Function at 0x401000
Capabilities:
Encrypt data using rc4 ksa
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
mov eax, 0x5a4d
mov dword [ebp - 4], edi
cmp word [edi], ax
jne 0x40140f
mov ecx, dword [edi + 0x3c]
add ecx, edi
mov dword [ebp - 0x14], ecx
cmp dword [ecx], 0x4550
jne 0x40140f
movzx eax, word [ecx + 0x14]
xor esi, esi
add eax, 0x18
mov dword [ebp - 0x10], esi
add eax, ecx
mov dword [ebp - 0x28], eax
xor eax, eax
cmp ax, word [ecx + 6]
jae 0x40140f
mov bh, 0x47
mov byte [ebp - 0x18], 0
mov al, 0x69
mov byte [ebp - 0x20], bh
xor al, bh
mov byte [ebp - 0x18], 0
mov ah, 0x21
mov byte [ebp - 0x1f], al
xor ah, bh
mov cl, 0x24
mov ch, 0x2e
mov byte [ebp - 0x1b], ah
xor cl, bh
movzx eax, si
xor ch, bh
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1a], ch
mov dl, 0x28
mov ecx, dword [ebp - 0x28]
mov dh, 0x20
lea eax, [eax + eax*4]
mov bl, 0x29
xor dl, bh
xor dh, bh
xor bl, bh
mov byte [ebp - 0x1d], dl
lea esi, [ecx + eax*8]
mov byte [ebp - 0x1c], bl
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x19], dh
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4011fb
mov esi, dword [esi + 0xc]
movzx ebx, byte [esi + edi + 1]
movzx eax, byte [esi + edi]
shl ebx, 8
or ebx, eax
push ebx
push 8
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esi + 2]
mov dword [ebp - 8], eax
push ebx
add ecx, edi
push ecx
push eax
call fcn.00409c70
add esp, 0xc
push str.M1Zw0w66GQYFi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
xor ecx, ecx
nop word [eax + eax]
mov eax, ecx
mov byte [ebp + ecx - 0x128], cl
xor edx, edx
div esi
mov al, byte [edx + str.M1Zw0w66GQYFi]
mov byte [ebp + ecx - 0x228], al
inc ecx
cmp ecx, 0x100
jl 0x401100
xor edi, edi
xor esi, esi
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x128]
movzx eax, byte [ebp + esi - 0x228]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x401156
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x128]
mov byte [ebp + esi - 0x128], al
inc esi
mov byte [ebp + edi - 0x128], dl
cmp esi, 0x100
jl 0x401130
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp dword [ebp - 0x24], ebx
jbe 0x4011e4
nop
inc edi
and edi, 0x800000ff
jns 0x401191
dec edi
or edi, 0xffffff00
inc edi
mov cl, byte [ebp + edi - 0x128]
movzx edx, cl
add esi, edx
and esi, 0x800000ff
jns 0x4011ad
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [ebp + esi - 0x128]
mov byte [ebp + edi - 0x128], al
mov byte [ebp + esi - 0x128], cl
movzx eax, byte [ebp + edi - 0x128]
add eax, edx
mov edx, dword [ebp - 8]
movzx eax, al
mov al, byte [ebp + eax - 0x128]
xor byte [ebx + edx], al
inc ebx
cmp ebx, dword [ebp - 0x24]
jb 0x401180
jmp 0x4011e7
mov edx, dword [ebp - 8]
cmp byte [edx], 0x43
jne 0x4011f8
cmp byte [edx + 1], 0x46
jne 0x4011f8
cmp byte [edx + 2], 0x47
je 0x401216
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x10], eax
cmp ax, word [ecx + 6]
jae 0x40140f
mov esi, eax
jmp 0x401053
movzx ecx, byte [edx + 4]
mov esi, 4
movzx eax, byte [edx + 3]
mov ebx, dword [ebp - 0xc]
shl cx, 8
or cx, ax
mov dword [ebp - 4], esi
movzx eax, cx
shl eax, 2
push eax
push 8
mov word [ebx], cx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebx + 4], eax
xor eax, eax
cmp ax, word [ebx]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x10], 0
jae 0x4012c8
nop dword [eax]
movzx eax, si
add esi, 2
mov dword [ebp - 4], esi
movzx ecx, byte [eax + ebx + 2]
movzx eax, byte [eax + ebx + 1]
shl cx, 8
or cx, ax
movzx edi, cx
mov esi, edi
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push esi
mov esi, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [ecx + edx*4], eax
movzx ecx, si
inc ecx
add ecx, ebx
push ecx
push eax
call fcn.00409c70
mov eax, dword [ebp - 0xc]
add esi, edi
mov ecx, dword [ebp - 0x10]
add esp, 0xc
inc ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ecx
movzx eax, word [eax]
cmp ecx, eax
jl 0x401260
movzx edi, si
add edi, ebx
movzx ecx, byte [edi + 2]
movzx eax, byte [edi + 1]
shl cx, 8
or cx, ax
movzx ebx, cx
mov esi, ebx
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
push esi
mov dword [ecx + 8], eax
lea ecx, [edi + 3]
push ecx
push eax
call fcn.00409c70
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, 2
add eax, ebx
movzx edi, ax
add edi, dword [ebp - 8]
mov dword [ebp - 0x14], eax
movzx ecx, byte [edi + 2]
movzx eax, byte [edi + 1]
shl cx, 8
or cx, ax
movzx ebx, cx
mov esi, ebx
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
push esi
mov dword [ecx + 0xc], eax
lea ecx, [edi + 3]
push ecx
push eax
call fcn.00409c70
mov eax, dword [ebp - 0x14]
add esp, 0xc
add eax, 2
add eax, ebx
movzx edi, ax
add edi, dword [ebp - 8]
mov dword [ebp - 0x14], eax
movzx ecx, byte [edi + 2]
movzx eax, byte [edi + 1]
shl cx, 8
or cx, ax
movzx ebx, cx
mov esi, ebx
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
push esi
mov dword [ecx + 0x10], eax
lea ecx, [edi + 3]
push ecx
push eax
call fcn.00409c70
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 8]
add edx, 2
add edx, ebx
mov ebx, dword [ebp - 0xc]
movzx eax, dx
movzx eax, byte [eax + ecx + 1]
inc edx
mov dword [ebx + 0x14], eax
movzx eax, dx
movzx eax, byte [eax + ecx + 1]
mov dword [ebx + 0x18], eax
test eax, eax
je 0x401403
lea eax, [edx + 1]
movzx edi, ax
movzx eax, byte [edi + ecx + 1]
add edi, ecx
movzx esi, byte [edi + 2]
shl esi, 8
or esi, eax
lea eax, [esi + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push esi
lea ecx, [edi + 3]
mov dword [ebx + 0x1c], eax
push ecx
push eax
call fcn.00409c70
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret