Function at 0x41ccc0
Capabilities:
Capture screenshot
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
push 0
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xc10]
push eax
lea edx, [esp + 0x14]
mov ecx, dword [ebx + 0xc0c]
lea eax, [esp + 0x2e]
call fcn.0041b7c4
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.GDI32.DLL_SelectObject
sub dword [ebx + 0xc20], 2
dec dword [ebx + 0xc24]
cmp dword [ebx + 0xc24], 0
jge 0x41cd28
mov dword [ebx + 0xc24], 0x168
mov ebp, dword [ebx + 0xc20]
mov edi, dword [ebx + 0xc2c]
test edi, edi
jle 0x41cd9c
mov dword [esp + 0x14], 1
add ebp, dword [ebx + 0xc18]
mov eax, dword [ebx + 0xc30]
mov edx, dword [esp + 0x14]
mov ecx, dword [eax + edx*4 - 4]
push 0xcc0020
push 0
push 0
lea esi, [ecx + ecx*4]
mov eax, dword [ebx + esi*4 - 0x10]
push eax
mov eax, dword [ebx + esi*4]
push eax
mov eax, dword [ebx + esi*4 - 4]
push eax
mov eax, dword [ebx + 0xc24]
add eax, ebp
mov ecx, 0x168
cdq
idiv ecx
mov eax, dword [ebx + edx*4 + 0x644]
add eax, dword [esp + 0x1c]
push eax
push ebp
mov eax, dword [esp + 0x28]
push eax
call sub.GDI32.DLL_BitBlt
inc dword [esp + 0x14]
dec edi
jne 0x41cd40
test ebp, ebp
jge 0x41cdac
mov eax, dword [ebx + 0xc0c]
mov dword [ebx + 0xc20], eax
mov edx, 3
mov edi, dword [ebx + 0xc0c]
test edi, edi
jl 0x41cdd8
inc edi
mov eax, dword [ebx + 0xc10]
test eax, eax
jl 0x41cdd5
inc eax
mov ecx, dword [esp + 0x10]
mov byte [ecx + edx], 0xff
add edx, 4
dec eax
jne 0x41cdc7
dec edi
jne 0x41cdbc
mov dword [esp + 0x18], 0x28
fild dword [esp + 0x18]
fld xword [ebx + 0xbf8]
fdivrp st(1)
fstp xword [ebx + 0xbe8]
wait
xor ebp, ebp
xor esi, esi
jmp 0x41ce52
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
xor edi, edi
jmp 0x41ce43
mov eax, ebp
imul dword [ebx + 0xc0c]
add eax, eax
add eax, eax
add eax, esi
mov edx, dword [esp + 0x10]
mov ecx, edi
mov byte [edx + eax + 3], cl
fld xword [esp + 0x20]
fld xword [ebx + 0xbe8]
faddp st(1)
fstp xword [esp + 0x20]
wait
fld xword [esp + 0x20]
call fcn.00403164
mov edi, eax
add esi, 4
mov eax, dword [esp + 0x18]
add eax, eax
add eax, eax
cmp esi, eax
jl 0x41ce0c
xor esi, esi
inc ebp
cmp ebp, dword [ebx + 0xc10]
jl 0x41cdf9
xor ebp, ebp
xor esi, esi
jmp 0x41cee7
mov eax, dword [ebx + 0xbf8]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xbfc]
mov dword [esp + 0x24], eax
mov ax, word [ebx + 0xc00]
mov word [esp + 0x28], ax
mov edi, 0xff
jmp 0x41ced6
mov eax, dword [ebx + 0xc0c]
sub eax, dword [esp + 0x18]
add eax, eax
add eax, eax
cmp esi, eax
jle 0x41ced3
mov eax, ebp
imul dword [ebx + 0xc0c]
add eax, eax
add eax, eax
add eax, esi
mov edx, dword [esp + 0x10]
mov ecx, edi
and cl, 0xff
mov byte [edx + eax + 3], cl
fld xword [esp + 0x20]
fld xword [ebx + 0xbe8]
fsubp st(1)
fstp xword [esp + 0x20]
wait
fld xword [esp + 0x20]
call fcn.00403164
mov edi, eax
add esi, 4
mov eax, dword [ebx + 0xc0c]
add eax, eax
add eax, eax
cmp esi, eax
jle 0x41ce8a
xor esi, esi
inc ebp
cmp ebp, dword [ebx + 0xc10]
jl 0x41ce63
mov eax, dword [esp + 0xc]
call fcn.0041b83c
push 4
call sub.GDI32.DLL_GetStockObject
push eax
mov eax, dword [esp + 4]
push eax
call sub.GDI32.DLL_SelectObject
push 0xf00021
mov eax, dword [ebx + 0xc10]
push eax
mov eax, dword [ebx + 0xc0c]
push eax
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.GDI32.DLL_PatBlt
push 0xcc0020
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xc10]
push eax
mov eax, dword [ebx + 0xc2c]
imul dword [ebx + 0xc18]
push eax
push 0
push 0
mov eax, dword [esp + 0x20]
push eax
call sub.GDI32.DLL_BitBlt
mov eax, dword [esp + 8]
push eax
call sub.GDI32.DLL_DeleteDC
mov eax, dword [esp + 0xc]
push eax
call sub.GDI32.DLL_DeleteObject
add esp, 0x58
pop ebp
pop edi
pop esi
pop ebx
ret