Function at 0x423310
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov dword [ebp - 0x44c], ebx
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 0xc]
inc edi
mov ecx, edi
cmp edi, 0x1000
jb 0x423354
sub esp, 0xffc
push edi
sub edi, 0x1000
jmp 0x42333d
sub esp, edi
and esp, 0xfffffff4
mov edi, esp
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xc], esp
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x14], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x38], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebp - 0x1c]
add eax, edx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
sub edx, eax
je 0x4233a7
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x10], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
cmp eax, 0xff
jg 0x423415
dec dword [ebp - 0x40]
mov esi, esi
inc dword [ebp - 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp + edx*4 - 0x440], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x40], 0xff
jl 0x4233d4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x40], 0
dec dword [ebp - 0x40]
nop
inc dword [ebp - 0x40]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp + eax*4 - 0x440]
mov eax, dword [ebp - 0x10]
add ebx, eax
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, 0
push eax
push edx
mov edx, dword [ebp - 0x40]
mov eax, edx
sar eax, 0x1f
push eax
push edx
call fcn.00406c80
movzx eax, byte [esi + eax]
add ebx, eax
mov dword [ebp - 0x10], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 0x100
idiv ecx
mov dword [ebp - 0x10], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
mov al, byte [ebp + eax*4 - 0x440]
mov byte [ebp - 0x18], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x440]
mov dword [ebp + edx*4 - 0x440], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
movzx edx, byte [ebp - 0x18]
mov dword [ebp + eax*4 - 0x440], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp - 0x40], 0xff
jl 0x423434
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebp - 0x40], 0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 8]
dec ebx
mov dword [ebp - 0x30], 0
cmp ebx, dword [ebp - 0x30]
jb 0x42371f
dec dword [ebp - 0x30]
nop
inc dword [ebp - 0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
inc eax
cdq
mov ecx, 0x100
idiv ecx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x593d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x440]
mov edx, dword [ebp - 0x10]
add eax, edx
cdq
mov ecx, 0x100
idiv ecx
mov dword [ebp - 0x10], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
mov al, byte [ebp + eax*4 - 0x440]
mov byte [ebp - 0x18], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x440]
mov dword [ebp + edx*4 - 0x440], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x10]
movzx edx, byte [ebp - 0x18]
mov dword [ebp + eax*4 - 0x440], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x440]
mov edx, dword [ebp + edx*4 - 0x440]
add eax, edx
cdq
mov ecx, 0x100
idiv ecx
mov dword [ebp - 0x20], edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x440]
mov dword [ebp - 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
mov edx, dword [ebp - 0x1c]
xor eax, edx
mov byte [ebp - 0x28], al
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
mov dl, byte [ebp - 0x28]
mov byte [eax], dl
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc dword [ebp + 8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp ebx, dword [ebp - 0x30]
ja 0x42357c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebp - 0x44c]
mov esi, dword [ebp - 0x448]
mov edi, dword [ebp - 0x444]
leave
ret 8