Function at 0x907c21d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90a9d96
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2958
call fcn.090a4f00
mov eax, dword [0x90e460c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2948], esi
mov edi, dword [ebx + 8]
push 0
mov dword [ebp - 0x2944], edi
mov eax, dword [edi + 4]
add eax, 0x94
push eax
call fcn.0909b970
cmp dword [esi], 0
pop ecx
pop ecx
jne 0x907c2a2
push 0
push 0x88b
push 0x4ce3
push dword [edi + 4]
call fcn.0909b970
add esp, 0x10
mov dword [esi], eax
mov ecx, edi
mov dword [ebp - 0x2954], edi
call fcn.0901658c
and dword [ebp - 4], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0x2938], eax
xor esi, esi
mov eax, dword [ebp - 0x2948]
add eax, 4
mov dword [ebp - 0x293c], esi
mov dword [ebp - 0x2940], eax
xor eax, eax
lea edi, [ebp - 0x85e]
inc eax
mov dword [ebp - 0x2934], eax
shr eax, 1
mov ecx, 0x8000
test esi, esi
movzx edx, ax
mov eax, edx
cmove ecx, eax
cmp esi, 1
mov word [edi - 2], cx
mov ecx, 0x8000
cmove ecx, eax
cmp esi, 2
mov word [edi], cx
mov ecx, 0x8000
cmove ecx, eax
lea edi, [edi + 8]
mov word [edi - 6], cx
cmp esi, 3
mov ecx, 0x8000
cmove ecx, eax
mov eax, dword [ebp - 0x2934]
add eax, 0x101
mov word [edi - 4], cx
mov dword [ebp - 0x2934], eax
cmp eax, 0x10101
jb 0x907c2e2
mov ecx, dword [ebp - 0x2944]
lea eax, [ebp - 0x860]
push 0
push 0x504c4142
push 0x434d594b
push 0x100
push eax
push eax
call fcn.0909b970
and dword [ebp - 0x2934], 0
xor edi, edi
movzx ecx, word [ebp - 0x66]
movzx eax, word [ebp + edi*8 - 0x85e]
sub eax, ecx
movzx ecx, word [ebp - 0x64]
cdq
mov esi, eax
movzx eax, word [ebp + edi*8 - 0x85c]
sub eax, ecx
xor esi, edx
sub esi, edx
cdq
mov ecx, eax
movzx eax, word [ebp + edi*8 - 0x85a]
xor ecx, edx
sub ecx, edx
movzx edx, word [ebp - 0x62]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add eax, ecx
add eax, esi
test edi, edi
jne 0x907c3be
test eax, eax
je 0x907c3fa
mov ecx, eax
mov dword [ebp - 0x2934], ecx
jmp 0x907c3c4
mov ecx, dword [ebp - 0x2934]
cmp eax, ecx
ja 0x907c3fa
shl eax, 0xf
xor edx, edx
div ecx
mov ecx, 0x8000
sub ecx, eax
mov word [ebp + edi*2 - 0x2128], cx
inc edi
movzx ecx, word [ebp - 0x66]
cmp edi, 0x100
jb 0x907c36f
lea ecx, [ebp - 0x2128]
call fcn.0906a289
test al, al
jne 0x907c405
lea ecx, [ebp - 0x2128]
call fcn.0906a2a9
push 8
lea ecx, [ebp - 0x2128]
call fcn.0909b970
mov edi, dword [ebp - 0x2940]
lea esi, [ebp - 0x2128]
mov ecx, 0x80
lea eax, [ebp - 0x2930]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x2128]
call fcn.0909b970
mov edi, dword [ebp - 0x2938]
xor esi, esi
mov eax, esi
lea ecx, [ebp - 0x2930]
and eax, 0x1ffff
shl eax, 0xc
push eax
call fcn.0909b970
mov word [edi], ax
inc esi
add edi, 2
cmp esi, 9
jb 0x907c43f
mov esi, dword [ebp - 0x293c]
add dword [ebp - 0x2940], 0x200
inc esi
mov dword [ebp - 0x2938], edi
mov dword [ebp - 0x293c], esi
cmp esi, 4
jb 0x907c2d3
and dword [ebp - 0x2940], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x294c], ecx
movzx eax, word [ecx]
xor edx, edx
mov dword [ebp - 0x2938], edx
lea ecx, [ebp - 0x1f26]
mov dword [ebp - 0x2950], eax
movzx eax, word [ebp + edx*2 - 0x4e]
xor edi, edi
mov dword [ebp - 0x293c], edi
mov dword [ebp - 0x2934], eax
movzx edx, word [ebp + edi*2 - 0x3c]
xor esi, esi
mov edi, dword [ebp - 0x2934]
mov eax, dword [ebp - 0x2950]
mov word [ecx - 2], ax
mov ax, word [ebp + esi*2 - 0x2a]
inc esi
mov word [ecx], di
mov word [ecx + 2], dx
mov word [ecx + 4], ax
add ecx, 8
cmp esi, 9
jb 0x907c4ce
mov edi, dword [ebp - 0x293c]
inc edi
mov dword [ebp - 0x293c], edi
cmp edi, 9
jb 0x907c4c1
mov edx, dword [ebp - 0x2938]
inc edx
mov dword [ebp - 0x2938], edx
cmp edx, 9
jb 0x907c4ae
mov ecx, dword [ebp - 0x2944]
lea eax, [ebp - 0x1f28]
push 0
push 0x504c4142
push 0x434d594b
push 0x2d9
push eax
push eax
call fcn.0909b970
mov eax, dword [ebp - 0x2948]
lea ecx, [ebp - 0x2968]
push 1
push 0x88b
push dword [ebp - 0x2940]
push dword [eax]
call fcn.0909b970
lea ecx, [ebp - 0x2968]
mov byte [ebp - 4], 1
call fcn.09005b3d
lea edi, [ebp - 0x1f28]
mov dword [ebp - 0x2934], 9
lea esi, [eax + 2]
mov dword [ebp - 0x2938], 9
mov dword [ebp - 0x293c], 9
mov eax, dword [edi]
mov edx, dword [edi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [esi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [esi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add edi, 8
mov byte [esi], al
add esi, 3
sub dword [ebp - 0x293c], 1
jne 0x907c58f
sub dword [ebp - 0x2938], 1
jne 0x907c585
sub dword [ebp - 0x2934], 1
jne 0x907c57b
lea ecx, [ebp - 0x2968]
mov byte [ebp - 4], 0
call fcn.0909b970
mov eax, dword [ebp - 0x2940]
mov ecx, dword [ebp - 0x294c]
add eax, 0x88b
push 2
pop edx
add ecx, edx
mov dword [ebp - 0x2940], eax
mov dword [ebp - 0x294c], ecx
cmp eax, 0x4ce3
jb 0x907c497
mov ecx, dword [ebp - 0x2944]
mov dword [ebp - 4], edx
call fcn.09016859
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09001fa0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4