0x40b6bb
call fcn.0040f0d0
xor dword [0x42922c], 0xd36b941f
call fcn.0040f0d0
lea edi, [ebp - 0x244]
mov esi, str.7_aER
lea ebx, [ebp - 0x244]
imul eax, dword [str.W__b], 0xdddd19e4
mov dword [0x429028], eax
mov eax, dword [0x42922c]
or eax, 0xfcea762f
mov dword [str.W__b], eax
call fcn.00413efc
mov eax, dword [0x42922c]
or dword [0x429028], 0x918a2424
xor eax, 0x25a911d2
mov dword [str.W__b], eax
call fcn.0040f0d0
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
mov dword [esp], str.The_create_operation_stopped_after_reaching_a_symbolic_link.
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
or eax, 0x7ba585b2
push edx
sub edi, dword [ebx + esi*4]
inc esi
mov dword [0x42922c], eax
mov ecx, edi
cmp esi, 5
jne 0x40b71d
mov edx, str.The_create_operation_stopped_after_reaching_a_symbolic_link.
mov al, byte [edx]
sub eax, 0x30
cmp al, 9
ja 0x40b751
inc edx
jmp 0x40b745
mov eax, dword [str.W__b]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x388], ecx
mov dword [ebp - 0x390], 0x18
mov ecx, 0x9de
or eax, 0x588bab85
mov dword [ebp - 0x38c], esi
lea edx, [eax + 0x6866533f]
mov dword [ebp - 0x384], esi
mov dword [str.W__b], edx
mov edx, eax
add eax, 0x76f2c389
mov dword [0x429028], eax
xor edx, 0xb1be874f
mov dword [ebp - 0x380], edi
mov dword [ebp - 0x37c], edi
mov dword [0x42922c], edx
mov edx, str.The_create_operation_stopped_after_reaching_a_symbolic_link.
movzx eax, byte [edx]
inc edx
test al, al
je 0x40b7db
add ecx, eax
cmp ecx, 0x183a
jbe 0x40b7b5
call fcn.0040f0d0
mov eax, dword [str.W__b]
sub eax, 0x3ed11fc
mov dword [0x42922c], eax
imul eax, dword [0x42922c], 0x10d4bd68
mov dword [str.W__b], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
xor eax, 0x35bd71a7
mov dword [str.W__b], eax
mov eax, dword [0x429028]
and eax, 0x5c408233
mov dword [0x429028], eax
mov dword [esp + 0xc], eax
mov edx, dword [0x42922c]
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], str.The_device_reported_an_unaligned_write_error.
call fcn.00413018
mov eax, dword [0x429028]
mov dword [ebp - 0x244], 0x22c
lea edx, [eax + 0x52eca039]
or eax, 0xf5ed9924
mov dword [str.W__b], eax
xor eax, eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], eax
xor eax, eax
mov dword [0x42922c], edx
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [0x416104]
call dword [eax + 0x34]
push edx
push edx
mov dword [ebp - 0x3ec], eax
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [0x416104]
call dword [eax + 0x38]
dec eax
push ecx
push ecx
jne 0x40bd27
lea edi, [ebp - 0x3bc]
mov esi, 0x4161b8
mov ecx, 5
xor eax, eax
imul ebx, dword [0x429028], 0xed6420de
rep movsd dword es:[edi], dword [esi]
mov dword [0x429028], ebx
cmp byte [eax + str.The_manager_type_is_unknown.], 0
je 0x40b8d5
inc eax
cmp eax, 0x12de
jne 0x40b8b3
call fcn.00411470
add ebx, 0x2753d144
mov dword [0x429028], ebx
mov eax, dword [0x429028]
xor ebx, ebx
mov esi, 8
xor eax, 0xabbb7eb5
mov dword [str.W__b], eax
mov edx, str.The_cluster_network_is_already_offline.
mov al, byte [edx]
test al, al
je 0x40b90c
sub eax, 0x30
cmp al, 9
jbe 0x40b909
or dword [str.W__b], 0x91f010a
jmp 0x40b90c
inc edx
jmp 0x40b8f0
xor dword [0x42922c], 0xebb7f955
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
cmp byte [eax + str.The_device_reported_an_unaligned_write_error.], 0
je 0x40b93e
inc eax
cmp eax, 0x75b
jne 0x40b91e
call fcn.00410fb0
xor dword [str.W__b], 0x64d6a18f
mov eax, dword [str.W__b]
xor eax, 0x94637f1e
sub eax, 0x330c6005
mov dword [0x429028], eax
call fcn.00413c50
mov dword [esp], str._cHRM_GreenY
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
sub esi, dword [ebp + ebx*4 - 0x3bc]
inc ebx
mov dword [ebp - 0x3f4], esi
cmp ebx, 5
jne 0x40b8eb
lea eax, [ebp - 0x244]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
mov eax, dword [0x416104]
call dword [eax + 0x3c]
push edx
push edx
mov edi, dword [ebp - 0x3f4]
cmp eax, edi
jne 0x40bd27
call dword [sym.imp.USER32.dll_AnyPopup]
mov eax, dword [str.W__b]
lea edi, [ebp - 0x3d3]
mov esi, 0x42c804
mov edx, eax
add eax, 0x445d6513
and edx, 0x825091ef
mov dword [str.W__b], eax
mov dword [0x42922c], edx
call fcn.00413c50
mov ecx, 0xb
xor eax, eax
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x376]
mov esi, 0x42c80f
mov ecx, 0x32
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + eax - 0x344], al
inc eax
cmp eax, 0x100
jne 0x40b9f5
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov edi, 0x31
xor edx, edx
mov cl, byte [ebp + ebx - 0x344]
div edi
mov byte [ebp - 0x3ed], cl
movzx eax, byte [ebp + edx - 0x376]
movzx edx, cl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x344]
mov byte [ebp + ebx - 0x344], al
mov eax, dword [0x42922c]
inc ebx
imul edx, eax, 0x54973c76
imul eax, eax, 0x77150620
mov dword [0x429028], edx
mov dword [str.W__b], eax
call fcn.0041205c
mov cl, byte [ebp - 0x3ed]
mov byte [ebp + esi - 0x344], cl
cmp ebx, 0x100
jne 0x40ba08
mov eax, dword [0x429028]
xor edi, edi
xor esi, esi
xor ebx, ebx
and eax, 0x50d809c5
mov dword [0x42922c], eax
imul eax, eax, 0x3421c5e5
mov dword [0x429028], eax
inc ebx
mov ecx, str.The_manager_type_is_unknown.
movzx ebx, bl
mov al, byte [ebp + ebx - 0x344]
lea edx, [eax + esi]
mov byte [ebp - 0x3ed], al
movzx esi, dl
mov dl, byte [ebp + esi - 0x344]
mov byte [ebp + ebx - 0x344], dl
mov byte [ebp + esi - 0x344], al
mov eax, 0x4f8
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x40bade
add eax, edx
cmp eax, 0x149e
jbe 0x40bacd
mov edx, dword [0x42922c]
and edx, 0x292c422c
mov dword [0x42922c], edx
add edx, 0x4b40020f
mov dword [str.W__b], edx
mov dword [esp], str.The_create_operation_stopped_after_reaching_a_symbolic_link.
call fcn.0040f2ac
mov eax, dword [str.W__b]
lea edx, [eax + 0xdc5d42a]
mov al, byte [ebp - 0x3ed]
add al, byte [ebp + ebx - 0x344]
movzx eax, al
mov dword [0x429028], edx
lea edx, [ebp - 0x3a6]
mov al, byte [ebp + eax - 0x344]
xor al, byte [ebp + edi - 0x3d3]
movzx eax, al
mov word [edx + edi*2], ax
inc edi
cmp edi, 0xb
jne 0x40ba97
mov word [ebp - 0x390], 0
lea eax, [ebp - 0x220]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040dfac
mov ebx, eax
test eax, eax
jne 0x40b97c
mov dword [ebp - 0x3c8], 0xe
xor esi, esi
mov dword [ebp - 0x3c4], 0x33
mov dword [ebp - 0x3c0], 0xffffffbf
mov edx, str.The_create_operation_stopped_after_reaching_a_symbolic_link.
mov ecx, 0xc21
movzx eax, byte [edx]
inc edx
test al, al
je 0x40bbbe
add ecx, eax
cmp ecx, 0x1a56
jbe 0x40bb9d
call fcn.0041205c
and dword [0x429028], 0x1314e95a
mov eax, dword [0x429028]
add eax, 0x10badad8
mov dword [str.W__b], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, str.The_manager_type_is_unknown.
imul eax, eax, 0x83f19b09
push edi
mov edi, 0xa3b
mov edx, eax
xor eax, 0x35822f24
xor edx, 0xf6badca6
mov dword [0x42922c], eax
mov dword [0x429028], edx
movsx eax, byte [ecx]
inc ecx
test al, al
je 0x40bc37
add edi, eax
cmp edi, 0x22ed
jbe 0x40bbff
call fcn.00411470
mov eax, dword [str.W__b]
and eax, 0xc40733c6
mov dword [0x429028], eax
call fcn.00410fb0
mov eax, dword [str.W__b]
lea edx, [eax - 0x6ee57bac]
jmp 0x40bc3d
imul edx, edx, 0xb7674fed
or edx, 0x619bcbd4
mov edi, ebx
mov dword [0x42922c], edx
mov dword [esp], str.LdrResFallbackLangList_Enter
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
or eax, 0x11da3e5e
push ecx
sub edi, dword [ebp + esi*4 - 0x3c8]
inc esi
mov dword [0x42922c], eax
mov ebx, edi
cmp esi, 3
jne 0x40bb93
imul eax, dword [0x429028], 0x85577d48
mov ecx, str.The_cluster_network_is_already_offline.
xor eax, 0x5feec09d
and eax, 0x72257a7a
mov dword [0x429028], eax
mov dl, byte [ecx]
test dl, dl
je 0x40bcb2
sub edx, 0x30
cmp dl, 9
jbe 0x40bcaf
imul eax, eax, 0x53090e1f
mov dword [str.W__b], eax
jmp 0x40bcb2
inc ecx
jmp 0x40bc94
imul eax, dword [str.W__b], 0xf288cf8f
mov dword [0x42922c], eax
call fcn.0040f0d0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x3dc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x390]
mov dword [esp + 8], eax
lea eax, [ebp - 0x3e0]
mov dword [esp + 4], 0x1fffff
mov dword [esp], eax
call fcn.0040108d
cmp eax, edi
jl 0x40b97c
cmp dword [ebp - 0x3e0], 0
je 0x40b97c
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
call fcn.00401065
mov eax, dword [ebp - 0x3e0]
jmp 0x40bd38
mov eax, dword [ebp - 0x3ec]
mov dword [esp], eax
call fcn.00401065
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret