Function at 0x402860
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ecx, 5
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x688]
mov esi, 0x42b6bf
push ebx
sub esp, 0x6fc
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x6bc]
mov esi, str.SaferCloseLevel
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
call fcn.004152ac
add dword [0x4290c8], 0x3db352f1
mov dword [esp], str.Illustrate.Spoon.Installer
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and eax, 0x614df551
push edx
sub eax, 0x4eb12e13
mov dword [0x4290c8], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
sub eax, 0x4dc22058
mov dword [0x4290c8], eax
call fcn.00410e1c
xor eax, eax
mov byte [ebp + eax - 0x518], al
inc eax
cmp eax, 0x100
jne 0x4028d3
xor esi, esi
xor ecx, ecx
mov edi, 0xf
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x518]
div edi
movzx eax, byte [ebp + edx - 0x6bc]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x518]
mov byte [ebp + ecx - 0x518], al
inc ecx
mov byte [ebp + esi - 0x518], bl
cmp ecx, 0x100
jne 0x4028eb
mov edi, dword [0x4290c8]
xor esi, esi
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x6ec], 0x26a
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x518]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x518]
mov byte [ebp + edx - 0x518], bl
mov ebx, str.Access_to_the_specified_handle_has_been_revoked.
mov byte [ebp + ecx - 0x518], al
add al, byte [ebp + edx - 0x518]
movzx eax, al
mov al, byte [ebp + eax - 0x518]
mov byte [ebp - 0x6f0], al
movsx eax, byte [ebx]
inc ebx
test al, al
je 0x4029a7
add dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x6ec], 0x1823
jbe 0x40297f
mov eax, edi
xor eax, 0xc7ca2106
and eax, 0xd571397d
jmp 0x4029ad
imul eax, edi, 0x5c75adcd
mov bl, byte [ebp - 0x6f0]
xor bl, byte [esi + ebp - 0x688]
imul edi, eax, 0x5bebc85
movzx ebx, bl
mov word [ebp + esi*2 - 0x5ee], bx
inc esi
cmp esi, 0x14
jne 0x402934
mov word [ebp - 0x5c6], 0
mov esi, 0x42b6d3
mov ecx, 0xd
mov dword [0x4290c8], edi
lea edi, [ebp - 0x6d6]
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x62a]
mov esi, 0x42b6e0
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov ecx, str.The_RPC_call_completed_before_all_pipes_were_processed.
mov dl, byte [ecx]
test dl, dl
je 0x402a2b
sub edx, 0x30
cmp dl, 9
jbe 0x402a28
imul eax, eax, 0x48210573
mov dword [0x4290c8], eax
jmp 0x402a2b
inc ecx
jmp 0x402a0d
mov eax, dword [0x4290c8]
xor eax, 0x52760738
and eax, 0x23e3ba06
imul eax, eax, 0x15cc017e
mov dword [0x4290c8], eax
mov dword [esp + 0xc], str.LdrpResMapFile_Exit
mov dword [esp + 8], str.Access_to_the_specified_handle_has_been_revoked.
mov dword [esp + 4], str.The_RPC_call_completed_before_all_pipes_were_processed.
mov dword [esp], str._tIME_Second
call fcn.004130d8
xor eax, eax
mov byte [ebp + eax - 0x418], al
inc eax
cmp eax, 0x100
jne 0x402a6b
xor edi, edi
xor ebx, ebx
and dword [0x4290c8], 0x2338af12
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
imul eax, dword [0x4290c8], 0x855f03f3
mov dword [0x4290c8], eax
call dword [sym.imp.USER32.dll_AnyPopup]
mov esi, dword [0x4290c8]
mov ecx, 0x1b
xor edx, edx
lea eax, [esi + 0x2a48785b]
mov dword [0x4290c8], eax
mov al, byte [ebp + ebx - 0x418]
mov byte [ebp - 0x6ec], al
mov eax, ebx
div ecx
movzx eax, byte [ebp + edx - 0x62a]
movzx edx, byte [ebp - 0x6ec]
add eax, edx
add eax, edi
movzx edi, al
mov al, byte [ebp + edi - 0x418]
mov byte [ebp + ebx - 0x418], al
mov al, byte [ebp - 0x6ec]
inc ebx
mov byte [ebp + edi - 0x418], al
cmp ebx, 0x100
jne 0x402a7e
sub esi, 0x3f61fec7
xor ebx, ebx
mov dword [0x4290c8], esi
xor esi, esi
call dword [sym.imp.USER32.dll_GetMessageTime]
xor ecx, ecx
and eax, 0xe4565e02
mov dword [ebp - 0x6ec], eax
inc ecx
mov edi, str.The_RPC_call_completed_before_all_pipes_were_processed.
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x418]
add ebx, edx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x418]
mov byte [ebp + ecx - 0x418], al
mov byte [ebp + ebx - 0x418], dl
mov al, byte [edi]
test al, al
je 0x402b73
sub eax, 0x30
cmp al, 9
jbe 0x402b70
add dword [ebp - 0x6ec], 0x76e9a915
jmp 0x402b73
inc edi
jmp 0x402b57
add dl, byte [ebp + ecx - 0x418]
mov eax, dword [ebp - 0x6ec]
movzx edx, dl
mov dl, byte [ebp + edx - 0x418]
xor dl, byte [esi + ebp - 0x6d6]
or eax, 0x566b4ad9
movzx edx, dl
lea edi, [eax + 0x5aeb61f4]
mov word [ebp + esi*2 - 0x65e], dx
inc esi
mov dword [ebp - 0x6ec], edi
cmp esi, 0xd
jne 0x402b2d
mov word [ebp - 0x644], 0
lea edi, [ebp - 0x6e1]
mov esi, 0x42b6fc
xor edx, edx
mov ecx, 0xb
sub eax, 0x3c008022
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c6]
mov esi, str.No_expand_callback_method_set._Cannot_expand_ZDB_file.
mov ecx, 0x37
rep movsb byte es:[edi], byte [esi]
or eax, 0xfdbfddb5
imul eax, eax, 0xb639db8
mov ebx, str.Access_to_the_specified_handle_has_been_revoked.
mov esi, 0x1af6
movsx ecx, byte [ebx]
inc ebx
test cl, cl
je 0x402c1e
add esi, ecx
cmp esi, 0x224b
jbe 0x402c00
add eax, 0x479ff633
and eax, 0xc83f91c1
jmp 0x402c24
imul eax, eax, 0x224358d4
mov byte [ebp + edx - 0x318], dl
inc edx
imul eax, eax, 0xab8168cc
cmp edx, 0x100
jne 0x402bf6
mov dword [0x4290c8], eax
xor esi, esi
xor ebx, ebx
xor eax, eax
cmp byte [eax + str.The_RPC_call_completed_before_all_pipes_were_processed.], 0
je 0x402c6e
inc eax
cmp eax, 0xbd1
jne 0x402c45
add dword [0x4290c8], 0x44a559f4
mov dword [esp], str.Access_to_the_specified_handle_has_been_revoked.
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, ebx
mov edi, 0x36
xor edx, edx
mov cl, byte [ebp + ebx - 0x318]
div edi
sub dword [0x4290c8], 0xd24b8e
mov al, byte [ebp + edx - 0x5c6]
add eax, ecx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x318]
mov byte [ebp + ebx - 0x318], al
inc ebx
mov byte [ebp + esi - 0x318], cl
cmp ebx, 0x100
jne 0x402c43
xor ebx, ebx
cmp word [ebx + 0x42dee0], 0
je 0x402d27
add ebx, 2
cmp ebx, 0xe76
jne 0x402cd9
or dword [0x4290c8], 0x2f4a102e
jmp 0x402d27
call fcn.00410e1c
and dword [0x4290c8], 0x32f692ce
call fcn.00410e1c
imul eax, dword [0x4290c8], 0xaf55d950
or eax, 0x9fd00529
mov dword [0x4290c8], eax
mov dword [esp + 0xc], 0x42dee0
mov dword [esp + 8], str._tIME_Second
mov dword [esp + 4], str.Access_to_the_specified_handle_has_been_revoked.
mov dword [esp], str.The_RPC_call_completed_before_all_pipes_were_processed.
call fcn.004130d8
jmp 0x402cb8
mov eax, dword [0x4290c8]
xor esi, esi
xor ebx, ebx
xor ecx, ecx
add eax, 0x43578e66
or eax, 0xb56c87df
mov edi, eax
inc ecx
and edi, 0x2c539eb6
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x318]
add ebx, edx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x318]
mov byte [ebp + ecx - 0x318], al
mov byte [ebp + ebx - 0x318], dl
add dl, byte [ebp + ecx - 0x318]
movzx edx, dl
mov dl, byte [ebp + edx - 0x318]
xor dl, byte [esi + ebp - 0x6e1]
movzx edx, dl
mov word [ebp + esi*2 - 0x674], dx
inc esi
cmp esi, 0xb
jne 0x402d3e
imul eax, edi, 0xfe178a7c
mov esi, 0x42b73e
lea edi, [ebp - 0x6ac]
xor ebx, ebx
mov word [ebp - 0x65e], 0
mov dword [0x4290c8], eax
call fcn.0041188c
mov eax, dword [0x4290c8]
add eax, 0xba2af0f
or eax, 0xcf757bcc
mov dword [0x4290c8], eax
call fcn.004116e0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x58f]
mov esi, 0x42b74e
mov ecx, 0x39
rep movsb byte es:[edi], byte [esi]
imul eax, dword [0x4290c8], 0x6719d3f8
mov dword [0x4290c8], eax
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
call fcn.00411ec8
mov byte [ebp + ebx - 0x218], bl
inc ebx
cmp ebx, 0x100
jne 0x402dea
xor esi, esi
xor ebx, ebx
mov ecx, 0x38
xor edx, edx
movzx edi, byte [ebp + ebx - 0x218]
imul eax, dword [0x4290c8], 0xd5dbdd3b
mov dword [0x4290c8], eax
mov eax, ebx
div ecx
mov eax, edi
add al, byte [ebp + edx - 0x58f]
add eax, esi
movzx esi, al
xor eax, eax
cmp byte [eax + str.Illustrate.Spoon.Installer], 0
je 0x402e6a
inc eax
cmp eax, 0x17ca
jne 0x402e4a
call fcn.00414a18
sub dword [0x4290c8], 0x354ca5b0
mov eax, dword [0x4290c8]
xor eax, 0xa983e403
add eax, 0x318a36e5
mov dword [0x4290c8], eax
mov dword [esp], eax
call fcn.0040f210
xor eax, eax
cmp byte [eax + str.The_RPC_call_completed_before_all_pipes_were_processed.], 0
je 0x402eb3
inc eax
cmp eax, 0x13cf
jne 0x402e88
add dword [0x4290c8], 0x77633b1
call dword [sym.imp.USER32.dll_GetShellWindow]
add eax, 0x59aed0a9
mov dword [0x4290c8], eax
mov eax, dword [0x4290c8]
xor eax, 0xa8aa9913
mov dword [0x4290c8], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
mov edx, dword [0x4290c8]
mov al, byte [ebp + esi - 0x218]
and edx, 0xb0e53a60
mov dword [0x4290c8], edx
mov byte [ebp + ebx - 0x218], al
xor eax, eax
cmp byte [eax + str.The_RPC_call_completed_before_all_pipes_were_processed.], 0
je 0x402f2d
inc eax
cmp eax, 0x1195
jne 0x402eee
mov dword [ebp - 0x6ec], edx
mov dword [esp + 4], str.LdrpResMapFile_Exit
mov dword [esp], str.The_RPC_call_completed_before_all_pipes_were_processed.
call fcn.0040e8e8
mov edx, dword [ebp - 0x6ec]
xor edx, 0xd57d7b3f
mov dword [0x4290c8], edx
jmp 0x402f34
cmp eax, 0xbe4
jle 0x402f39
call fcn.004116e0
mov eax, dword [0x4290c8]
inc ebx
and eax, 0xc1eede35
or eax, 0xc20034
mov dword [0x4290c8], eax
call fcn.00411ec8
mov eax, edi
mov byte [ebp + esi - 0x218], al
cmp ebx, 0x100
jne 0x402e18
mov dword [esp], str.Unable_to_open_main_database__S
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ecx, ecx
xor edx, edx
push ebx
mov eax, dword [0x4290c8]
mov dword [ebp - 0x6ec], eax
inc edx
movzx edx, dl
mov al, byte [ebp + edx - 0x218]
add ecx, eax
movzx ecx, cl
mov bl, byte [ebp + ecx - 0x218]
mov byte [ebp + edx - 0x218], bl
mov byte [ebp + ecx - 0x218], al
add al, byte [ebp + edx - 0x218]
movzx eax, al
mov al, byte [ebp + eax - 0x218]
xor al, byte [esi + ebp - 0x6ac]
movzx eax, al
mov word [ebp + esi*2 - 0x60e], ax
inc esi
cmp esi, 0x10
jne 0x402f87
mov ebx, dword [ebp - 0x6ec]
lea edi, [ebp - 0x6c9]
mov esi, 0x42b787
mov word [ebp - 0x5ee], 0
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
add ebx, 0x77f65c35
lea edi, [ebp - 0x556]
mov esi, 0x42b794
and ebx, 0x1fa81868
mov ecx, 0x3e
rep movsb byte es:[edi], byte [esi]
mov dword [0x4290c8], ebx
call fcn.0041188c
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x403021
xor esi, esi
xor ecx, ecx
mov edi, 0x3d
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x556]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x403039
xor ecx, ecx
xor edx, edx
xor ebx, ebx
mov esi, str.The_RPC_call_completed_before_all_pipes_were_processed.
mov al, byte [esi]
test al, al
je 0x4030a2
sub eax, 0x30
cmp al, 9
jbe 0x40309f
imul eax, dword [0x4290c8], 0xc096f147
mov dword [0x4290c8], eax
jmp 0x4030a2
inc esi
jmp 0x403081
mov eax, dword [0x4290c8]
mov dword [ebp - 0x6f0], ecx
inc ebx
lea edi, [ebp - 0x644]
mov dword [ebp - 0x6ec], edx
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
movzx ebx, bl
and eax, 0xe5b1cb1c
sub eax, 0x316b597d
mov dword [0x4290c8], eax
mov dword [esp], eax
call esi
push ecx
mov eax, dword [0x4290c8]
or eax, 0xe898689e
mov dword [0x4290c8], eax
mov dword [esp], eax
call fcn.0040f210
mov al, byte [ebp + ebx - 0x118]
mov edx, dword [ebp - 0x6ec]
add dword [0x4290c8], 0x155c0fe1
add edx, eax
movzx edx, dl
mov cl, byte [ebp + edx - 0x118]
mov byte [ebp + ebx - 0x118], cl
mov ecx, dword [ebp - 0x6f0]
mov byte [ebp + edx - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebp + ecx - 0x6c9]
movzx eax, al
mov word [edi + ecx*2], ax
inc ecx
cmp ecx, 0xd
jne 0x40307c
mov word [ebp - 0x62a], 0
xor eax, eax
cmp byte [eax + str.Access_to_the_specified_handle_has_been_revoked.], 0
je 0x40317a
inc eax
cmp eax, 0x84b
jne 0x40315a
call fcn.004102f0
and dword [0x4290c8], 0xc0c076b0
mov eax, dword [0x4290c8]
xor ebx, ebx
and eax, 0x1c0bbdab
add eax, 0x2d126b05
mov dword [0x4290c8], eax
call fcn.004102f0
mov dword [esp], str.AslRegistryOpenKey_failed___x_
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
lea eax, [ebp - 0x5ee]
mov dword [ebp - 0x69c], eax
lea eax, [ebp - 0x65e]
mov dword [ebp - 0x698], eax
lea eax, [ebp - 0x674]
mov dword [ebp - 0x694], eax
lea eax, [ebp - 0x60e]
mov dword [ebp - 0x690], eax
mov eax, dword [0x4290c8]
mov dword [ebp - 0x68c], edi
or eax, 0x6db6ffe6
imul eax, eax, 0xe8e9ea92
mov dword [0x4290c8], eax
call fcn.0041188c
imul eax, dword [0x4290c8], 0xb1988f81
sub eax, 0x4702f0c8
mov dword [0x4290c8], eax
mov dword [esp], eax
call esi
push edx
mov eax, dword [ebp + ebx*4 - 0x69c]
mov dword [esp], eax
call fcn.004010e8
test eax, eax
jne 0x403228
inc ebx
cmp ebx, 5
jne 0x40320d
jmp 0x40322d
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret