Function at 0x406030
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x23c
mov dword [ebp - 0x204], 0x57
mov dword [ebp - 0x200], 0x3e
mov dword [ebp - 0x1fc], 0xffffff6b
mov eax, dword [0x429448]
and eax, 0x7f946702
mov dword [0x429380], eax
or eax, 0x9c7d767a
mov dword [0x429448], eax
xor eax, 0xe0f2a24b
mov dword [0x429278], eax
call fcn.00412d68
sub esi, dword [ebp + ebx*4 - 0x204]
inc ebx
mov dword [ebp - 0x220], esi
cmp ebx, 3
jne 0x40605e
lea edi, [ebp - 0x198]
mov esi, 0x42b878
mov ecx, 0x10
mov eax, dword [0x429278]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1b4]
mov esi, str.The_parameter_is_incorrect.
mov ecx, 7
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov dword [esp + 4], str.STATUS_WAIT_1
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.0040eabc
mov eax, dword [0x429448]
or eax, 0x20d92c39
sub eax, 0xc8cb6d8
mov dword [0x429278], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x4060f8
xor esi, esi
xor ecx, ecx
mov edi, 0x1b
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x1b4]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov al, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], al
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x406110
mov eax, dword [0x429380]
xor esi, esi
xor ebx, ebx
sub eax, 0x63997695
mov dword [0x429448], eax
mov dword [esp], str.AslEnvGetSystem32DirPathBuf_failed___x_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
xor edi, edi
mov eax, dword [0x429278]
inc ebx
movzx ebx, bl
or eax, 0x8f3a2d63
mov dword [0x429448], eax
call fcn.004142b8
mov al, byte [ebp + ebx - 0x118]
cmp byte [str.STATUS_WAIT_1], 0
lea edx, [eax + esi]
movzx esi, dl
je 0x4061b0
mov ecx, dword [0x429448]
lea edx, [ecx - 0x7f82901d]
mov dword [0x429278], edx
mov dl, byte [ebp + esi - 0x118]
mov ecx, dword [0x429278]
mov byte [ebp + ebx - 0x118], dl
imul edx, ecx, 0xd7d0c2e6
mov byte [ebp + esi - 0x118], al
add al, byte [ebp + ebx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
mov byte [ebp - 0x21c], al
imul eax, ecx, 0x62e41642
mov dword [0x429448], eax
lea eax, [edx - 0x7d6cddfe]
sub edx, 0x2b85500e
mov dword [0x429380], eax
mov dword [0x429278], edx
call fcn.004107f8
mov al, byte [ebp - 0x21c]
xor al, byte [ebp + edi - 0x198]
mov byte [ebp + edi - 0x158], al
inc edi
cmp edi, 0x40
jne 0x406170
mov byte [ebp - 0x118], 0
mov edx, str.STATUS_DEVICE_NOT_CONNECTED
mov ecx, 0x123e
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x406253
add ecx, eax
cmp ecx, 0x1c0e
jbe 0x40623e
mov eax, dword [0x429380]
lea edi, [ebp - 0x1f8]
mov esi, 0x41606c
xor ebx, ebx
mov edx, eax
add eax, 0x4bf057f1
and eax, 0xd4e48265
and edx, 0x55d7f881
mov dword [0x429380], eax
imul eax, eax, 0x151f2af0
mov dword [0x429278], edx
mov dword [0x429448], eax
mov dword [esp + 0xc], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp + 8], str.STATUS_WAIT_1
mov dword [esp + 4], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410bcc
mov eax, dword [0x429448]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov esi, 0x1b
and eax, 0xb1efe326
mov dword [0x429278], eax
mov eax, dword [0x429278]
or eax, 0xaf384dbd
mov dword [0x429380], eax
mov eax, dword [0x429448]
sub eax, 0x12872337
mov dword [0x429278], eax
call fcn.0040ef74
cmp byte [str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed], 0
je 0x406307
mov eax, dword [0x429448]
add eax, 0x4635ab02
mov dword [0x429278], eax
mov eax, dword [0x429380]
add esi, dword [ebp + ebx*4 - 0x1f8]
inc ebx
mov dword [ebp - 0x21c], esi
and eax, 0x87a3d22b
mov dword [0x429448], eax
cmp ebx, 4
jne 0x4062cc
mov bl, byte [ebp - 0x220]
mov dword [esp], 0x104
call fcn.0040c7e4
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x158]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call fcn.0040e000
mov eax, dword [0x429278]
sub eax, 0x21ee51ad
mov dword [0x429448], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x234], eax
mov edi, dword [ebp - 0x224]
cmp dword [ebp - 0x234], edi
je 0x406aee
mov eax, dword [0x429278]
mov ecx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov edx, 0x17c7
sub eax, 0x8ce6d10
mov dword [0x429448], eax
movzx eax, byte [ecx]
inc ecx
test al, al
je 0x4063cd
add edx, eax
cmp edx, 0x1429
jbe 0x4063a5
call fcn.0040ef74
mov eax, dword [0x429278]
and eax, 0xa6f6d86a
mov dword [0x429380], eax
jmp 0x4063df
mov eax, dword [0x429380]
xor eax, 0x2380f5cd
cmp edx, 0x1429
jbe 0x4063f5
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410578
mov eax, dword [0x429278]
sub eax, 0x381b5f42
mov edx, dword [0x429448]
imul eax, eax, 0xdd7e8747
mov ecx, edx
and edx, 0x6ce2ee97
or ecx, 0xa7ba87ff
or edx, 0x24a28697
mov dword [0x429380], eax
mov dword [0x429448], ecx
mov dword [0x429278], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
and eax, 0x8ebdc656
mov dword [0x429448], eax
xor eax, eax
cmp eax, 0x40
je 0x406457
mov esi, dword [ebp - 0x224]
mov edi, dword [ebp - 0x228]
lea edx, [eax + 1]
mov cl, byte [esi]
cmp byte [edi + eax], cl
je 0x406459
mov eax, edx
jmp 0x406438
mov al, 0x40
movzx ecx, bl
lea edx, [ebx + 1]
mov byte [ebp + ecx - 0x210], al
cmp bl, 3
jne 0x406ae1
mov edx, dword [0x429278]
mov ecx, str.STATUS_WAIT_1
mov eax, edx
and eax, 0x509b0d93
mov dword [0x429380], eax
mov al, byte [ecx]
test al, al
je 0x4064a4
sub eax, 0x30
cmp al, 9
jbe 0x4064a1
and edx, 0x90580
mov dword [0x429380], edx
jmp 0x4064a4
inc ecx
jmp 0x406486
imul eax, dword [0x429380], 0xaa800172
mov dword [0x429448], eax
mov dword [esp + 0xc], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov dword [esp + 4], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410bcc
cmp byte [str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed], 0
je 0x406515
mov dword [esp + 0xc], str.STATUS_WAIT_1
mov eax, dword [0x429278]
mov dword [esp + 8], eax
mov eax, dword [0x429380]
mov dword [esp], str.The_allocation_being_referenced_has_been_closed_permanently.
mov dword [esp + 4], eax
call fcn.0040f78c
mov eax, dword [0x429448]
or eax, 0xf8cf8a3d
mov dword [0x429380], eax
mov eax, dword [0x429380]
xor eax, 0xd6cb5d4e
imul edx, eax, 0x1969e59
mov dword [0x429278], eax
mov dword [0x429380], edx
mov dword [esp + 0xc], str.STATUS_WAIT_1
mov dword [esp + 8], eax
mov eax, dword [0x429448]
mov dword [esp], str.STATUS_WAIT_1
mov dword [esp + 4], eax
call fcn.0040f78c
mov eax, dword [0x429380]
sub eax, 0x2a7990a4
mov dword [0x429278], eax
mov eax, dword [0x429448]
mov dword [esp + 8], str.The_allocation_being_referenced_has_been_closed_permanently.
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.STATUS_WAIT_1
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.0040eabc
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [esp], 0x3bf
call dword [sym.imp.USER32.dll_IsZoomed]
sub eax, 0x2db9243c
push esi
mov dword [0x429380], eax
xor eax, eax
cmp byte [eax + str.The_allocation_being_referenced_has_been_closed_permanently.], 0
je 0x4065d1
inc eax
cmp eax, 0x22fb
jne 0x4065a5
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410578
mov eax, dword [0x429380]
and eax, 0x238e62
mov dword [0x429448], eax
imul eax, dword [0x429448], 0x330ac8a4
xor edi, edi
mov esi, 0x47
mov dword [0x429278], eax
mov dword [esp], 0x493
call dword [sym.imp.USER32.dll_IsZoomed]
push ebx
mov eax, dword [0x429278]
mov dword [ebp - 0x20c], 0x43
mov dword [ebp - 0x208], 0xffffff78
or eax, 0xc501155f
mov dword [0x429380], eax
mov ebx, dword [0x429380]
mov edx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov ecx, 0x5ff
mov eax, ebx
xor eax, 0xd59b33da
mov dword [0x429448], eax
movzx eax, byte [edx]
inc edx
test al, al
je 0x406675
add ecx, eax
cmp ecx, 0xd60
jbe 0x406634
imul eax, dword [0x429278], 0x1c6ac7be
mov dword [0x429278], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov dword [esp + 4], str.The_allocation_being_referenced_has_been_closed_permanently.
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00414978
mov eax, dword [0x429448]
sub eax, 0x30d94b0b
xor eax, 0xf8ac7c07
mov dword [0x429278], eax
mov dword [esp + 0xc], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp + 8], str.The_allocation_being_referenced_has_been_closed_permanently.
mov dword [esp + 4], str.STATUS_DEVICE_NOT_CONNECTED
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410bcc
mov edx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov al, byte [edx]
test al, al
je 0x4066d3
sub eax, 0x30
cmp al, 9
jbe 0x4066d0
mov eax, dword [0x429278]
xor eax, 0xcde8b15c
mov dword [0x429448], eax
jmp 0x4066d3
inc edx
jmp 0x4066b2
mov eax, dword [0x429278]
mov ebx, dword [ebp + edi*4 - 0x20c]
xor eax, 0xd6a0ea78
add ebx, esi
mov dword [0x429380], eax
mov esi, ebx
test edi, edi
jne 0x4066fb
mov edi, 1
jmp 0x406618
or eax, 0x55b8d511
mov dword [0x429278], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov al, byte [edx]
test al, al
je 0x40672c
sub eax, 0x30
cmp al, 9
jbe 0x406729
or dword [0x429448], 0x2d0816b3
jmp 0x40672c
inc edx
jmp 0x406710
mov eax, dword [0x429380]
lea edi, [ebp - 0x1e8]
mov esi, 0x41607c
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x1c0
mov edx, eax
and edx, 0x796a66a3
mov dword [0x429278], edx
xor edx, edx
sub ecx, dword [ebp + edx*4 - 0x1e8]
inc edx
xor eax, 0x1cf59fe
mov dword [ebp - 0x22c], ecx
cmp edx, 4
jne 0x406758
mov dword [0x429380], eax
mov dword [esp], str.STATUS_WAIT_1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
and eax, 0xc4ea4b38
push ecx
mov edi, dword [ebp - 0x21c]
mov edx, eax
mov cl, byte [ebp - 0x20f]
mov esi, dword [ebp - 0x21c]
mov dword [0x429278], eax
or edx, 0x3449883e
inc edi
mov dword [0x429448], edx
mov dl, byte [ebp - 0x210]
mov byte [ebp - 0x22d], cl
shr cl, 4
cmp byte [ebp + ebx - 0x210], 0x40
mov dword [ebp - 0x220], edi
mov edi, dword [ebp + 8]
lea edx, [ecx + edx*4]
mov byte [edi + esi], dl
je 0x406a56
mov ecx, str.STATUS_WAIT_1
mov ebx, 0x1fa7
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x406806
add ebx, edx
cmp ebx, 0x246d
jbe 0x4067e4
imul eax, eax, 0x85fb36ea
mov dword [0x429278], eax
call fcn.00412d68
and dword [0x429278], 0xdabd4f3
mov ebx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov esi, 0x98a
mov ecx, dword [0x429448]
lea eax, [ecx - 0x63c5370b]
movzx edx, byte [ebx]
inc ebx
test dl, dl
je 0x406844
add esi, edx
cmp esi, 0x9ee
jbe 0x406826
add ecx, 0x5da25f1a
mov dword [0x429278], ecx
imul eax, eax, 0x93e99478
lea edi, [ebp - 0x1c8]
mov esi, 0x41608c
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xe
and eax, 0x5a372d13
mov dword [0x429380], eax
mov dword [esp + 0xc], str.The_allocation_being_referenced_has_been_closed_permanently.
mov eax, dword [0x429448]
mov dword [esp + 8], eax
mov eax, dword [0x429278]
mov dword [esp], str.The_allocation_being_referenced_has_been_closed_permanently.
mov dword [esp + 4], eax
call fcn.0040f78c
mov eax, dword [0x429448]
xor eax, 0x5bb2cc9b
mov dword [0x429448], eax
mov dword [esp + 4], eax
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.004128f8
mov eax, dword [0x429448]
add eax, 0x2a162d9f
mov dword [0x429278], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
sub edi, dword [ebp + esi*4 - 0x1c8]
inc esi
mov ebx, edi
cmp esi, 5
jne 0x40686d
xor eax, eax
cmp byte [eax + str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed], 0
je 0x4068fa
inc eax
cmp eax, 0xfc6
jne 0x4068d8
imul eax, dword [0x429448], 0xa5009517
mov dword [0x429448], eax
jmp 0x406901
cmp eax, 0x376
jle 0x406906
call fcn.0040ef74
mov eax, dword [0x429278]
lea edx, [eax - 0x248bd183]
and eax, 0xf0a4ed5
mov dword [0x429448], edx
mov dword [0x429380], eax
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push edx
call fcn.00412d68
mov edx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov ecx, 0x787
movzx eax, byte [edx]
inc edx
test al, al
je 0x406967
add ecx, eax
cmp ecx, 0x180e
jbe 0x40693a
mov eax, dword [0x429448]
sub eax, 0x7346143
mov dword [0x429278], eax
mov dword [esp], str.STATUS_DEVICE_NOT_CONNECTED
call fcn.00410578
mov eax, dword [0x429278]
lea edi, [ebp - 0x1d8]
mov esi, 0x4160a0
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x21
xor eax, 0x492e2ac0
mov dword [0x429380], eax
sub eax, 0x7ae44968
mov dword [0x429448], eax
mov edx, str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov ecx, 0x1b50
movzx eax, byte [edx]
inc edx
test al, al
je 0x4069e5
add ecx, eax
cmp ecx, 0x1866
jbe 0x4069a3
mov dword [esp + 0xc], str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov eax, dword [0x429278]
mov dword [esp + 8], eax
mov eax, dword [0x429448]
mov dword [esp], str.WER_CrashAPI:_u:_ERROR_VirtualAlloc_failed
mov dword [esp + 4], eax
call fcn.0040f78c
add dword [0x429278], 0x2c987c71
imul eax, dword [0x429278], 0x6e58a978
mov dword [0x429278], eax
mov dword [esp], 0x1e8e
call dword [sym.imp.USER32.dll_GetTopWindow]
push eax
mov eax, dword [0x429448]
add edi, dword [ebp + esi*4 - 0x1d8]
inc esi
sub eax, 0x4f5b6562
mov dword [0x429380], eax
cmp esi, 4
jne 0x406999
movzx eax, byte [ebp + ebx - 0x210]
mov ecx, edi
mov ebx, dword [ebp - 0x220]
mov edi, dword [ebp + 8]
sar eax, cl
mov edx, eax
mov al, byte [ebp - 0x22d]
shl eax, 4
add eax, edx
mov byte [edi + ebx], al
mov eax, dword [ebp - 0x21c]
add eax, 2
mov dword [ebp - 0x220], eax
movzx eax, byte [ebp - 0x20d]
mov edi, dword [ebp - 0x22c]
cmp eax, edi
je 0x406ad3
mov dword [ebp - 0x1c8], 0x47
xor ebx, ebx
mov esi, 5
mov dword [ebp - 0x1c4], 0x5f
mov dword [ebp - 0x1c0], 0xffffff58
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [0x429380]
add esi, dword [ebp + ebx*4 - 0x1c8]
inc ebx
or eax, 0x71f1ad49
mov dword [0x429448], eax
cmp ebx, 3
jne 0x406a8c
mov al, byte [ebp - 0x20e]
mov ebx, dword [ebp - 0x220]
mov edi, dword [ebp + 8]
shl eax, 6
add al, byte [ebp + esi - 0x210]
mov byte [edi + ebx], al
mov eax, ebx
inc eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
xor edx, edx
mov dword [ebp - 0x21c], eax
inc dword [ebp - 0x224]
mov ebx, edx
jmp 0x40637a
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x21c]
mov byte [eax + edi], 0
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call fcn.0040c828
mov eax, dword [ebp - 0x21c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret