Function at 0x401c00
Capabilities:
Encrypt data using rc4 prga
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x40206b
mov ecx, 0xfa
xor eax, eax
lea edi, [ebp - 0x3e8]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xa
push 2
mov edx, dword [ebp - 0x3f6]
and edx, 0xffff
push edx
lea eax, [ebp - 0x3e8]
push eax
call fcn.00402090
add esp, 0x10
mov edi, 0x40125c
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 2
mov eax, dword [ebp - 0x3fa]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x40125c
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 4
mov eax, dword [ebp - 0x3fc]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x401258
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 2
mov eax, dword [ebp - 0x3f4]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x401254
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 2
mov eax, dword [ebp - 0x3f2]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x401254
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 2
mov eax, dword [ebp - 0x3f0]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x401254
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0xa
push 3
mov eax, dword [ebp - 0x3ee]
and eax, 0xffff
push eax
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00402090
add esp, 0x10
mov edi, 0x401258
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
and eax, 0xff
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 4
ja case.0x401e99.2
mov ecx, dword [ebp - 0x404]
jmp dword [ecx*4 + 0x402072]
mov edi, 0x401248
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.0x401e99.2
mov edi, 0x40123c
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.0x401e99.2
mov edi, 0x401230
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp case.0x401e99.2
mov edi, 0x401224
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 0xc]
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x401150
lea edx, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
add edi, 0xffffffff
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3e8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xffffffff
mov dword [ebp - 0x3ec], ecx
mov dword [ebp - 0x400], 0
jmp 0x402012
mov eax, dword [ebp - 0x400]
add eax, 1
mov dword [ebp - 0x400], eax
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [ebp - 0x3ec]
jge 0x40203e
mov edx, dword [ebp - 0x400]
mov al, byte [ebp + edx - 0x3e8]
xor al, 0xab
mov ecx, dword [ebp - 0x400]
mov byte [ebp + ecx - 0x3e8], al
jmp 0x402003
push 0x7fffffff
mov edx, dword [ebp - 0x3ec]
push edx
lea eax, [ebp - 0x3e8]
push eax
push 0x401214
call fcn.00401af0
add esp, 0x10
push 2
push 0x401214
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret