Function at 0x416dc0
Capabilities:
Encrypt data using rc4 ksa
Read file on windows

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42da06
push eax
mov eax, 0x3f7d0
mov dword fs:[0], esp
call fcn.0042cd60
push ebx
push ebp
lea eax, [esp + 0x24]
mov ebp, ecx
push esi
push edi
test eax, eax
mov dword [esp + 0x2c], ebp
jne 0x4172f1
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
xor eax, eax
movsx ecx, ax
mov byte [esp + ecx + 0x10], al
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416e0f
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416e1f
inc eax
cmp ax, 0x100
jl 0x416e02
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416e36
mov byte [esp + 0x18], 0
mov byte [esp + 0x14], 0
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], 0
mov byte [esp + 0x1c], 0
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416e5e
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416e6e
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x416e7e
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
and ebp, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
mov edi, edx
and edi, 0xff
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x416ec5
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x416e58
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416f08
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416f18
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x416f28
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov ebp, edx
and ebp, 0xff
mov bl, byte [eax + 0x384]
add edi, ebx
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x416f6d
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x416f02
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor eax, eax
movsx ecx, ax
mov byte [esp + ecx + 0x10], al
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416fba
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416fca
inc eax
cmp ax, 0x100
jl 0x416fad
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x416fe1
mov byte [esp + 0x18], bl
mov byte [esp + 0x14], bl
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], bl
mov byte [esp + 0x1c], bl
jmp 0x417003
xor ebx, ebx
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x417009
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x417019
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x417029
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
and ebp, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
mov edi, edx
and edi, 0xff
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x417070
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x417001
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4170b3
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x4170c3
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x4170d3
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov ebp, edx
and ebp, 0xff
mov bl, byte [eax + 0x384]
add edi, ebx
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x417118
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x4170ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
xor eax, eax
movsx edx, ax
mov byte [esp + edx + 0x10], al
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x417160
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x417170
inc eax
cmp ax, 0x100
jl 0x417153
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x417187
mov byte [esp + 0x18], cl
mov byte [esp + 0x14], cl
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x15], cl
mov byte [esp + 0x1c], cl
jmp 0x4171a9
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4171af
xor eax, eax
lea edx, [esp + 0x10]
mov byte [edx], al
inc eax
inc edx
cmp ax, 0x100
jl 0x4171bf
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x4171cd
movsx eax, cx
mov dl, byte [esp + eax + 0x10]
xor ebx, ebx
lea esi, [esp + eax + 0x10]
mov eax, dword [esp + 0x1c]
and eax, 0xff
mov edi, edx
and edi, 0xff
and ebp, 0xff
mov bl, byte [eax + 0x384]
add ebx, edi
add ebx, ebp
and ebx, 0x800000ff
jns 0x417216
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov ebp, dword [esp + 0x18]
mov edi, ebp
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
lea edi, [esp + edi + 0x10]
mov byte [esi], bl
mov esi, 0x57
mov byte [edi], dl
cdq
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x4171a7
mov edi, ebp
and edi, 0xff
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x417259
xor eax, eax
lea ecx, [esp + 0x10]
mov byte [ecx], al
inc eax
inc ecx
cmp ax, 0x100
jl 0x417269
xor ecx, ecx
lea eax, [esp + 0x10]
mov byte [eax], cl
inc ecx
inc eax
cmp cx, 0x100
jl 0x417279
mov eax, dword [esp + 0x1c]
xor ebx, ebx
movsx edx, cx
and eax, 0xff
lea esi, [esp + edx + 0x10]
mov bl, byte [eax + 0x384]
mov dl, byte [esi]
add edi, ebx
mov ebp, edx
and ebp, 0xff
add ebp, edi
mov ebx, ebp
and ebx, 0x800000ff
jns 0x4172bc
dec ebx
or ebx, 0xffffff00
inc ebx
mov byte [esp + 0x18], bl
mov edi, dword [esp + 0x18]
and edi, 0xff
inc eax
mov bl, byte [esp + edi + 0x10]
mov byte [esi], bl
mov byte [esp + edi + 0x10], dl
cdq
mov esi, 0x57
idiv esi
inc ecx
cmp cx, 0x100
mov byte [esp + 0x1c], dl
jl 0x417253
mov ebp, dword [esp + 0x2c]
lea ecx, [esp + 0x24]
call fcn.00419460
xor edi, edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x3f7e8], edi
call fcn.00419ee0
cmp dword [esp + 0x28], edi
je 0x417322
mov dword [esp + 0x3f7e8], 0xffffffff
jmp 0x41745d
mov eax, dword [ebp + 0x18]
mov ecx, dword [0x4353d0]
push 0x7530
push eax
call dword [ecx + 0x70]
or esi, 0xffffffff
cmp eax, edi
je 0x417456
cmp eax, esi
je 0x417456
push 0x1fbd0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
lea ecx, [esp + 0x30]
mov ebx, eax
mov dword [esp + 0x20], edi
call fcn.0040e190
lea edx, [esp + 0x20]
lea ecx, [esp + 0x30]
push edx
push ebx
mov byte [esp + 0x3f7f0], 1
call fcn.0040ec20
cmp dword [esp + 0x20], edi
je 0x4173c4
mov eax, dword [ebp + 0x18]
mov ecx, dword [0x4353d0]
push 0xbb8
push eax
call dword [ecx + 0x70]
cmp eax, edi
je 0x417445
cmp eax, esi
je 0x417445
cmp dword [esp + 0x20], edi
jle 0x4173c4
mov esi, ebx
push esi
mov ecx, ebp
call fcn.00417480
mov eax, dword [esp + 0x20]
inc edi
add esi, 0x104
cmp edi, eax
jl 0x4173aa
or esi, 0xffffffff
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x41743c
mov edx, dword [ebp + 0x18]
mov eax, dword [0x4353d0]
push 0x1388
push edx
call dword [eax + 0x70]
test eax, eax
je 0x417445
cmp eax, esi
je 0x417445
lea ecx, [esp + 0x20]
push ecx
push ebx
lea ecx, [esp + 0x38]
call fcn.0040f230
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4173cb
mov edx, dword [ebp + 0x18]
mov eax, dword [0x4353d0]
push 0xbb8
push edx
call dword [eax + 0x70]
test eax, eax
je 0x417445
cmp eax, esi
je 0x417445
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jle 0x4173cb
mov esi, ebx
push esi
mov ecx, ebp
call fcn.00417480
mov eax, dword [esp + 0x20]
inc edi
add esi, 0x104
cmp edi, eax
jl 0x417420
or esi, 0xffffffff
jmp 0x4173cb
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x3f7e8], 0
call fcn.0040e6f0
mov dword [esp + 0x3f7e8], esi
lea ecx, [esp + 0x24]
call fcn.004199c0
mov ecx, dword [esp + 0x3f7e0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3f7dc
ret