Function at 0x4487a2
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push esi
push edi
mov esi, 0x403858
mov dword [ebp - 0x54], edx
lea edi, [ebp - 0x38]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x1c], 0x7cf750c7
mov dword [ebp - 0x18], 0xf603ab64
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 0xba350809
mov dword [ebp - 0x10], 0x3ebe698c
mov dword [ebp - 0xc], 0xca254178
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], 0x465bf24
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx esi, ax
xor esi, 0xaf983441
xor eax, eax
mov dword [ebp - 0x24], esi
mov edi, eax
mov ecx, eax
mov byte [ebp + ecx - 0x1b4], cl
inc ecx
cmp ecx, 0x100
jb 0x448804
mov esi, eax
xor edx, edx
mov dword [ebp - 0x20], 0x12
mov eax, esi
mov cl, byte [ebp + esi - 0x1b4]
div dword [ebp - 0x20]
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ebp + edx - 0x38]
add eax, edi
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x1b4]
mov byte [ebp + esi - 0x1b4], al
inc esi
mov al, byte [ebp - 1]
mov byte [ebp + edi - 0x1b4], al
cmp esi, 0x100
jb 0x448816
xor eax, eax
mov dword [ebp - 0x20], eax
mov edi, eax
mov esi, eax
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp + edi - 0x1b4]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x20], eax
mov al, byte [ebp + eax - 0x1b4]
mov byte [ebp + edi - 0x1b4], al
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x1b4], cl
movzx eax, byte [ebp + edi - 0x1b4]
mov ecx, dword [ebp - 0x24]
add eax, edx
movzx eax, al
xor ecx, 0x3a9d2b4c
mov dword [ebp - 0x24], ecx
mov al, byte [ebp + eax - 0x1b4]
xor al, byte [ebp + esi - 0x1c]
mov byte [ebp + esi - 0x98], al
inc esi
cmp esi, 0x18
jb 0x448867
xor eax, eax
mov dword [ebp - 0xc], 0x52
push 0x34
mov byte [ebp - 0x80], al
mov edx, eax
pop esi
mov dword [ebp - 8], 0xffffff7a
add esi, dword [ebp + edx*4 - 0xc]
inc edx
cmp edx, 2
jl 0x4488e3
mov dword [ebp - 0x48], esi
xor ecx, 0x17a15818
mov esi, eax
mov dword [ebp - 0x10], 0x62
mov dword [ebp - 0xc], 0x25
mov edx, eax
mov dword [ebp - 8], 0xffffff79
sub esi, dword [ebp + edx*4 - 0x10]
inc edx
cmp edx, 3
jl 0x44890f
mov dword [ebp - 0x14], 0x50
xorps xmm2, xmm2
mov dword [ebp - 0x10], 0x4f
mov edi, 0x1a24
mov dword [ebp - 0xc], 0x23
mov dword [ebp - 8], 0x30d
movups xmm1, xmmword [ebp - 0x14]
mov dword [ebp - 0x4c], esi
mov esi, str.syr_SY
movaps xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd edx, xmm1
add edx, 0x31
and ecx, 0xea6fd57f
mov dword [ebp - 0x44], edx
movzx edx, byte [str.syr_SY]
mov dword [0x44eec0], ecx
jmp 0x44898e
add edi, edx
inc esi
cmp edi, 0x1c33
ja 0x448994
movzx edx, byte [esi]
test edx, edx
jne 0x448980
jmp 0x4489ae
push ecx
mov edx, ecx
call fcn.0044251f
pop ecx
mov ecx, dword [0x44eec0]
xorps xmm2, xmm2
sub ecx, 0x4f23c1f1
xor eax, eax
and ecx, 0x460350
mov dword [ebp - 0x10], 0x32
mov dword [ebp - 0xc], 0x4c
mov edx, eax
mov dword [ebp - 8], 0x1ada
mov esi, 0x1f40
sub esi, dword [ebp + edx*4 - 0x10]
inc edx
cmp edx, 3
jl 0x4489d0
mov dword [ebp - 0x50], esi
lea edi, [ebp - 0x10]
mov esi, 0x401e2c
mov dword [ebp - 0x3c], 0x9d6b00f6
mov dword [ebp - 0x38], 0xc0ce867c
or ecx, 0x66d51f52
mov dword [ebp - 0x34], 0x2683561
mov edx, eax
mov dword [ebp - 0x30], 0x4645a475
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2c], 0x99fd75ab
mov dword [ebp - 0x28], 0x228a03ae
mov dword [ebp - 0x20], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [ebp + edx - 0x1b4], dl
inc edx
cmp edx, 0x100
jb 0x448a1d
and ecx, 0x606c3989
mov dword [ebp - 0x40], 0xb
mov edi, eax
mov dword [ebp - 0x24], ecx
mov esi, ecx
xor edx, edx
mov cl, byte [ebp + edi - 0x1b4]
mov eax, edi
mov byte [ebp - 1], cl
div dword [ebp - 0x40]
movzx ecx, cl
or esi, 0x8d4446f1
movzx eax, byte [ebp + edx - 0x10]
add eax, dword [ebp - 0x20]
add ecx, eax
movzx ecx, cl
mov dword [ebp - 0x20], ecx
mov al, byte [ebp + ecx - 0x1b4]
mov byte [ebp + edi - 0x1b4], al
inc edi
mov al, byte [ebp - 1]
mov byte [ebp + ecx - 0x1b4], al
cmp edi, 0x100
jb 0x448a41
xor eax, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov esi, eax
mov edi, eax
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 0x20]
mov cl, byte [ebp + esi - 0x1b4]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 0x20], eax
mov al, byte [ebp + eax - 0x1b4]
mov byte [ebp + esi - 0x1b4], al
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x1b4], cl
movzx eax, byte [ebp + esi - 0x1b4]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1b4]
xor al, byte [ebp + edi - 0x3c]
mov byte [ebp + edi - 0xb4], al
inc edi
cmp edi, 0x18
jb 0x448a98
mov esi, dword [ebp - 0x24]
movaps xmm1, xmm2
mov dword [ebp - 0x10], 0x27
xor eax, eax
mov dword [ebp - 0xc], 0x1a
mov ecx, eax
mov dword [ebp - 8], 0xffffff6c
mov dword [ebp - 0x14], 0x53
movups xmm0, xmmword [ebp - 0x14]
mov byte [ebp - 0x9c], al
mov dword [ebp - 0x10], 0x58
psubd xmm1, xmm0
mov dword [ebp - 0xc], 0x44
movaps xmm0, xmm1
mov dword [ebp - 8], 0xffffff64
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd dword [ebp - 0x40], xmm1
sub ecx, dword [ebp + eax*4 - 0x10]
inc eax
cmp eax, 3
jl 0x448b56
mov al, byte [str.ff_Latn_NG]
push 0xd
mov dword [ebp - 0x20], ecx
mov ecx, str.ff_Latn_NG
pop edi
jmp 0x448b7b
sub al, 0x30
cmp al, 9
ja 0x448b81
inc ecx
mov al, byte [ecx]
test al, al
jne 0x448b72
jmp 0x448b87
imul esi, esi, 0xc1fa538b
imul edx, esi, 0x3cf4de4a
mov ecx, 0x40386c
mov dword [0x44eec0], edx
call fcn.0044260d
xor eax, eax
mov dword [ebp - 0x10], 0x3c
mov dword [ebp - 0xc], 0xf
mov ecx, eax
mov dword [ebp - 8], 0xffffffa8
add edi, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, 3
jl 0x448bb6
push 0x45
mov dword [ebp - 0x60], edi
mov ecx, eax
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0x3b7
pop edx
add edx, dword [ebp + ecx*4 - 0xc]
inc ecx
cmp ecx, 2
jl 0x448bd6
push 0xb
pop ecx
mov dword [ebp - 0x14], ecx
movaps xmm1, xmm2
mov dword [ebp - 0x10], 0x43
mov dword [ebp - 0xc], 0x49
mov dword [ebp - 8], 0x1169
movups xmm0, xmmword [ebp - 0x14]
push 0x4c
mov dword [ebp - 0x5c], edx
psubd xmm1, xmm0
mov dword [ebp - 0x10], 0x39
movaps xmm0, xmm1
mov dword [ebp - 0xc], 0x2c
psrldq xmm0, 8
paddd xmm1, xmm0
mov dword [ebp - 8], 0xffffff4f
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
pop edx
push 3
add ecx, 0x1400
mov dword [ebp - 0x24], ecx
mov ecx, eax
pop esi
add edx, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, esi
jl 0x448c4b
mov dword [ebp - 0x6c], edx
mov ecx, eax
mov edx, 0x3c00
mov dword [ebp - 0x10], 0x31
mov dword [ebp - 0xc], 0x63
mov dword [ebp - 8], 0x376c
sub edx, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, esi
jl 0x448c73
push 0x1f
mov dword [ebp - 0x68], edx
mov ecx, eax
pop edx
mov dword [ebp - 0x10], 0x5d
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 8], 0x174
add edx, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, esi
jl 0x448c99
mov dword [ebp - 0x64], edx
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x10], 0x18
mov dword [ebp - 0xc], 0x26
mov dword [ebp - 8], 0xffffffc2
sub edx, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, esi
jl 0x448cbe
mov dword [ebp - 0xc], 0x1e
movaps xmm1, xmm2
mov dword [ebp - 8], 0x2ff
mov dword [ebp - 0x14], 0x33
mov dword [ebp - 0x10], 0x54
movups xmm0, xmmword [ebp - 0x14]
push 0x46
mov dword [ebp - 0x78], edx
paddd xmm1, xmm0
mov dword [ebp - 0xc], 0x41
movaps xmm0, xmm1
mov dword [ebp - 8], 0x179
psrldq xmm0, 8
paddd xmm1, xmm0
movups xmm0, xmm1
psrldq xmm0, 4
paddd xmm1, xmm0
movd ecx, xmm1
pop edx
add ecx, 0x5c
mov dword [ebp - 0x74], ecx
mov ecx, eax
add edx, dword [ebp + ecx*4 - 0xc]
inc ecx
cmp ecx, 2
jl 0x448d26
mov dword [ebp - 0x70], edx
mov ecx, eax
mov dword [ebp - 0x10], 0x3f
mov dword [ebp - 0xc], 0x5e
mov dword [ebp - 8], 0xffffff63
sub eax, dword [ebp + ecx*4 - 0x10]
inc ecx
cmp ecx, 3
jl 0x448d4a
mov dword [ebp - 0x34], 0x20
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0x56
mov dword [ebp - 0x2c], 0x57
mov dword [ebp - 0x28], 0x30e
movups xmm0, xmmword [ebp - 0x34]
mov dword [ebp - 8], eax
paddd xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
movd eax, xmm2
add eax, 0x25
mov dword [ebp - 0x7c], eax
call fcn.0043617c
mov ecx, dword [ebp - 0x48]
mov esi, eax
mov edx, esi
call fcn.0043709c
mov ecx, esi
mov edi, eax
call fcn.004369c6
push eax
push dword [ebp - 0x4c]
push esi
call fcn.004360de
mov ecx, esi
call fcn.0041e600
mov eax, dword [ebp - 0x44]
lea ecx, [eax + eax]
call fcn.0041e51b
imul ecx, dword [0x44eec0], 0x6410b14b
mov dword [ebp - 0x44], eax
mov dword [0x44eec0], ecx
mov ecx, edi
call fcn.0043715b
xor edx, edx
mov ecx, dword [ebp + 0xc]
div dword [ebp - 0x50]
mov dword [ecx], eax
lea ecx, [ebp - 0xb4]
call fcn.0043617c
mov esi, eax
mov ecx, esi
call fcn.004369c6
mov edi, dword [ebp - 0x44]
push eax
push esi
push edi
call fcn.00436044
mov ecx, esi
call fcn.004369c6
push eax
push dword [ebp - 0x40]
push esi
call fcn.004360de
mov ecx, esi
call fcn.0041e600
mov ecx, edi
call fcn.004369c6
mov edx, dword [ebp + 0x18]
push eax
call fcn.0041c49c
push dword [ebp + 0x18]
mov edx, dword [ebp - 0x54]
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x58]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push edi
push dword [ebp + 8]
call fcn.0043cbb5
mov eax, dword [ebp - 0x24]
add esp, 0x40
imul eax, dword [ebp - 0x5c]
add dword [0x44eec0], 0x56f07965
add eax, eax
push eax
push dword [ebp - 0x60]
push dword [ebp + 0x10]
call fcn.004360de
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x68]
add eax, eax
push eax
push dword [ebp - 0x6c]
push dword [ebp + 0x14]
call fcn.004360de
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x74]
add eax, eax
push eax
push dword [ebp - 0x78]
push dword [ebp + 0x18]
call fcn.004360de
mov eax, dword [ebp - 0x7c]
add eax, eax
push eax
mov eax, dword [ebp - 8]
push eax
push edi
call fcn.004360de
add esp, 0x30
mov ecx, edi
call fcn.0041e600
pop edi
pop esi
leave
ret