Function at 0x668680
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x668e0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 7
mov eax, dword [ebp - 0x14]
call fcn.004f0ff4
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
test eax, eax
je 0x6686cc
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
test eax, eax
jne 0x6686e2
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc4]
mov edx, esi
call fcn.0066963c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 0x48]
call fcn.004e8524
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 0x49]
call fcn.004e84d0
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + 0x59]
call fcn.004e85a0
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
mov edx, dword [ebp - 0x18]
mov edx, dword [edx + 0x2c]
call fcn.004e842c
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
xor edx, edx
call fcn.004e8064
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x18]
movzx edx, word [edx + 0x44]
call fcn.004094ec
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
push eax
fild dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
fmul qword [eax + 0x50]
call fcn.00405c9c
mov edx, eax
pop eax
call fcn.004e836c
push 0
lea edx, [ebp - 0x7c]
mov eax, dword [ebp - 0x14]
call fcn.0072f938
lea edx, [ebp - 0x7c]
mov ecx, 0xffffff
mov eax, dword [ebp - 0x14]
call fcn.00654bb8
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x58], 0
je 0x6687ec
mov eax, dword [ebp + 0xc]
mov ecx, 0x30
cdq
idiv ecx
inc eax
push eax
push 0
push 1
mov eax, dword [ebp - 0x14]
call fcn.004efc64
lea ecx, [ebp - 0x5c]
mov edx, dword [ebp - 0x28]
movzx edx, word [edx]
call fcn.00667dcc
jmp 0x668813
push 0xf00
lea eax, [ebp - 0x5c]
push eax
push 1
mov eax, dword [ebp - 0x28]
call fcn.00409588
push eax
mov eax, dword [ebp - 0x14]
call fcn.004efc64
call fcn.004e9e78
push eax
call sub.user32.dll_DrawTextW
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov esi, eax
lea eax, [ebp - 0x5c]
xor edx, edx
call fcn.0072faa0
sub esi, eax
sar esi, 1
jns 0x668830
adc esi, 0
mov dword [ebp - 0x6c], esi
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
lea eax, [ebp - 0x5c]
xor edx, edx
call fcn.0072fab4
sub esi, eax
sar esi, 1
jns 0x668850
adc esi, 0
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x5c]
xor edx, edx
call fcn.0072faa0
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x5c]
xor edx, edx
call fcn.0072fab4
add eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], eax
test ebx, ebx
je 0x668895
mov dword [ebp - 0x80], ebx
fild dword [ebp - 0x80]
mov eax, dword [ebp - 0x18]
fmul qword [eax + 0x50]
call fcn.00405c9c
lea edx, [ebp - 0x6c]
mov ecx, eax
xor eax, eax
xchg edx, eax
call fcn.00410c38
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0xc], 0
je 0x66896a
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x58], 0
je 0x6688dc
mov eax, dword [ebp + 0xc]
mov ecx, 0x30
cdq
idiv ecx
inc eax
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.004efc64
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 0x28]
movzx edx, word [edx]
call fcn.00667dcc
jmp 0x6689ca
mov eax, dword [ebp - 0x14]
call fcn.0070cb1c
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.004efc64
mov eax, dword [eax + 0x40]
push eax
mov eax, ebx
call fcn.004efc64
mov eax, dword [eax + 0x40]
pop edx
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.00668174
pop ecx
push 0xb04
lea eax, [ebp - 0x6c]
push eax
push 1
mov eax, dword [ebp - 0x28]
call fcn.00409588
push eax
mov eax, ebx
call fcn.004efc64
call fcn.004e9e78
push eax
call sub.user32.dll_DrawTextW
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov ecx, 0x168
cdq
idiv ecx
push edx
lea edx, [ebp - 0x7c]
mov eax, ebx
call fcn.0072f938
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004efc64
call fcn.004e9e78
mov edx, ebx
pop ecx
call fcn.00650fbc
mov eax, ebx
call fcn.00406ad8
jmp 0x6689ca
mov eax, dword [ebp - 0x18]
cmp byte [eax + 0x58], 0
je 0x66899c
mov eax, dword [ebp + 0xc]
mov ecx, 0x30
cdq
idiv ecx
inc eax
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.004efc64
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 0x28]
movzx edx, word [edx]
call fcn.00667dcc
jmp 0x6689ca
push ebp
call fcn.00668174
pop ecx
push 0xb04
lea eax, [ebp - 0x6c]
push eax
push 1
mov eax, dword [ebp - 0x28]
call fcn.00409588
push eax
mov eax, dword [ebp - 0x14]
call fcn.004efc64
call fcn.004e9e78
push eax
call sub.user32.dll_DrawTextW
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0xa8]
cmp ebx, 0x1fffffff
je 0x6689ee
mov eax, ebx
xor edx, edx
call fcn.006f7920
call fcn.00654b8c
mov dword [ebp - 0x10], eax
jmp 0x668a14
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 0x38]
cmp ebx, 0x1fffffff
je 0x668a0f
mov eax, ebx
xor edx, edx
call fcn.006f7920
call fcn.00654b8c
mov dword [ebp - 0x10], eax
jmp 0x668a14
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x40], 0x1fffffff
je 0x668a6d
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 0xa8]
cmp ebx, 0x1fffffff
je 0x668a47
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x38]
xor edx, edx
call fcn.006f7920
call fcn.00654b8c
cmp ebx, eax
je 0x668a6d
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0x1fffffff
jne 0x668a6d
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x40]
xor edx, edx
call fcn.006f7920
call fcn.00654b8c
mov dword [ebp - 0xc], eax
jmp 0x668a74
mov dword [ebp - 0xc], 0x1fffffff
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x14]
call fcn.006ffdf0
test al, al
je 0x668ded
cmp dword [ebp - 0xc], 0x1fffffff
jne 0x668bb0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
jne 0x668b3d
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0xcd], 0xff
je 0x668b3d
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
dec eax
test eax, eax
jl 0x668ded
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
imul dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
dec edx
test edx, edx
jl 0x668b30
inc edx
xor esi, esi
mov eax, dword [ebp - 0x24]
lea edi, [eax + esi*4]
movzx eax, byte [edi + 2]
movzx ecx, byte [edi + 1]
add ecx, ecx
add eax, ecx
movzx ecx, byte [edi]
add eax, ecx
shr eax, 2
push eax
mov al, 0xff
pop ecx
sub al, cl
mov ecx, dword [ebp - 0x10]
mov dword [edi], ecx
movzx eax, al
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + 0xcd]
imul eax, ecx
shr eax, 8
mov byte [edi + 3], al
inc esi
dec edx
jne 0x668af1
inc dword [ebp - 0x2c]
dec dword [ebp - 0x4c]
jne 0x668ad3
jmp 0x668ded
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
dec eax
test eax, eax
jl 0x668ded
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
imul dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
dec edx
test edx, edx
jl 0x668ba3
inc edx
xor esi, esi
mov eax, dword [ebp - 0x24]
lea edi, [eax + esi*4]
movzx eax, byte [edi + 2]
movzx ecx, byte [edi + 1]
add ecx, ecx
add eax, ecx
movzx ecx, byte [edi]
add eax, ecx
shr eax, 2
push eax
mov al, 0xff
pop ecx
sub al, cl
mov ecx, dword [ebp - 0x10]
mov dword [edi], ecx
mov byte [edi + 3], al
inc esi
dec edx
jne 0x668b77
inc dword [ebp - 0x2c]
dec dword [ebp - 0x4c]
jne 0x668b59
jmp 0x668ded
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
mov esi, eax
dec esi
movzx eax, byte [ebp - 0xc]
movzx edx, byte [ebp - 0x10]
movzx ecx, dl
sub eax, ecx
mov dword [ebp - 0x80], eax
fild dword [ebp - 0x80]
mov dword [ebp - 0x84], esi
fild dword [ebp - 0x84]
fdivp st(1)
fstp dword [ebp - 0x40]
wait
movzx eax, byte [ebp - 0xb]
movzx ecx, byte [ebp - 0xf]
movzx ebx, cl
sub eax, ebx
mov dword [ebp - 0x80], eax
fild dword [ebp - 0x80]
mov dword [ebp - 0x84], esi
fild dword [ebp - 0x84]
fdivp st(1)
fstp dword [ebp - 0x44]
wait
movzx edi, byte [ebp - 0xa]
movzx eax, byte [ebp - 0xe]
movzx ebx, al
sub edi, ebx
mov dword [ebp - 0x80], edi
fild dword [ebp - 0x80]
mov dword [ebp - 0x84], esi
fild dword [ebp - 0x84]
fdivp st(1)
fstp dword [ebp - 0x48]
wait
movzx edx, dl
mov dword [ebp - 0x80], edx
fild dword [ebp - 0x80]
fstp dword [ebp - 0x34]
wait
movzx edx, cl
mov dword [ebp - 0x80], edx
fild dword [ebp - 0x80]
fstp dword [ebp - 0x38]
wait
movzx eax, al
mov dword [ebp - 0x80], eax
fild dword [ebp - 0x80]
fstp dword [ebp - 0x3c]
wait
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
jne 0x668d3b
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0xcd], 0xff
je 0x668d3b
test esi, esi
jl 0x668ded
inc esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 0
fld dword [ebp - 0x34]
call fcn.00405c9c
mov byte [ebp - 0x30], al
fld dword [ebp - 0x38]
call fcn.00405c9c
mov byte [ebp - 0x2f], al
fld dword [ebp - 0x3c]
call fcn.00405c9c
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 8]
imul dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
dec edx
test edx, edx
jl 0x668d0c
inc edx
xor esi, esi
mov eax, dword [ebp - 0x24]
lea edi, [eax + esi*4]
movzx eax, byte [edi + 2]
movzx ecx, byte [edi + 1]
add ecx, ecx
add eax, ecx
movzx ecx, byte [edi]
add eax, ecx
shr eax, 2
push eax
mov al, 0xff
pop ecx
sub al, cl
test al, al
jne 0x668ced
xor ecx, ecx
mov dword [edi], ecx
jmp 0x668cf2
mov ecx, dword [ebp - 0x30]
mov dword [edi], ecx
movzx eax, al
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + 0xcd]
imul eax, ecx
shr eax, 8
mov byte [edi + 3], al
inc esi
dec edx
jne 0x668cc3
fld dword [ebp - 0x34]
fadd dword [ebp - 0x40]
fstp dword [ebp - 0x34]
wait
fld dword [ebp - 0x38]
fadd dword [ebp - 0x44]
fstp dword [ebp - 0x38]
wait
fld dword [ebp - 0x3c]
fadd dword [ebp - 0x48]
fstp dword [ebp - 0x3c]
wait
inc dword [ebp - 0x2c]
dec dword [ebp - 0x4c]
jne 0x668c84
jmp 0x668ded
test esi, esi
jl 0x668ded
inc esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 0
fld dword [ebp - 0x34]
call fcn.00405c9c
mov byte [ebp - 0x30], al
fld dword [ebp - 0x38]
call fcn.00405c9c
mov byte [ebp - 0x2f], al
fld dword [ebp - 0x3c]
call fcn.00405c9c
mov byte [ebp - 0x2e], al
mov eax, dword [ebp - 8]
imul dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
mov edx, eax
dec edx
test edx, edx
jl 0x668dc3
inc edx
xor esi, esi
mov eax, dword [ebp - 0x24]
lea edi, [eax + esi*4]
movzx eax, byte [edi + 2]
movzx ecx, byte [edi + 1]
add ecx, ecx
add eax, ecx
movzx ecx, byte [edi]
add eax, ecx
shr eax, 2
push eax
mov al, 0xff
pop ecx
sub al, cl
test al, al
jne 0x668db7
xor ecx, ecx
mov dword [edi], ecx
jmp 0x668dbc
mov ecx, dword [ebp - 0x30]
mov dword [edi], ecx
mov byte [edi + 3], al
inc esi
dec edx
jne 0x668d8d
fld dword [ebp - 0x34]
fadd dword [ebp - 0x40]
fstp dword [ebp - 0x34]
wait
fld dword [ebp - 0x38]
fadd dword [ebp - 0x44]
fstp dword [ebp - 0x38]
wait
fld dword [ebp - 0x3c]
fadd dword [ebp - 0x48]
fstp dword [ebp - 0x3c]
wait
inc dword [ebp - 0x2c]
dec dword [ebp - 0x4c]
jne 0x668d4e
push ebp
call fcn.006681b0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x668e11
lea eax, [ebp - 0x28]
call fcn.0040888c
ret