Function at 0x1001d190
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0xc8], eax
mov eax, dword [ebx]
xor esi, esi
push ebx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xcc], edx
mov dword [eax + 8], esi
call fcn.1001c800
add esp, 4
test eax, eax
jne 0x1001d1f3
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
push esi
mov ecx, ebx
call fcn.1001c040
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
mov eax, dword [eax + 8]
xor ecx, ecx
cmp eax, 3
setge cl
lea ecx, [ecx + ecx + 1]
mov dword [ebp - 0x90], ecx
cmp eax, 3
jne 0x1001d22e
cmp dword [ebx + 0x47ec], eax
je 0x1001d227
cmp dword [ebx + 0x47e8], esi
jne 0x1001d22e
cmp dword [ebx + 0x47e4], esi
jne 0x1001d22e
mov edx, 1
jmp 0x1001d230
xor edx, edx
mov dword [ebp - 0xc0], edx
cmp eax, 3
jne 0x1001d30e
cmp ecx, eax
jge 0x1001d30e
cmp edx, esi
jne 0x1001d30e
mov eax, 1
mov dword [ebp - 0xb0], eax
push edi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x88], esi
cmp eax, esi
jle 0x1001d39a
lea edx, [ebx + 0x46a0]
lea esi, [ebp - 0x74]
mov dword [ebp - 0x8c], edx
mov eax, dword [ebx]
mov eax, dword [eax]
add eax, 3
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov ecx, dword [ebp - 0x8c]
add esp, 4
mov dword [ecx + 0x34], eax
test eax, eax
je 0x1001d453
mov eax, dword [ebx + 0x4684]
cdq
mov edi, ecx
idiv dword [edi]
mov dword [esi + 0xc], 0
mov ecx, eax
mov eax, dword [ebx + 0x4688]
cdq
idiv dword [edi + 4]
mov dword [esi - 4], ecx
mov edi, eax
mov eax, dword [ebx]
mov eax, dword [eax]
mov edx, edi
sar edx, 1
mov dword [esi + 8], edx
xor edx, edx
lea eax, [ecx + eax - 1]
div ecx
mov edx, dword [ebp - 0x8c]
mov dword [esi], edi
mov dword [esi + 4], eax
mov eax, dword [edx + 0x28]
mov dword [esi - 8], eax
mov dword [esi - 0xc], eax
cmp ecx, 1
jne 0x1001d347
cmp edi, ecx
jne 0x1001d339
mov dword [esi - 0x10], 0x1001caa0
jmp 0x1001d371
mov dword [ebp - 0xb0], eax
cmp eax, esi
jg 0x1001d25a
push esi
mov ecx, ebx
call fcn.1001c040
add esp, 4
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
cmp edi, 2
jne 0x1001d347
mov dword [esi - 0x10], 0x1001cab0
jmp 0x1001d371
cmp ecx, 2
jne 0x1001d36a
cmp edi, 1
jne 0x1001d35a
mov dword [esi - 0x10], 0x1001caf0
jmp 0x1001d371
cmp edi, 2
jne 0x1001d36a
mov eax, dword [ebx + 0x4814]
mov dword [esi - 0x10], eax
jmp 0x1001d371
mov dword [esi - 0x10], 0x1001ce10
mov eax, dword [ebp - 0x88]
add dword [ebp - 0x8c], 0x48
inc eax
add esi, 0x20
mov dword [ebp - 0x88], eax
cmp eax, dword [ebp - 0xb0]
jl 0x1001d290
mov ecx, dword [ebp - 0x90]
mov esi, dword [ebx]
mov edi, dword [esi]
test ecx, ecx
js 0x1001d41b
test edi, edi
js 0x1001d41b
je 0x1001d3bd
mov eax, 0x7fffffff
cdq
idiv edi
xor edx, edx
cmp ecx, eax
setle dl
mov eax, edx
test eax, eax
je 0x1001d41b
mov eax, edi
imul eax, ecx
mov dword [ebp - 0xac], eax
test eax, eax
js 0x1001d41b
mov eax, dword [esi + 4]
test eax, eax
js 0x1001d41b
je 0x1001d3f5
mov eax, 0x7fffffff
cdq
idiv dword [esi + 4]
xor ecx, ecx
cmp dword [ebp - 0xac], eax
setle cl
mov eax, ecx
test eax, eax
je 0x1001d41b
mov ecx, dword [ebp - 0x90]
imul edi, dword [esi + 4]
imul edi, ecx
cmp edi, 0x7ffffffe
jg 0x1001d41b
inc edi
push edi
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 0xac], edi
test edi, edi
jne 0x1001d45a
mov eax, dword [esi + 8]
push 0
mov ecx, ebx
call fcn.1001c040
mov eax, dword fs:[0x2c]
mov edx, dword [0x102f8ca0]
mov ecx, dword [eax + edx*4]
add esp, 4
pop edi
pop esi
mov dword [ecx + 0xc], str.outofmem
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
jmp 0x1001d41e
cmp dword [esi + 4], 0
mov dword [ebp - 0xb4], 0
jbe 0x1001da46
mov edi, edi
mov esi, dword [esi]
imul esi, dword [ebp - 0xb4]
imul esi, dword [ebp - 0x90]
add esi, dword [ebp - 0xac]
cmp dword [ebp - 0xb0], 0
mov dword [ebp - 0x88], 0
jle 0x1001d54a
lea edx, [ebx + 0x46bc]
mov dword [ebp - 0x8c], edx
lea edi, [ebp - 0x6c]
lea esp, [esp]
mov eax, dword [edi - 8]
sar eax, 1
xor edx, edx
cmp dword [edi], eax
setge dl
mov eax, edx
test eax, eax
je 0x1001d4ca
mov ecx, dword [edi - 0x14]
mov eax, dword [edi - 0x10]
jmp 0x1001d4d0
mov ecx, dword [edi - 0x10]
mov eax, dword [edi - 0x14]
mov edx, dword [edi - 0xc]
push edx
mov edx, dword [edi - 4]
push edx
mov edx, dword [edi - 0x18]
push ecx
push eax
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x18]
push ecx
call edx
mov ecx, dword [ebp - 0x88]
mov dword [ebp + ecx*4 - 0xa4], eax
mov eax, dword [edi]
inc eax
add esp, 0x14
mov dword [edi], eax
cmp eax, dword [edi - 8]
jl 0x1001d527
inc dword [edi + 4]
mov ecx, dword [edi + 4]
mov edx, dword [ebp - 0x8c]
mov eax, dword [edi - 0x10]
mov dword [edi], 0
mov dword [edi - 0x14], eax
cmp ecx, dword [edx]
jge 0x1001d527
mov edx, dword [edx + 4]
add edx, eax
mov dword [edi - 0x10], edx
mov eax, dword [ebp - 0x88]
add dword [ebp - 0x8c], 0x48
inc eax
add edi, 0x20
mov dword [ebp - 0x88], eax
cmp eax, dword [ebp - 0xb0]
jl 0x1001d4b0
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0xa0]
mov edx, dword [ebp - 0xa4]
cmp ecx, 3
jl 0x1001d797
mov ecx, dword [ebx]
mov edi, dword [ecx + 8]
cmp edi, 3
jne 0x1001d5e9
cmp dword [ebp - 0xc0], 0
je 0x1001d5c5
xor edi, edi
cmp dword [ecx], edi
jbe 0x1001da28
mov ecx, dword [ebp - 0x9c]
add esi, 2
sub edx, eax
sub ecx, eax
mov dword [ebp - 0x94], ecx
movzx ecx, byte [edx + eax]
mov byte [esi - 2], cl
movzx ecx, byte [eax]
mov byte [esi - 1], cl
mov ecx, dword [ebp - 0x94]
movzx ecx, byte [ecx + eax]
mov byte [esi], cl
mov byte [esi + 1], 0xff
mov ecx, dword [ebx]
add esi, dword [ebp - 0x90]
inc edi
inc eax
cmp edi, dword [ecx]
jb 0x1001d595
jmp 0x1001da28
mov edi, dword [ebp - 0x90]
mov ecx, dword [ecx]
push edi
push ecx
mov ecx, dword [ebp - 0x9c]
push ecx
push eax
push edx
mov edx, dword [ebx + 0x4810]
push esi
call edx
add esp, 0x18
jmp 0x1001da28
cmp edi, 4
jne 0x1001d76b
mov edi, dword [ebx + 0x47e8]
test edi, edi
jne 0x1001d6bf
mov dword [ebp - 0x88], edi
cmp dword [ecx], edi
jbe 0x1001da28
mov edi, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x98]
sub ecx, edi
mov dword [ebp - 0xbc], ecx
mov ecx, dword [ebp - 0x9c]
sub eax, edi
add esi, 2
sub ecx, edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xa8], ecx
jmp 0x1001d649
mov eax, dword [ebp - 0x8c]
movzx ecx, byte [edi + eax]
movzx eax, byte [edi]
imul eax, ecx
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
mov eax, dword [ebp - 0xbc]
shr edx, 8
mov byte [esi - 2], dl
movzx eax, byte [edi + eax]
imul eax, ecx
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
mov eax, dword [ebp - 0xa8]
shr edx, 8
mov byte [esi - 1], dl
movzx eax, byte [edi + eax]
imul eax, ecx
sub eax, 0xffffff80
mov ecx, eax
shr ecx, 8
add ecx, eax
mov eax, dword [ebp - 0x88]
shr ecx, 8
mov byte [esi], cl
mov byte [esi + 1], 0xff
mov edx, dword [ebx]
add esi, dword [ebp - 0x90]
inc eax
inc edi
mov dword [ebp - 0x88], eax
cmp eax, dword [edx]
jb 0x1001d643
jmp 0x1001da28
mov ecx, dword [ecx]
cmp edi, 2
mov edi, dword [ebp - 0x90]
push edi
push ecx
mov ecx, dword [ebp - 0x9c]
push ecx
push eax
push edx
mov edx, dword [ebx + 0x4810]
push esi
jne 0x1001d5df
call edx
mov eax, dword [ebx]
xor ecx, ecx
add esp, 0x18
cmp dword [eax], ecx
jbe 0x1001da28
add esi, 2
jmp 0x1001d700
mov edx, dword [ebp - 0x98]
movzx edi, byte [ecx + edx]
or al, 0xff
sub al, byte [esi - 2]
inc ecx
movzx eax, al
imul eax, edi
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
or al, 0xff
sub al, byte [esi - 1]
shr edx, 8
movzx eax, al
imul eax, edi
mov byte [esi - 2], dl
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
or al, 0xff
sub al, byte [esi]
shr edx, 8
movzx eax, al
imul eax, edi
mov byte [esi - 1], dl
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
shr edx, 8
mov byte [esi], dl
mov eax, dword [ebx]
add esi, dword [ebp - 0x90]
cmp ecx, dword [eax]
jb 0x1001d700
jmp 0x1001da28
xor edi, edi
cmp dword [ecx], edi
jbe 0x1001da28
inc esi
mov al, byte [edi + edx]
mov byte [esi + 1], al
mov byte [esi], al
mov byte [esi - 1], al
mov byte [esi + 2], 0xff
mov eax, dword [ebx]
add esi, dword [ebp - 0x90]
inc edi
cmp edi, dword [eax]
jb 0x1001d776
jmp 0x1001da28
xor edi, edi
cmp dword [ebp - 0xc0], edi
je 0x1001d870
cmp ecx, 1
mov ecx, dword [ebx]
jne 0x1001d810
mov dword [ebp - 0x88], edi
cmp dword [ecx], edi
jbe 0x1001da28
mov ecx, dword [ebp - 0x9c]
mov edi, eax
sub edi, ecx
sub edx, ecx
sub esi, ecx
mov dword [ebp - 0x94], esi
mov edi, edi
movzx eax, byte [edx + ecx]
movzx esi, byte [edi + ecx]
imul eax, eax, 0x4d
imul esi, esi, 0x96
add eax, esi
movzx esi, byte [ecx]
imul esi, esi, 0x1d
add eax, esi
mov esi, dword [ebp - 0x94]
sar eax, 8
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x88]
mov esi, dword [ebx]
inc eax
inc ecx
mov dword [ebp - 0x88], eax
cmp eax, dword [esi]
jb 0x1001d7d0
jmp 0x1001da28
cmp dword [ecx], edi
jbe 0x1001da28
mov ecx, dword [ebp - 0x9c]
sub eax, ecx
sub edx, ecx
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xa8], edx
jmp 0x1001d83c
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0xa8]
movzx edx, byte [ecx + edx]
movzx eax, byte [ecx + eax]
imul edx, edx, 0x4d
imul eax, eax, 0x96
add edx, eax
movzx eax, byte [ecx]
imul eax, eax, 0x1d
add edx, eax
sar edx, 8
mov byte [esi], dl
mov byte [esi + 1], 0xff
mov edx, dword [ebx]
inc edi
inc ecx
add esi, 2
cmp edi, dword [edx]
jb 0x1001d830
jmp 0x1001da28
mov ecx, dword [ebx]
mov edi, dword [ecx + 8]
cmp edi, 4
jne 0x1001d9e7
cmp dword [ebx + 0x47e8], 0
jne 0x1001d97c
cmp dword [ecx], 0
mov dword [ebp - 0x88], 0
jbe 0x1001da28
mov edi, dword [ebp - 0x98]
mov ecx, eax
mov eax, dword [ebp - 0x9c]
sub edi, edx
sub ecx, edx
sub eax, edx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xa8], eax
jmp 0x1001d8dc
mov edi, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0xbc]
movzx ecx, byte [edx + ecx]
movzx edi, byte [edx + edi]
movzx eax, byte [edx]
imul ecx, edi
imul eax, edi
mov dword [ebp - 0xb8], edi
mov edi, dword [ebp - 0xa8]
movzx edi, byte [edx + edi]
imul edi, dword [ebp - 0xb8]
sub ecx, 0xffffff80
mov edx, ecx
shr edx, 8
add edx, ecx
shr edx, 8
movzx ecx, dl
sub edi, 0xffffff80
imul ecx, ecx, 0x96
mov edx, edi
shr edx, 8
add edx, edi
shr edx, 8
movzx edx, dl
imul edx, edx, 0x1d
add ecx, edx
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
shr edx, 8
movzx eax, dl
mov edx, dword [ebp - 0x94]
imul eax, eax, 0x4d
add ecx, eax
mov eax, dword [ebp - 0x88]
sar ecx, 8
mov byte [esi], cl
mov byte [esi + 1], 0xff
mov ecx, dword [ebx]
add esi, dword [ebp - 0x90]
inc eax
inc edx
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x94], edx
cmp eax, dword [ecx]
jb 0x1001d8d0
jmp 0x1001da28
cmp edi, 4
jne 0x1001d9e7
cmp dword [ebx + 0x47e8], 2
jne 0x1001d9e7
mov eax, dword [ebx]
xor ecx, ecx
cmp dword [eax], ecx
jbe 0x1001da28
mov edi, dword [ebp - 0x98]
sub edx, edi
mov dword [ebp - 0xb8], edx
jmp 0x1001d9b6
mov edx, dword [ebp - 0xb8]
or al, 0xff
sub al, byte [edx + edi]
movzx edx, byte [edi]
movzx eax, al
imul eax, edx
sub eax, 0xffffff80
mov edx, eax
shr edx, 8
add edx, eax
shr edx, 8
mov byte [esi], dl
mov byte [esi + 1], 0xff
mov eax, dword [ebx]
add esi, dword [ebp - 0x90]
inc ecx
inc edi
cmp ecx, dword [eax]
jb 0x1001d9b0
jmp 0x1001da28
cmp dword [ebp - 0x90], 1
jne 0x1001da0f
xor eax, eax
cmp dword [ecx], eax
jbe 0x1001da28
mov edi, edx
sub edi, esi
lea ebx, [ebx]
mov cl, byte [edi + esi]
mov byte [esi], cl
mov edx, dword [ebx]
inc eax
inc esi
cmp eax, dword [edx]
jb 0x1001da00
jmp 0x1001da28
xor edi, edi
cmp dword [ecx], edi
jbe 0x1001da28
mov al, byte [edi + edx]
mov byte [esi], al
mov byte [esi + 1], 0xff
mov ecx, dword [ebx]
inc edi
add esi, 2
cmp edi, dword [ecx]
jb 0x1001da15
mov eax, dword [ebp - 0xb4]
mov esi, dword [ebx]
inc eax
mov dword [ebp - 0xb4], eax
cmp eax, dword [esi + 4]
jb 0x1001d470
mov edi, dword [ebp - 0xac]
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0
mov ecx, ebx
call fcn.1001c040
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ebp - 0xc8]
mov dword [edx], ecx
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0xcc]
mov edx, dword [ebp - 0xc4]
add esp, 4
mov dword [edx], ecx
test eax, eax
je 0x1001da8b
mov ecx, dword [ebx]
xor edx, edx
cmp dword [ecx + 8], 3
setge dl
lea edx, [edx + edx + 1]
mov dword [eax], edx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026fb8
mov esp, ebp
pop ebp
ret