Function at 0x40f11f
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x394
push ebx
push esi
push edi
push 0xf
pop eax
mov dword [ebp - 0xe8], ecx
lea edi, [ebp - 0x238]
push 0xe
pop ecx
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionStructuredQuery
mov byte [ebp - 0x25], al
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 0xe4], edx
mov dword [ebp - 0x60], 0x81ab7fa6
mov ecx, eax
mov dword [ebp - 0x5c], 0x9041d7ec
movsw word es:[edi], word [esi]
mov dword [ebp - 0x58], 0x2555d9e8
mov edi, eax
mov dword [ebp - 0x54], 0xc08682a
mov dword [ebp - 0x50], 0x2677dc5f
mov dword [ebp - 0x4c], 0x2b38c009
mov dword [ebp - 0x48], 0xea71c88b
mov dword [ebp - 0x44], 0xadf16729
mov dword [ebp - 0x40], 0x5ad5ae81
mov dword [ebp - 0x3c], 0xcbb91647
mov dword [ebp - 0x38], 0x362063f4
mov dword [ebp - 0x34], 0x92292d44
mov dword [ebp - 0x30], 0x321a9a26
mov dword [ebp - 0x2c], 0x34eb7f10
mov word [ebp - 0x28], 0x9241
mov byte [ebp - 0x26], 0x9a
mov dword [ebp - 0x24], 0x9ce9ef8a
mov dword [ebp - 0x20], 0x3f1a16a
mov dword [ebp - 0x1c], 0x732bfb30
mov dword [ebp - 0x18], 0xfed69109
mov dword [ebp - 0x14], 0x27dc0b6
mov dword [ebp - 0x10], 0xaed378c
mov dword [ebp - 0xc], 0xdde5d1f2
mov byte [ebp + ecx - 0x1fc], cl
inc ecx
cmp ecx, 0x100
jb 0x40f1f2
push 0x39
mov esi, eax
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x1fc]
mov eax, esi
div ecx
movzx ecx, bl
push 0x39
movzx eax, byte [ebp + edx - 0x238]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x1fc]
mov byte [ebp + esi - 0x1fc], al
inc esi
mov byte [ebp + edi - 0x1fc], bl
cmp esi, 0x100
jb 0x40f207
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + edi - 0x1fc]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x1fc]
mov byte [ebp + edi - 0x1fc], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x1fc], cl
movzx eax, byte [ebp + edi - 0x1fc]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1fc]
xor al, byte [ebp + esi - 0x60]
mov byte [ebp + esi - 0x394], al
inc esi
cmp esi, 0x58
jb 0x40f250
push 0xa
pop ecx
mov esi, 0x42f228
mov byte [ebp - 0x33c], bl
lea edi, [ebp - 0x228]
mov dword [ebp - 0xbc], 0x7c7267f6
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb8], 0xf3828f9f
mov edi, ebx
mov dword [ebp - 0xb4], 0x641535f
mov eax, ebx
mov dword [ebp - 0xb0], 0x948f0ea7
mov dword [ebp - 0xac], 0x89fe3899
mov dword [ebp - 0xa8], 0xfe95bf1b
mov byte [ebp + eax - 0x1fc], al
inc eax
cmp eax, 0x100
jb 0x40f2fe
push 0x27
mov esi, ebx
pop ecx
xor edx, edx
mov bl, byte [ebp + esi - 0x1fc]
mov eax, esi
div ecx
movzx ecx, bl
push 0x27
movzx eax, byte [ebp + edx - 0x228]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x1fc]
mov byte [ebp + esi - 0x1fc], al
inc esi
mov byte [ebp + edi - 0x1fc], bl
cmp esi, 0x100
jb 0x40f312
mov eax, dword [0x4354f0]
xor ebx, ebx
mov dword [ebp - 0xd8], eax
mov edi, ebx
and eax, 0xed8feb9e
mov dword [ebp - 4], ebx
mov esi, ebx
mov dword [ebp - 0xdc], eax
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + edi - 0x1fc]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x1fc]
mov byte [ebp + edi - 0x1fc], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x1fc], cl
movzx eax, byte [ebp + edi - 0x1fc]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1fc]
xor al, byte [ebp + esi - 0xbc]
mov byte [ebp + esi - 0x218], al
inc esi
cmp esi, 0x18
jb 0x40f371
mov esi, str.SrchIndexerQuery
mov byte [ebp - 0x200], bl
lea edi, [ebp - 0xfc]
mov dword [ebp - 0xd4], 0x16e01227
mov dword [ebp - 0xd0], 0xcbc88d89
mov eax, ebx
mov dword [ebp - 0xcc], 0x9ce3ba33
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc8], 0x9e11351d
mov dword [ebp - 0xc4], 0xcdd42447
mov dword [ebp - 0xc0], 0x986dfabb
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, ebx
mov byte [ebp + eax - 0x1fc], al
inc eax
cmp eax, 0x100
jb 0x40f422
mov ecx, ebx
mov dword [ebp - 4], ebx
mov dl, byte [ebp + ecx - 0x1fc]
and ecx, 0xf
mov byte [ebp - 5], dl
movzx eax, byte [ebp + ecx - 0xfc]
add eax, esi
movzx ecx, dl
add ecx, eax
movzx eax, cl
mov dword [ebp - 0xe0], eax
call fcn.0040dbc9
push 5
pop ecx
mov esi, 0x42f848
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0xbc], 0x6f
jne 0x40f4ad
mov al, 0x6f
mov esi, ebx
test al, al
je 0x40f4ad
cmp byte [ebp + esi - 0xbc], bl
je 0x40f4ad
mov edx, dword [ebp - 0xdc]
mov ecx, 0x42f860
call fcn.0040d278
mov al, byte [esi + 0x42fc21]
inc esi
cmp al, byte [ebp + esi - 0xbc]
je 0x40f480
mov esi, dword [ebp - 0xe0]
mov ecx, dword [ebp - 4]
mov al, byte [ebp + esi - 0x1fc]
mov byte [ebp + ecx - 0x1fc], al
inc ecx
mov al, byte [ebp - 5]
mov byte [ebp + esi - 0x1fc], al
mov dword [ebp - 4], ecx
cmp ecx, 0x100
jb 0x40f436
mov dword [ebp - 4], ebx
mov edi, ebx
mov esi, ebx
lea eax, [edi + 1]
movzx edi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + edi - 0x1fc]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x1fc]
mov byte [ebp + edi - 0x1fc], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x1fc], cl
movzx eax, byte [ebp + edi - 0x1fc]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x1fc]
xor al, byte [ebp + esi - 0xd4]
mov byte [ebp + esi - 0xbc], al
inc esi
cmp esi, 0x18
jb 0x40f4e5
mov esi, str.no_such_process
mov byte [ebp - 0xa4], bl
lea edi, [ebp - 0xfc]
mov dword [ebp - 0xa0], 0xbd2bc681
push 0xf
pop ecx
movsd dword es:[edi], dword [esi]
mov eax, ebx
mov dword [ebp - 0x9c], 0xacab1656
mov dword [ebp - 0x98], 0xe231edce
mov dword [ebp - 0x94], 0x5eb65334
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x90], 0x93676ea5
mov dword [ebp - 0x8c], 0xd3e6159e
mov dword [ebp - 0x88], 0x487f1568
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x84], 0x16b8f516
mov dword [ebp - 0x80], 0x37992c26
mov dword [ebp - 0x7c], 0x3bb43e8f
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x78], 0xf116a2f9
mov edi, ebx
mov dword [ebp - 0x74], 0x104dc63f
mov dword [ebp - 0x70], 0x8b15506e
mov dword [ebp - 0x6c], 0xc9d83432
mov dword [ebp - 0x68], 0xf6eb8d30
mov dword [ebp - 0x64], 0xf5aa97ef
mov dword [ebp - 0x60], 0xf811fc46
mov dword [ebp - 0x5c], 0xf2ec07ab
mov word [ebp - 0x58], 0xa298
mov byte [ebp - 0x56], 0xc9
mov byte [ebp - 0x55], cl
mov dword [ebp - 0x54], 0x9b5032bb
mov dword [ebp - 0x50], 0xbfc54b3f
mov dword [ebp - 0x4c], 0xb6be45da
mov dword [ebp - 0x48], 0xef26b506
mov dword [ebp - 0x44], 0x9dffef47
mov dword [ebp - 0x40], 0x9bdd260
mov dword [ebp - 0x3c], 0x7b7109ca
mov dword [ebp - 0x38], 0x9d8e15de
mov dword [ebp - 0x34], 0x91df430
mov dword [ebp - 0x30], 0x8be8b6ee
mov dword [ebp - 0x2c], 0xde8d35f
mov dword [ebp - 0x28], 0x280c01ef
mov dword [ebp - 0x24], 0x97727d0d
mov dword [ebp - 0x20], 0xe4a139a5
mov dword [ebp - 0x1c], 0x6827044b
mov dword [ebp - 0x18], 0xe9ad700
mov dword [ebp - 0x14], 0x33dd5646
mov dword [ebp - 0x10], 0x34abcf66
mov dword [ebp - 0xc], 0x123c4f5d
mov byte [ebp + eax - 0x338], al
inc eax
cmp eax, 0x100
jb 0x40f684
mov esi, ebx
xor edx, edx
mov bl, byte [ebp + esi - 0x338]
mov eax, esi
div ecx
movzx ecx, bl
push 0xf
movzx eax, byte [ebp + edx - 0xfc]
add eax, edi
add ecx, eax
movzx edi, cl
pop ecx
mov al, byte [ebp + edi - 0x338]
mov byte [ebp + esi - 0x338], al
inc esi
mov byte [ebp + edi - 0x338], bl
cmp esi, 0x100
jb 0x40f695
xor ebx, ebx
imul esi, dword [ebp - 0xd8], 0x34527c97
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [0x435588], esi
mov esi, ebx
lea eax, [esi + 1]
movzx esi, al
mov eax, dword [ebp - 4]
mov cl, byte [ebp + esi - 0x338]
movzx edx, cl
add eax, edx
movzx eax, al
mov dword [ebp - 4], eax
mov al, byte [ebp + eax - 0x338]
mov byte [ebp + esi - 0x338], al
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x338], cl
movzx eax, byte [ebp + esi - 0x338]
add eax, edx
movzx eax, al
mov al, byte [ebp + eax - 0x338]
xor al, byte [ebp + edi - 0xa0]
mov byte [ebp + edi - 0x198], al
inc edi
cmp edi, 0x98
jb 0x40f6ee
mov edi, dword [ebp - 0xd8]
mov esi, dword [0x435588]
mov byte [ebp - 0x100], bl
cmp dword [ebp + 8], ebx
jne 0x40f7c7
call fcn.0040dce6
sub esi, 0x71e06c4b
inc ebx
cmp byte [ebx + 0x42fc40], 0
jne 0x40f763
mov dword [0x435588], esi
mov esi, dword [ebp + 8]
cmp esi, ebx
jae 0x40f8b2
push ecx
mov edx, edi
mov ecx, str.network_unreachable
call fcn.0040da97
add esp, 4
cmp esi, 0xb35
jne 0x40f7ac
or edi, 0xbeea46d5
call fcn.0040cce9
or edi, 0x6753f13b
call fcn.0040de1d
inc esi
cmp esi, ebx
jb 0x40f789
mov dword [0x4354f0], edi
jmp 0x40f8b2
lea ecx, [ebp - 0x394]
call fcn.0040b5df
lea ecx, [ebp - 0x218]
mov ebx, eax
call fcn.0040b5df
push dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
lea edx, [ebp - 0xbc]
push dword [ebp + 8]
mov edi, eax
push dword [ebp - 0xe4]
push ebx
push esi
push 2
pop ecx
call fcn.0040a2e6
call eax
mov edx, dword [ebp + 0xc]
mov ecx, esi
call fcn.0040ba5f
mov edx, edi
call fcn.0040ba5f
call fcn.0040b8e6
mov edx, dword [ebp + 0x1c]
push eax
call fcn.00408921
mov ecx, dword [ebp - 0xe8]
lea edx, [ebp - 0x198]
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.0040dfcf
mov ecx, ebx
call fcn.0040b8e6
push eax
xor esi, esi
push esi
push ebx
call fcn.0040b587
mov ecx, edi
call fcn.0040b8e6
push eax
push esi
push edi
call fcn.0040b587
mov edx, dword [0x4354f0]
add esp, 0x3c
mov ecx, 0x42cd30
call fcn.0040da97
add esp, 4
mov ecx, ebx
call fcn.0040a2d2
mov ecx, edi
call fcn.0040a2d2
mov edi, dword [0x4354f0]
mov esi, 0x42fc40
mov edx, dword [0x435588]
xor edi, 0x2d9a5670
push ecx
mov ecx, 0x42dfa0
call fcn.0040da97
add esp, 4
mov edx, edi
inc esi
cmp byte [esi], 0
jne 0x40f896
mov dword [0x435588], edx
pop edi
pop esi
pop ebx
leave
ret