Function at 0x41955b
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov dword [ebp - 0x54], ecx
lea edi, [ebp - 0x74]
push 5
pop ecx
mov esi, str.NtUpdateWnfStateData
mov dword [ebp - 0x50], edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], 0xb9f79c3b
mov dword [ebp - 0x14], 0x598dec17
mov dword [ebp - 0x10], 0x16e9fc3f
movsb byte es:[edi], byte [esi]
xor esi, esi
mov dword [ebp - 0xc], 0x81ee9033
mov dword [ebp - 8], 0x5cbf2249
xor eax, eax
mov dword [ebp - 4], 0xf24251c1
mov byte [ebp + eax - 0x188], al
inc eax
cmp eax, 0x100
jb 0x4195a9
push 0x14
xor ebx, ebx
pop edi
xor edx, edx
mov cl, byte [ebp + ebx - 0x188]
mov eax, ebx
mov byte [ebp - 0x2d], cl
div edi
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x74]
add eax, esi
add ecx, eax
movzx eax, cl
mov dword [ebp - 0x34], eax
call fcn.004148e3
mov esi, str.no_protocol_option
lea edi, [ebp - 0x88]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x88], 0x74
jne 0x41962b
mov al, 0x74
xor esi, esi
test al, al
je 0x41962b
cmp byte [ebp + esi - 0x88], 0
je 0x41962b
mov ecx, str.text_file_busy
call fcn.00414ab4
mov al, byte [esi + 0x430905]
inc esi
cmp al, byte [ebp + esi - 0x88]
je 0x419603
mov esi, dword [ebp - 0x34]
push 0x14
pop edi
mov al, byte [ebp + esi - 0x188]
mov byte [ebp + ebx - 0x188], al
inc ebx
mov al, byte [ebp - 0x2d]
mov byte [ebp + esi - 0x188], al
cmp ebx, 0x100
jb 0x4195bd
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x188]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x188]
mov byte [ebp + edi - 0x188], al
mov byte [ebp + ebx - 0x188], cl
movzx eax, byte [ebp + edi - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1a4], al
inc esi
cmp esi, 0x18
jb 0x41965c
push 9
pop eax
push 5
pop ecx
mov esi, str.NtUpdateWnfStateData
mov byte [ebp - 0x2c], al
lea edi, [ebp - 0x74]
mov byte [ebp - 0x18c], 0
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2b], 0x1fd8a3b1
mov dword [ebp - 0x27], 0x2298fef
mov dword [ebp - 0x23], 0x2676cc8b
movsb byte es:[edi], byte [esi]
xor edi, edi
mov dword [ebp - 0x1f], 0x62aae0a5
mov dword [ebp - 0x1b], 0xf800a02b
xor eax, eax
mov dword [ebp - 0x17], 0x3ee44a7b
mov dword [ebp - 0x13], 0x6122705a
mov dword [ebp - 0xf], 0xe9cd3f9f
mov dword [ebp - 0xb], 0xf1c1d427
mov dword [ebp - 7], 0x33fdd701
mov word [ebp - 3], 0x5fa8
mov byte [ebp - 1], 0xd6
mov byte [ebp + eax - 0x188], al
inc eax
cmp eax, 0x100
jb 0x41971b
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x188]
push 0x14
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x74]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x188]
mov byte [ebp + esi - 0x188], al
inc esi
mov byte [ebp + edi - 0x188], bl
cmp esi, 0x100
jb 0x41972c
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x188]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x188]
mov byte [ebp + edi - 0x188], al
mov byte [ebp + ebx - 0x188], cl
movzx eax, byte [ebp + edi - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + esi - 0x2c]
mov byte [ebp + esi - 0x228], al
inc esi
cmp esi, 0x2c
jb 0x41976f
mov esi, str.imageName
mov byte [ebp - 0x1fc], 0
lea edi, [ebp - 0x80]
mov dword [ebp - 0x18], 0x28e0667c
mov dword [ebp - 0x14], 0x3c721aa3
mov dword [ebp - 0x10], 0x1c5cb078
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], 0x87242e8b
mov dword [ebp - 8], 0xfdc4efa1
mov dword [ebp - 4], 0xabea7b45
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x188], al
inc eax
cmp eax, 0x100
jb 0x419800
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x188]
push 9
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x80]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x188]
mov byte [ebp + esi - 0x188], al
inc esi
mov byte [ebp + edi - 0x188], bl
cmp esi, 0x100
jb 0x419811
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x188]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x188]
mov byte [ebp + edi - 0x188], al
mov byte [ebp + ebx - 0x188], cl
movzx eax, byte [ebp + edi - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1c0], al
inc esi
cmp esi, 0x18
jb 0x419854
push 5
pop ecx
mov esi, str.SrchGatherDestruction
mov byte [ebp - 0x1a8], 0
lea edi, [ebp - 0x74]
mov dword [ebp - 0x18], 0x328a3a1f
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xf896ec4b
mov dword [ebp - 0x10], 0xd7aa4676
mov dword [ebp - 0xc], 0xb8a3cda2
movsw word es:[edi], word [esi]
xor edi, edi
mov dword [ebp - 8], 0x9c74c460
mov dword [ebp - 4], 0xe89ac8d
xor eax, eax
mov byte [ebp + eax - 0x188], al
inc eax
cmp eax, 0x100
jb 0x4198e8
xor esi, esi
xor edx, edx
mov bl, byte [ebp + esi - 0x188]
push 0x15
mov eax, esi
pop ecx
div ecx
movzx ecx, bl
movzx eax, byte [ebp + edx - 0x74]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x188]
mov byte [ebp + esi - 0x188], al
inc esi
mov byte [ebp + edi - 0x188], bl
cmp esi, 0x100
jb 0x4198f9
mov esi, dword [0x43576c]
xor ebx, ebx
and dword [ebp - 0x34], 0
and esi, 0x59f88847
mov dword [ebp - 0x38], esi
xor edi, edi
mov esi, dword [ebp - 0x34]
lea eax, [ebx + 1]
movzx ebx, al
mov cl, byte [ebp + ebx - 0x188]
movzx edx, cl
lea eax, [edx + esi]
movzx esi, al
mov al, byte [ebp + esi - 0x188]
mov byte [ebp + ebx - 0x188], al
mov byte [ebp + esi - 0x188], cl
movzx eax, byte [ebp + ebx - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + edi - 0x18]
mov byte [ebp + edi - 0x1dc], al
inc edi
cmp edi, 0x18
jb 0x419950
mov esi, dword [ebp - 0x38]
lea edi, [ebp - 0x80]
or esi, 0xa1a6566f
mov byte [ebp - 0x1c4], 0
mov dword [0x43576c], esi
mov ebx, 0x100
mov esi, 0x42c100
mov dword [ebp - 0x18], 0xee9fc9f6
mov dword [ebp - 0x14], 0xed9811da
mov dword [ebp - 0x10], 0xe081e144
mov dword [ebp - 0xc], 0x62681ae
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x9a552634
mov dword [ebp - 4], 0x28caff8f
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor edi, edi
xor eax, eax
mov byte [ebp + eax - 0x188], al
inc eax
cmp eax, ebx
jb 0x4199f4
xor esi, esi
mov dl, byte [ebp + esi - 0x188]
mov eax, esi
and eax, 7
movzx ecx, dl
movzx eax, byte [ebp + eax - 0x80]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x188]
mov byte [ebp + esi - 0x188], al
inc esi
mov byte [ebp + edi - 0x188], dl
cmp esi, ebx
jb 0x419a02
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x188]
movzx edx, cl
lea eax, [ebx + edx]
movzx ebx, al
mov al, byte [ebp + ebx - 0x188]
mov byte [ebp + edi - 0x188], al
mov byte [ebp + ebx - 0x188], cl
movzx eax, byte [ebp + edi - 0x188]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x188]
xor al, byte [ebp + esi - 0x18]
mov byte [ebp + esi - 0x1f8], al
inc esi
cmp esi, 0x18
jb 0x419a3d
mov ecx, 0xf000
mov byte [ebp - 0x1e0], 0
call fcn.0040a2a8
mov edi, eax
mov ecx, 0x7800
mov dword [ebp - 0x5c], edi
call fcn.0040a2a8
mov esi, eax
mov ecx, 0x208
mov dword [ebp - 0x58], esi
call fcn.0040a2a8
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x4c], eax
call fcn.0040b5df
mov ebx, eax
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x34], ebx
call fcn.0040b628
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x40], eax
call fcn.0040b628
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x44], eax
call fcn.0040b628
push dword [ebp - 0x44]
lea edx, [ebp - 0x1f8]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x40]
push dword [ebp - 0x4c]
push 2
pop ecx
call fcn.0040a2e6
call eax
mov ecx, dword [ebp - 0x50]
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x38], eax
cmp dword [ecx], eax
jbe 0x419bdb
mov ebx, dword [0x43572c]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + eax*4]
mov ecx, esi
call fcn.0040ba5f
push 5
pop ecx
mov esi, str.address_not_available
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0x3c], eax
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x74], 0x53
jne 0x419b7d
mov cl, 0x53
test cl, cl
je 0x419b77
cmp byte [ebp + eax - 0x74], 0
je 0x419b77
call fcn.00414797
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov cl, byte [eax + 0x430b6c]
cmp cl, byte [ebp + eax - 0x74]
je 0x419b54
mov ebx, dword [0x43572c]
push ebx
mov edx, 0x42dd30
call fcn.00414ef8
pop ecx
mov ecx, dword [ebp - 0x3c]
movzx eax, byte [ebp + ecx - 0x74]
movzx ecx, byte [ecx + 0x430b6c]
sub ecx, eax
cmp ecx, 0x340
jbe 0x419baa
and ebx, 0x42ea1c96
jmp 0x419bb0
add ebx, 0x6e28b652
mov esi, dword [ebp - 0x58]
mov ecx, esi
mov edx, dword [ebp - 0x34]
mov dword [0x43572c], ebx
call fcn.0040ba5f
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, dword [ecx]
jb 0x419b2b
mov ebx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x5c]
mov ecx, esi
call fcn.0040b8e6
push eax
mov edx, esi
mov ecx, edi
call fcn.0040b6cf
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
push edi
call fcn.004154d5
mov ecx, ebx
call fcn.0040b8e6
push eax
push 0
push ebx
call fcn.0040b587
mov ecx, dword [ebp - 0x40]
call fcn.0040b8f4
push eax
push 0
push ecx
call fcn.0040b587
mov ecx, dword [ebp - 0x44]
call fcn.0040b8f4
push eax
push 0
push ecx
call fcn.0040b587
mov ecx, dword [ebp - 0x48]
call fcn.0040b8f4
push eax
push 0
push ecx
call fcn.0040b587
mov ecx, ebx
call fcn.0040a2d2
mov ecx, dword [ebp - 0x40]
call fcn.0040a2d2
mov ecx, dword [ebp - 0x44]
call fcn.0040a2d2
mov ecx, dword [ebp - 0x48]
call fcn.0040a2d2
imul eax, dword [0x43576c], 0x7d0a3d34
xor ebx, ebx
push 0xf000
push ebx
push edi
mov dword [0x43572c], eax
call fcn.0040b587
add esp, 0x44
push 0x7800
push ebx
push esi
call fcn.0040b587
push 0x208
push ebx
mov ebx, dword [ebp - 0x4c]
push ebx
call fcn.0040b587
add esp, 0x18
mov ecx, edi
call fcn.0040a2d2
mov ecx, esi
call fcn.0040a2d2
mov ecx, ebx
call fcn.0040a2d2
pop edi
pop esi
pop ebx
leave
ret