Function at 0x407054
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
mov ecx, dword [0x429240]
mov dword [ebp - 0x14e], 0x260920bd
mov word [ebp - 0x14a], 0x61c1
mov eax, ecx
or eax, 0xbfb6773c
mov dword [0x429240], eax
cmp word [edx + edx + str.ENTERPRISEAUTHENTICATION], 0
je 0x4070a9
inc edx
cmp edx, 0x2631
jne 0x407087
or ecx, 0xffbfff7d
mov dword [0x429240], ecx
jmp 0x4070b7
imul eax, eax, 0x8f483270
cmp edx, 0x18d
jle 0x4070d9
mov dword [esp], str.Duplicate_privileges_were_specified_for_the_token.
call fcn.0041013c
add dword [0x429240], 0x77ffe203
call dword [sym.imp.USER32.dll_GetMessageTime]
imul eax, eax, 0x83695cb6
xor eax, 0x8e076dd2
mov ecx, str.Duplicate_privileges_were_specified_for_the_token.
mov ebx, 0x10c
mov dword [0x429240], eax
movzx edx, word [ecx]
add ecx, 2
test dx, dx
je 0x407118
add ebx, edx
cmp ebx, 0x1dd1
jbe 0x4070ed
call fcn.004125f4
mov eax, dword [0x429240]
or eax, 0xa1c26e3e
add eax, 0xf3f9d7c
jmp 0x40711d
sub eax, 0x18fe73bd
lea edi, [ebp - 0x142]
mov esi, str.RtlGetNativeSystemInformation_failed___x_
mov ecx, 0x2a
or eax, 0xc84e5370
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x15c], eax
xor eax, eax
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jne 0x40713c
xor esi, esi
xor ecx, ecx
mov edi, 0x29
mov eax, ecx
xor edx, edx
mov bl, byte [ebp + ecx - 0x118]
div edi
movzx eax, byte [ebp + edx - 0x142]
movzx edx, bl
add eax, edx
add eax, esi
movzx esi, al
mov dl, byte [ebp + esi - 0x118]
mov byte [ebp + ecx - 0x118], dl
inc ecx
mov byte [ebp + esi - 0x118], bl
cmp ecx, 0x100
jne 0x407154
mov eax, dword [ebp - 0x15c]
mov byte [ebp - 0x19], dl
xor ecx, ecx
xor edx, edx
mov byte [ebp + esi - 0x118], bl
xor ebx, ebx
add eax, 0x1121300
mov dword [0x429240], eax
inc edx
lea esi, [ebp - 0x148]
movzx edx, dl
movzx edi, byte [ebp + edx - 0x118]
add ecx, edi
movzx ecx, cl
mov al, byte [ebp + ecx - 0x118]
mov byte [ebp + edx - 0x118], al
mov eax, edi
mov byte [ebp + ecx - 0x118], al
add al, byte [ebp + edx - 0x118]
movzx eax, al
mov al, byte [ebp + eax - 0x118]
xor al, byte [ebx + ebp - 0x14e]
mov byte [ebp + ebx - 0x148], al
inc ebx
cmp ebx, 6
jne 0x4071b1
mov dword [esp + 8], esi
mov dword [esp + 0xc], 6
mov dword [esp + 4], 0xf18
mov dword [esp], str.Q6MXjKl1Z29ev4egriacBS0wbNdQvSWg_hNmLNmqZaLLyhFFA3lJ1Gy7Jmxu79DtLJEG35_8YEkCY5wxuoP7XqzHWKdYUFmZv1PMgbzUXRG39vvOf6Jq7JpVvK1qm5bspPbT07mx4SnmhaacaMe3zyAKFiTvG6DwKYzUcFM_ZxHLPeMbKZvZvVwAcYaYbArLrvDNI8VNSpZLmFjgNuwWnf8TB7mfTR5_xr1KlBtFa6rFMjo10RXQFR63mjPBsf3N6nFbMwj_B8WHNeA0ydCXx5xEtK4KfrPgtproflRDahE3N8dHBcpaDEd0EvdzTwpMcvcIxBj4yORNd7pctrKDFastpppR8yCu9xVcZBiEx1HDhLmysSPbD3OxYASXSs2ryXpDnzGt9s8jRSGZNtuYIm03JljMmNrL7dFOG6EWqdvSQS2LHoSMwoZpWb2vBtxqzHB5Ch7i6RIMwYUIGIlmL2zqJu4t9lmEIRSHO4to744WnvlAQ00t8cA4xX0HFAcNun6ELaNMubGmIFbqEwxmiMp7xN1tkRVW5Seyn6xcrGacvQrwyLQC5D4seYkwLjgEPcqScbd4fl9JvNhcP267Vb90VxqktKCDYwDpo_nCrK_asmO7Ivd3RRtfCl0PydPIgacrbLYcAQsp9TZe8ibBEcnWKXpKHKmrU5mQt42bzAKA_BnyFXQIno5VKSTMsq2qTBgL5nIddVVQRbKWSh_CrFBX5zZCicUulcQ_uVAPHRKiP27FrWFBqN_KbFe0Oo4R3u7bNqjiCOXTcKyWAtDAXbV0WGzNndcDDoZjmGO3vuKdIWDjf2K8icCWq2jCXzCdUjzwNGRp0pPvoAxtja6EOaAImdSGX2ndrJJYHbTNUBRFitJ0fCaDByO3OjQQ8LY2gWV8YzRR4KsvHNyKn1LU2QcJLxVCljpmi3aROqaAzYOhEN5RvTvHAqzVgZlfgDugCOAyr74gQqmxFSTZXB0YaGME2XB7x72g6K9Vk1DdbsWeriw2rXDRdRqaRPDu85bxDFLTRrndFXio3tS67aV7saQVFUA6TIszYig9vTXwG9AKW01Sp_wgLxl9XAQwnE7L1WsfWmwl8iRxZ8GbSJUf51En7XSPZtAR0vZFCOcXDEWXHV_WSMPU4ozlLQHqvrAuyvW5MJSr26zpFLUrl4Y37cmdztdCH0zPh9P7vKUPkB9SV1JezP_6CRyRYxsvd5N_7ThXfPV8HLUvkdN2V4ZjjFPa17ytkh4vn4PrZsym1x9no1_i96XK0KW_XhO_q99HrICeFGphBihJT7HsI7DZ3hCvOxLyKNBLZtsS7elwBdsPUbY7GlMpPRv1nF3JM9J3c_aPgnPI1Iee8ApUl7orix4igDwogcUOJjzltYElyVnXq5qgJyWlWcqOSLFcmNRZKSklatZCd3N1CONmgF8xLDWFpavCBQkYBvak6SXEiUNCNLAw6kvbJOamaYxq9lVgVdQ1y2BwokO5iQ3YOmR_61gehhJZ8bXt1whXnv6WclN3Ub4SHiqwSb_K4z4wCqQqBcmiqDBrxJguReQp2vMYLzn1zlN0DBSK6WjSAtRCTF6DXME34ut9lxs86qePMwoAnnblu_Tq03I2EAXZm5zfT1sMcajUVHUilrsbM9AJgSd9kAGVcty_xS3yGn811uSQ_sU2SgH00_GnGZlC53afMg7kd1R8L6KFVDnLsHM8YJ53ecxBNjKq9dMjlGXC8FD3ioHevVjHAqZOcBHjX6RG7rutoDiWMvricXg8tGAI_lEw5jcBjV9N7b2Mx6ftcuITh6MPEDJLGB7D_ki5Zyy9teb5g2LFfm70sI2LcWJzRy3Wqz64BYJ4VC3nDI7Jie7M9n07IXUwO_z606hWOqPeZUEDvsNgq9NkiRhuYFhsouf5yhPujH9zkOsilvnRrWIbxhcnvGLeLFGdT_RmPQnFjfSO3ucNDLZuyKpNd4nhHBE_sUMefi6Gt04K_DQVWeuyWxBsAs4c8XOpLsB22Imgks7ZS7wkLQlMYM7nvbuBjt01gezXLWDVQ56FXeDdubzxq8z4l9BL1IKTmRr_gyy2iHy3iJBc83xv5lMScMScXoANwT_lJmQLBq7vPhVlda5Mnxlm3kEuXi8CJsuwL19l2Zlzyd3naPmN3hRkoScPKejHVvd2AExHcF3r_eKoTuD_Xrjp7L06C8p6hRg0SULwXk776I9no0xNf7C6BiM0c8BQ4w_6RbieO2F3MHnyWlklYuwql7XT_eWgV34Nm1VLcG9itjcsCGpcJFGMXtogrJg8NzzMXWzSUn0mV9qKcI20u0rcop4RuwGJQX7vZmxkzglJiUheIdVhGITAS6szRna9VXh5umu84y9ojJexEeFPZLG8zyEftKLszGt3rOBFXcjeA9BZnnjjmDU7CRtdyAmQ0fOPv7vBOhgW24PrUXXH3p4JLDc2Vodz1gpqmNWypS98NJ4RT90LShdnscR1mOoKrKCXpGmc5H8nha6TFsuX0o8fXNLuu5wd3oa4pBdGGBVuTdhj2kMy1DNhmSJ_I5X_up3uYfGKJEeNvrnTxaxBi8UUeaH08yb1tWanSwBsUMbVdtiaO1X5dEfFDuEUAcaq3CZMRtyA1aU9VaZB4VgTbMScq8sHBMml_hMhwRW7U7y6NPtTY0ZpmQ1HNLXHw8weVQ9Rfa0zCT85ZogKPNHdLlirGaKxhaWEbFLGq85Dw83xL_Rkw77Vf_a34DZHDKZXFBTcRtO9f0tvoHelDfQpLvBQcvWHBGApOH34kEfz3yLmdJmnI03a0P1GgLIaV37fBIEeragQs72nMiZM7Q1ETrhg7jW92sZGh8xYOrD3d10bd8gEJiCpkibPK1mKhyC8Yn4TWkTFVYVA9x40Z7teoFvMgOeVh0xeEsTXl4Oqx3tfYuIYGvYhna1pQoWflX0VHeZ4I9KvAI40aEQIrLTVBOsR5dJ0zOJ7D1n1Vzq4hk3nxju8kKn843HVIaW9y7D0jmylWNNQdMDIxOMfq9PymDLRU8MM5uVXRBaGlKopV8Kj50MF17HTem3kKag6JlGQMbG45M_wGgPEfUebo4BHFuKq10p3oXkjmh4byw1xs2jDoS5uiVxxRFgNv_FNiZ10pgaRSqd804J1afEnOqMIbitsFDZiOcLmqovWRJgysfU7IM9vksnKrMaphXvt1JX1uXTUquTtNORIhxjFeVcbbyAqWjIMP30C8Pujj_EBieljIBW64gYXW5vsLN7oY0UnJvmmGPyM55G2RbnDMrcWrjKUmVVlnTdxGyOef2mR6vD4GJCJswp6d6mH5nqzKOeuFat6D_7Wb7VjOmyEHWuZsXHtjPP7HkwimyvtS1Wtim2caBuuWHQa8bV6h0i4Kynr5tXSSU0jUxR9FSUahhSrH3zujkveC6furFjViP3sLhbiUHZcrXPBOpQMX53xLlLYG_CNl11MJlXPG_9KsX5Bp_wNMrNiQK_O_oq33paMZRfkdyX4Svb5kQZ2m8AvIFPvwGNIIpK4OAwEj7aPu7i4vLSmrhvcdzenzukjiBKE1Hzuo4bZa37JCwCCW2k4Q1p37pV73o6KaeuQFkGY_tUH3uYRj0y8apjwAqmVZjTdXvxHatbXosDmbSnkOi6fSttS2qNTmvBArosYXGiDZa4qH5UzCI8msNd7yAZqnyQRnRcH5pnzt_3xk9Xv58idVykB7ogA5JzM0r5nwld0XRybgL34arXrRpWmHyY1jIF5H4YcwIXi6Nx1SsfAxr269oUXDe1c17KtGIeqY5Ewj1xAAtz4VQjvKeOvcOzvlHB4P
mov byte [ebp - 0x142], 0
call fcn.0040b3c4
add esp, 0x16c
pop ebx
pop esi
pop edi
pop ebp
ret